module PandaPal::Helpers::ControllerHelper
Public Instance Methods
Source
# File lib/panda_pal/helpers/controller_helper.rb, line 16 def current_lti_platform @current_lti_platform ||= current_panda_session&.lti_platform end
Source
# File lib/panda_pal/helpers/controller_helper.rb, line 9 def current_organization @organization ||= current_session&.panda_pal_organization @organization ||= PandaPal::Organization.find_by!(key: organization_key) if organization_key # Deprecated @organization ||= PandaPal::Organization.find_by(id: organization_id) if organization_id # Deprecated @organization ||= PandaPal::Organization.for_apt_tenant(Apartment::Tenant.current) end
Source
# File lib/panda_pal/helpers/controller_helper.rb, line 124 def forbid_access_if_lacking_session super safari_override end
Calls superclass method
PandaPal::Helpers::SessionReplacement#forbid_access_if_lacking_session
Source
# File lib/panda_pal/helpers/controller_helper.rb, line 20 def lti_launch_params current_panda_session[:launch_params] end
Source
# File lib/panda_pal/helpers/controller_helper.rb, line 139 def safari_override use_secure_headers_override(:safari_override) if browser.safari? end
Source
# File lib/panda_pal/helpers/controller_helper.rb, line 117 def switch_tenant(organization = current_organization, &block) return unless organization raise 'This method should be called in an around_action callback' unless block_given? organization.switch_tenant(&block) end
Source
# File lib/panda_pal/helpers/controller_helper.rb, line 129 def valid_session? return false unless current_panda_session&.persisted? return false unless current_organization return false unless current_panda_session.panda_pal_organization_id == current_organization.id return false unless Apartment::Tenant.current == current_organization.tenant_name true rescue SessionNonceMismatch false end
Source
# File lib/panda_pal/helpers/controller_helper.rb, line 24 def validate_launch!(version: :any) safari_override version = %i[v1p0 v1p3] if version == :any if version.is_a?(Array) version = case when params[:id_token].present? :v1p3 when params[:oauth_consumer_key].present? :v1p0 end end valmthd = :"validate_#{version}_launch" return send(valmthd) if respond_to?(valmthd) render plain: 'Failed to validate LTI launch', status: :unauthorized end
Source
# File lib/panda_pal/helpers/controller_helper.rb, line 44 def validate_v1p0_launch authorized = false # We should verify the timestamp is recent (within 5 minutes). The approved timestamp is part of the signature, # so we don't need to worry about malicious users messing with it. We should deny requests that come too long # after the approved timestamp. good_timestamp = params['oauth_timestamp'] && params['oauth_timestamp'].to_i > Time.now.to_i - 300 if @organization = good_timestamp && params['oauth_consumer_key'] && PandaPal::Organization.find_by_key(params['oauth_consumer_key']) sanitized_params = request.request_parameters # These params come over with a safari-workaround launch. The authenticator doesn't like them, so clean them out. safe_unexpected_params = ["full_win_launch_requested", "platform_redirect_url", "dummy_param"] safe_unexpected_params.each do |p| sanitized_params.delete(p) end tp = IMS::LTI::ToolProvider.new(@organization.key, @organization.secret, sanitized_params) authorized = tp.valid_request?(request) end if !authorized render plain: 'Failed to validate LTI v1p0 launch', :status => :unauthorized return false end start_panda_session! end
Source
# File lib/panda_pal/helpers/controller_helper.rb, line 69 def validate_v1p3_launch require "json/jwt" decoded_jwt = JSON::JWT.decode(params.require(:id_token), :skip_verification) raise JSON::JWT::VerificationFailed, 'error decoding id_token' if decoded_jwt.blank? client_id = decoded_jwt['aud'] deployment_id = decoded_jwt['https://purl.imsglobal.org/spec/lti/claim/deployment_id'] if deployment_id.present? @organization ||= PandaPal::Organization.find_by(key: "#{client_id}/#{deployment_id}") @organization ||= PandaPal::Organization.find_by(key: deployment_id) end @organization ||= PandaPal::Organization.find_by(key: client_id) params[:session_key] = params[:state] raise JSON::JWT::VerificationFailed, 'Unrecognized Organization' unless @organization.present? raise JSON::JWT::VerificationFailed, 'Organization does not trust platform' unless @organization.trusted_platform?(current_lti_platform) begin decoded_jwt.verify!(current_lti_platform.public_jwks) rescue JSON::JWK::Set::KidNotFound decoded_jwt.verify!(current_lti_platform.public_jwks(force: true)) end raise JSON::JWT::VerificationFailed, 'State is invalid' unless current_panda_session[:lti_oauth_nonce] == decoded_jwt['nonce'] jwt_verifier = PandaPal::LtiJwtValidator.new(decoded_jwt, client_id) raise JSON::JWT::VerificationFailed, jwt_verifier.errors unless jwt_verifier.valid? current_panda_session.update(panda_pal_organization: @organization) @decoded_lti_jwt = decoded_jwt rescue JSON::JWT::VerificationFailed => e payload = Array(e.message) render json: { message: [ { errors: payload }, { id_token: params.require(:id_token) }, ], }, status: :unauthorized false end
Private Instance Methods
Source
# File lib/panda_pal/helpers/controller_helper.rb, line 153 def organization_id params[:organization_id] end
Deprecated
Source
# File lib/panda_pal/helpers/controller_helper.rb, line 146 def organization_key org_key ||= params[:oauth_consumer_key] org_key ||= session[:organization_key] org_key end
Deprecated