Commit Graph

1657 Commits

Author SHA1 Message Date
Wagner Gonçalves 968ce4b846 refactor content_type/extension identification
refs INTEROP-6483
flag=none

See the discussion: https://gerrit.instructure.com/c/canvas-lms/+/257523/
5/app/controllers/submissions_api_controller.rb#625

The current behavior of inferring content-type/extension only considers
name or filename or url parameter to infer the extension, but when a name
doesn't contain the file extension and filename/url contains it, we can
use these fields to infer the content type/extension.

So, we're changing this behavior to infer from filename/url when it is
possible. When the name/filename/url contains an unknown mime type like
`example.xpto`, we'll return the content_type as `unknown/unknown` and
the extension as `xpto`.

test-plan:
* All steps from https://gerrit.instructure.com/c/canvas-lms/+/257523
  should work fine;
* You should configure the assignment to restrict upload file types
  like: png,xpto (invalid/unknown mime type);
* You should be able to submit the assignment and validate the file
  created via Submission Details page, after:
  * Informing a name without an extension and filename/url with extension;
  * Informing a name/filename/url with an unknown extension;

Change-Id: I173c5ca2a6f9832ab3da92fd858b65654139221f
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/257762
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: Wagner Goncalves <wagner.goncalves@instructure.com>
Product-Review: Wagner Goncalves <wagner.goncalves@instructure.com>
Reviewed-by: Xander Moffatt <xmoffatt@instructure.com>
Reviewed-by: Mysti Lilla <mysti@instructure.com>
2021-02-03 14:10:40 +00:00
Wagner Gonçalves 2d605454cc fix the filename identification when submitting an assignment
When we’re submitting a file using the LTI tool, in some situations,
we can face a tool that doesn't send the text field in the content item
payload. This field is used to infer the filename and extension of the
submission file.

As a fallback, we'll try to recover the filename from the URL.

closes INTEROP-6483
flag=none

test-plan
* Have an LTI tool installed (you can use lti-1.3-test-tool); You could
  use this  commit https://gerrit.instructure.com/c/lti-1.3-test-tool/+/257525
  to  facilitate the tests in case it was not submitted yet.
* Have a Course recorded;
* Have a Student enrolled in this Course;
* Have an Assignment with online submission recorded to this Course;
* As a Student, you should be able to access the Assignment to submit
  your homework. On the submission homework page, you should be able to
  find LTI tool (usually rendered in a tab);
* After launching the tool, you should be able to select File as the
  Content Item Type and fill the File URL field and submit;
* After submitting the Assignment, you should be able to access the
  Submission Details page, and validate if the specified file was properly
  created/recorded  (name and image);
* I used https://dummyimage.com to generate some images like:
  * https://dummyimage.com/300/09f/sample
  * https://dummyimage.com/300/09f/sample.png
  * https://dummyimage.com/300/09f
  * https://dummyimage.com/300
* You should check if when the LTI tool sends the File Name (text) field
  and everything works as expected;

Change-Id: Iae5f128492834f8efc8934de347cfa5d9944ac1b
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/257523
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Xander Moffatt <xmoffatt@instructure.com>
QA-Review: Xander Moffatt <xmoffatt@instructure.com>
Product-Review: Karl Lloyd <karl@instructure.com>
2021-01-29 16:11:39 +00:00
August Thornton 940f47ec07 add granular permissions for course files
Note: we'll want to re-run the data fix-up when we're ready to turn
on the feature flag permanently; in hopes to capture any differences
made to course files permissions between now and then.

Modified the files_controller quota and api_quota permission checks
to make them more lenient in regards to accepting any or all of the
files permissions role overrides. This allows legacy grouping and
new granularized files permissions to live in harmony and be modified
without causing unauthorized errors on the quota resource.

This commit will cover the backend permissions required to granularize
files / folders permission calls, however there will be a follow-up
ps to clean up the course file page to hide elements the user might
not be authorized to use.

closes FOO-130
refs FOO-1501
flag = granular_permissions_course_files
[fsc-max-nodes=18]
[fsc-timeout=30]

Test Plan:
  - Run the migration and make sure there are no errors
  - With the granular_permissions_course_files FF turned off,
    course sections and REST API should work the same with this patch
    set checked out as it does in beta/production
  - Some things to check:
    * How it acts as a teacher, student, and public user
      in course files/folders and personal files/folders
      with the various settings above toggled to different states
    * How it acts as a teacher, student, and public user
      in discussions, modules, content migrations/import/exports
      (RCE should behave similarly throughout the site)
  - With the granular_permissions_course_files feature flag turned on
    course files/folders and REST API should work as expected. The same
    list checked above should be done so again, but this time:
    * Should only be able to upload or add folders if the
      Course Files - add permission is enabled for the user's role
    * Should only be able to manage file access, usage rights, move,
      or rename course files/folders if the Course Files -
      edit permission is enabled for the user's role
      • Check Toolbar header at the top of Course files
      • Check Cog (hamburger menu) to the right of each file/folder
      • Check Usage Rights Indicator under usage rights column
        that can be found in course and group file pages. This can
        be enabled under course settings if not available
    * Should only be able to delete course files/folders if the
      Course Files - delete permission is enabled for the user's role
    * Any given user/role should have full access to their respective
      personal files/folders regardless of granted permissions. The
      same also applies to a group context with some caveats
      • Should not be able to modify file access in a group context
      • Should not be able to modify usage rights in personal files
    * A student enrollment not granted any file permissions (the default)
      should only be able to _view_ and _download_ files unless granted
      additional access from an authorizing role
    * REST API works as expected
    * UI works as expected with no additional javascript errors

Change-Id: Ieb2d10915c274959e8da4c623f7aba11d3540c2b
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/253777
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: Simon Williams <simon@instructure.com>
Product-Review: August Thornton <august@instructure.com>
Reviewed-by: Michael Ziwisky <mziwisky@instructure.com>
2021-01-27 17:02:38 +00:00
Brian Watson 9a5bc16cbd Add filters for inactive/concluded enrollments to LMGB
flag=inactive_concluded_lmgb_filters

closes OUT-3794

Test-plan:
  * FF: 'Student filters in LMGB'
  - Create 3+ students in a course
  - Create an assignment that has 2+ outcomes attached via rubric
  - For one of the other students, conclude their enrollment
    ('Concluded User')
  - For one of the other students, deactivate their user
    ('Deactivated User')
  - One user should remain that is an active enrollment
    ('Normal User')
  - Provide outcomes assessment on the new assignment via speedgrader
     for each of the above 3 students (Concluded/Deactivated/Normal)
  - Create another 20 students in the course (they don't have to have
    assessments)
    > 1.upto(20) {|i| u = User.create!(name: "Student #{i}");
        Course.find(..).enroll_student(u) }

  - With the FF off
    - LMGB should behave as normal
    - Note: if "Hide students with unassessed outcomes" is enabled,
      Unassessed User should not appear in the outcome report and
      vice versa.

  - With the FF on
    - Click kebab filter in 'Students' header to toggle different
      options
    - For 'Show Unassessed students' enabled, unassessed users should
      appear and vice versa
    - For 'Show Concluded students' enabled, Concluded User should appear
      and vice versa
    - For 'Show Inactive students' enabled, Inactive User should appear
      and vice versa
    - The filter options should now apply to the export, i.e. the users
      that appear in the LMGB should appear in the CSV export (sorting will
      differ)
    - Verify that sorting by column headers works as expected
    - Verify that the column header averages apply only to the scores
      that are visible (total students, not limited to the current page)
    - Verify that pagination is correct (20 students by default) regardless
      of filter selections

  - Add an inactive and concluded user to a different section
  - Change a users' section and make sure that with the FF on and off,
    the LMGB behaves as expected.
  - Note: inactive + concluded users
    should be displayed in CSV with FF disabled but not in the UI.
    Unassessed users with active enrollments should always appear in the
    csv report if and only if they appear in the UI based on enabled or
    disabled filters.

Change-Id: I5639dc28f1c5ebd43900de4e99006ecc3535468d
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/256110
QA-Review: Augusto Callejas <acallejas@instructure.com>
Product-Review: Jody Sailor
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Augusto Callejas <acallejas@instructure.com>
Reviewed-by: Pat Renner <prenner@instructure.com>
2021-01-20 23:22:14 +00:00
Jeremy Stanley 8b497c373c Homeroom course setting
test plan:
- enable Canvas for Elementary feature
- "Enable as homeroom course" setting should appear
  in course settings
- the setting should persist when course settings are
  saved and reloaded
- the setting should persist across course copy

flag = canvas_for_elementary

closes LS-1749

Change-Id: Iacba1bd37e6dbf5536dddb3610c0e26322cc42c3
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/256875
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Nate Armstrong <narmstrong@instructure.com>
QA-Review: Nate Armstrong <narmstrong@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
2021-01-20 17:59:05 +00:00
Spencer Olson c2f17da038 add soft-deletion to rubric associations
closes EVAL-812
flag=none

Test Plan 1: Deleting and Restoring a Rubric Association
1. Create a rubric in a course and attach it to an assignment.
2. In SpeedGrader, use the rubric to assess a couple students.
3. On the assignment show page, click the trash can icon on the
   rubric to delete the rubric association with the assignment (it
   says "Delete Rubric" but it's really just deleting the Rubric
   Association).
4. Go back to SpeedGrader and verify the rubric does not show up
   for the students that you assessed (the final grade should still
   be awarded, if you awarded one separate from the rubric).
5. Verify the rubric itself still exists at /courses/:id/rubrics
6. Go to /courses/:id/undelete and verify the RubricAssociation that
   was deleted is listed there. Click 'restore'.
7. Go back to the assignment show page and note that the rubric is
   now showing again.
8. Go back to SpeedGrader and note that the rubric assessments have
   returned. Hallelujah!

Test Plan 2: Deleting and Restoring a Rubric
1. Create a rubric in a course and attach it to an assignment.
2. In SpeedGrader, use the rubric to assess a couple students.
3. Go to /courses/:id/rubrics, click on the rubric, and then click
   'Delete Rubric'.
4. Go to the assignment show page and verify the rubric does not
   show as attached to the assignment any more.
5. Go back to SpeedGrader and verify the rubric does not show up
   for the students that you assessed (the final grade should still
   be awarded, if you awarded one separate from the rubric).
6. Go to /courses/:id/undelete and verify the Rubric that
   was deleted is listed there. Click 'restore'. You can also verify
   that the RubricAssociation for the assignment is listed on the
   page as well, though you don't need to click 'Restore' for that
   item.
7. Go back to the assignment show page and note that the rubric is
   now showing again.
8. Go back to SpeedGrader and note that the rubric assessments have
   returned. Hallelujah!

* Edge case testing: test account rubrics, and using rubrics that
  were created in other courses.

Change-Id: I02745619457f99f760bd9459ab9d85d23bba57bc
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/253739
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: Kai Bjorkman <kbjorkman@instructure.com>
Product-Review: Syed Hussain <shussain@instructure.com>
Reviewed-by: Adrian Packel <apackel@instructure.com>
Reviewed-by: Gary Mei <gmei@instructure.com>
2021-01-20 16:25:16 +00:00
August Thornton 51b6bf3f6f only include active teachers in account course search
this commit exposes an optional include for the
accounts controller courses_api action to be used solely
for the AccountCourseUserSearch frontend component when
displaying teacher user_display views for any given
course search result. the new include filters out teachers
that have enrollments that are no longer in an active state.
specifically workflow states such as: rejected, inactive,
completed, and deleted.

closes FOO-1275
flag = none

test plan:
 • Create a course with two teacher enrollments
 • Navigate to the course's People page and Deactivate one of the
   teachers via the hamburger menu on the right-hand side
 • Navigate to account level course search and filter by Course
 • Verify you see the results populated with your course and
   you only see the actively enrolled teacher under the Teacher
   column for that course
 • Reactivate the teacher from before and head back to
   account course search (default Course filter)
 • Verify you now see *both* teachers listed under the Teacher
   column for that course

Change-Id: Id9c03801071c5665589ba865ab6a1d4d830a5c6c
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/256284
QA-Review: August Thornton <august@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
2021-01-12 22:49:02 +00:00
Ethan Vizitei 524148d394 cap users in groups json
closes FOO-1436
flag=none

TEST PLAN:
  1) make a giant group with more memberships than your setting value
  2) ask for the groups index with "include[]=users"
  3) you only get the first N users in each group
  4) you can still paginate through group memberships
     from the memberships endpoint successfully

Change-Id: I211c48d7adcc444b9d9e05d22b38131add66be41
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/256219
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Rob Orton <rob@instructure.com>
QA-Review: Ethan Vizitei <evizitei@instructure.com>
Product-Review: Ethan Vizitei <evizitei@instructure.com>
2021-01-07 18:19:46 +00:00
Adrian Packel c473fecbfa Hide score from quiz submission JSON if unposted
fixes EVAL-1356
flag=none

Test plan:
- Have a course with some students
- Create a quiz (old), and set the corresponding assignment to be
  manually posted in Gradebook
  - Take note of the IDs of the course, the quiz, and the quiz
    submission
- As a student, take the quiz
- As that same student, access the API endpoint for the quiz:
  - /api/v1/courses/<courseid>/quizzes/<quizid>/submissions/<qsubid>
  - The resulting JSON should *not* include the score or kept_score
    field
- As the teacher, post grades for the quiz
- As the student, access the endpoint again
  - The JSON should now include score and kept_score

Change-Id: If62a86e3fb6b9b78bec28162cdcf0252c573522a
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/255243
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Spencer Olson <solson@instructure.com>
Reviewed-by: Syed Hussain <shussain@instructure.com>
QA-Review: Mark McDermott <mmcdermott@instructure.com>
Product-Review: Syed Hussain <shussain@instructure.com>
2020-12-17 21:15:46 +00:00
Wagner Gonçalves ad46fd9511 persist custom params at assignment selection placement
We are adding the ability to save the custom params from an external
tool at assignment selection placement.

closes=INTEROP-6311
flag=none

test-plan:
* Have a LTI tool installed in your local Canvas, you can use the
lti-1.3.-test-tool for it;
* Have a Course recorded;
* When creating a new Assignment:
1. Choose `External Tool` from the Submission Type field;
2. Click in the find button to select `LTI Test Tool` at
`Configure External Tool` modal;
3. After the LTI tool was lunched, you will be able to fill Custom Params
text area with a custom JSON and click on submit;
4. At this point you will be able to check that the hidden input was
filled with the custom JSON, for example you can access the browser
console and execute `$('#external_tool_create_custom_params').val()`;
5. After selecting the tool and saving the assignment, you will be able
to check the Assignment into the database, for example:
Assignment.find(assignment).lti_resource_links.first.custom;

Change-Id: I5f1b1143eec035eb18f814439c6ae7077bcab8bf
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/254453
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Weston Dransfield <wdransfield@instructure.com>
QA-Review: Weston Dransfield <wdransfield@instructure.com>
Product-Review: Weston Dransfield <wdransfield@instructure.com>
2020-12-16 20:50:05 +00:00
Jacob Burroughs f4a5f2da33 Quad-state feature flags
Allow feature flags to be "allowed on".  Updates user facing langauge
to be enabled/disabled + "(always)" or "(default)", which is clearer
than allowed, especially with 4 states.  Also moves from backbone UI
to react UI rather than retrofitting the changes to the old UI. The
backbone ui can be killed in a separate PS.  The new UI is easier to
ctrl-f on and presents the flags in alphabetical order according to
the user's current locale.

This includes a somewhat gross workaround for a bug in InstUI <Menu>
which is why it goes in an explicit <Popover>

fixes FOO-835

test plan:
- Ensure 'New Feature Flags' feature is off
- Make sure feature flags work in all the expected ways at the siteadmin, account, and course level
- Turn on 'New Feature Flags'
- Make sure that you can still use the feature flag ui in natural ways at each level
- Try turning a feature flag "on" but unlocking it/leaving it unlocked
- Ensure it is inherited on but overridable

Change-Id: I520824cdf6e18b5a7da5ab5f552a7fd3140fd4bf
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/249917
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Charley Kline <ckline@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Product-Review: Jacob Burroughs <jburroughs@instructure.com>
2020-12-15 23:18:33 +00:00
Pat Renner efb45164cb serialize mastery scale data for outcomes and links
closes OUT-4119
flag=account_level_mastery_scales

test-plan:
before checking out this PS, verify the following:
- enable FF, if not already
- create a mastery scale at the account level
- create an account rubric with an account outcome
aligned to it and align it to an assignment in a course
- assess a student using the rubric
- create a course mastery scale
- validate that visiting the SLMGB for the student
uses the outcome mastery scale for points_possible
rather than the course scale

after checking out:
- verify that when visiting the SLMGB, the course scale is used
- verify that when visiting the LMGB, the course scale is used
- turn off the FF, and verify that traditional outcome ratings
are used in the LMGB/SLMGB

Change-Id: I9565121cfd8fbb380d4e0ae19791cf8cef4a6f14
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/254560
QA-Review: Augusto Callejas <acallejas@instructure.com>
Product-Review: Jody Sailor
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Michael Brewer-Davis <mbd@instructure.com>
Reviewed-by: Augusto Callejas <acallejas@instructure.com>
2020-12-15 15:22:51 +00:00
Ethan Vizitei 8077f72d6d give wiki-pages a media redirect path
refs FOO-1186
flag=none

TEST PLAN:
  1) make a new wiki page with a video
     embed.
  2) notification should get sent, and it should
     have a media download url pointing at the
     course the page lives in

Change-Id: I7b5b3599bf264b5b3aa0cc1c4bb4d09fc135b2cf
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/253934
Reviewed-by: Cody Cutrer <cody@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: Ethan Vizitei <evizitei@instructure.com>
Product-Review: Ethan Vizitei <evizitei@instructure.com>
2020-11-30 22:39:37 +00:00
Manoel Quirino Neto adc7bc2818 Update Language for users that can update mastery scales
Change this language to separate out admin-based roles
vs course-based roles

closes OUT-4077
flag=account_level_mastery_scales

test plan:
- Enable account_level_mastery_scales FF
- Go to any account > Permissions
- In Course Roles, look for Outcome Proficiency
  Calculations and set active to some roles
- Do the same for Outcome Proficiency Scales
- In Account Roles, let the same permissions enabled
- Go to any account > Outcomes > Mastery
- You should see 2 messages about the course and account level
- Go to any account > Outcomes > Calculation
- You should see 2 messages about the course and account level
- Disable some or all permissions and check the messages
  disappear accordingly what permission remove

Change-Id: Ie9ceb4f766c7303f9cde7fa6da6d8439ceb6967f
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/252887
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Pat Renner <prenner@instructure.com>
Reviewed-by: Augusto Callejas <acallejas@instructure.com>
QA-Review: Chrystal Langston <chrystal.langston@instructure.com>
Product-Review: Jody Sailor
2020-11-24 12:04:09 +00:00
Pat Renner cf71d5567e ensure course scale is used in the LMGB
closes OUT-4042
flag=account_level_mastery_scales

test-plan:
- Generate student result data for assignments
aligned to an account rubric:
> Generate account level mastery scales, if not already
created (values between 0-100 makes things easier)
> Create an account rubric
> Create a course, students, with an assignment using
account rubric
> Assess a student using the account rubric assignment
- Create a course level mastery scale for this course
- Repeat the above steps, but with a course rubric
  > Using vastly different numbers (1000, 900, ..,
    helps make the differences apparent)
- Enable the LMGB, SLMGB feature flag
- Visit the LMGB
- Verify that only course level mastery levels are used in
the gradebook, and results associated with the account level
rubric have been scaled appropriately
- Verify that the LMGB column tooltip chart accurately
shows the percents using course level scales
- Verify the filters on the right of the LMGB are using course
level scales
- Turn off the account_level_mastery_scales FF
- Verify that the LMGB uses account scales for the filter
and column charts
- Verify that the results are now scaled using the
account level scale

Change-Id: Ie95f3347a0f1bd326d50c4adf6c972c0cf528715
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/252322
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Product-Review: Jody Sailor
Reviewed-by: Augusto Callejas <acallejas@instructure.com>
Reviewed-by: Michael Brewer-Davis <mbd@instructure.com>
QA-Review: Brian Watson <bwatson@instructure.com>
2020-11-18 18:04:13 +00:00
Spencer Olson 3eb1a26604 remove checks for post_policies_enabled
closes EVAL-671
flag=post_policies_enabled

Test Plan:
- General smoke test of post policies

Change-Id: I618ade57dca203e5500d882f29a9494253839319
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/251977
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Aaron Shafovaloff <ashafovaloff@instructure.com>
Reviewed-by: Adrian Packel <apackel@instructure.com>
QA-Review: Kai Bjorkman <kbjorkman@instructure.com>
Product-Review: Syed Hussain <shussain@instructure.com>
2020-11-17 21:47:36 +00:00
Caleb Guanzon fd02a0d588 preload UserProfile in GroupCategoriesController#users
fixes VICE-919
flag=none

TEST PLAN:
- in your course, create a group set
- make sure that in the group set, there are assigned users
and unassigned users
- visit that group set's page
- watch the console and make sure that no errors happen
- make sure that no n+1 user profile load query happens
where n is the number of unassigned students

existing specs make sure there should be no regressions

Change-Id: I3dbf9e948b585a7b1ec0b952db1e9dc84977c2ee
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/252452
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Rob Orton <rob@instructure.com>
QA-Review: Rob Orton <rob@instructure.com>
Product-Review: Rob Orton <rob@instructure.com>
2020-11-12 16:23:28 +00:00
Ethan Vizitei e6ae468af4 make routes work for media downloads
closes FOO-1186
flag=none

discussion entries and announcements
were generating a lot of failures

TEST PLAN:
  1) make a new discussion entry with a video
     embed.
  2) notification should get sent, and it should
     have a media download url pointing at the
     course the topic lives in

Change-Id: I888a8508bd18ac9e37727eab5ede9e7a0102f184
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/252278
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Rob Orton <rob@instructure.com>
QA-Review: Ethan Vizitei <evizitei@instructure.com>
Product-Review: Ethan Vizitei <evizitei@instructure.com>
2020-11-10 20:13:09 +00:00
Rob Orton 2c73162b30 conversations have not included submissions 4ever
... or at least 6 years

still maintaining the shape since it is passed as an empty array from
the controller

Change-Id: I773694a06f3ddbd65ab22c8db52e1cd0445ee1b8
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/250502
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Caleb Guanzon <cguanzon@instructure.com>
QA-Review: Caleb Guanzon <cguanzon@instructure.com>
Product-Review: Caleb Guanzon <cguanzon@instructure.com>
2020-11-05 17:39:39 +00:00
Cody Cutrer 548a2a1732 update all invocations of send_later and friends to new syntax
Change-Id: I7f40ed058b50882121da69f0cb05966854b8e920
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/250924
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Simon Williams <simon@instructure.com>
QA-Review: Simon Williams <simon@instructure.com>
Product-Review: Simon Williams <simon@instructure.com>
2020-10-30 19:13:54 +00:00
Cody Cutrer 06763dd519 add # frozen_string_literal: true for lib
Change-Id: I59b751cac52367a89e03f572477f0cf1d607b405
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/251155
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Simon Williams <simon@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
2020-10-27 20:49:50 +00:00
August Thornton f52a577a58 remove AuthenticationMethods#load_pseudonym_from_policy
The two occurrences I found were `prepend_around_action`,
which prepends a callback around actions. The two actions
associated with this callback are no longer being used. Therefore
there was no evidence pointing to a callsite for
AuthenticationMethods#load_pseudonym_from_policy.

The files controller appears to call a new action `api_create`
vs the old :create. This handles the policy via its new code-path.

The content imports controller referenced a "migrate_content_upload"
action that is no longer in commission.

It appears the original intent behind the usage was for flash file
uploads. Usage existed in local_storage.rb & s3_storage.rb

[skip-cache]

refs FOO-1085
refs https://gerrit.instructure.com/c/migration_tool/+/251170
flag = none

test plan:
 - specs pass
 - bulk course migrations still work

Change-Id: Iedd0ff846e13840ce1c33f4da27b29ddd30f87ae
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/250591
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Simon Williams <simon@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Product-Review: August Thornton <august@instructure.com>
2020-10-27 14:56:32 +00:00
Adrian Packel b7a5ce6e6e Fall back to scores for override grade changes
fixes EVAL-1276
flag=final_grade_override_in_gradebook_history

Test plan:
- Have a course with a grading scheme enabled (C1) and one without a
  grading scheme (C2)
  - For both courses, add some students, allow final grade override in
    Gradebook, and enter some override grades for students
- Open Gradebook History for each course and check the
  before/after/current columns for the override grade events
  - For C1, the columns should show the appropriate letter grades
  - For C2, the columns should show the score displayed as a percent
    (e.g., "89%")
  - In both cases, the lack of a value should still be indicated by a
    dash
- Do some general testing with switching a grading scheme on/off,
  doing some grading, then switching back (e.g., for C1, disable the
  scheme, enter some override grades, the re-enable it)
  - For override grade changes:
    - The before/after columns should reflect the grading scheme (or
      lack thereof) *at the time of the grade change*
    - The current column should always reflect the current grading
      scheme (or lack thereof)
  - Grade changes for assignments should not be affected

Change-Id: Id6011a78a19f69fc39090e8bc7ce56f9aeec0ae3
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/250911
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Gary Mei <gmei@instructure.com>
Reviewed-by: Spencer Olson <solson@instructure.com>
QA-Review: Spencer Olson <solson@instructure.com>
Product-Review: Syed Hussain <shussain@instructure.com>
2020-10-23 15:30:53 +00:00
Mysti Lilla b66d25ae49 Fix teacher permissions to view user data in GraphQL
fixes INTEROP-6182
flag=none

Test plan
- While masquerading as a teacher with permission
  to read sis and view email addresses in a course
  go to http://localhost:3000/graphiql and load a
  student from a course the teacher teaches and has
  the permissions in and ensure you can load their
  email and sis data

Change-Id: I4acd548ab518b6479dc41b7a91dea6cf748e1433
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/250022
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Tucker Mcknight <tmcknight@instructure.com>
Product-Review: Oxana Jurosevic
2020-10-22 19:36:13 +00:00
Cody Cutrer d52d6968c2 rails 6: fixes for API specs
Change-Id: I3ac07e45861aecaca50f82dbb7dccf169bc11edc
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/250566
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Simon Williams <simon@instructure.com>
QA-Review: Simon Williams <simon@instructure.com>
Product-Review: Simon Williams <simon@instructure.com>
2020-10-21 02:07:15 +00:00
Cody Cutrer 114399a1d3 rails 6: fix overrides API to use SisPseudonym
Change-Id: I56d1d651293330b8a43b235e01b62cefd3f4e000
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/224593
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Rob Orton <rob@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
2020-10-19 21:36:08 +00:00
Ed Schiebel b706c50618 Use an svg file as its own thumbnail
as long as it's < 16k (some course designers embed base64 encoded
png images in their 2MB svgs. we don't want those)

closes LS-1522
flag=none

test plan:
  - upload an svg file
  - find it in the files page
  > expect it to have itself as its thumbnail
  - upload a giant svg file
  > expect it to have a vanilla icon instead of its thumbnail

Change-Id: I4ad26e67c1b7dfbc2a38fa2182a6fa18d233f27e
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/249403
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Robin Kuss <rkuss@instructure.com>
Product-Review: Peyton Craighill <pcraighill@instructure.com>
2020-10-14 19:45:26 +00:00
Jeremy Stanley 3c798a4115 show name of user who performed sync in blueprint history
test plan:
 - set up a blueprint course and associated course
 - perform a sync
 - the sync history in the blueprint course's sidebar should show
   "X changes pushed by (name of user)"
 - the blueprint information in the associated course's settings
   should also show the name of the user who performed the last sync

flag = none
closes LS-1263

Change-Id: Iee4e2326d773a72d109566291a873c922108e173
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/249760
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: James Williams <jamesw@instructure.com>
QA-Review: Robin Kuss <rkuss@instructure.com>
Product-Review: Peyton Craighill <pcraighill@instructure.com>
2020-10-13 16:54:08 +00:00
James Williams 1467961992 allow configuring rce favorites on sub-accounts
test plan:
* before checking out the patchset,
 have some editor button tools installed on a root account
 and at least one set to be an rce favorite
* after checking out the patchset but before running
 migrations, ensure that the previously configured
 rce favorite tools still show up in the rce
 and still are marked as a favorite in the root account settings
* after running migrations, ensure that everything appears the
 same again

* now, should be able to configure sub-accounts external tools
 to have their own set of rce favorites

closes #LS-1420

Change-Id: Ie95b9860149ab11ad5227544e4881d6b36bb6ee3
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/248632
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Jeremy Stanley <jeremy@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
2020-10-08 16:34:31 +00:00
Augusto Callejas 59a5fb70e3 Enable usage rights on discussion topic files
closes OUT-3933

flag=usage_rights_discussion_topics

If a course has usage rights enabled, then discussion topics
and announcements will require usage rights set when a file
is attached. If a user does not have manage_files permission,
then the usage rights indicator won't appear, but a default
set of usage rights will be applied.

prerequisites:
  - in a course, enable copyright and license information
    on files under course settings
  - create teacher and student accounts
  - create a group in the course, and add the student

test plan (before enabling feature flag):
  - confirm that when creating course discussions
    with file attachments as a teacher and student,
    copyright information is not set in the Files
    section
  - confirm the same with group discussions

test plan:
  - enable the feature flag
  - for course discussions:
    - as a teacher, confirm that when creating
      a discussion, usage rights are required
      when attaching a file. confirm the usage
      rights settings are set by re-editing
      the discussion and viewing the file in
      the Files section
    - as a student, confirm that when creating
      a discussion, usage rights are not required
      when attaching a file, but when the topic
      is created, the file appears with a copyright
      setting in the Files section
  - for group discussions:
    - as a teacher and student, confirm that when
      creating a discussion, usage rights are
      required when attaching a file. confirm the usage
      rights settings are set by re-editing
      the discussion and viewing the file in
      the Files section

Change-Id: I0dc6532f7d8188cf4f623275fcf8562f19585f1f
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/248211
Reviewed-by: Pat Renner <prenner@instructure.com>
QA-Review: Pat Renner <prenner@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Product-Review: Jody Sailor
2020-10-07 22:40:04 +00:00
Cody Cutrer c5227d3f1b shackles was renamed to guardrail
closes FOO-989, FOO-990

Change-Id: I49dfa130cb74c34dd0eb25952790176ae4951058
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/249365
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Simon Williams <simon@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
2020-10-06 19:23:08 +00:00
Pablo Marti f198b32862 apply current proficiency calculation on export csv
closes: OUT-3775
flag=account_level_mastery_scales

test-plan:
- create outcomes at Course-level
- assign the outcomes to a rubric and then to an assignment
- turn on the Account-level Mastery Scales flag
- in the Account-level Outcomes section define Mastery scales
and change the calculation method and change the default mastery
- grade student submissions
- turn off the Account-level Mastery Scales flag
- export the CSV report from the lmgb page
- expected result: results should have the scores and mastery
points taken from the course outcome
- turn on the Account-level Mastery Scales flag
- export the CSV report from the lmgb page
- expected result: results should reflect the resolved
proficiency calculation method, the 'result' field should be
scaled to the resolved mastery scale and the 'mastery points'
field should reflect the resolved mastery scale

Change-Id: Ic8e5fb5140dffb634af61748efcfc465465088b8
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/249052
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Pat Renner <prenner@instructure.com>
Reviewed-by: Michael Brewer-Davis <mbd@instructure.com>
QA-Review: Brian Watson <bwatson@instructure.com>
Product-Review: Jody Sailor
2020-10-02 19:37:33 +00:00
Pat Renner 0dd41c3310 return resolved calc method in outcome response
closes OUT-3771
flag=account_level_mastery_scales

test-plan:
- follow the steps in g/248109 but ensure changing the
calculation method accurately updates whether or
not the student met mastery

Change-Id: I843d20f9d2f0f79b8faaee15382dc174adf6886f
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/248449
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: Brian Watson <bwatson@instructure.com>
Product-Review: Jody Sailor
Reviewed-by: Manoel Quirino <manoel.quirino@instructure.com>
Reviewed-by: Michael Brewer-Davis <mbd@instructure.com>
2020-10-01 23:03:15 +00:00
Mysti Lilla 1cc85a6fcd Prevent assignments from creating plagiarism subscriptions
fixes INTEROP-5767
flag=none

Test plan
- Create a new plagiarism assignment
- Ensure the assignment configuration tool lookup
  doesn't have a subscription associated with it
  and that the subscription service didn't get
  called
- Ensure that the subscriptions do still send
- Also ensure that the tool_proxy_controller
  methods for recreate_subscriptions, destroy,
  and update all can still properly create
  subscriptions on the tool proxy

Change-Id: Ieca7eb74f385c1b253f2480b0bfe95d9dd336f94
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/246733
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: Tucker Mcknight <tmcknight@instructure.com>
Product-Review: Mysti Lilla <mysti@instructure.com>
Reviewed-by: Xander Moffatt <xmoffatt@instructure.com>
2020-09-28 22:16:58 +00:00
Pat Renner 50f11b48fa use outcome proficiency ratings in SLMGB
closes OUT-3772
flag=account_level_mastery_scales

Test-plan:
- Ensure the FF is disabled
- Create a course with one student, an outcome,
and an assignment with a rubric aligned to that outcome
- Ensure the rubric is used for assignment grading
- Enable the LMGB under course settings
- Give the student a grade for the outcome (can use speedgrader)
The rest of the test plan assumes I gave the student a 3/5. Feel
free to use another scale and adjust later values
- Click on the student via the student’s name in the LMGB
(this will open up the SLMGB page)
- Note the score (3/5)
- At the account level, enable the FF
- Create an outcome proficiency with 20x the outcome
ratings (100, 60, 0)
- Go back to the SLMGB within the course
- Ensure ratings scaled - if the student previously
had a score of 3, they should now have a score of 60
(20 * 3)
- Grade the same student with another assignment
- Hop in the rails console and verify that the
LearningOutcomeResult associated with the old grade uses
the old outcome scale (specifically, look at `possible`
and `score`). Ensure the newest result uses the scaled
outcome proficiency values for those same fields
- Delete your proficiency and calculation method for the account
via the rails console. Verify that the SLMGB reverts to
using the original outcome values
(this will be fixed after OUT-3922)

Change-Id: Iac888e6eeb929c031559456e2edb9f3bfce4c611
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/248109
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: Brian Watson <bwatson@instructure.com>
Product-Review: Jody Sailor
Reviewed-by: Augusto Callejas <acallejas@instructure.com>
2020-09-28 20:49:07 +00:00
James Williams ccad5df312 handle contextless outcomes in blueprint history api
i don't know why they exist but apparently they do

test plan:
* sync history should work

closes #LS-1463

Change-Id: I0c294088aaeddafe8aadcec728d0f5085c7bc754
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/247715
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
QA-Review: James Williams <jamesw@instructure.com>
Product-Review: James Williams <jamesw@instructure.com>
2020-09-22 17:31:57 +00:00
Michael Brewer-Davis f979a12ef1 remove outcomes export i18n FF
closes OUT-3194
flag=none

Test plan:
qa-cr

Change-Id: I09cc9777dd92aa5d3c3274b4a0813e40d5731bce
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/247418
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Augusto Callejas <acallejas@instructure.com>
Reviewed-by: Pat Renner <prenner@instructure.com>
QA-Review: Michael Brewer-Davis <mbd@instructure.com>
Product-Review: Michael Brewer-Davis <mbd@instructure.com>
2020-09-21 14:47:35 +00:00
Adrian Packel 452405d197 Show "final grade override" as assignment name
closes EVAL-1069
flag=final_grade_override_in_gradebook_history

Test plan:
- Enable the "Final Grade Override in Gradebook History" feature flag
- Have a course with some override grades given out
- Open gradebook history
- You should see override grade changes in the results
  - For those results, the assignment name should  appear as "Final
    Grade Override" (italicized)
- For non-override grade change events, the assignment name should
  appear as before

Change-Id: Id88388c8fe7f0e292c7a1742a2a9107735a106d4
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/247667
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Spencer Olson <solson@instructure.com>
Reviewed-by: Kai Bjorkman <kbjorkman@instructure.com>
Reviewed-by: Gary Mei <gmei@instructure.com>
QA-Review: Adrian Packel <apackel@instructure.com>
Product-Review: Jody Sailor
2020-09-18 19:59:53 +00:00
Nick Pitrak be4ce6fb28 remove uses of whitelist and blacklist
closes EVAL-1062
flag = none

test plan:
- make sure tests pass

Change-Id: I25f72393d6711944718ad2aa04441c810e8fbf4a
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/247629
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: Nick Pitrak <npitrak@instructure.com>
Product-Review: Nick Pitrak <npitrak@instructure.com>
Reviewed-by: Spencer Olson <solson@instructure.com>
Reviewed-by: Kai Bjorkman <kbjorkman@instructure.com>
2020-09-18 15:58:40 +00:00
Augusto Callejas b4bf5427e2 Display roles that can edit proficencies
closes OUT-3945

flag=account_level_mastery_scales

test plan:
  - enable account levels mastery scales flag
  - create custom roles that have different
    outcome proficiency permissions
    (scales & calculation methods)
  - confirm the mastery and calculation tabs
    on an account outcomes page display the
    roles that have the respective permissions

Change-Id: Ic677ca651c1825629609f00532598532313e002a
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/247692
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: Brian Watson <bwatson@instructure.com>
Product-Review: Jody Sailor
Reviewed-by: Michael Brewer-Davis <mbd@instructure.com>
2020-09-17 23:11:37 +00:00
Jeremy Stanley eb903f7037 rip out wiki_pages.view_count update
it causes database sadness and the value isn't even used

test plan: page "must view" module completion requirements
 should still work

flag = none
refs LS-1436

Change-Id: I7a27e78559c1ff0f35538844dec67103fd4565b3
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/247126
Reviewed-by: James Williams <jamesw@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: Robin Kuss <rkuss@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
2020-09-08 17:52:39 +00:00
Jeremy Stanley 7c2fcc3542 use squiggly heredocs for SQL
to avoid sending unnecessary whitespace to the database

test plan: specs

closes LS-1422

Change-Id: Iaaa73059b46964d4c51e920fd469b876256ec632
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/246811
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Mysti Lilla <mysti@instructure.com>
QA-Review: Jeremy Stanley <jeremy@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
2020-09-04 19:11:47 +00:00
Adrian Packel f7d1ae25b6 Return override grade changes in results
Update the grade change audit API controller to return override grade
changes if the FGOGH feature flag is enabled, rather than always
excluding them.

flag=final_grade_override_in_gradebook_history
closes EVAL-1068

Test plan:

Take care to test that this works both when reading data from
ActiveRecord and when reading data from Cassandra. Note that a bug
currently exists (separate from this patchset) where grade change data
*written* will only be properly indexed in Cassandra if Cassandra is
also set as the active read_path. In other words, if you have
active_record as the read_path and assign some grades, those grades will
not appear when you view the results using Cassandra.

- Have auditors set up for both ActiveRecord and Cassandra
- Have a course with some assignments and students
  - Issue some assignment grades and some course override grades
- With the Final Grade Override in Gradebook History feature flag ON:
  - Gradebook history for a course should include override grades in the
    results
    - The "Before" and "After" columns should display the override
      grade values before and after that change
    - The "Current" column should display the current override grade if
      there is one (or score if no grading scheme exists)
    - Note that the above two columns should always show the override
      grade, never the *computed* grade (even if there is no current
      value for the override grade)
    - The assignment name will display as "Not available"--for now, this
      is fine
  - Filtering by a specific assignment should not include override
    grades in the results
  - Filtering by other parameters, however (e.g., student/grader) should
    include override grades where appropriate
- With the feature flag OFF:
  - Gradebook history should not show override grades
- Test the above with both ActiveRecord and Cassandra set as the auditor
  read_path (but see the preliminary note)

Change-Id: I90768edfb512774eed7c4c87c76e1df93955511b
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/246383
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Spencer Olson <solson@instructure.com>
Reviewed-by: Kai Bjorkman <kbjorkman@instructure.com>
QA-Review: Adrian Packel <apackel@instructure.com>
Product-Review: Syed Hussain <shussain@instructure.com>
2020-09-04 16:06:17 +00:00
James Williams ee2b75c6f9 skip user join on assignment override invisible users query
test plan:
* specs

closes #LS-1419

Change-Id: Ie82488b3885f9c8e5f2c029de003398bba574379
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/246779
Reviewed-by: Keith Garner <kgarner@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
2020-09-02 15:58:36 +00:00
Jackson Howe 07960b20cd Add can_submit value to assignments_api
Mobile needs to know whether to show the submit button on an
assignment or whether it should be disabled. This adds a value
'can_submit' to the API that is true if all are met:
 - assignment expects_submission?
 - user has rights_status :submit
 - attempts_left not exceeded on assignment

This is only returned if user includes 'can_submit' in the
include param and if a single assignment is being requested.

flag=none
fixes LS-1398
refs LS-1385

Test plan:
 - Create a course, enroll a student
 - As student, GET /api/v1/courses/:id/assignments/:id
   ?include[]=can_submit
 - Response should contain can_submit: true
 - As teacher, set course end date to be in the past
 - Response should still be can_submit: true
 - As teacher, set 'Students can only participate in the course
   between these dates'
 - Response should now be can_submit: false
 - Restore course dates, make a new assignment with no submission
 - Response should be can_submit: false, until given a submission
   type
 - Set max attempts=1 on a new assignment
 - Response should be true
 - Submit assignment as student
 - Response now should be false
 - As the student, GET /api/v1/courses/:id/assignments/
   ?include[]=can_submit
 - can_submit should not be in response

Change-Id: I9f3b6bce80c25ce5e7edc20cf027fd534854439c
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/246133
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Robin Kuss <rkuss@instructure.com>
Product-Review: Jackson Howe <jackson.howe@instructure.com>
2020-09-01 16:28:01 +00:00
Jackson Howe c06e410ab7 Add SR label to recent history icons
Adds a label like 'page' or 'assignment' after the link in recent
history tray. Needed to give context to sr-users for what the item
is.

fixes LS-1338
flag = recent_history

Test plan:
 - Enable page views & enable recent history FF
 - Open the tray in the global nav
 - Use VO and browse the items
 - Expect to hear items like listed in ticket
 - Repeat with NVDA, JAWS

Change-Id: Ifbbad89729da63931afc4cb6c920ee03dd720cb3
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/245908
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Ed Schiebel <eschiebel@instructure.com>
QA-Review: Robin Kuss <rkuss@instructure.com>
Product-Review: Jackson Howe <jackson.howe@instructure.com>
2020-08-27 18:16:37 +00:00
Charley Kline 0ea99751b3 Don't return stale data after updating permissions
Fixes FOO-661
Refs FOO-873
flag=none

When updating a permission via the API, even though the change
is properly persisted, the stale (pre-update) value may get
returned in the API response. This is because although the
RoleOverride model clears the caches after a save, the update
of the Redis caches may happen asynchronously and thus may not
be complete by the time the response is built.

The fix is to add a new argument to RoleOverride.permissions_for
which causes it to bypass all the caches and always hit the AR
model itself. Then the role_json method in lib/api/v1 can use
that to force permissions_for to skip any cached entries.

Fixing this plus adding the spinners to the permissions buttons
should make the whole workflow of editing permissions settings
way more clear to the user.

Test plan:
* Play around with the permissions settings page
* Your changes should always be reflected properly after the
  API call completes, and should stay that way

Change-Id: I5b0fc1a242f886a4b2d2940e61d2e6d65c1d43d8
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/245905
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: August Thornton <august@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Product-Review: August Thornton <august@instructure.com>
2020-08-25 17:57:51 +00:00
James Williams 4403eb3c2a fix cross-shard content shares
shares belong to the user's shard, not the content export's

so shares created for a course on a shard
that the user doesn't belong to will break

and shares sent to cross-shard users that create "received"
copies of the original share will also break

also semi-inadvertently fixing share sender info in API
and some problems on the import side when the correct
shard isn't active

test plan:
* cross-shard content shares should work
 (both when sharing content from a course from a shard
 the sending user is not native to, and when sharing content
 to a user on a shard different than the content's course)

closes #LS-1337

Change-Id: Ib91529ffa5de0ee7a6f20f63281d6c5508982063
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/245496
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Jeremy Stanley <jeremy@instructure.com>
Product-Review: James Williams <jamesw@instructure.com>
2020-08-20 17:07:08 +00:00
Andrew Haberlandt 92a038cd53 Add score statistics to the assignments API as an 'include' option
This is designed to match the grade distribution graphs
shown in the web UI on the 'Grades' screen to students.

The permissions model is identical: students can view grade
grade distribution (min, max, mean) only if all of the following:
  - The 'hide_distribution_graphs' setting is NOT enabled
  by the instructor in the course's settings
  - There are at least 5 graded submissions
  - The student's submission is graded, and the grade is visible
  to them.

Instructors (or anyone with the read_admin permission) can
always view distributions when they are looking at a student
with a graded assignment.

closes EVAL-1057
closes GH-1669
flag=none

Test Plan:
  - Make API requests to the GET endpoints for individual assignments,
  assignment groups, and for listing all assignments for a course
  - Test these API endpoints with and without the
  include[]=score_statistics flag.
  - Verify that the statistics match those shown in the grade
  distribution graphs on in the web UI
  - Verify that the statistics are only available in the API
  when there are 5 graded submissions and when not disabled by
  the instructor (this behavior should match the distribution
  graphs in the web UI)

Change-Id: Ib0213794abbc45c1debdd989bdbf04e516c2dd82
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/243903
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Product-Review: Jody Sailor
Reviewed-by: Spencer Olson <solson@instructure.com>
Reviewed-by: Syed Hussain <shussain@instructure.com>
QA-Review: Kai Bjorkman <kbjorkman@instructure.com>
2020-08-19 15:10:03 +00:00
Jeremy Stanley a258858a22 add recent history to global nav
test plan:
 - enable page views
 - enable Recent History feature
 - the global nav should show recent activity
   with links to the pages, the name of the context,
   and the time since the activity
   - the history should also appear in the
     responsive global nav, when the browser
     width is reduced
 - render API documentation
 - ensure the History API behaves as documented
 - ensure if an admin masquerades as a student,
   1. the admin does not see the student's history
      (but does see her own history as the student)
   2. the student does not see what the admin did
      while masquerading as him

closes LS-1311
flag = recent_history

Change-Id: I4c41f58622ce9ac7f18d00744ba108fd51b2d03a
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/200801
Reviewed-by: James Williams <jamesw@instructure.com>
QA-Review: Robin Kuss <rkuss@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Product-Review: Peyton Craighill <pcraighill@instructure.com>
2020-08-17 15:50:21 +00:00
Jacob Fugal 2b3886c5f4 extend client_credentials oauth2 grants for CD2
refs SAS-1540

* adds an audience setting to developer keys, so a key can be set to
  target external audiences with its credentials grants
* when a key with an external audience grants credentials, the token is
  signed with an asymmetric key instead of the internal symmetric key
* external audiences can retrieve the corresponding public keys from
  /login/oauth2/jwks
* credentials issued by developer keys with an account id include the
  account's guid in a custom claim

includes a refactor of key storage and rotation in consul, which had
already been done for LTI. but it wasn't really a feature of lti, just
something used by LTI, and we needed the same for key management for
this. moved it to be part of Canvas::Security

Change-Id: Ie5c0fcee6fc21687f31c109389a3bcc1ed349c5d
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/243606
QA-Review: Jonathan Featherstone <jfeatherstone@instructure.com>
Reviewed-by: Jonathan Featherstone <jfeatherstone@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Product-Review: Jacob Fugal <jacob@instructure.com>
2020-08-13 18:52:47 +00:00
Alex Slaughter fea8170e33 remove "muted" attribute from api and api docs
Fixes: DEMO-8
flag=none

Test Plan:
 - All specs pass

Change-Id: I1917cf3b890a0457f85f38ac5f6f10a297c6d8ae
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/243303
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Han Yan <hyan@instructure.com>
QA-Review: Alex Slaughter <aslaughter@instructure.com>
Product-Review: Alex Slaughter <aslaughter@instructure.com>
2020-07-29 19:27:06 +00:00
Drake Harper 6d2e121d6b Remove student planner feature flag
Test plan:
-verify planner is always enabled when a student has an enrollment

flag=none

fixes VICE-331

Change-Id: I6ffb90de94737d01afbac36eee0f36a967ace179
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/242462
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Davis Hyer <dhyer@instructure.com>
QA-Review: Caleb Guanzon <cguanzon@instructure.com>
Product-Review: Davis Hyer <dhyer@instructure.com>
2020-07-23 18:59:09 +00:00
Spencer Olson 738f6e74ce gradebook history: ignore versions without versionable assoc
Sometimes 'Version' objects that are being mapped over in Gradebook
History code have a nil 'versionable' association. This breaks
Gradebook History. There's a separate commit to fix the root cause, but
this commit makes the Gradebook History code ignore those versions
instead of throwing an error.

closes EVAL-903
flag=none

Test Plan:
1. Create an assignment and submit to the assignment as a student.
2. As a teacher, grade the submission. Verify the grading action
   is recorded in Gradebook History.
3. In a rails console, modify the Version so that it no longer has an
   associated 'versionable':

   sub = Submission.find_by(assignment_id: <id>, user_id: <id>)
   version = sub.versions.first
   version.update_column(:versionable_id, nil)

4. Make a GET request to the /api/v1/courses/<id>/gradebook_history/feed
   endpoint and verify you get a success response.

Change-Id: Ia19132ebbe3f79bc341f69bd68afd97363509314
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/242715
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Product-Review: Syed Hussain <shussain@instructure.com>
Reviewed-by: Adrian Packel <apackel@instructure.com>
Reviewed-by: Gary Mei <gmei@instructure.com>
QA-Review: Adrian Packel <apackel@instructure.com>
2020-07-20 16:01:48 +00:00
James Williams 0a1eb84cd0 unset submission_types as well when setting to not_graded
test plan:
* create a graded assignment
* use the API to update the assignment with
 "assignment[grading_type]=not_graded"
* it should show as "Not Graded" when editing
 via the UI

closes #LS-1162

Change-Id: I26d336fb2979b5c6d8508d0e31cc89fcfaa05e5e
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/241965
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Jeremy Stanley <jeremy@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
2020-07-07 21:52:30 +00:00
Clint Furse ed4127c72e basic launch and response from MasteryConnect
closes LA-728
flag = submission_type_tool_placement

Test Plan:
- find a LTI 1 tool that can be configured to do
  submission_type_selection placements.  The
  tool will also need to be able to send a
  ContentItemResponse back to Canvas.  I used
  a tool called lti_tool_provider_example (github)
  and modified it.  The response should include
  the following data for MasteryConnect:
  "https://canvas.instructure.com/lti/mastery_connect_assessment": {
          "points": 10,
          "objectives": "6.R.P.A.1, 6.R.P.A.2",
          "trackerName": "My Tracker Name",
          "trackerAlignment": "6th grade Math",
          "studentCount": 15
        }
- Install the tool under an account or course
- Create an assignment using the submission type
  that matches the tool (not 'External Tool')
- interact with the tool to send a response item
  back to Canvas
- The new data should be displayed below the button
- Save the assignment and verify that the data is
  persisited to the DB as JSON (content_external_tag.external_data)
- also verify data is still correclty displayed when
  editing an assignment

Change-Id: I5b1457e5dcfb8988ec75fbe3dfa1a3ca88bf0a77
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/240130
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: James Williams <jamesw@instructure.com>
QA-Review: Robin Kuss <rkuss@instructure.com>
Product-Review: Clint Furse <cfurse@instructure.com>
2020-06-17 15:21:23 +00:00
Jacob Burroughs d3c962a550 Support recaptcha by default for new user registration
flag=default_recaptcha_registration_enable

fixes USERS-587

test plan:
- Configure recaptcha in dynamic_settings.yml
   development: private: canvas: recaptcha_{client|server}_key
   DM me for a key pair or create your own v2 recaptcha config
- Enable open registration for the canvas authentication provider
- Attempt to create a teacher account, you should not be prompted for a captcha and it should work
- Enable the default_recaptcha_registration_enable siteadmin feature flag
- Attempt to create a teacher account without completing the captcha-it should fail
- Attempt to create a teacher account with the captcha-it should work
- Attempt to create student, observer accounts with the captcha-it should work
- As a siteadmin, deselect the "Require Captcha for Self Registration" option on the canvas authentication provider
- Attempt to create a teacher account-there should be no captcha, and it should work
- As an account (but not site) admin, verify you cannot see "Require Captcha for Self Registration"

Change-Id: I3db1f15006473c5c84ed3a8de4a688100744f281
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/239022
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Simon Williams <simon@instructure.com>
QA-Review: Ahmad Amireh <ahmad@instructure.com>
Product-Review: Ahmad Amireh <ahmad@instructure.com>
2020-06-11 15:01:01 +00:00
Steve Shepherd 07434113ca Add setting to hide students from other sections
Adds a new course setting to make it so students
can't see students from other sections when it is
enabled. Behavior only triggers when there is more than
one section.

test plan:
1. As a teacher, create a course and go to the course settings page
2. Under more options, check the "Hide sections on the People page
   from students" checkbox and then Click Update Course Details.
3. Leave the course as a single section for now and publish it.
4. Add a student to the course, and then log in as the student.
5. Go to the people page and verify you can see the Section column
   on the roster table.
6. Log in as a teacher and add a second section to the course.
7. Add another student and assign them the new section.
8. Log in as either student, and verify on the people page that
   the Section column no longer appears.
9. As a teacher turn off the setting and verify the students can
   see the Section column again.
10. As a teacher, delete the second section.
11. Turn on the setting again and verify the student can still see
    the Section column.

closes: USERS-352
Change-Id: I9a674674424e4d37d23e9df4dea690b1114feb7a
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/234974
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Rob Orton <rob@instructure.com>
QA-Review: Rob Orton <rob@instructure.com>
Product-Review: Rob Orton <rob@instructure.com>
2020-05-21 20:01:41 +00:00
James Williams 0b742ad0b8 add external tool placement for submisson type selection
test plan:
* enable the "Submission Type LTI Placement" feature
* add an external tool to a course or account with a
 "submission_type_selection" placement configured
* should be able to create or edit an assignment and
 select the tool directly from the submission type
 drop down
* when selected, it should show a button
 (that currently does nothing but will be used to
 launch the tool for additional configuration)
* should be able to save the assignment with
 the tool selected, and it should stay selected
 when the saved assignment is edited again

flag=submission_type_tool_placement
closes #LA-725

Change-Id: Ic0dd44f91b61f3300c55db7e7b30d9180c7a14e2
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/237534
Reviewed-by: Clint Furse <cfurse@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: Clint Furse <cfurse@instructure.com>
Product-Review: James Williams <jamesw@instructure.com>
2020-05-20 18:12:57 +00:00
Nate Armstrong ea35376bfb Add context_name to calendar events api
flag=none
refs: MBL-14399

Test plan:
- Enroll a student in a course
- Create and publish an assignment in the course and set its due date to
some day this month
- Create a calendar event on the user's calendar
- As the student, query the calendar_events api for the assignment
  - Something like: /api/v1/calendar_events
    ?type=assignment
    &start_date=2020-05-01
    &end_date=2020-05-30
    &context_codes[]=course_1
- The context_name should be included
- As the student, give the course a nickname
- The context_name should be the nickname of the course
- As the student, query the calendar_events api for the calendar event
  - Something like: /api/v1/calendar_events
    ?start_date=2020-05-01
    &end_date=2020-05-30
- The context_name should be included

Change-Id: Ie5336637824d3241d39b7fbb6dcb083e3ec25cdc
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/237393
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Ben Nelson <bnelson@instructure.com>
Reviewed-by: Rob Orton <rob@instructure.com>
QA-Review: Ben Nelson <bnelson@instructure.com>
Product-Review: Ben Nelson <bnelson@instructure.com>
2020-05-18 17:02:56 +00:00
Jon Willesen 714e905073 add is_rce_favorite to external tools db and api
closes LA-812

test plan:
- migrate your database to create the new is_rce_favorite column
- For root account LTI tools with an editor button placement, the
  external_tools create and update actions should allow you to specify
  an is_rce_favorite parameter.
- The specified value of that parameter should be returned in
  external_tools index and show actions.
- LTI tools that are not at the root account should not return an
  is_rce_favorite field at all.
- LTI tools that do not have an editor button placement should not
  return an is_rce_favorite field at all.

Change-Id: I59ab583bdf0793bedec9c3d89d7d1fbb5582f6e0
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/229575
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Jeremy Stanley <jeremy@instructure.com>
Product-Review: Jon Willesen <jonw+gerrit@instructure.com>
2020-05-18 16:31:15 +00:00
Simon Williams 470d5319de squash old migrations, p25
Change-Id: I90e2c042c82edcdb4ab47a8d29c3af2af015195e
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/233761
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Ethan Vizitei <evizitei@instructure.com>
QA-Review: Ethan Vizitei <evizitei@instructure.com>
Product-Review: Ethan Vizitei <evizitei@instructure.com>
2020-05-18 02:37:00 +00:00
Chad McGuire c9001377d3 Merge branch 'dev/proserv-liberty-quizzes'
Change-Id: I6a77723d7ef415435cda1a9fed2fc48b40fd012a
2020-05-14 10:31:55 -06:00
Jeremy Stanley 5334c1a026 add syllabus_course_summary to course settings API
test plan:
 - the "show course summary" option on the syllabus page should
   be exposed in the course settings API at
   /api/v1/courses/X/settings (true by default)

flag = syllabus_course_summary_option

fixes LA-998

Change-Id: Iad8398b300e2e51ac6be1589c502085c7df771e4
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/236968
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: James Williams <jamesw@instructure.com>
QA-Review: James Williams <jamesw@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
2020-05-13 16:15:53 +00:00
Jeremy Stanley b5f73533db fix null indent in module items
test plan:
 - import something into a module via direct share import
 - the imported content_tag should have an indent value of
   0, rather than null
 - the module items API should return 0 for a module item's
   position if it is null (for pre-existing items)

fixes LA-873

Change-Id: I0fc9db9dcff90e5d760258d47e77cefb90623753
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/235711
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: Ed Schiebel <eschiebel@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
Reviewed-by: James Williams <jamesw@instructure.com>
2020-05-07 15:22:50 +00:00
Mark Neuburger 1acdb57154 Add support for editing disable_timer_autosubmission attribute
Test plan:

1. Verify that the "Disable automatic submission" option does not appear
   when the "Time Limit" option is unchecked, with or without the
feature flag enabled.
2. Verify that "Disable automatic submission" option does appear when
   the Time Limit option is checked and the feature flag is enabled, and
does not appear when the Time Limit option is checked and the feature
flag is disabled.

Refs PFS-15514
Refs PFS-15516
flag=timer_without_autosubmission

Change-Id: I4d155bd986cb7e25fc3f41179c60ec0f731fe4db
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/234186
Product-Review: Hyrum Romrell <hyrum@instructure.com>
Tested-by: Chad McGuire <cmcguire@instructure.com>
QA-Review: Chad McGuire <cmcguire@instructure.com>
Reviewed-by: Stephen Kacsmark <skacsmark@instructure.com>
2020-05-06 17:52:52 +00:00
Cody Cutrer c921d9d787 avoid joining to pseudonyms for users list unless necessary
fixes USERS-343

also change the index to include a column we sort by, so that postgres
will actually use it

also fix including last_login even when searching, since it's easy now

test plan:
 * go to /accounts/self/users in an account with users that have logged in
 * notice Last Login is populated
 * sort by Last Login; it should still work
 * revert the sort
 * search for the user that has a last login; it should still work

Change-Id: I56c1263e9b5534005045f5053de5ab3e45a5e975
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/235389
QA-Review: Cody Cutrer <cody@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: James Williams <jamesw@instructure.com>
2020-05-04 20:33:57 +00:00
Michael Brewer-Davis f869f6b1f9 add ui for adding conference from calendar entry
closes CAL-4
flag=calendar_conferences

Test plan:
- enable FFs ("Add Conferences fro Calendar" and
  "Allow Conference Selection LTI placement"
- enable BigBlueButton at /plugins/big_blue_button
- enroll a user in multiple courses
- add conference LTI tool to one course
- from calendar, add an event for one of the courses
- verify that option to add calendar event is present
  - for course with LTI tool, should be dropdown between LTI and BBB
  - for course without, should be button for BBB
- add BBB conference
- verify that conference link is added and button hidden
- save event
- verify that conference link shows on the event "show" dialog
  (on clicking in calendar, before clicking edit)
- verify that removing the event and saving persists
- add LTI conference in that course's context
- verify that dialog launches to go through LTI workflow
- verify that conference is added, saved, can be removed
- verify that when conference is selected, dropdown is shown
  allowing switching to BBB

Change-Id: I4892d49efcfd41e9c3a223faf071b677e26ba8fb
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/234639
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: Steve Shepherd <sshepherd@instructure.com>
Product-Review: Michael Brewer-Davis <mbd@instructure.com>
Reviewed-by: Ken McGrady <kmcgrady@instructure.com>
Reviewed-by: Davis Hyer <dhyer@instructure.com>
2020-04-30 18:06:01 +00:00
Ben Nelson 79cba0a46c Anonymize Submission json when anonymous_grading on
When the "Graders cannot view student names" option is enabled on an
assignment, submitter information should not be available to graders in
the API, as it is hidden from them in the UI.

Test Plan:
 - Ensure the Anonymous Grading feature flag is enabled on the account
 - In a course with at least 1 teacher and 1 student
 - Create an assignment with the "Graders cannot view student names"
     option checked
 - Submit to the assignment as a student and leave a submission comment
 - As the teacher, make a GET request to
     api/v1/courses/<course_id>/assignments/<assignment_id>/submissions
        ?include[]=submission_comments&include[]=user
 - Verify that there is no information in the response that identifies
     the commenter

fixes KNO-30
flag=none

Change-Id: I712007f565979d206c88b88bcdd8f0d42625d260
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/229576
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Davis Hyer <dhyer@instructure.com>
QA-Review: Davis Hyer <dhyer@instructure.com>
Product-Review: Davis Hyer <dhyer@instructure.com>
2020-04-30 17:06:01 +00:00
Augusto Callejas 239eb7c7a3 Custom file rename messaging
closes LA-963

flag=module_dnd

test plan:
  - in an empty module, upload a file using the
    drag and drop area
  - after upload complete, attempt to upload the
    file again using the drop and drop area
  - confirm that the rename dialog doesn't mention
    "location" anymore
  - open the Add Item to Module dialog
  - select File -> "New Files(s)" and then attempt
    to upload the same file
  - confirm that the rename dialog mentions "folder"
    and not "location"
  - load the "Files" page on the same course
  - attempt to upload the same file again, both
    using the upload button and file drag and drop
  - confirm that the rename dialog mentions "file"
    instead of "item" and "folder" instead of "location"
  - repeat the above steps with a course associated with
    a blueprint course with files, so that the associated
    course has locked files
  - confirm that when attempting to upload a locked file
    that the messaging is not generic like:
    "A locked item named...". instead it should start
    with "A locked file named..."

Change-Id: I4752b6ae9b0cb8176f230f2d9ab49920c40af2d9
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/235297
Reviewed-by: Ed Schiebel <eschiebel@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: Mark McDermott <mmcdermott@instructure.com>
Product-Review: Lauren Williams <lcwilliams@instructure.com>
2020-04-28 23:14:20 +00:00
Ethan Vizitei 0abe3b6fe3 make quiz_submissions.submissions valid
fixes sentry issue: 971915
https://sentry.insops.net/instructure/canvas/issues/971915/

Test Plan:
- Given an UNTAKEN quiz with a file upload question
- On the quiz details page, select 'Download All Files'
- After the first success, do it again
- The download should succeed as expected

This also fixes the submission downloader when we hit an "errored"
state - which can only occur when no files are added to the zip.

flag = none
refs QO-603

Change-Id: I598118e4b5fa36458fca66e47e0df44a6ceb9ec8
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/233336
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: David Tan <dtan@instructure.com>
Product-Review: Kevin Dougherty <jdougherty@instructure.com>
Reviewed-by: Stephen Kacsmark <skacsmark@instructure.com>
2020-04-24 15:29:05 +00:00
Adrian Packel 5a7463df22 Return current_points on enrollment API
flag=none
closes TALLY-684

Test plan:
- Have a course with a student and a teacher enrolled
  - Issue some grades
  - Ensure that at least one scored submission is not posted (or post it
    and then re-hide it), so that there can be a meaningful difference
    between current_points and unposted_current_points
- As a teacher in the course:
  - Test the API endpoint for course enrollments, supplying a parameter
    to include the current points:
    - /api/v1/courses/<course_id>/enrollments?include[]=current_points
    - Check that the returned enrollment objects include
      "current_points" and "unposted_current_points" fields, and that
      they reflect that student's total points earned for the course
  - Test the same endpoint without the parameter:
    - /api/v1/courses/<course_id>/enrollments
    - The current_points and unposted_current_points fields should not
      be included
- As a student in the course:
  - Test the API endpoint for user enrollments, supplying a parameter to
    include the current points:
    - /api/v1/users/self/enrollments?include[]=current_points
    - The "current_points" field should be included for the user's
      student enrollments
      - unposted_current_points, however, should not be included
  - Test the endpoint without the parameter:
    - /api/v1/users/self/enrollments
    - Neither field should be included

Change-Id: Idf26efd2995603a27e221b5a766e9c275a3efa8c
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/234675
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Jeremy Neander <jneander@instructure.com>
Reviewed-by: Spencer Olson <solson@instructure.com>
QA-Review: Robin Kuss <rkuss@instructure.com>
Product-Review: Spencer Olson <solson@instructure.com>
2020-04-23 15:35:30 +00:00
Jared Crystal e8039c65c7 fix N+1 for quiz description attachments on quizzes:index
fixes QO-606
flag = none

test plan:
 - test with the newquizzes_on_quiz_page FF disabled and
   enabled, as it forces different code paths
 - create several classic quizzes in a course where each quiz
   has one or more file attachments in the quiz description
 - hit the quizzes index either by visiting the `Quizzes`
   page in the course, or by hitting the api directly
     - /api/v1/courses/1/quizzes
 - in the development.log there should only be a single
   SQL query to load all description attachments instead
   of one query per attachment
 - make sure nothing breaks when there are New Quizzes
   mixed in

Change-Id: I2e004c124f5b480894df522ece2e745489a238fa
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/234492
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Han Yan <hyan@instructure.com>
QA-Review: Han Yan <hyan@instructure.com>
Product-Review: Jared Crystal <jcrystal@instructure.com>
2020-04-21 16:42:22 +00:00
Michael Brewer-Davis 47ee312937 add conference to calendar event
closes CAL-22
flag=calendar_conferences

Test plan:
- Create a conference in a course context
  (can enable BigBlueButton plugin with dummy settings
  to make feature available)
- Create a calendar event in the course, copying
  the curl command from the dev tools (URL will be
  something like POST /api/v1/calendar_events)
- Update the calendar event, copying the curl command
  (POST /api/v1/calendar_events/{id})
- enable the "Add Conferences from Calendar" FF
- run the update command above, adding
    &calendar_event[web_conference_id]={conference_id}
  to the end of the request body (where the id is substituted
  from the conference created above)
- run the create command above, adding
  the same web_conference_id param
- verify that both requests complete successfully
- reload the calendar page and copy the index request
  to /api/v1/calendar_events
- add &include[]=web_conference to the request and verify
  that the conference details are included in the
  response

Change-Id: Ib8aa6969e650d84798f64238fcac521064ae88a1
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/233396
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: Steve Shepherd <sshepherd@instructure.com>
Product-Review: Steve Shepherd <sshepherd@instructure.com>
Reviewed-by: Davis Hyer <dhyer@instructure.com>
Reviewed-by: Alex Slaughter <aslaughter@instructure.com>
2020-04-21 15:20:04 +00:00
Michael Brewer-Davis e18bfb9871 create LtiConference for lti conference_selection placement
closes CAL-2
flag=conference_selection_lti_placement

Test plan:
- create an api access token from user settings
- add an LTI tool with conference placement
  (including FF, see g/232853) to a course.
  You will need the course id and the tool id.
- create an LTI conference via the API, e.g.:
  > curl http://canvas.docker/api/v1/courses/${COURSE_ID}/conferences \
    -H 'Content-type: application/json' \
    -H 'Authorization: Bearer ${ACCESS_TOKEN}' \
    -d '{
          "web_conference": {
             "title": "Something",
             "conference_type": "LtiConference",
             "lti_settings": {
                "tool_id": ${TOOL_ID}
             }
          }
        }'
- view the conferences created via the api
  > curl -H 'Authorization: Bearer ${ACCESS_TOKEN}' \
      http://canvas.docker/api/v1/courses/${COURSE_ID}/conferences

Change-Id: I5d1da73c76590395b7d37c58deaf4b1a69cff9b4
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/233227
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Ahmad Amireh <ahmad@instructure.com>
QA-Review: Steve Shepherd <sshepherd@instructure.com>
Product-Review: Steve Shepherd <sshepherd@instructure.com>
2020-04-21 15:19:49 +00:00
Cody Cutrer 86096d22df fix account_name include on courses api
fixes USERS-368

test plan:
 * use /api/v1/accounts/self/courses?include[]=account_name
 * ensure account_name is in the output

Change-Id: I124f9195365c4acc12c9cb2c831cd6b405ebb1d0
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/229630
Reviewed-by: August Thornton <august@instructure.com>
Reviewed-by: Simon Williams <simon@instructure.com>
Reviewed-by: James Williams <jamesw@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Product-Review: August Thornton <august@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
2020-04-16 15:18:49 +00:00
James Williams 5f5c4b17c1 fix a bunch of n+1 queries and cache calls for submissions api
test plan:
* SubmissionsApi#for_students should work as before

closes #LA-906

Change-Id: I8fe9b6c297461eb6cc7b075ef74c180e77fc480e
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/233560
Reviewed-by: Simon Williams <simon@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: Jeremy Stanley <jeremy@instructure.com>
Product-Review: James Williams <jamesw@instructure.com>
2020-04-13 18:06:16 +00:00
James Williams e628a8cd8b preload course nicknames and favorites on courses api index
test plan:
* the courses api should load nicknames and favorite
info as before

closes #LA-912

Change-Id: Id42f70e76f58e899c9d6f5321d0c35bbca92ca86
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/233663
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Jon Willesen <jonw+gerrit@instructure.com>
QA-Review: Jeremy Stanley <jeremy@instructure.com>
Product-Review: James Williams <jamesw@instructure.com>
2020-04-13 17:02:38 +00:00
James Williams c862439baf move discussion user counts to slave
closes #LA-882

Change-Id: Id6fbd028e20f3123b2c9602345069d7e4dd7e34f
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/232651
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: Jeremy Stanley <jeremy@instructure.com>
Product-Review: James Williams <jamesw@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
2020-04-13 16:56:02 +00:00
Keith T. Garner 65daceb819 stringify student and grader ids in gradebook history audit api
Grader and student ids in grade events are transmitted as now
transmitted as strings instead of integers. This fixes issues with
cross-shard user ids that will lose precision in javascript.

fixes TALLY-492

test plan:
 - Have a course with a local student, a cross shard student, a local
   teacher, and a cross shard teacher and any number of assignments.
   (It'll help if the cross shard users' global ids are big enough to
   cause javascript precision errors.)
 - Grade each student as each teacher
 - Visit gradebook history and confirm that all student and teacher
   names are properly displayed

Change-Id: I8a56f4cc65b808613087a7f8cb00eaedeb1fa6a4
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/229682
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: Robin Kuss <rkuss@instructure.com>
Product-Review: Keith Garner <kgarner@instructure.com>
Reviewed-by: Jeremy Neander <jneander@instructure.com>
Reviewed-by: Adrian Packel <apackel@instructure.com>
2020-04-13 16:06:19 +00:00
Michael Brewer-Davis cecc1804b0 add conference_selection LTI placement
closes CAL-6
flag=conference_selection_lti_placement

Test plan:
- Add LTI developer key at /accounts/self/developer_keys
- verify that conference_selection is not included in the
  list of placement options
- turn on feature flag "Allow Conference Selection LTI placement"
  at /accounts/site_admin/settings
- add LTI developer key again
- verify that conference_selection is included in
  the placement options and tool can be saved/reloaded

Change-Id: Ie6016514a29e9362562aab1a7a33f0c3d808ed6a
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/232853
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Weston Dransfield <wdransfield@instructure.com>
QA-Review: Steve Shepherd <sshepherd@instructure.com>
Product-Review: Michael Brewer-Davis <mbd@instructure.com>
2020-04-10 16:07:26 +00:00
Jeremy Stanley 1c62e34641 add include[]=can_edit to assignments index
test plan:
 - render API docs and note include[]=can_edit
 - set up some assignments and assignment overrides
   including dates inside and outside closed
   grading periods
 - use this endpoint, including can_edit and all_dates
 - as a teacher,
   - ensure can_edit is true for assignments and dates
     in the absence of grading periods or moderated grading
   - ensure can_edit is false for a date that lands in
     a closed grading period (still true for the
     assignment, however)
   - ensure can_edit is false for an assignment and all
     dates for a moderated grading assignment where the
     teacher lacks "select final grade" permission and
     isn't the moderator
  - as a student,
   - ensure can_edit is false everywhere
  - as an account administrator,
   - ensure can_edit is true everywhere
 - also test the can_edit include in
  - assignment show
  - assignment group index w/include[]=assignments

flag=none
closes LA-861

Change-Id: I7c0df7a0071cfd2bdb97e09cf4b77800de962d54
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/232004
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: Anju Reddy <areddy@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
Reviewed-by: James Williams <jamesw@instructure.com>
Reviewed-by: Jon Willesen <jonw+gerrit@instructure.com>
2020-04-08 23:03:51 +00:00
Ben Nelson 1c19e967e7 add Email to student self registration
add the ability to require an email address when using the student self
signup. Since this was written specifically for FFT, the option is set
to OFF as a default, meaning accounts will see no change until the
Setting is manually updated.

Test Plan:
When not logged in:
 - Navigate to /register_from_website
 - Click "I'm a Student"
 - Verify that there is no required field for Email
     (This is the default OFF case)
 - In a Rails console:
    a = Account.default
    a.settings[:require_email_for_registration] = true
    a.save!

 - Navigate again to the sign up modal
 - Verify that there is now a required field for email
 - Fill out the form and submit
    (You will need a course with a Join Code
    https://community.canvaslms.com/docs/DOC-13116-415274473 )
 - Verify that the newly created user has their email address associated

refs UXS-62
flag=none

Change-Id: Iab9eaefe9b1d84243531ebf66267fa73a6fb15ec
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/232195
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Rob Orton <rob@instructure.com>
QA-Review: Matthew Lemon <mlemon@instructure.com>
Product-Review: Ben Nelson <bnelson@instructure.com>
2020-03-31 22:45:07 +00:00
James Williams de6df6b789 improve blueprint associations performance for many teachers
we try to return teacher information but having thousands
of teachers slows things down so just return a count
(like we do on the account course search)

test plan:
* have a course with more than 5 teachers
* should be able to search for and add them to a
blueprint course and have the UI show a count
instead of every teacher's name

closes #LA-863

Change-Id: Ie4d2294d04492e52d9f6854886458871c7f050d9
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/231920
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: Jeremy Stanley <jeremy@instructure.com>
Product-Review: James Williams <jamesw@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
2020-03-30 21:47:21 +00:00
Adrian Packel 419f7d5c84 Add API endpoint for a user's conferences
flag=none
closes MBL-14123

Test plan:
- Enable BigBlueButton (or similar) on your local Canvas
  - (you can enable BBB at /plugins/big_blue_button)
- Have a course with at least one student (S1)
  - Within the course, create a group set, and create at least one group
    with S1 in it
- Create a conference for the course
  - Invite S1 (or check "Invite all course members" on creation)
  - Do not start the conference yet
- Create a conference for S1's group from the group homepage
  - Invite S1 (or check "Invite all group members" on creation)
  - Do not start the conference yet

- Logged in as S1, access the endpoint:
  - /api/v1/conferences
    - You should get a JSON response containing both the conferences you
      created above (contained in the "conferences" hash)

  - /api/v1/conferences?state=live
    - You should get a JSON response with an empty array (contained in
      the "conferences" hash)
    - Start one or more of the conferences you created
    - Access the endpoint again; this time, it should include the
      conferences you just started
    - Stop the conferences you started
    - Access the endpoint again; it should be back to returning an empty
      array

Change-Id: Id91ca3a8a42fd1f1f9e092c3e30a0e788134886e
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/230542
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Spencer Olson <solson@instructure.com>
Reviewed-by: Keith Garner <kgarner@instructure.com>
QA-Review: Nate Armstrong <narmstrong@instructure.com>
Product-Review: Keith Garner <kgarner@instructure.com>
2020-03-27 14:11:52 +00:00
Jacob Burroughs 2d7a8a8af4 Create BBB kill switch
refs C19CONF-36

flag=none

- specifies "Replace with alternatives" and "Is free trial" for
  BBB, so we can show different content based on those settings
  in the ensuing PS

Test plan:
- verify plugin settings are saved and returned
  correctly
- verify plugin settings inherit correctly

Change-Id: I577804d53737e163272f023003169b25ad8d65bf
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/230076
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: Pat Renner <prenner@instructure.com>
Reviewed-by: Augusto Callejas <acallejas@instructure.com>
Product-Review: Michael Brewer-Davis <mbd@instructure.com>
2020-03-18 18:19:03 +00:00
Gary Mei 4f52b3f1a5 Revert "add hidden_submissions_count to.."
closes TALLY-668
flag=none

This reverts commit 37aeb9f452. A
performance issue was identified with courses containing a large
number of Submissions.

Test Plan
- Verify that docs do not reference hidden_submissions_count as a
  currently available field.
- Verify that docs do not reference include_hidden_submissions_count
  as an available parameter to the assignments api.

Change-Id: Ifd93cbc57b03a1526d666285063c3f7c49989a48
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/229330
Reviewed-by: Adrian Packel <apackel@instructure.com>
QA-Review: Adrian Packel <apackel@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Product-Review: Jonathan Fenton <jfenton@instructure.com>
2020-03-09 21:16:08 +00:00
Jeremy Neander c6dd252d4e spec: update submission api for post policies
Change-Id: I1f72c6ff970c15033d3cb38fd48ffe78137d0431
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/229117
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Robin Kuss <rkuss@instructure.com>
QA-Review: Jeremy Neander <jneander@instructure.com>
Product-Review: Jeremy Neander <jneander@instructure.com>
2020-03-06 19:30:15 +00:00
Spencer Olson 37aeb9f452 add hidden_submissions_count to assignment json responses
closes TALLY-639
flag=none

The "muted" param is removed from endpoints. The "muted" attribute on
Assignment is marked as deprecated and is replaced with
"hidden_submissions_count".

Test Plan
- Generate fresh api docs.
  `bin/rails doc:api`
- Navigate to public/doc/api and do a search for the string "muted".
- Verify that any mention of a muted attribute for Assignment has a
  deprecation warning.
- Verify that the description of "hidden_submissions_count" in
  assignment.html is accurate.
- Enable the release flag "Allow Postable Submission Comments" as the
  Site Admin.
- Create an assignment with a manual posting policy.
- Give a student a grade.
- Give another student a comment, but no grade.
- Ensure there is a third student, but do not give them a grade nor
  comment.
- Send a GET request for the assignment:
  `/api/v1/courses/:course_id/assignments/:id`
- Verify that hidden_submissions_count is not returned on assignments
- Send a GET request for the assignment with hidden_submissions_count:
	```
	/api/v1/courses/:course_id/assignments/:id
		?include_hidden_submissions_count=true
	```
- Verify that hidden_submissions_count is 2.

Change-Id: I70b92740984662cece251b8ab518fdc62eaee487
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/228649
Reviewed-by: Gary Mei <gmei@instructure.com>
Reviewed-by: Jeremy Neander <jneander@instructure.com>
QA-Review: Gary Mei <gmei@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Product-Review: Jonathan Fenton <jfenton@instructure.com>
2020-03-05 21:44:46 +00:00
Rob Orton b9acc6eac4 remove hidden_submissions_count
this is a partial revert e5b9b52e4b

test plan
 - hit calendar for user that has a cross shard assignment
 - it should work

fixes: CNVS-48431
flag=none

Change-Id: I9b38f13fa379eec3018418427760e9483ac765ef
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/228304
Reviewed-by: James Williams <jamesw@instructure.com>
Reviewed-by: Jeremy Neander <jneander@instructure.com>
Reviewed-by: Spencer Olson <solson@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: Rob Orton <rob@instructure.com>
QA-Review: Spencer Olson <solson@instructure.com>
Product-Review: Rob Orton <rob@instructure.com>
2020-02-28 01:15:31 +00:00
Gary Mei e5b9b52e4b remove "muted" param from api docs
closes TALLY-440
flag=none

The "muted" param is removed from endpoints. The "muted" attribute on
Assignment is marked as deprecated and is replaced with
"hidden_submissions_count".

Test Plan
- Generate fresh api docs.
  `bin/rails doc:api`
- Navigate to public/doc/api and do a search for the string "muted".
- Verify that any mention of a muted attribute for Assignment has a
  deprecation warning.
- Verify that the description of "hidden_submissions_count" in
  assignment.html is accurate.

- Enable the release flag "Allow Postable Submission Comments" as the
  Site Admin.
- Create an assignment with a manual posting policy.
- Give a student a grade.
- Give another student a comment, but no grade.
- Ensure there is a third student, but do not give them a grade nor
  comment.
- Send a GET request for the assignment:
  `/api/v1/courses/:course_id/assignments/:id`
- Verify that hidden_submissions_count is 2.

Change-Id: I423dd857a9c0dc0e8efb1b993f66038d22ed0b46
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/224590
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Jeremy Neander <jneander@instructure.com>
Reviewed-by: Adrian Packel <apackel@instructure.com>
Reviewed-by: Spencer Olson <solson@instructure.com>
QA-Review: Jeremy Neander <jneander@instructure.com>
Product-Review: Spencer Olson <solson@instructure.com>
2020-02-07 19:36:18 +00:00
Han Yan 55b2b55679 fix symbol loading error for local dev env
Change-Id: I9571be2947d0cd1e200d6586cc82967dc107b9d2
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/224491
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Stephen Kacsmark <skacsmark@instructure.com>
QA-Review: Han Yan <hyan@instructure.com>
Product-Review: Han Yan <hyan@instructure.com>
2020-02-07 15:47:57 +00:00
Landon Gilbert-Bland 99f804529e Update API to allow for granular permissions
This adds a new `:group` key to the permissions. All permissions that
share a `:group` can be updated at once by passing it a permission to
the `update` put request. For example, if you wanted to update all the
permissions under the `manage_wiki` group, you could use:

```
permissions[manage_wiki][enabled]=1
permissions[manage_wiki][explicit]=1
```

You can also update the permissions individually, by using the rest
api PUT as normal, for example:

```
permissions[manage_wiki_create][enabled]=1
permissions[manage_wiki_create][explicit]=1
```

If you were previously using the (now) group permission, after we
turn on granular permission it will for all intensive purposes still
work the same way, and can continue to be used without need to change
the API usage at all.

The only change for granular permissions is that you can no longer
change the locked status on granular permissions, you can only lock
or unlock permissions that have a group at the group level.

There is one other API change worth mentioning. If you attempt to
update several permission in a single API call now, and one of them
fails, none of the previously processed permissions will be saved.
They now all succeed or all fail.

Test Plan:
  - Enable the :granular_permissions_wiki_pages feature flag. This
    is just so that we have some granular permissions you can use
    to test things with
  - Make some manual API calls to update the permissions. See
    https://canvas.instructure.com/doc/api/roles.html (Update a role)
    for reference. Specifically check that:

    * All the permissions in a group can be updated in a single
      API call
    * Granular permissions can be updated individually
    * Grouped permissions can only be locked/unlocked at the group
      level
    * Granular permission can not be locked/unlocked individually
    * Non granular singular permissions (ex: read_reports) can still
      be locked/unlocked individually

fixes USERS-164

flag = granular_permissions_wiki_pages

Change-Id: I9695fde27724f72f8c762f0be8cb989d935e6f47
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/223993
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
Reviewed-by: Charley Kline <ckline@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: August Thornton <august@instructure.com>
2020-02-05 16:59:55 +00:00
Nate Armstrong 2c842eee28 Add account setting to limit parent app web access
refs: MBL-13883
flag = none

Test plan:
* View account settings as an admin that can manage the site settings
* Enable the option to "Limit access to Canvas web from the Canvas Parent
app"
* As an observer, visit `/api/v1/users/self`
* permissions.limit_parent_app_web_access should be true

* Disable the option in settings
* As an observer, visit `/api/v1/users/self` again
* permissions.limit_parent_app_web_access should be false
* View account settings as an admin that can manage the site settings

* View the account settings as an admin that can not manage site settings
* The option to "Limit access to Canvas web from Canvas Parent app" should
not be visible

Change-Id: Ief167618e0ffbc7dac4de97ea553a97150b44c67
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/224790
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
QA-Review: Nate Armstrong <narmstrong@instructure.com>
Product-Review: Nate Armstrong <narmstrong@instructure.com>
2020-01-30 22:30:04 +00:00
Han Yan f61498c7e8 pop up new tab if assignment rldb setting is enabled
closes QUIZ-7266

test plan:
- create a N.Q assignment
- in rails console, set require_lockdown_browser to true for the
  assignment:
  assignment.settings = {
    'lockdown_browser' => {
      'require_lockdown_browser' => true
    }
  }
  assignment.save!
- from Canvas Assignments Page, click the assignemnt will pop up
  a new tab
- with N.Q on Canvas Quizzes Page FF on, clicking on the N.Q
  quiz will pop up a new tab

Change-Id: Icda1b96a05dd44b7b45c85e6f9ad2b1cd05e9a6a
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/222173
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Tyler Burraston <tburraston@instructure.com>
QA-Review: Mark McDermott <mmcdermott@instructure.com>
Product-Review: Han Yan <hyan@instructure.com>
2020-01-17 21:14:12 +00:00
wdransfield 8430f519ed Back-end: "allow includes" checkbox
The "allow_includes" field on the developer
key is used to control what access tokens
can use "include" parameters when making
API requests.

refs PLAT-5152
flag = developer_key_support_includes

Test Plan:
Verify you can set the "allow_includes" field
when creating a new developer key

Verify you can update the "allow_includes" field
when editing an existing developer key

Change-Id: Ibcfb7a2cdd06793483421b1ad6a8c0a8d7b99ed6
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/222617
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Product-Review: Weston Dransfield <wdransfield@instructure.com>
Reviewed-by: Clint Furse <cfurse@instructure.com>
QA-Review: Clint Furse <cfurse@instructure.com>
2020-01-13 16:10:22 +00:00
Adrian Packel 953aeb2b7d Restrict anonymize_students to active enrollments
With post policies, ignore submissions belonging to concluded or
inactive enrollments when considering whether an anonymously graded
assignment should anonymize students, rather than simply checking the
assignment's muted attribute (which does not take students' enrollment
states into consideration).

fixes TALLY-151
flag=none

Test plan:
- Have a course with New Gradebook and Post Policies enabled
- Enroll at least three students (S1, S2, S3)
- Set up an anonymous assignment (A1)
- Conclude S2's enrollment in the course
- Deactivate S3's enrollment in the course
- In Gradebook:
  - Check that A1 appears as anonymous and grades are concealed
  - Post grades for A1
  - Reload the page
  - Check that grades for A1 are unconcealed after reload, and that
    "Hide grades" is now possible but posting grades isn't
- Repeat the above in SpeedGrader

Change-Id: I4ae69c088376fe6ba1acc5e8c04dc5abd1706c82
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/222155
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Spencer Olson <solson@instructure.com>
Reviewed-by: Jeremy Neander <jneander@instructure.com>
QA-Review: Robin Kuss <rkuss@instructure.com>
Product-Review: Jonathan Fenton <jfenton@instructure.com>
2020-01-09 17:21:07 +00:00
Evan Battaglia a73af243db Fix launch_type in accounts tabs API
When working on https://gerrit.instructure.com/c/canvas-lms/+/220669 I
noticed the accounts tabs API is returning sessionless launch URLs with
launch_type=course_navigation instead of account_navigation. If you have
tools that do not have both of these launch types, hitting the
sessionless launch URL returned will return an error.

flag=none
Closes PLAT-5252

Test plan:
- install an LTI app such as the live events (Data Services) app that
  has account navigation
- generate a token for your user by going to Account -> Settings ->
  Approved Integrations -> New Access Token
- hit the account tabs API with that token, e.g.:
    curl -H "Authorization: Bearer MYTOKEN" \
    http://web.canvas-lms.docker/api/v1/accounts/1/tabs | jq .
- observe that the sessionless_launch URL returned for the tool has
  launch_type=account_navigation and not launch_type=course_navigation
- you can also hit the URL with launch_type=account_navigation
   returned to double-confirm that it works (use your auth token again)

Change-Id: I20cead38a5aaf2c51f4a95c90e911683199a7aae
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/221153
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: Xander Moffatt <xmoffatt@instructure.com>
Product-Review: Evan Battaglia <ebattaglia@instructure.com>
Reviewed-by: Marc Phillips <mphillips@instructure.com>
2020-01-06 19:01:43 +00:00
Gary Mei 6fcc28885f fix cache after changing peer review anonymity
fixes TALLY-316
flag=none

Names were showing up or not showing up when flipping
anonymous_peer_reviews for assignments because the AssessmentRequests
associated with the assignment's submissions were not being updated,
so the cache was stale.

Test Plan
- Create a peer review assignment.
- As a student, submit to the assignment.
- As the teacher, assign that student another student to peer review.
- As the student, verify that you are able to see other student's
name.
- As the teacher, edit the assignment to have anonymous peer reviews.
- As the student, verify that the other student's name is no longer
visible.

Change-Id: I6c9805528ae322de2e6cd71966e37c89771687a9
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/221890
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Spencer Olson <solson@instructure.com>
Reviewed-by: Adrian Packel <apackel@instructure.com>
QA-Review: Adrian Packel <apackel@instructure.com>
Product-Review: Spencer Olson <solson@instructure.com>
2020-01-06 17:15:11 +00:00
Evan Battaglia ccc0fe64bb Fix comments for external tool file submissions
Comments when submitting a file upload via an external tool appear to
have been broken in
https://github.com/instructure/canvas-lms/commit/8cdf400ba720623d8d2c

This commit changes the UI to again send the comment to the server, and
changes the server-side code to process the comment.

The server side code has two possible data paths:
* With InstFS:
  include the comment in the JWT we send (in capture_params) to InstFS.
  When InstFS is done it hits FilesController#api_capture. Now it
  include comment -- so we now take the comment and pass it into
  SubmitHomeworkService which submits it.
* Without InstFS:
  pass the comment in when making the asynchronous job in
  SubmitHomeworkService.submit_job() in this case, though.

Note: File uploads using an external tool appear to not work at all (?)
using Assignments 2. This fix is for "classic" Assignments.

Also, I can get file uploads using an external tool for group
assignments to work at all, locally or production. It was supposedly
working as of b55cf587. Someone else should check and we can create
another ticket for that apparently separate issue. I did test that the
"comment" is now getting through to the call to SubmitHomeworkService.

flag=none
closes PLAT-4390

Test plan:
- If running locally, disable Assignments 2 by editing
  config/feature_flags/meeseeks_release_flags.yml and commenting out the
  hardcoded "environments: development: state: on" config under
  "assignments_2_student"
- You may need to run `node_modules/bin/.webpack` or `rails
  canvas:compile_assets` to compile the coffeescript.
- Install an LTI tool such as Box or Google Drive which allows file
  upload.
- Make an assignment that accepts file upload
- As a student, submit an assignment by choosing a file to upload with
  the LTI tool. After choosing a file, add a comment and submit.
- Start asynchronous jobs if running Canvas locally.
- Previously, the assignment would be submitted with no comment. Now,
  once submitted, the attachment should show up on the right side of the
  assignment page for the student. Under this the comment should appear.
- Submit again, this time with no comment, and check that no comment is
  added.
- InstFS team will help test this for the InstFS route.
- Test external tool file submission for group assignments on production
  (or beta) and we can create another ticket
  if that isn't working.

Change-Id: Ie0bbacae1e732518aae46017f72be8a72f567510
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/221096
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Product-Review: Evan Battaglia <ebattaglia@instructure.com>
Reviewed-by: Marc Phillips <mphillips@instructure.com>
QA-Review: Jonathan Featherstone <jfeatherstone@instructure.com>
2020-01-06 16:16:59 +00:00
James Williams 12a656fd2b ignore no-op allowed attempts updates in assignments api
allowed_attempts is returned as -1 in the api json if it's nil
so it might be passed back in an update call
but we don't allow changes in a closed grading period
so just ignore the attempted change

closes #LA-134

Change-Id: I4e7c30331357fa569aa14de7891476d6b82996cd
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/220903
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Tested-by: Jenkins
QA-Review: Jeremy Stanley <jeremy@instructure.com>
Product-Review: James Williams <jamesw@instructure.com>
2019-12-20 20:36:28 +00:00
Han Yan ebbd9ebd63 a new endpoint to return both NQ and Old quiz json
(for N.Q mobile and N.Q Respondus)

closes QUIZ-6788

test plan:
- create old quizzes and new quizzes in Canvas
- /api/v1/course/:course_id/all_quizzes will return json for both
  old quizzes and new quizzes

Change-Id: I98c9a40b4075566a1945e3c46ef7b5dcb1c7dcac
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/218090
Tested-by: Jenkins
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: Mark McDermott <mmcdermott@instructure.com>
Product-Review: Kevin Dougherty <jdougherty@instructure.com>
Reviewed-by: Stephen Kacsmark <skacsmark@instructure.com>
2019-12-16 19:36:38 +00:00
James Williams 4f95f9e290 hide old previously configured user services
user service configurations should not be shown
in the UI as still configured if the user service
has been removed from the code altogether

test plan:
* find a user with a user profile configuration
 set up for a since-removed service (e.g. LinkedIn)
* it should no longer show in the list of configured
 services with this change

closes #LA-291

Change-Id: Ic90eb8d2cb17b98c82ed90af0316f0988e22fdc8
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/218887
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Tested-by: Jenkins
Reviewed-by: Carl Kibler <ckibler@instructure.com>
Reviewed-by: Mysti Lilla <mysti@instructure.com>
QA-Review: Carl Kibler <ckibler@instructure.com>
Product-Review: James Williams <jamesw@instructure.com>
2019-12-16 13:21:53 +00:00
Evan Battaglia b177942721 Fix LTI 2 apps in tabs apis
LTI 2 apps have tab[:args] in the tabs as hash. cf. MessageHandler#lti_apps_tabs:
  args = {message_handler_id: app.id, resource_link_fragment: "nav"

This is apparently handled in the other path in SectionTabPresenter#path:
  tab.args.instance_of?(Hash) ? send(tab.href, tab.args) : send(tab.href, *path_args)

This case is not handled where the tabs API constructs the URL however -- it expects
tabs[:args] to be either an array or nil. This commit fixes that. Note
that the hash had string keys, not symbols, for me, so symbolize_keys
was necessary.

See also 2de0f345b2 and 54e05827d1

closes PLAT-5245
flag=none

Test plan:
- add an LTI2 tool with a course placement
- hit /api/v1/courses/2/tabs (where 2 is the course id). This can be
  done one of two ways:
  - Use the mobile app and go to courses
  - Make an auth token in your user settings and curl it, e.g.
    curl -H "Authorization: Bearer xyz" \
      web.canvas-lms.docker/api/v1/courses/2/tabs

Change-Id: I4b4ef1214a8571aaafd1191ec77f66c44fb9d522
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/220642
Tested-by: Jenkins
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Weston Dransfield <wdransfield@instructure.com>
QA-Review: Evan Battaglia <ebattaglia@instructure.com>
Product-Review: Evan Battaglia <ebattaglia@instructure.com>
2019-12-13 23:44:12 +00:00
Ed Schiebel f4fda23b9f Add iframe url to canvas-lms' media_objects api
refs LA-352
flag=none

test plan:
  - have some media objects
  - GET /api/v1/media_objects?exclude[]=sources&exclude[]=tracks
  > expect embedded_iframe_url to be included in each media_object
    of the response

Change-Id: Ib97e128766b2eb54a2dc62fbd5bc26c171f89fa7
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/220174
Tested-by: Jenkins
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
QA-Review: Jeremy Putnam <jeremyp@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
Product-Review: Ed Schiebel <eschiebel@instructure.com>
2019-12-10 17:55:09 +00:00
James Williams 55a592a80b add default points_possible for assignments via API
test plan:
* trying to use a blank string when creating or
updating an assignment's points_possible via the API
(or alternatively through the assignment group level
 add dialog on the assignments index)
should fallback to 0

closes #LA-135

Change-Id: I482b36462c7eb06b72fbe9a38e0fb847f603cbeb
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/218554
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Tested-by: Jenkins
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Mysti Lilla <mysti@instructure.com>
Product-Review: James Williams <jamesw@instructure.com>
2019-12-04 13:21:31 +00:00
James Williams 842f4be312 clear quiz availability cache on assignment override change
and vis versa

apparently quiz assignment overrides are set with both
quiz_id and assignment_id and overrides are pulled
by both the assignment and quiz object interchangeably
so we have to invalidate the cache for both pathways

refs #QO-542

Change-Id: I6b9fc5fef1bf64c6d597699c9088ff2874c3622c
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/219230
Reviewed-by: Aaron Griffin <agriffin@instructure.com>
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Tested-by: Jenkins
QA-Review: Bryan Petty <bpetty@instructure.com>
Product-Review: Bryan Petty <bpetty@instructure.com>
2019-12-03 18:04:40 +00:00
Ed Schiebel 8b81fea626 Update canvas media_objects api for the RCE
closes LA-68

test plan:
  - have a user with media objects in a couple courses
  - have another user with a media object
  - GET /api/v1/media_objects
  > expect all the objects for the logged in user to be returned,
    including the sources and tracks data
  - query /api/v1/media_objects?&exclude[]=sources&exclude[]=tracks
  > expect all the objects for the logged in user to be returned,
    excluding the sources and tracks data (it should be _much_ faster too)
  - query /api/v1/courses/:course_id/media_objects?exclude[]=sources&exclude[]=tracks
  > expect only the media objects for the logged in user,
    in the given course to be returned
  > expect /doc/api/media_objects.html to properly document the api
  - query /api/v1/courses/:a_nonexistent_course_id/
  > expect a 404

sorting
  - have some media objects with user_entered_title, some with
    only title.
  - GET /api/v1/media_objects&sort=title&order=desc
  > expect the results to be sorted by title descending
  - GET /api/v1/media_objects&sort=create_at&order=asc
  > expect the results to be sorted by created_at ascending
  - you can try other sorts

updating*
  - PUT /api/v1/media_objects/:media_obj_id?user_entered_title=new+title
  - if :media_obj_id belongs to the current user
    > expect status=200 and the object to be returned
  - if :media_obj_id doesn't exist
    > expect status=401
  - if :media_obj_id belongs to another user
    > expect status=401
  - if user_entered_title was empty
    > expect status=400
  - if user_entered_title was missing
    > expect status=400
  - if user wasn't logged in
    > expect either a 422 (cuz the CSRF header is funky) or
      a 302 (redirect to the login page)
  - after updating
    - GET /media_objects/:id/info
    > expect the object with the new title returned
    - GET /api/v1/media_objects?exclude[]=sources&exclude[]=tracks
    > expect the object to have its new title

*To PUT, the request must include a X-CSRF-Token header. The value can
be found in documet.cookie on a canvas page (after running
decodeURIComponent on it)

Change-Id: I496b8a36f1d177054736dadb6695a25bb7aee217
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/215292
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Tested-by: Jenkins
Product-Review: Ed Schiebel <eschiebel@instructure.com>
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Jeremy Stanley <jeremy@instructure.com>
2019-11-20 22:15:43 +00:00
Steven Burnett b8258a0bb9 add pronouns to profile page
fixes KNO-132
flag=account_pronouns

Test Plan:
- on the account settings page enable profiles for your account
- as a user go to the profile page
- notice in the edit settings you can edit your pronouns
- edit pronouns
- notice they now show up
- remove pronouns
- notice they go away

Change-Id: I51053a9e6e06e271d17e3ba5c9e5069f4875b979
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/217564
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Tested-by: Jenkins
Reviewed-by: Ryan Shaw <ryan@instructure.com>
QA-Review: Steven Burnett <sburnett@instructure.com>
Product-Review: Steven Burnett <sburnett@instructure.com>
2019-11-18 23:11:54 +00:00
Steven Burnett 9924687ebb add pronouns to group manage page
fixes KNO-114

Test Plan:
- With pronouns turned on and with a student
  who has pronouns configured go to http://localhost:3000/courses/2/groups#tab-1
- notice pronouns are showing on the drag items

Change-Id: I06a34c48d09499a6577b679cc7b5c9e55f5c0e86
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/217562
Tested-by: Jenkins
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Reviewed-by: Ryan Shaw <ryan@instructure.com>
QA-Review: Steven Burnett <sburnett@instructure.com>
Product-Review: Steven Burnett <sburnett@instructure.com>
2019-11-18 16:40:41 +00:00
James Williams ba650e5b96 exclude deleted child topics from discussions API results
test plan:
* create a group set with a group
* create a discussion topic assigned to the group set
* the api show endpoint for the root topic
 (e.g. /api/v1/courses/X/discussion_topics/Y)
 should show the child topic in "topic_children"
* edit the topic to not be assigned to the group set anymore
 or destroy the group
* either way it should not show the old results in
 the "topic_children" in the API anymore

closes #LA-163

Change-Id: I17b460e308768a9166e0a3f78f4a100f359fa5a1
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/216141
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Tested-by: Jenkins
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Jeremy Stanley <jeremy@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
2019-11-15 17:35:09 +00:00
James Williams 13fea28fa4 add section restriction to enrollments in courses API
test plan:
* accessing /api/v1/courses
 should add "limit_privileges_to_course_section" to
 the included enrollments

closes #LA-244

Change-Id: I6ebd2fea27c08acd870a802bf124498f5649d5e0
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/217319
Tested-by: Service Cloud Jenkins <svc.cloudjenkins@instructure.com>
Tested-by: Jenkins
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Jeremy Stanley <jeremy@instructure.com>
Product-Review: James Williams <jamesw@instructure.com>
2019-11-15 15:40:01 +00:00
Gary Mei 6f3e62a013 allow submissions with comments to be posted
Submissions without grades, but with comments from instructors, will
now be postable.

closes APG-102

Test Plan
- Enable the Allow Postable Submission Comments feature flag.
- Create a manually posted assignment (NORMAL).
- Create a peer review, manually posted assignment (PEER).
- Create a group, manually posted assignment (GROUP).

NORMAL
- Verify that the option to post grades for the assignment is
  disabled, in both Gradebook and SpeedGrader.
- As a teacher, leave a comment on a student's submission.
- Reload the Gradebook.
- Verify that the option to post grades is available for both
  Gradebook and SpeedGrader.
- Verify posting grades works.
- Verify hiding grades works.

- After hiding grades, post grades for Graded only.
- Verify that the submission with a comment is posted.
- Verify that submissions with no comments and no grades remain
  unposted.

- Hide grades.
- Change the manually posted assignment to be automatically posted.
- Verify posting grades works.
- Verify hiding grades works.

- Disable the Allow Postable Submission Comments feature flag.
- Verify that submission comments on a manual posting assignment are
  not enough to allow posting of the assignment.

PEER
- Set up peer reviews between two students.
- Submit to the assignment for each student.
- Comment as students for self, and for the peer review.
- Verify that the option to post grades is not available for both
  Gradebook and SpeedGrader.
- Comment as a teacher on one of the submissions.
- Verify that the option to post grades is available for both
  Gradebook and SpeedGrader.

GROUP
- Set up a group with at least 2 students.
- Set up a group assignment.
- As one student, submit to the assignment and leave a comment.
- As the other student in the group, leave a comment.
- Verify that the option to post grades is not available for both
  Gradebook and SpeedGrader.
- Comment as a teacher on one of the submissions.
- Verify that the option to post grades is available for both
  Gradebook and SpeedGrader.

Change-Id: Ia33b757d6c0acdb8cb915f980e81b3b485abc61a
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/208747
Tested-by: Jenkins
Reviewed-by: Adrian Packel <apackel@instructure.com>
Reviewed-by: Spencer Olson <solson@instructure.com>
QA-Review: Adrian Packel <apackel@instructure.com>
Product-Review: Jonathan Fenton <jfenton@instructure.com>
2019-11-07 15:08:54 +00:00
Ryan Shaw ea8157447e fix `undefined method `pronouns' for nil:NilClass` bug
Closes: WOKE-93

Test plan:
* go to a public course as a non logged in user
* make sure the Course has a discussion topic
* load the assignment index page
* it should not have a 500 error for the XHR request

Change-Id: I45148dca86e41d3bee68b211c58a13e8aaf21b49
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/216074
Reviewed-by: Landon Gilbert-Bland <lbland@instructure.com>
Tested-by: Ryan Shaw <ryan@instructure.com>
QA-Review: Ryan Shaw <ryan@instructure.com>
Product-Review: Ryan Shaw <ryan@instructure.com>
2019-11-06 00:43:03 +00:00
Adrian Packel faf2d1e933 Hide body of quiz submissions if can't see grade
Nullify the "body" attribute of submissions for a quiz when returned via
the API unless the caller has permissions to see the student's grades.
Although said field is intended to contain the body of text entry
submissions, quiz-based assignments set it to a string including (among
other things) the student's score, which should be omitted if the
student isn't allowed to see it.

fixes APG-154

Test plan:

Setup:
- Have a course with at least one student
- Create a graded quiz (old, not new)
  - In the Gradebook, set the associated assignment to manual posting
- As a student, take the quiz
  - (do not post grades yet)

- Take note of the following:
  - The associated assignment ID (*not* the quiz ID)
  - The user ID of the student
- Note the URL for retrieving the submission via the API:
  - /api/v1/courses/<cid>/assignments/<asmt_id>/submissions/<user_id>

- As a teacher:
  - Access the above URL
  - The result should include a "body" attribute like so:
    "user: <id>, quiz: <id>, score: <score>, time: <time graded>"
- As the student:
  - Access the above URL
  - The "body" attribute should be nil
- As a teacher:
  - Post grades for the assignment
- As the student:
  - Access the above URL
  - The "body" attribute should now match the value shown to the teacher

Change-Id: Ifd54489dde591d26cae524fd96cf4c42283095df
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/213332
Product-Review: Spencer Olson <solson@instructure.com>
Tested-by: Jenkins
Reviewed-by: Spencer Olson <solson@instructure.com>
Reviewed-by: Gary Mei <gmei@instructure.com>
QA-Review: Spencer Olson <solson@instructure.com>
2019-11-05 19:27:05 +00:00
Jeremy Stanley 957cbaf811 fix course tab visibility for institution-visible courses
test plan:
 - have a course whose visibility is set to "institution"
 - have a user who is not enrolled in the course use the
   tabs API (/api/v1/courses/X/tabs)
 - tabs that are visible to the user on the web should
   be returned in the API (e.g., home, syllabus)

fixes ADMIN-2995

Change-Id: Icfc10d74f50711e0d70e11e69a797b97fda4be71
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/215139
Tested-by: Jenkins
Reviewed-by: James Williams <jamesw@instructure.com>
QA-Review: Jeremy Putnam <jeremyp@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
2019-11-05 16:04:57 +00:00
Steven Burnett bbd978321a Add personal pronouns
closes: WOKE-5

Test plan:
Preconditions:
* go to the settings page for the domain root account
* go to your user settings page, click “edit settings”
* you should not see anything about “Pronouns”

turn on:
* you should not see a section about “Pronouns”
* go to a root account, enable the “Pronouns” feature flag
* go back to the settings page for the domain root account
* you should now see a section about “Pronouns”
* check the box to enable it
* add a couple options
* save

Pick one for yourself:
* go to a user’s profile page, you should see a <select> where you can
  pick one of the options the school allowed
* you should see an

Make sure it show up in inbox and stuff
* go to conversations and discussions and all the places we started
  Showing pronouns, they should display your pronouns after where it
  Shows your name

Make sure you can still unset yours after the account turns off the
Setting:
* go back to the account settings page & turn off the “Enable Personal
  Pronouns” checkbox
* save
* go to inbox or somewhere and verify that it still shows your pronouns
* go to your user profile page
* it should still display that you are “He/Him” (or whatever pronouns
  You picked above)
* click “Edit Settings”
* the select box to pick a pronoun should only have an option of
  “None”
* hit save
* now your pronouns should not show up on that page nor should
  They show up anywhere else in the UI

Change-Id: I7f51c9ca2ec82cb0a3cbdca3bf37c7bc2a69d4f9
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/215336
Reviewed-by: Matthew Lemon <mlemon@instructure.com>
Reviewed-by: Rob Orton <rob@instructure.com>
Tested-by: Jenkins
QA-Review: Steven Burnett <sburnett@instructure.com>
Product-Review: Steven Burnett <sburnett@instructure.com>
2019-11-04 17:32:22 +00:00
Cameron Matheson c05b18c17d add user_pronoun to discussion_topic_api_json
Test plan:
  * /api/v1/courses/:course_id/discussion_topics/:topic_id should
    include a user_pronoun

refs COMMS-2501
flag = account_pronouns

Change-Id: I1f9fadefa6306a058877f436963701a4df994c07
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/214452
Reviewed-by: Steven Burnett <sburnett@instructure.com>
QA-Review: Steven Burnett <sburnett@instructure.com>
Tested-by: Jenkins
Product-Review: Cameron Matheson <cameron@instructure.com>
2019-10-23 22:47:43 +00:00
Steven Burnett bf9c8ce673 allow conversations to show pronouns
fixes COMMS-2501

Test Plan:
- have a couple users in an account add pronouns
- have them message each other in the inbox
- notice their pronouns show

Change-Id: Id4b558c604e3abf2760b3ca2d1c71d2aa6490b5a
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/214289
Tested-by: Jenkins
Reviewed-by: Landon Gilbert-Bland <lbland@instructure.com>
QA-Review: Steven Burnett <sburnett@instructure.com>
Product-Review: Steven Burnett <sburnett@instructure.com>
2019-10-23 15:29:00 +00:00
Han Yan 2706a2af1c align quiz migration behaviors with quiz duplication
closes QUIZ-6791

test plan:
- test the ps with quiz_lti patch
- make sure quiz migration works
  - quiz shell is created
  - quiz shell status is updated when quiz migration is done

Change-Id: Ia002ceb48ded582849301e3efd8631396d9ffe95
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/210548
Tested-by: Jenkins
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
Reviewed-by: Stephen Kacsmark <skacsmark@instructure.com>
QA-Review: Robin Kuss <rkuss@instructure.com>
Product-Review: Kevin Dougherty <jdougherty@instructure.com>
2019-10-22 22:18:35 +00:00
Jeremy Stanley 7ab99f9184 make include[]=sections work for admins in courses#show
test plan:
 - as an account admin without enrollments in a course,
   /courses/X?include[]=sections should include all course
   sections
  (as someone enrolled in the course, it returns only the
   sections you are enrolled in and also includes the
   enrolled role)

fixes ADMIN-2935

Change-Id: Ibb26e369255368743023dbedcf6efe70a48ddd7f
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/212941
Tested-by: Jenkins
QA-Review: Anju Reddy <areddy@instructure.com>
Reviewed-by: Carl Kibler <ckibler@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
2019-10-22 21:00:49 +00:00
Steven Burnett f4a67da30d add pronouns to course page
refs COMMS-2501

Test Plan:
- have a couple users in a course
- have one of the users add a pronoun identifier
- go to /courses/1/users
- notice it shows up

Change-Id: Ic3d5a6e4dd9a1983e034cc036809993f9f6287ad
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/213645
Tested-by: Jenkins
Reviewed-by: Landon Gilbert-Bland <lbland@instructure.com>
QA-Review: Landon Gilbert-Bland <lbland@instructure.com>
Product-Review: Steven Burnett <sburnett@instructure.com>
2019-10-18 21:02:46 +00:00
Steven Burnett 98acc7cc2a add pronouns to group roster page
fixes COMMS-2499

Test Plan:
- add a bunch of people to a group
- have users in group add an account pronoun
- notice it now shows up next to their name

Change-Id: I6e2ba4efc751ac3f15fbc0f203c5d229a46d295c
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/213559
Reviewed-by: Landon Gilbert-Bland <lbland@instructure.com>
QA-Review: Landon Gilbert-Bland <lbland@instructure.com>
Tested-by: Jenkins
Product-Review: Steven Burnett <sburnett@instructure.com>
2019-10-18 21:02:38 +00:00
Nick Houle 4f89ef6bd8 Remove workflow_state from files API json response
Fixes: DIG-189

Test plan:
- Specs pass
- workflow_state is no longer in the files API response

Change-Id: I10060366d38cf1926a77858aefa1a3ffce6cb026
Reviewed-on: https://gerrit.instructure.com/213397
Reviewed-by: Joshua Orr <jgorr@instructure.com>
Reviewed-by: Rob Orton <rob@instructure.com>
Tested-by: Jenkins
QA-Review: Deepeeca Soundarrajan <dsoundarrajan@instructure.com>
Product-Review: Joshua Orr <jgorr@instructure.com>
2019-10-17 20:17:43 +00:00
Steven Burnett 7d1e879b72 show account pronoun on profile tray
fixes COMMS-2498

Test Plan:
- add a pronoun
- open profile tray
- notice you see your pronoun in the tray
  and the words break on word

Change-Id: I2b2fa9b3f61c31ab1dff5c8686536b97cf3bd4b7
Reviewed-on: https://gerrit.instructure.com/213481
Tested-by: Jenkins
Reviewed-by: Matthew Lemon <mlemon@instructure.com>
QA-Review: Matthew Lemon <mlemon@instructure.com>
Product-Review: Steven Burnett <sburnett@instructure.com>
2019-10-17 18:44:36 +00:00
Gary Mei 6656959d51 fix assignment groups error when no assignments
This was occurring when no assignments existed, but a closed grading
period did.

fixes CNVS-47307

Test Plan
- Delete all assignments.
- Create a closed grading period.
- Visit the assignments page:
  `courses/:course_id/assignments`
- Verify there is no error.

Change-Id: I57ea41c2b8d74f48e24da50c1dd39b812f2e8a3e
Reviewed-on: https://gerrit.instructure.com/213482
Reviewed-by: Derek Bender <djbender@instructure.com>
Reviewed-by: Spencer Olson <solson@instructure.com>
QA-Review: Spencer Olson <solson@instructure.com>
Tested-by: Jenkins
Product-Review: Keith Garner <kgarner@instructure.com>
2019-10-17 16:23:14 +00:00
Han Yan 6e65e2ef31 move N.Q to Quizzes Page
(flag=newquizzes_on_quiz_page)

- populate N.Q quizzes to assignment quizzes list
- display kebab menu based on quiz types (old quizze and new quizzes)
- items in kebab menu are functional

closes QUIZ-6790, QUIZ-6792, QUIZ-6789, QUIZ-6786

test plan:
- With the newquizzes_on_quiz_page flag disabled
  everything should behave like in production
- With the newquizzes_on_quiz_page flag enabled
  1) N.Q quizzes show up on Quizzes Page
  2) N.Q quiz shells have correct kebab menu
  3) each menu items (delete, duplicate) should work

Change-Id: Ie4a78bb0f0a69f4d6e248135d1c486f1ca0ffe7f
Reviewed-on: https://gerrit.instructure.com/209993
Tested-by: Jenkins
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
Reviewed-by: Stephen Kacsmark <skacsmark@instructure.com>
Reviewed-by: Jon Willesen <jonw+gerrit@instructure.com>
QA-Review: Robin Kuss <rkuss@instructure.com>
Product-Review: Kevin Dougherty III <jdougherty@instructure.com>
2019-10-16 18:20:14 +00:00
Gary Mei fac671f803 optimize assignment groups controller attempt 2
closes APG-143

When the include param includes "assignments", the controller
spends a lot of effort recalculating whether an assignment falls
under a closed grading period rather than using the grading period
id stored on submissions already.

Test Plan
On master:
- Have at least 2 students in a course.
- Have NO grading periods initiially.

- Create an assignment due in the past (A1).
- Create an assignment due in the past for 1 student, and in the
  future for a second student (A2).
- Create a closed grading period (that A1 falls under) and an open
  grading period set up (that A2 falls under).
- Create an assignment due in the open grading period.
- Create an assignment due in the future that's not in any grading
  period.
- Create an assignment with no due date.

- Note your setup details; you will destroy the grading periods and
  recreate them later.
- Load the assignments page. Note which assignments are considered to
  be "closed" (can't edit/delete a closed assignment).
- Destroy the open grading period. Note which assignments are
  considered to be "closed".
- Destroy the closed grading period. Note which assignments are
  considered to be "closed".

On my patchset:
- Recreate the grading periods.
- Now load the assignments page. Note which assignments are considered
  to be "closed" (can't edit/delete a closed assignment).
- Destroy the open grading period. Note which assignments are
  considered to be "closed".
- Destroy the closed grading period. Note which assignments are
  considered to be "closed".
- Compare results; they should be identical.

Change-Id: Icc93a15ad80cd823f8d7cfa0ed98c62403166e5f
Reviewed-on: https://gerrit.instructure.com/212310
Tested-by: Jenkins
Reviewed-by: Adrian Packel <apackel@instructure.com>
Reviewed-by: Spencer Olson <solson@instructure.com>
QA-Review: Adrian Packel <apackel@instructure.com>
Product-Review: Keith Garner <kgarner@instructure.com>
2019-10-15 20:23:19 +00:00
Jeremy Stanley 12303682fc include correct preview_url for historical quiz submissions
test plan:
 - have a graded quiz that allows multiple submissions
 - as a student, take the quiz more than once
 - as a teacher/admin, hit the API endpoint
   /api/v1/courses/X/assignments/Y/submissions?include[]=submission_history
 - the first attempt's preview_url should have version=1
   and not hte current version number

fixes ADMIN-2951

Change-Id: If48de36be25437815bf012cbfdee94556d8c1d82
Reviewed-on: https://gerrit.instructure.com/213109
Tested-by: Jenkins
QA-Review: Carl Kibler <ckibler@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
Reviewed-by: Mysti Lilla <mysti@instructure.com>
2019-10-15 18:50:06 +00:00
Gary Mei a62a222a0c Revert "optimize assignment groups controller"
This reverts commit 2c5320334f.

closes APG-139

Test Plan
- Specs pass.

Change-Id: I7900be627fead9f001105e1be7322b6a3b71b310
Reviewed-on: https://gerrit.instructure.com/212091
Reviewed-by: Spencer Olson <solson@instructure.com>
QA-Review: Gary Mei <gmei@instructure.com>
Tested-by: Jenkins
Product-Review: Keith Garner <kgarner@instructure.com>
2019-10-04 21:10:23 +00:00
Gary Mei 38117bbd50 preload post policies on assignments page
Test Plan
- Specs pass.

Change-Id: I7535b51ce46d80c9fec954231dd09b80e377e869
Reviewed-on: https://gerrit.instructure.com/211815
Reviewed-by: Keith Garner <kgarner@instructure.com>
Reviewed-by: Adrian Packel <apackel@instructure.com>
Tested-by: Jenkins
QA-Review: Gary Mei <gmei@instructure.com>
Product-Review: Keith Garner <kgarner@instructure.com>
2019-10-04 21:10:14 +00:00
Evan Battaglia 54e05827d1 Fix buggy link to external tool in user navigation
If windowTarget=blank, the link appears as something like:

/users/1234/external_tools/123.display=borderless

Instead of

/users/1234/external_tools/123?display=borderless

This URL generation from the tab API can also generate full URLs --
with a different host -- and the way we do that was messing up
query parameters since query parameters are sent as a hash as the last
argument in `args` for the tab. (The other code path which renders the
tabs directly, e.g. in the account navigation, doesn't support a full
URL with a different host so doesn't have this issue)

This change could potentially affect other links generated by the tab
API, however it's highly unlikely we ever really wanted to pass in a hash
(which normally gets serialized as `key1=val1&key2=val2...`) to the rails
URL helper as anything but the last parameter. The other tabs which
could have an `args` that I found were:

1. Under account navigation,  `lti_apps_tabs` in
  `models/lti/message_handler.rb` can generate tabs with
  `args = {message_handler_id: app.id, resource_link_fragment: "nav"}`.
2. In a Course, `tab_configuration` can apparently come from
   the database so it could have something arbitrary.

I talked thru these cases with Weston and he thinks it's unlikely that
these would be negatively affected by this change.

Closes PLAT-4800

Test plan
- install an LTI tool with placement in the user navigation that uses
  `windowTarget` = `_blank`. The link in the user navigation should
  end with `?display=borderless`. (Note that it seems that we don't
  actually support a borderless launch from the user navigation -- when
  the link is clicked, it still has the canvas navigation)
- try to find some of the other cases that could possibly be affected
  by this change (?)

Change-Id: I27cc1a3da37c4d7e4da4fabefc38c222b3eaa73d
Reviewed-on: https://gerrit.instructure.com/212079
Reviewed-by: Weston Dransfield <wdransfield@instructure.com>
QA-Review: Weston Dransfield <wdransfield@instructure.com>
Tested-by: Jenkins
Product-Review: Jesse Poulos <jpoulos@instructure.com>
2019-10-04 18:07:00 +00:00
Steven Burnett 199dbb768e add index media_objects api route
fixes COREFE-329

Test Plan:
- hit api/v1/media_objects
- ensure it returns all media_objects you have created

Change-Id: If3ccd9622e0af7107900bc0f782902933873b031
Reviewed-on: https://gerrit.instructure.com/211758
Reviewed-by: James Williams <jamesw@instructure.com>
Tested-by: Jenkins
QA-Review: Steven Burnett <sburnett@instructure.com>
Product-Review: Steven Burnett <sburnett@instructure.com>
2019-10-04 14:16:35 +00:00
Mysti Lilla b9be84d5ea Return admins in content share search
closes ADMIN-2907
flag=direct_share

Test plan
- Search should only return users by their name
- Should be able to search for any kind of admin
  (sub-account, root account, whatever)
- Should be able to search for teacher, ta and
  designers
- Should not be able to search for users with only
  deleted accounts/account admin membership/courses/
  or enrollments
- Should return all base Account Admin roles and
  any AccountMembership role that has the
  manage content permission at any account level

Change-Id: Ib2cb672fc6a44bbf201ae3bf6ee2c98a7b160018
Reviewed-on: https://gerrit.instructure.com/210328
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
Tested-by: Jenkins
QA-Review: Jeremy Stanley <jeremy@instructure.com>
Product-Review: Mysti Lilla <mysti@instructure.com>
2019-10-03 22:05:33 +00:00
Gary Mei 2c5320334f optimize assignment groups controller
closes APG-47

When the include param includes "assignments", the controller
spends a lot of effort recalculating effective due dates for
submissions rather than using the cached due date on the submission.

Test Plan
- Specs pass.

Change-Id: I255d85f4ff5abcf3ef8d50707c5ba66372572f33
Reviewed-on: https://gerrit.instructure.com/210968
Tested-by: Jenkins
Reviewed-by: Jeremy Neander <jneander@instructure.com>
Reviewed-by: Adrian Packel <apackel@instructure.com>
Reviewed-by: Derek Bender <djbender@instructure.com>
QA-Review: Gary Mei <gmei@instructure.com>
Product-Review: Keith Garner <kgarner@instructure.com>
2019-10-01 15:24:20 +00:00
Landon Gilbert-Bland a98b61c2ee Have speedgrader display comments based on the attempt
This will only happen if the assignments_2_student feature flag is
enabled and it is an assignment that will be rendered by the new A2
student view.

Test Plan:
  - Enable the assignments_2_student feature flag
  - Create an online_upload assignment
  - As a student, submit the assignment multiple times. Leave a comment
    on each submission attempt
  - As a teacher, pull up speedgrader for that assignment and student
  - Select different submission attempts, and notice that the comments
    based on what attempt is being displayed.
  - Leave comments on different attempts, and notice that they are only
    displayed on the attempt that you left the comment for
  - Disable the assignments_2_student feature flag, and notice that all
    the comments from student and teacher are now displayed on every
    attempt

fixes COMMS-2404

flag = assignments_2_student

Change-Id: I06d4474c6189749226af11643e2676daff859734
Reviewed-on: https://gerrit.instructure.com/210419
Tested-by: Jenkins
QA-Review: Steven Burnett <sburnett@instructure.com>
Reviewed-by: Steven Burnett <sburnett@instructure.com>
Product-Review: Landon Gilbert-Bland <lbland@instructure.com>
2019-09-30 16:28:02 +00:00
Jon Willesen 01877f8cdd add content_export to content_shares api
closes ADMIN-2931
flag=direct_share

test plan:
- Perform CRUD operations on content shares. Results should include the
  content_export field with data about the associated content export.
- Generate API docs and see new field in the ContentShare type
  definition

Change-Id: I153f580b247af124bd00b0283b28bf01c6748928
Reviewed-on: https://gerrit.instructure.com/210255
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Jeremy Stanley <jeremy@instructure.com>
Tested-by: Jenkins
Product-Review: Jon Willesen <jonw+gerrit@instructure.com>
2019-09-20 22:18:52 +00:00
Jeremy Stanley 34f254b1d5 fix permissions around "Login ID" column in course roster
test plan:
 - a custom role with "Users - View login IDs" permission granted
   and without "add/remove students" or "add/remove teachers"
   should still see the login ID column in the course roster
   and it should be populated
 - a custom role without "Users - View login IDs" permission granted
   should not see the login ID column in the course roster
   even if they do have "add/remove students" or "add/remove teachers"

fixes ADMIN-2628

Change-Id: I876fbcd7cae705cf78c2b422fb365adc629235fc
Reviewed-on: https://gerrit.instructure.com/208837
QA-Review: Rex Fleischer <rfleischer@instructure.com>
Tested-by: Jenkins
Reviewed-by: Mysti Lilla <mysti@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
2019-09-19 15:31:34 +00:00
Landon Gilbert-Bland f09f271b5a Do not expose assignment description for locked assignment
Fixes COMMS-2455

Test Plan:
  - Make an assignment that is due in the future and unlocks in the
    future, and has a description
  - As a student, navigate to your calendar page
  - Open your network tab in your browser, and find the API request
    that pulls that assignment into your calendar. It should look
    something like /api/v1/calendar_events?type=assignments
  - Notice that the description for the assignment is not in the
    response for that API request
  - Modify the assignment so it now unlocks in the past
  - Make the API call again, and this time notice that the description
    for the assignment shows up in the API

Change-Id: I7500316f1835cf4a575077da80858136d5cd8112
Reviewed-on: https://gerrit.instructure.com/210004
QA-Review: Ben Nelson <bnelson@instructure.com>
Tested-by: Jenkins
Reviewed-by: Ryan Norton <rnorton@instructure.com>
Product-Review: Landon Gilbert-Bland <lbland@instructure.com>
2019-09-18 16:50:52 +00:00
Rex Fleischer 5563aa50d3 move usage_rights_required and course_catalog to account settings
fixes: ADMIN-2525
fixes: ADMIN-2531

Test-Plan:
ensure that the settings work the same as the flags did

Change-Id: If5dd8e1d1700357321592fa433bbdfe49c75c886
Reviewed-on: https://gerrit.instructure.com/205261
Tested-by: Jenkins
QA-Review: Anju Reddy <areddy@instructure.com>
Product-Review: Carl Kibler <ckibler@instructure.com>
Reviewed-by: Carl Kibler <ckibler@instructure.com>
2019-09-17 20:07:46 +00:00
Jeremy Stanley b6c96b76e9 remove broken include[]=external argument for list tabs
this parameter never worked, and making it work will hide
external tabs from people who don't expect them to be hidden

closes ADMIN-2867

Change-Id: I79851467fa09db89026ea2906331c3acf62e6e58
Reviewed-on: https://gerrit.instructure.com/208577
Tested-by: Jenkins
Reviewed-by: Mysti Lilla <mysti@instructure.com>
QA-Review: Anju Reddy <areddy@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
2019-09-11 19:56:26 +00:00
Derek Bender 15c8009064 Remove unused provisional_grade_id from url
Closes: GRADE-2066

test plan:
- no behavioral changes

Change-Id: Id70ad67ce4d56c8a2b9718f84c0844016bcd44c9
Reviewed-on: https://gerrit.instructure.com/206710
Tested-by: Jenkins
Reviewed-by: Gary Mei <gmei@instructure.com>
Reviewed-by: Adrian Packel <apackel@instructure.com>
QA-Review: Derek Bender <djbender@instructure.com>
Product-Review: Keith Garner <kgarner@instructure.com>
2019-09-10 15:46:59 +00:00
Keith T. Garner e0d26acb19 always expose submission.posted_at to the api
fixes GRADE-2416

test plan:
 - specs pass

Change-Id: I56536b659c23542e74e21493c0f099909880ee18
Reviewed-on: https://gerrit.instructure.com/208350
Tested-by: Jenkins
Reviewed-by: Derek Bender <djbender@instructure.com>
Reviewed-by: Jeremy Neander <jneander@instructure.com>
QA-Review: Keith Garner <kgarner@instructure.com>
Product-Review: Keith Garner <kgarner@instructure.com>
2019-09-06 13:55:00 +00:00
Jeremy Stanley 6639056155 fix assignment override caching issue
test plan:
 - set up and enable redis caching
 - enable "new SIS integration settings" feature in account
 - turn on "require assignment due date" in account settings
 - create an assignment with overrides for multiple sections
   and "sync to SIS" checked
 - save the assignment
 - the list of overrides should not be blank

fixes ADMIN-2854

flag=none

Change-Id: Ida6cb4b1fbb52a104f274e5b829bf074634921cf
Reviewed-on: https://gerrit.instructure.com/208080
Reviewed-by: James Williams <jamesw@instructure.com>
Tested-by: Jenkins
QA-Review: Anju Reddy <areddy@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
2019-09-05 22:08:55 +00:00
Marc Phillips fef16a4151 Add email to user_json in users api for lti 2
closes PLAT-4782

Test Plan:
 - note that a call to the users api for an lti tool will
   add the users email

Change-Id: I31cbdebdd1c066241bd5d78b298815428b1f35b7
Reviewed-on: https://gerrit.instructure.com/207958
Tested-by: Jenkins
Reviewed-by: Weston Dransfield <wdransfield@instructure.com>
QA-Review: Tucker Mcknight <tmcknight@instructure.com>
Product-Review: Marc Phillips <mphillips@instructure.com>
2019-09-04 19:27:38 +00:00
Jeremy Stanley d4f8f5e14e content share index/show/delete/add_users endpoints
test plan:
 - render API docs
 - test API endpoints to
   * list sent content shares
     - includes type of item shared
     - admins can list other users' shares
     - avoids N+1 query
   * list received content shares
     - should not show other users who have received the same share
     - also avoids N+1 query
   * show a single content share
     - admins can see another user's share
     - scoped to the user in the path (/users/X/content_shares/Y
       404s if share Y does not belong to user X)
   * delete a content share
     - only the owner of the share can do this; user X cannot delete
       /users/Y/content_shares/...
   * add users to a content share
     - only the owner of the share can do this
     - returns 400 if you try to add yourself
     - silently ignores if you try to add someone who has already
       received the share
     - returns 400 if you try to add users to a content share
       that somebody else created and shared with you
   * change read state of a content share
     - only works with your own content share
     - rejects invalid read state

closes ADMIN-2810

flag=direct_share

Change-Id: I014f23c2aff1ba5a655e47148c8c859cfcd75d03
Reviewed-on: https://gerrit.instructure.com/205672
Tested-by: Jenkins
Reviewed-by: Mysti Lilla <mysti@instructure.com>
QA-Review: Carl Kibler <ckibler@instructure.com>
Product-Review: Carl Kibler <ckibler@instructure.com>
2019-08-30 18:05:31 +00:00
Mysti Lilla 6d9e4516b1 Add create content share API
closes ADMIN-2809
flag=direct_share

Test plan
- Ensure you can create a content export
  and share content between users
- Users cannot create shares for other
  users or share content they do
  not have access to

Change-Id: Ic3c748ad800f85eddd24ac6f0995a363619eed2b
Reviewed-on: https://gerrit.instructure.com/204338
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
Tested-by: Jenkins
QA-Review: Jeremy Stanley <jeremy@instructure.com>
Product-Review: Mysti Lilla <mysti@instructure.com>
2019-08-22 19:10:27 +00:00
Ryan Shaw 6c3bde3a9a refactor media_object_iframe for less flaky tests
Changes:
* refactor tests to be less brittle
* better code reuse
* make sure we mark the media_object as viewed if they load the iframe


Test plan:
* the /media_objects_iframe/blahblah endpoint should work exactly
  as it did before

Change-Id: I632b5b6f21cbb1536a02764de59227558c26e9c9
Reviewed-on: https://gerrit.instructure.com/206204
Tested-by: Jenkins
Reviewed-by: Steven Burnett <sburnett@instructure.com>
QA-Review: Steven Burnett <sburnett@instructure.com>
Product-Review: Ryan Shaw <ryan@instructure.com>
2019-08-22 03:55:45 +00:00
Rob Orton a4b4a14640 api: add ability to set grade_passback_setting
fixes CORE-3216

test plan
 - in api set grade_passback_setting on course

Change-Id: Ief381fae7b81e2eb6db096adcebfcf999e987b3f
Reviewed-on: https://gerrit.instructure.com/205916
Reviewed-by: James Williams <jamesw@instructure.com>
QA-Review: James Williams <jamesw@instructure.com>
Product-Review: James Williams <jamesw@instructure.com>
Tested-by: Jenkins
2019-08-21 21:40:07 +00:00
wdransfield a63c1f0468 Create default tool assignment from "quick create"
Closes PLAT-4695

Test Plan:
- Create a a default tool assignment from the
  quick create modal in the assignment index page
- Edit the new assignment
- Verify you can select content from the default
  tool as the default
- Verify you can save and launch the assignment
- Verify you can create non-default external
  tool assignments as before
- Verify you can create non-default and default
  external tool assignments withouth the "quick
  create" modal

Change-Id: I94578f99c3d200e3dac57a13a7d5f7157413618b
Reviewed-on: https://gerrit.instructure.com/204847
Tested-by: Jenkins
Reviewed-by: Clint Furse <cfurse@instructure.com>
Reviewed-by: Landon Gilbert-Bland <lbland@instructure.com>
QA-Review: Tucker Mcknight <tmcknight@instructure.com>
Product-Review: Jesse Poulos <jpoulos@instructure.com>
2019-08-20 21:58:49 +00:00