This reverts commit ec90fe1357.
the validation check might fail, because it uses a cassandra commit
Change-Id: Ia8be0df1d7de5716f6ec376589af1532b9d84a18
Reviewed-on: https://gerrit.instructure.com/c/canvas-lms/+/227042
Reviewed-by: Jonathan Featherstone <jfeatherstone@instructure.com>
Tested-by: Simon Williams <simon@instructure.com>
QA-Review: Simon Williams <simon@instructure.com>
Product-Review: Simon Williams <simon@instructure.com>
also pins all migrations to Rails 4.2 semantics
Change-Id: I386566f7a1f3e3e8aa31675f467c87c443457aee
Reviewed-on: https://gerrit.instructure.com/95571
Reviewed-by: Simon Williams <simon@instructure.com>
Tested-by: Simon Williams <simon@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
QA-Review: Cody Cutrer <cody@instructure.com>
refs CNVS-7877
* counter updates have to be in their own batch in 1.2+
* add the use_cql3? method to cassandra gem, even
though we're not updating it yet
* slight change in syntax for table creation
* 1.2 doesn't return schema info in the schema cql command;
use a query to get tables
Change-Id: I22642b0fb99e744080f9a7efd0b3d0372de020b9
Reviewed-on: https://gerrit.instructure.com/25361
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Reviewed-by: Brian Palmer <brianp@instructure.com>
Product-Review: Cody Cutrer <cody@instructure.com>
fixes CNVS-390
stores and allows querying by user/account/pseudonym of login/logout
events.
test-plan:
[setup]
- set up an 'auditors' keyspace in cassandra and run migrations
- have shardX and shardY on one database server, and shardZ on a
different database server
- have accountW and accountX on shardX
- have accountY and accountZ on shardY and shardZ, respectively
- have userA on shardX with pseudonymAW in accountW and pseudonymAX in
accountX (cross-account, single-shard user)
- have userB on shardY with pseudonymBY in accountY and pseudonymBX in
accountX (cross-shard user)
- have userC on shardZ with pseudonymCZ in accountZ and pseudonymCX in
accountX (cross-db-server user)
- log in and out of each pseudonym above multiple times
[index isolation]
- /api/v1/audit/authentication/pseudonyms/<pseudonymAX> should
include logins and logouts from pseudonymAX only
- /api/v1/audit/authentication/accounts/<accountX> should include
logins and logouts from pseudonymAX, pseudonymBX, and pseudonymCX
but not pseudonymAW
- /api/v1/audit/authentication/users/<userA> should include logins
and logouts from both pseudonymAW and pseudonymAX but not
pseudonymBX or pseudonymCX
[permission isolation]
(in each of these, either :view_statistics or :manage_user_logins on
an account qualifies as "having permission")
- /api/v1/audit/authentication/pseudonyms/<pseudonymAX> should be
unauthorized if the current user doesn't have permission on
accountX
- /api/v1/audit/authentication/accounts/<accountX> should be
unauthorized if the current user doesn't have permission on
accountX
- /api/v1/audit/authentication/users/<userA> should be unauthorized
if the current user doesn't have permission on either of accountW
or accountX
- /api/v1/audit/authentication/users/<userA> should include logins
and logouts from accountW but not from accountX if the current
user has permission on accountW but not on accountX
[sharding]
- /api/v1/audit/authentication/users/<userB> should include logins
and logouts from both pseudonymBY and pseudonymBX
- /api/v1/audit/authentication/users/<userB> should not include
duplicate logins and logouts from either pseudonymBY and
pseudonymBX (potential for bug due to both pseudonyms' shards
being on the same database server)
- /api/v1/audit/authentication/users/<userC> should include logins
and logouts from both pseudonymCZ and pseudonymCX
Change-Id: I74b1573b346935f733fe5b07919d2d450cf07592
Reviewed-on: https://gerrit.instructure.com/21829
Reviewed-by: Brian Palmer <brianp@instructure.com>
Tested-by: Jenkins <jenkins@instructure.com>
QA-Review: Jeremy Putnam <jeremyp@instructure.com>
Product-Review: Jacob Fugal <jacob@instructure.com>
Cody Cutrer