Commit Graph

5828 Commits

Author SHA1 Message Date
James Williams a3aa082831 bulk permission calculations for dashboard
test plan:
* regression test dashboard

closes #CORE-1733

Change-Id: I301e8670c9fccd1a2340adce01379f0c6d3b7c01
Reviewed-on: https://gerrit.instructure.com/161174
Reviewed-by: Cody Cutrer <cody@instructure.com>
Tested-by: Jenkins
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Jeremy Putnam <jeremyp@instructure.com>
Product-Review: James Williams  <jamesw@instructure.com>
2018-08-20 21:26:07 +00:00
Han Ngo 7704e5d6a5 Support User Placement for LTI 1.3 Launch
Closes PLAT-3636

Test Plan:
- Verify the LTI 1.3 Launch for `User Navigation` works

Change-Id: Idc1924269632f7d6e16f5c2e56d45d1fa47e27b0
Reviewed-on: https://gerrit.instructure.com/161216
Reviewed-by: Marc Alan Phillips <mphillips@instructure.com>
Tested-by: Jenkins
QA-Review: Weston Dransfield <wdransfield@instructure.com>
Product-Review: Weston Dransfield <wdransfield@instructure.com>
2018-08-20 19:15:59 +00:00
Jeremy Neander c03ea6647b add bulk selection for provisional grades
closes GRADE-1480

test plan:
 A. Setup
    1. Create a published course
    2. Enroll one teacher
    3. Enroll two TAs
    4. Enroll three students
    5. Create a moderated assignment
       * with Teacher as final grader

    6. As the first TA:
       a. Visit SpeedGrader for the assignment
       b. Grade Student 1
       c. Grade Student 2

    7. As the second TA:
       a. Visit SpeedGrader for the assignment
       b. Grade Student 2
       c. Grade Student 3

    8. Open the Rails console
    9. Note these attributes of the provisional grades:
       * `id` (provisional grade id)
       * `user_id` (student id)
       * `scorer_id` (grader id)

       assignment = Assignment.find(:id)
       assignment.pluck(:id, :user_id, :scorer_id)

 B. Verification without Anonymity
    * To test bulk selection, send a PUT request to:

       /api/v1/courses/:course_id/assignments/:assignment_id/
         ↪ provisional_grades/bulk_select

       * Use a session for the final grader
       * Include in the request body an object as follows:
         {provisional_grade_ids: […]}
       * The array will contain some of the provisional grade ids
         noted from the Rails console
       * The response will include an array of objects as follows:

         {
           "assignment_id": "1",
           "selected_provisional_grade_id": "2",
           "student_id": "3"
         }

    * To verify grade selection:
       a. Log in or act as the Teacher
       b. Visit the moderation page for the assignment
       c. Verify the intended grades have been selected
    * Each of the following steps will be done in sequence without
      resetting anything to a prior state

    1. Bulk select the following grades:
       * TA-1's grade for Student 1
       * TA-2's grade for Student 2
    2. Verify the JSON includes the following grades:
       * TA-1's grade for Student 1
       * TA-2's grade for Student 2
    3. Verify the following grades are selected:
       * TA-1's grade for Student 1
       * TA-2's grade for Student 2

    4. Bulk select the following grades:
       * TA-1's grade for Student 2
       * TA-2's grade for Student 3
    5. Verify the JSON includes the following grades:
       * TA-1's grade for Student 2
       * TA-2's grade for Student 3
    6. Verify the following grades are selected:
       * TA-1's grade for Student 1
       * TA-1's grade for Student 2
       * TA-2's grade for Student 3

    7. Bulk select the following grades (listed in this order):
       * TA-1's grade for Student 1
       * TA-2's grade for Student 3
       * TA-1's grade for Student 3
    8. Verify the JSON includes the following grades:
       * TA-1's grade for Student 3
    9. Verify the following grades are selected:
       * TA-1's grade for Student 1
       * TA-1's grade for Student 2
       * TA-1's grade for Student 3

 B. Verification with Anonymity
    1. Enable anonymous grading for the assignment
    2. Bulk select the following grades:
       * TA-2's grade for Student 2
       * TA-2's grade for Student 3
    3. Verify the JSON includes "anonymous_id"
    4. Verify the JSON excludes "student_id"

e1d4b3ee4d

Change-Id: I51190808a9dfd321c6110f50d6d0e4661fa86c1c
Reviewed-on: https://gerrit.instructure.com/161215
Reviewed-by: Adrian Packel <apackel@instructure.com>
Tested-by: Jenkins
Reviewed-by: Gary Mei <gmei@instructure.com>
QA-Review: James Butters <jbutters@instructure.com>
Product-Review: Keith T. Garner <kgarner@instructure.com>
2018-08-20 18:29:13 +00:00
James Williams 41e901b7a1 allow imported sis csvs to be downloaded
after filtering out passwords of course

test plan:
* with the sis imports refactor feature flag on,
 upload some zips and csvs to sis imports,
 including some users.csv files with passwords
* view the sis imports API index and show
 endpoints
* should be able to use the urls in the new
 "csv_attachments" attribute to download versions
 of the imported files without passwords

closes #CORE-1655

Change-Id: I31e34d42f4abf2597efd6066dabea6f230632855
Reviewed-on: https://gerrit.instructure.com/158899
Tested-by: Jenkins
QA-Review: Jeremy Putnam <jeremyp@instructure.com>
Reviewed-by: Rob Orton <rob@instructure.com>
Product-Review: Rob Orton <rob@instructure.com>
2018-08-18 03:02:29 +00:00
wdransfield b9a51f6550 Allow assignment expansions for LTI2 tools in assignment launches
Fixes PLAT-3673

Test Plan
- Install an LTI 2 tool with the new
  com.instructure.Assignment.anonymous_grading capability
  enabled
- Associate the tool with an assignment with anonymous
  grading on
- Verify the parameter is sent in the launch message

Change-Id: I83b244b5c3aa9e86b9ac3786fad07e8e2847cd2b
Reviewed-on: https://gerrit.instructure.com/161133
Reviewed-by: Marc Alan Phillips <mphillips@instructure.com>
Tested-by: Jenkins
QA-Review: August Thornton <august@instructure.com>
Product-Review: Weston Dransfield <wdransfield@instructure.com>
2018-08-17 21:07:38 +00:00
Matthew Berns c3d8cf0431 fix outcomes not adding to course with bank
fixes OUT-2281

test plan:
- create two account level outcomes
- create an account level bank with at least
  one question
- attach the new outcomes to the bank
- create or edit a quiz in a course
- go to "Find Questions" and add the question(s)
  from the account level bank
- ensure the account level outcomes from the
  bank now appear in the course's Outcomes page

Change-Id: I64278f5ee4d17eabca2bc40d6c3d4f84ae9b144b
Reviewed-on: https://gerrit.instructure.com/160565
Reviewed-by: Neil Gupta <ngupta@instructure.com>
Reviewed-by: Frank Murphy <fmurphy@instructure.com>
Tested-by: Jenkins
QA-Review: Dariusz Dzien <ddzien@instructure.com>
Product-Review: Sidharth Oberoi <soberoi@instructure.com>
2018-08-17 18:01:56 +00:00
Marc Phillips a66493c16d Refactor Oauth2 Provier controller into GrantTypes
To make adding additional grant_types easier and cleaner in the
future, refactor the existing Oauth2_provider_controller to
push the token generation to grant type objects.

refs PLAT-3659

Test plan:
 - Run through the oauth 2 flow for both grant types
 - Everything should still work

Change-Id: Ic5fe4a4cc39231620003977c33350f4d98879b0f
Reviewed-on: https://gerrit.instructure.com/160484
Tested-by: Jenkins
Reviewed-by: Weston Dransfield <wdransfield@instructure.com>
Reviewed-by: Nathan Mills <nathanm@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Product-Review: Marc Alan Phillips <mphillips@instructure.com>
2018-08-16 21:53:25 +00:00
wdransfield 03fa56b270 Allow resubmitting to plagiarism platform for anonymous grading
Closes PLAT-3647

Test Plan:
- Enable  the 'Anonymous Grading' FF in your root
  account
- Create an assignment with a plagiarism detection tool.
  Be sure to select the 'Graders cannot view student names'
  option when creating the assignment.
- As a student submit to the assignment.
- Create a pending originality report for the submission.
- In speedgrader click the "resubmit to <tool name>" button.
- Verify the page refreshes and a `plagiarism_resubmit` live
  event was emitted.

Change-Id: Ib633b0d2b9807d2c963ecdba00048d4cfb0392a7
Reviewed-on: https://gerrit.instructure.com/160767
Tested-by: Jenkins
Reviewed-by: Nathan Mills <nathanm@instructure.com>
Reviewed-by: Han Ngo <hngo@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Product-Review: Weston Dransfield <wdransfield@instructure.com>
2018-08-16 20:27:01 +00:00
Jeremy Stanley 91820598a9 move PlannerController#index onto slave
refs ADMIN-1342

Change-Id: Icba9567614865df2e4e3a9b2e19c6053eccb0526
Reviewed-on: https://gerrit.instructure.com/160968
Tested-by: Jenkins
Reviewed-by: Dan Minkevitch <dan@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
2018-08-16 15:44:33 +00:00
James Williams b639254de0 sort users not logged in last when sorting by last login
test plan:
* on the account user search page, when searching by
 login descending, it should put users without any
 login time last

closes #CORE-1688

Change-Id: I2c13c52d6ada64c31865944f4a1bb32ebc2625ad
Reviewed-on: https://gerrit.instructure.com/159807
Tested-by: Jenkins
QA-Review: Jeremy Putnam <jeremyp@instructure.com>
Reviewed-by: Rob Orton <rob@instructure.com>
Product-Review: Rob Orton <rob@instructure.com>
2018-08-16 14:52:42 +00:00
James Williams 945013200e preload some more things
for planner and calendar events api

also apparently the except(:preload) makes it so
the inverse association for course on enrollments isn't set

Change-Id: Id490aa6b76c7c0b283a6c4a8be13ef2e5d4d9707
Reviewed-on: https://gerrit.instructure.com/160897
Tested-by: Jenkins
Reviewed-by: Mysti Sadler <mysti@instructure.com>
Product-Review: James Williams  <jamesw@instructure.com>
QA-Review: James Williams  <jamesw@instructure.com>
2018-08-16 14:50:22 +00:00
Rob Orton 685dfb287f add option to only un_conclude from sis import
Change-Id: Id248fd99fc377cd658275dcf3662c2f95850cd6d
Reviewed-on: https://gerrit.instructure.com/160872
Reviewed-by: James Williams  <jamesw@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
Tested-by: Jenkins
Product-Review: Rob Orton <rob@instructure.com>
QA-Review: Rob Orton <rob@instructure.com>
2018-08-15 23:58:34 +00:00
Spencer Olson b766794156 add slot_taken to moderation_graders
closes GRADE-1426

Test Plan:
1. Before running migrations, make sure you have some moderation_grader
   records.
2. Run migrations. Verify 1) the moderation_graders table now has a
   slot_taken column, and 2) the existing moderation_grader records have
   slot_taken set to true.
3. Create a moderated assignment, then log in as a provisional grader.
4. Verify there are no moderation_grader records for the provisional
   grader for that assignment.

   assignment.moderation_graders.find_by(user: provisional_grader)
   => nil

5. Visit SpeedGrader, but don't grade or comment. Verify a moderation
   grader record has been created for the provisional grader, and verify
   it has slot_taken set to false.

   grader =
   	assignment.moderation_graders.find_by(user: provisional_grader)
   grader.slot_taken?
   => false

6. Leave a submission comment or a grade in SpeedGrader. Verify the
   moderation grader record for the provisional grader has been updated
   with slot_taken set to true.

   grader.reload.slot_taken?
   => true

7. Verify you can roll the migration back. The slot_taken column should
   be removed.

Change-Id: I94fafc259df5022ed1af27d3457d8df87947153e
Reviewed-on: https://gerrit.instructure.com/159544
Reviewed-by: Jeremy Neander <jneander@instructure.com>
Reviewed-by: Keith T. Garner <kgarner@instructure.com>
Reviewed-by: Cody Cutrer <cody@instructure.com>
Tested-by: Jenkins
QA-Review: Jeremy Neander <jneander@instructure.com>
Product-Review: Keith T. Garner <kgarner@instructure.com>
2018-08-15 20:01:19 +00:00
Simon Williams 43bd1e018a sign pandata_events JWT with ES512
closes CNVS-43231

test plan: tokens generated by canvas can still be decoded by
pandata_events

Change-Id: I99379b7330719b5e98dddc84a8f06974311b9062
Reviewed-on: https://gerrit.instructure.com/159603
Reviewed-by: Addison Higham <ahigham@instructure.com>
Reviewed-by: Brad Horrocks <bhorrocks@instructure.com>
Tested-by: Jenkins
Product-Review: Simon Williams <simon@instructure.com>
QA-Review: Simon Williams <simon@instructure.com>
2018-08-15 19:38:21 +00:00
Mysti Sadler 6f7062a96e Standardize where planner overrides live
closes ADMIN-143

Test plan
- Have a graded quiz, discussion and wiki page
- Try to create planner overrides for the
  assignments for all of them
- Ensure the planner override gets created for
  the quiz/discussion/wiki page instead
- Have a group discussion
- Try to create a planner override for one of
  the child topics
- Ensure the planner override gets created for
  the parent topic
- Have an announcement and create a planner
  override for it
- Make an api call for the override and ensure
  it shows up as "announcement" in the type
  instead of discussion_topic

Change-Id: I7940f27508453cdc03366eda10d59e5ca1fbf110
Reviewed-on: https://gerrit.instructure.com/156904
Tested-by: Jenkins
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Anju Reddy <areddy@instructure.com>
Product-Review: Mysti Sadler <mysti@instructure.com>
2018-08-15 19:06:34 +00:00
James Williams 3baca02aaa activate slave around uses of Course#module_items_visible_to
since the method itself just returns a scope

Change-Id: Ifefa2581fce0c7b5669c4c6ed05fa8529d285eb4
Reviewed-on: https://gerrit.instructure.com/160877
Reviewed-by: Cody Cutrer <cody@instructure.com>
Tested-by: Jenkins
Product-Review: James Williams  <jamesw@instructure.com>
QA-Review: James Williams  <jamesw@instructure.com>
2018-08-15 17:07:43 +00:00
Jeremy Stanley 1b06e3f941 drop unused last_[un]lock_at columns
from folders and attachments. these are set but never looked at

refs ADMIN-1329

Change-Id: Icfe1bf07c1a6ab62cf2354be59e4a8d7b686ef5d
Reviewed-on: https://gerrit.instructure.com/160621
Reviewed-by: Cody Cutrer <cody@instructure.com>
Tested-by: Jenkins
Product-Review: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Jeremy Stanley <jeremy@instructure.com>
2018-08-14 22:42:49 +00:00
Jeremy Stanley 33e82b00c9 blueprint courses: add subscriptions_index
this endpoint allows a teacher to retrieve the blueprint course that
their course is subscribed to, if any

test plan:
 - render API docs
 - use "List blueprint subscriptions" to retrieve subscription information
   for an associated course. ensure:
   - an array containing one element is returned when the course
     is associated with a blueprint
   - an empty array is returned otherwise
   - an unauthorized error is returned if a user without manage rights
     on the course attempts the API call

closes ADMIN-1323

Change-Id: I297bd136fd6b5fc4645d1794d162f2c0b1c4a6e8
Reviewed-on: https://gerrit.instructure.com/159521
Tested-by: Jenkins
Reviewed-by: Dan Minkevitch <dan@instructure.com>
QA-Review: Anju Reddy <areddy@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
2018-08-13 21:37:55 +00:00
Ed Schiebel e7cd35e560 Manage accounts/id/users page kabob menu
If the user doesn't have permission to access the page linked to off the
kabob menu items, hide the menu item.  If the user doesn't have
permission for either item, supress the menu.

closes ADMIN-1222

test plan:
  - as site admin go to /accounts/1/permissions Account Roles tab
  - create a new role with just "See the list of users" enabled
  - go to /accounts/1/settings Admins tab
  - create a new account admin in the role you just created
  - log in as that new account admin
  - go to /accounts/1/users
  > expect no kabob menu after the +People button
  - log in as your site admin
  - return to /accounts/1/permissions page, account roles tab
  - add 'Manage (create / edit / delete) groups'  to the new role
  - log in as the account admin
  - go to /accounts/1/users
  > expect the kabob menu to include "View user groups"
  - have site admin go to /accounts/1/permisions Account Roles tab
  - enable "Add/remove other teachers, course designers or TAs to the
    course" to the new admin role
  - have account admin return to the accounts/1/users page
  > expect the kabob menu to include "manage profile pictures"

    NOTE: I don't know how permissions are cached, but once I was able
          to see new permissions by logging into a new private browsing
          window, and once I had to restart my rails server

Change-Id: Ib8403c35f40993d29c8c4c940c813cf743b793e1
Reviewed-on: https://gerrit.instructure.com/159987
Tested-by: Jenkins
Reviewed-by: Dan Minkevitch <dan@instructure.com>
QA-Review: Deepeeca Soundarrajan <dsoundarrajan@instructure.com>
Product-Review: Ed Schiebel <eschiebel@instructure.com>
2018-08-13 18:10:45 +00:00
Jeremy Stanley 0492a553fb return unpublished / cross-shard todo items
test plan:
 - have a user that is a teacher in one course and a student in
   another
 - have wiki pages and ungraded discussions with todo dates in both
 - ensure that the user sees published and unpublished items
   in the courses she teaches, and only published ones in
   the other one
 - also ensure todo items in a course in another shard show up
   if selected as a context in the calendar

fixes ADMIN-1310

Change-Id: Idc1267746015990d32f11ef341bbdbd58e87e656
Reviewed-on: https://gerrit.instructure.com/159718
Reviewed-by: Mysti Sadler <mysti@instructure.com>
Tested-by: Jenkins
QA-Review: Anju Reddy <areddy@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
2018-08-13 15:56:39 +00:00
Ryan Kuang 83bddc402c Add API for bulk uploading custom columns
When updating custom columns in database,
we can use the API for efficient bulk uploads

closes GRADE-1350

Test Plan
    - Send a PUT request to
      /api/v1/courses/:id/custom_gradebook_column_data
    - The request body should have
      an array of objects with attributes column_id, user_id, and content
    - An example below
      {column_data:
        [column_id: string, user_id: string, content: string]
      }
    - Make sure the auth token in Postman is configured properly
      (bearer token)
    - Send the request
    - Check to see if the data appears in the gradebook

Change-Id: I90e747d5d92478b1e3dd101e4f254dfd392486ed
Reviewed-on: https://gerrit.instructure.com/156647
Reviewed-by: Spencer Olson <solson@instructure.com>
Reviewed-by: Keith T. Garner <kgarner@instructure.com>
QA-Review: Adrian Packel <apackel@instructure.com>
Tested-by: Jenkins
Product-Review: Keith T. Garner <kgarner@instructure.com>
2018-08-09 22:04:07 +00:00
Nate Armstrong 4c3d0fc3be Allow sub account admins to generate pairing codes
Refs MBL-10998

Test plan:
* Create a sub account
* Add an admin to the sub account
* Create a course for the sub account
* Enroll a student in the course
* Verify that you can generate pairing codes as the admin in the sub
account

Change-Id: I7a67fc6c5c9335bbd7cd8716720b66bf9fe31f42
Reviewed-on: https://gerrit.instructure.com/160286
Tested-by: Jenkins
Reviewed-by: Matthew Sessions <msessions@instructure.com>
Reviewed-by: Simon Williams <simon@instructure.com>
Product-Review: Matthew Sessions <msessions@instructure.com>
QA-Review: Matthew Sessions <msessions@instructure.com>
2018-08-09 21:33:57 +00:00
James Williams 360c1c6d3a strip hosts and verifiers from links in quiz content
test plan:
* try to include an absolute link to a file with a verifier
 in a quiz description or quiz question text
* view the content as a student
* it should have stripped the domain and verifier
 from the link

closes #CORE-1377 #CORE-1666

Change-Id: I16390003ba482f42bb49362f1d99838c8674ae27
Reviewed-on: https://gerrit.instructure.com/159596
Tested-by: Jenkins
Reviewed-by: Clay Diffrient <cdiffrient@instructure.com>
QA-Review: Tucker McKnight <tmcknight@instructure.com>
Product-Review: James Williams  <jamesw@instructure.com>
2018-08-09 12:29:18 +00:00
Adrian Packel 01e2f8d5f1 Keep section synced between SG/new gradebook
When new gradebook is enabled and the user restricts the display to a
specific section, have the selected section carry over to SpeedGrader,
and similarly in the other direction. (If a section is changed in
SpeedGrader, the change will propagate to both old and new gradebooks;
if different selections are selected in OG and NG, SpeedGrader itself
will choose depending on whether new gradebook is enabled.)

fixes GRADE-989

Test plan:
- Have a course with multiple sections and new gradebook enabled
  - At least one section should be empty (i.e., contain no students)
- Test the following:
  - When you change the selected section in new gradebook and then
    open SpeedGrader, the new section should be shown
  - Similarly, section changes in SG should be persisted in NG
  - Selecting the empty section in SG (or selecting it in NG and then
    opening SG) should display an alert indicating no students could be
    found, and reload showing all students
  - Revert to old Gradebook and check that syncing sections still works
    between SG and OG

(Note that selecting a section in new gradebook will *not* directly
update the selected section in old gradebook, and vice versa. Changing
sections in SpeedGrader, however, will update both gradebooks.)

Change-Id: I42b4558f40f3208a93bd00fd6a2224d0f954c96e
Reviewed-on: https://gerrit.instructure.com/159356
Reviewed-by: Spencer Olson <solson@instructure.com>
Reviewed-by: Gary Mei <gmei@instructure.com>
Reviewed-by: Derek Bender <djbender@instructure.com>
QA-Review: Gary Mei <gmei@instructure.com>
Tested-by: Jenkins
Product-Review: Sidharth Oberoi <soberoi@instructure.com>
2018-08-08 22:16:17 +00:00
James Williams 6ee5809bc8 Add new permission for creating discussions
Test plan
- Create a course with at least one teacher and apply a closed term
- As the teacher, check that you do not have a create discussion
  button
- go to courses/{course_id}/discussion_topics/new
- Verify that if you try to create a discussion, it returns an appropriate
  error message
- Create a discussion in a group to make sure the restriction only
  applies to courses
- Create a course end date that is active and overrides the term date
- Check that discussions can be created in this context

and don't grant it to concluded teachers
(unlike post_to_forum)

Change-Id: I5f16d535652e52917e2b5f2038b0a78f015cc688
Reviewed-on: https://gerrit.instructure.com/159732
Tested-by: Jenkins
Reviewed-by: Steven Burnett <sburnett@instructure.com>
QA-Review: KC Naegle <knaegle@instructure.com>
Product-Review: Steven Burnett <sburnett@instructure.com>
2018-08-08 19:03:36 +00:00
Rob Orton c1e2d47712 api: return a progress for sis restore states
fixes CORE-1670

this endpoint would time out as it would try and
restore all the states before returning the api
response

test plan
 - delete a large set of users that had
   enrollments with a sis import
 - hit the sis import api to restore the states
 - it should not time out
 - it should return a progress
 - it should restore the states

Change-Id: I245e8c2f2914a77ff32abb2f1151abadc23ba17d
Reviewed-on: https://gerrit.instructure.com/159577
Tested-by: Jenkins
Reviewed-by: James Williams  <jamesw@instructure.com>
QA-Review: Rohan Cheeniyil <rcheeniyil@instructure.com>
Product-Review: Rob Orton <rob@instructure.com>
2018-08-08 16:57:51 +00:00
wdransfield 0f14bf4d93 Add LTI 1.3 Launch Path
Closes PLAT-3629

Test Plan:
- Install an LTI 1 tool in a course
- Modify the tool via the Rails console:
  `tool.settings['use_1_3'] = true; tool.save!`
- Add the tool to a module item
- Launch the tool and verify a JWT is sent as the 'id_token'
- Verify the JWT contains all required LTI 1.3 claims (minus
  security claims).
- Verify all claim data is accurate
- Verify the JWT contains all extensions Canvas sends
  from the same placement in LTI 1.1
- Verify custom variables are sent and expanded
- Create an External Tool assignment with the same tool
- View the assignment and verify a JWT is sent as the
  'id_token'
- Verify the JWT contains all required LTI 1.3 claims (minus
  the security claims).
- Verify the JWT contains all extension Canvas sends in LTI 1
  (ext_ LTI 1 params) as extension claims.

Note: For now the id_token is signed with a placeholder secret.

Change-Id: I7df3d150055bb30010bb509e4d40dde82a406631
Reviewed-on: https://gerrit.instructure.com/158907
Tested-by: Jenkins
Reviewed-by: Marc Alan Phillips <mphillips@instructure.com>
Product-Review: Marc Alan Phillips <mphillips@instructure.com>
QA-Review: Marc Alan Phillips <mphillips@instructure.com>
2018-08-08 16:43:58 +00:00
Cody Cutrer 2c185786b9 rails 5.2: Arel.sql
Change-Id: I6cf138e9ccc67a1a5ef6dbfb3061cda0fc93eedb
Reviewed-on: https://gerrit.instructure.com/159902
Tested-by: Jenkins
Reviewed-by: James Williams  <jamesw@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
2018-08-08 16:34:08 +00:00
James Williams 425d117230 fix api pagination url on course_accounts endpoint
closes #ADMIN-1311

Change-Id: Ic58cc484de45698d30f3aad29b62211bf8e9b0f0
Reviewed-on: https://gerrit.instructure.com/159982
Tested-by: Jenkins
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
Product-Review: James Williams  <jamesw@instructure.com>
QA-Review: James Williams  <jamesw@instructure.com>
2018-08-08 15:35:58 +00:00
Cody Cutrer d39c0b6fd2 moar preloads
found by API specs

refs CORE-1541

Change-Id: I6a4cf04a121a5cd41673561fc57f0f55e5001440
Reviewed-on: https://gerrit.instructure.com/159903
Tested-by: Jenkins
Reviewed-by: Rob Orton <rob@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
2018-08-08 05:22:30 +00:00
Nate Armstrong 569a687628 Add an endpoint for account help links
Refs MBL-10965

Test plan:
* As an admin, teacher, and student hit `api/v1/accounts/self/help_links`
* You should get default and custom help links

Change-Id: I291e64d4bedad4c45c2ba11dd09210d25479ac07
Reviewed-on: https://gerrit.instructure.com/159607
Tested-by: Jenkins
Reviewed-by: Matthew Sessions <msessions@instructure.com>
Product-Review: Matthew Sessions <msessions@instructure.com>
QA-Review: Matthew Sessions <msessions@instructure.com>
2018-08-07 19:20:58 +00:00
Jeremy Stanley e034a1ad1d don't show deleted todo items on teacher calendar
test plan:
 - pages and ungraded discussions with todo items should no
   longer appear on a teacher's calendar after they are deleted
 - unpublished pages and graded discussions don't appear either
   (for now)

fixes ADMIN-1307

Change-Id: I957442375c73f22ed5058a3fca39860305c215b4
Reviewed-on: https://gerrit.instructure.com/159686
Reviewed-by: Mysti Sadler <mysti@instructure.com>
Tested-by: Jenkins
QA-Review: Carl Kibler <ckibler@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
2018-08-07 15:35:28 +00:00
Cody Cutrer 9d9dbbd439 protect against SAML responses
so badly whacked that we can't even log what's wrong with them

Change-Id: I31740b8498d6bba214dc8305d098fc2d0e133eb8
Reviewed-on: https://gerrit.instructure.com/159828
Tested-by: Jenkins
Reviewed-by: Rob Orton <rob@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
2018-08-07 15:20:24 +00:00
KC Naegle ac06c769d9 Revert "Stop teachers from creating discussions after term ends"
This reverts commit 21d795b565.

Change-Id: Ib16abf69ce0eb4c9dc913a4c26c93a570195aa3e
Reviewed-on: https://gerrit.instructure.com/159844
Reviewed-by: Landon Gilbert-Bland <lbland@instructure.com>
Product-Review: KC Naegle <knaegle@instructure.com>
QA-Review: KC Naegle <knaegle@instructure.com>
Tested-by: Jenkins
2018-08-06 22:35:35 +00:00
KC Naegle bd98940111 Revert "Allow adding a discussion if course, term or section is open"
This reverts commit dc6b1d29c5.

Change-Id: Ib983efc29c3b4db1531002d109e3889879d52640
Reviewed-on: https://gerrit.instructure.com/159840
Reviewed-by: Landon Gilbert-Bland <lbland@instructure.com>
Product-Review: KC Naegle <knaegle@instructure.com>
QA-Review: KC Naegle <knaegle@instructure.com>
Tested-by: Jenkins
2018-08-06 22:06:44 +00:00
Derek Bender 1fd3045c20 add sis id to course users api for admins
test plan:
- as an account admin
- /api/v1/courses/:id/users now includes `sis_user_id`
- as any user that doesn't have read_sis/manage_sis credentials,
  sis_user_id is not present

Change-Id: I91c0cba69600ddf589682c43c4bfee4b382b9c6f
Reviewed-on: https://gerrit.instructure.com/158850
Reviewed-by: Keith T. Garner <kgarner@instructure.com>
Tested-by: Jenkins
Reviewed-by: Spencer Olson <solson@instructure.com>
QA-Review: Derek Bender <djbender@instructure.com>
Product-Review: Keith T. Garner <kgarner@instructure.com>
2018-08-06 21:06:03 +00:00
KC Naegle dc6b1d29c5 Allow adding a discussion if course, term or section is open
Fixes: COMMS-1362

Test plan:
- Create a closed term
- Create a course with an end date in the future and the term is the created term
- Create a group
- Add a teacher to the course
- As the teacher, on the discussions index page check that you do have a create discussion
  button
- As the tacher, on the group discussion index page check that you do have a create discussion button

- Create a section in the course and add a future end date to the section
	- On the section page click the section name then the Edit Section button
- Change the course end date to be in the past
- As the teacher, on the discussions index page check that you do have a create discussion
  button
- As the tacher on, the group discussion index page check that you do have a create discussion button

Change-Id: I66a1719fe518893d7f6d415c7730cc8c8e4a23cf
Reviewed-on: https://gerrit.instructure.com/159719
Tested-by: Jenkins
QA-Review: Gentry Beckmann <gbeckmann@instructure.com>
Reviewed-by: Gentry Beckmann <gbeckmann@instructure.com>
Reviewed-by: Steven Burnett <sburnett@instructure.com>
Product-Review: KC Naegle <knaegle@instructure.com>
2018-08-05 21:04:39 +00:00
Cameron Matheson 4ca9f8305c record basic metrics on all graphql queries
closes RECNVS-545

Test plan:
  * post some graphql queries using graphiql or the command-line:
    * some metrics should be recorded (but NOT operation name or query
      md5)
  * load student context cards in canvas
    * all graphql metrics should be recorded

Change-Id: Ia639e5cbe815873ae5b68998af51f68bdc2fd8ab
Reviewed-on: https://gerrit.instructure.com/159651
Tested-by: Jenkins
Reviewed-by: Jonathan Featherstone <jfeatherstone@instructure.com>
QA-Review: Jonathan Featherstone <jfeatherstone@instructure.com>
Product-Review: Cameron Matheson <cameron@instructure.com>
2018-08-03 21:18:29 +00:00
Simon Williams 11cd1cf7cb allow graphiql for all users + global graphql timeout
1. any user can already make graphql queries, so we might as well show
   them the graphiql browser as well.

2. provide a global graphql timeout so we have an upper bound on app cpu
   runtime of a query that isn't expensive for the database but is
   expensive for the app server.

test plan:
- <canvas>/graphiql should work when logged in as a student/teacher
- student context cards should still work, even with expensive analytics
  queries

Change-Id: Ibc66178d67255efa8db63670ba481fe660d129f3
Reviewed-on: https://gerrit.instructure.com/158379
Reviewed-by: Cameron Matheson <cameron@instructure.com>
Tested-by: Jenkins
Product-Review: Cameron Matheson <cameron@instructure.com>
QA-Review: Cameron Matheson <cameron@instructure.com>
2018-08-03 19:31:56 +00:00
Jon Willesen d0935a8535 fix accessing external url module items
fixes ADMIN-1294

test plan:
- add an external URL to a module
- add an assignment to a module
- add a graded discussion to a module
- add a discussion to a module without a todo date
- add an ungraded discussion with a todo date to a module
- ditto for pages
- with all those items, the modules page should load successfully
without error.

Change-Id: Ib1bda6bad105bab8173c0701d331f7779500ff2b
Reviewed-on: https://gerrit.instructure.com/159348
Tested-by: Jenkins
Reviewed-by: Dan Minkevitch <dan@instructure.com>
QA-Review: Luke Kingsley <lkingsley@instructure.com>
Product-Review: Jon Willesen <jonw+gerrit@instructure.com>
2018-08-03 17:03:40 +00:00
Cody Cutrer 4299298526 fix several N+1 found by Bullet
in spec/controllers/*

refs CORE-1541

Change-Id: I66e564127f7f4d70ac2e452796d5dcd731ea3f6b
Reviewed-on: https://gerrit.instructure.com/159225
Tested-by: Jenkins
Reviewed-by: Rob Orton <rob@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
2018-08-02 21:26:11 +00:00
Carl Kibler a62cbffbed return correct HTTP error code in subaccounts api
fixes ADMIN-1158

test plan:
 - (see jira for API call example)
 - POST to create sub-account to create 1 subaccount.
   (update token, host, account IDs, etc below in command)
   curl -X POST -H "Authorization: Bearer <token>" https://<domain>/api/v1/accounts/1/sub_accounts -d "account[name]=Testing_API&account[sis_account_id]=C001" -vvv
 - POST again to create sub-account with same SIS accound id
 - should get 400 Bad Request error and body has "errors" text

Change-Id: I47d972c6db0f85b29e5675664010a9a1a804d474
Reviewed-on: https://gerrit.instructure.com/159074
Tested-by: Jenkins
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Luke Kingsley <lkingsley@instructure.com>
Product-Review: Carl Kibler <ckibler@instructure.com>
2018-08-01 21:58:23 +00:00
Michael Guymon 904e7b5b52 Send failure email if homework submission fails.
Check the attachment state to send the correct email. If the
clone url fails, the failure email will be sent.

Refactored SubmitHomeworkService to be instance based to DRY up methods
calls.

refs: GOOF-434
fixes: GOOF-491

Test Plan:
  * Create a test document in Google/Office
  * Select the Google/Office document for homework assignment
  * Delete the test document
  * Submit the homework assignment
  * Clone url will fail, failure email will be sent

Change-Id: I3f1884b2177f8a2d1892e8d2bd01724620c9cc2f
Reviewed-on: https://gerrit.instructure.com/158039
Reviewed-by: Josh Orr <jgorr@instructure.com>
Reviewed-by: Jeremy Slade <jslade@instructure.com>
QA-Review: Mark McDermott <mmcdermott@instructure.com>
Product-Review: Michael Guymon <mguymon@instructure.com>
Tested-by: Jenkins
2018-08-01 21:31:54 +00:00
Cody Cutrer 11f056182a rails 5.2: arel.sql
Change-Id: I3239ddb374edb7bfdeba5cb9e8524f671ee30514
Reviewed-on: https://gerrit.instructure.com/159224
Tested-by: Jenkins
Reviewed-by: Rob Orton <rob@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
2018-08-01 17:29:52 +00:00
James Williams ed86be51a3 don't masquerade as yourself when following destination url
also don't explode if current_user is missing
just in case

also don't leave users as pre-registered if
a password is provided on creation (so the email
confirmation link works now)

test plan:
* use test plan for g/145033

closes #CORE-1647

Change-Id: I9f9a457be555f19afc2b0b997dd87a0024f02d63
Reviewed-on: https://gerrit.instructure.com/157978
Tested-by: Jenkins
Reviewed-by: Cody Cutrer <cody@instructure.com>
QA-Review: Rohan Cheeniyil <rcheeniyil@instructure.com>
Product-Review: James Williams  <jamesw@instructure.com>
2018-07-31 16:49:33 +00:00
Spencer Olson 3fa322b7e3 remove moderate_grades permission checks
changes checks for :moderate_grades permissions to instead call
Assignment#permits_moderation?

closes GRADE-1227

Test Plan:
1. Verify only the final grader or an admin with select_final_grade
   permission can give final provisional grades.
2. General smoke test on the Grade Summary page (logged in as final
   grader and logged in as admin) and in SpeedGrader (logged in as
   final grader, logged in as admin, and logged in as provisional
   grader) for moderated assignments.

Change-Id: If039cc36c373097bab81993335b5f2306f90b17e
Reviewed-on: https://gerrit.instructure.com/155973
Reviewed-by: Adrian Packel <apackel@instructure.com>
Reviewed-by: Gary Mei <gmei@instructure.com>
Tested-by: Jenkins
QA-Review: Adrian Packel <apackel@instructure.com>
Product-Review: Keith T. Garner <kgarner@instructure.com>
2018-07-31 15:04:22 +00:00
Mysti Sadler b3ade4b924 Load manageable appointment groups more efficiently
closes ADMIN-1199
closes ADMIN-1031

Test plan
- This is a pretty hefty re-write for appointment
  group permissions.  May need regression testing
- Set up at least one or two courses with
  appointment groups
- Set up at least one "manage_calendar by default"
  user and one non-default user
- Ensure they can see the appointment groups in
  the calendar as appropriate
- Fiddle with their permissions (by the enrollment
  role or by admin roles) and ensure the user can
  see the appointment groups as appropriate
- While a student is able to manage the appointment
  groups, ensure they can see them on the planner
- In the server logs, ensure the appointment groups
  don't create N+(6/7/8) queries

Change-Id: I5d5e1b4e8a83544374db063c76377b85b095d61e
Reviewed-on: https://gerrit.instructure.com/154975
Tested-by: Jenkins
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
Reviewed-by: James Williams  <jamesw@instructure.com>
QA-Review: Deepeeca Soundarrajan <dsoundarrajan@instructure.com>
Product-Review: Mysti Sadler <mysti@instructure.com>
2018-07-30 20:34:46 +00:00
Jeremy Stanley 1966f31381 add syllabus to blueprint sync history
test plan (ADMIN-51):
 - have a blueprint syncing to multiple associated courses
 - change the syllabus text in the blueprint and in one associated course
 - in the blueprint, the "Unsynced Changes" should include the syllabus
   and the Sync button should be present
 - perform a sync
 - the syllabus text should be updated in courses where the syllabus
   was not changed downstream
 - the sync history in the blueprint course should show the syllabus
   was synced, and should show the exception in the course whose
   syllabus was changed downstream
 - the sync history in the associated courses should show that the
   syllabus was changed and indicate whether this change was applied
   (course settings / Blueprint information in the right sidebar)

test plan (ADMIN-1283)
 - have a blueprint and associated course that are syncing
   a syllabus body
 - detach the associated course and attach it to a different
   blueprint
 - the associated course's syllabus body should be overwritten
   with the new blueprint's syllabus body after a sync happens
 - changing the syllabus body in the associated course should
   prevent future syncs from overwriting the syllabus

also regression test:
 - course settings (e.g. tab order) are copied to a newly added
   course
 - course settings are overwritten in child courses if the
   "copy course settings" box is checked

fixes ADMIN-51
fixes ADMIN-1283

Change-Id: I44f7086746f279059d5bb86e177ceb8f18a15e56
Reviewed-on: https://gerrit.instructure.com/158247
Tested-by: Jenkins
Reviewed-by: James Williams  <jamesw@instructure.com>
QA-Review: Luke Kingsley <lkingsley@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
2018-07-30 19:49:07 +00:00
James Williams a89cc72a0d use message participants in interaction report
shouldn't count conversations in interaction report
if message wasn't received by a student

test plan:
* have two students and a teacher in a course
* as a student send a message to the other student
 and the teacher
* respond as a teacher just to the original sender
* the student interaction report shouldn't count
 the conversation for the student who didn't
 receive the message

closes #ADMIN-1165

Change-Id: I7e67befd867f9be6952865573086551887c1beda
Reviewed-on: https://gerrit.instructure.com/158329
Tested-by: Jenkins
Reviewed-by: Jeremy Stanley <jeremy@instructure.com>
QA-Review: Luke Kingsley <lkingsley@instructure.com>
Product-Review: James Williams  <jamesw@instructure.com>
2018-07-30 16:36:39 +00:00
Jeremy Stanley 0c6945f2e6 fix creating a new front_page when planner is enabled
also do some spec cleanup, add missing expectations,
and remove unnecessary timecoppery

test plan:
 - start with a course that has no front page
 - enable student planner
 - use the API to create a front page
   https://canvas.instructure.com/doc/api/pages.html#method.wiki_pages_api.update_front_page
   for example,

 curl -X PUT -H "Authorization: Bearer <token>" \
  /api/v1/courses/X/front_page -d wiki_page[title]=blah

 - the request should succeed (no 500 error)

fixes ADMIN-1278

Change-Id: I8fccb0426e9bdbf0ba1f50d09eb73b8ab0595bbf
Reviewed-on: https://gerrit.instructure.com/158514
Reviewed-by: Mysti Sadler <mysti@instructure.com>
Tested-by: Jenkins
QA-Review: Carl Kibler <ckibler@instructure.com>
Product-Review: Jeremy Stanley <jeremy@instructure.com>
2018-07-25 19:21:40 +00:00