SWAMPy

✎ CARVE FLESH

EDITING: membership_service_controller.rb

# frozen_string_literal: true

#
# Copyright (C) 2011 - present Instructure, Inc.
#
# This file is part of Canvas.
#
# Canvas is free software: you can redistribute it and/or modify it under
# the terms of the GNU Affero General Public License as published by the Free
# Software Foundation, version 3 of the License.
#
# Canvas is distributed in the hope that it will be useful, but WITHOUT ANY
# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
# A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
# details.
#
# You should have received a copy of the GNU Affero General Public License along
# with this program. If not, see <http://www.gnu.org/licenses/>.
#
require "oauth/request_proxy/action_controller_request"

module Lti
  class MembershipServiceController < ApplicationController
    before_action :require_context
    before_action :check_authorized_action

def course_index
      render_page_presenter
    end

def group_index
      render_page_presenter
    end

private

def check_authorized_action
      if @current_user
        require_user
        authorized_action(@context, @current_user, :read)
      elsif lti_tool_access_enabled?
        req = OAuth::RequestProxy.proxy(request)
        consumer_key, timestamp, nonce = req.oauth_consumer_key, req.oauth_timestamp, req.oauth_nonce
        return head :unauthorized unless Security.check_and_store_nonce("lti_nonce_#{consumer_key}_#{nonce}", timestamp, 10.minutes)

tool = ContextExternalTool.find_active_external_tool_by_consumer_key(consumer_key, @context.is_a?(Course) ? @context : @context.context)
        head :unauthorized unless tool&.allow_membership_service_access && OAuth::Signature.verify(request, consumer_secret: tool.shared_secret)
      else
        head :unauthorized
      end
    end

def render_page_presenter
      @page = MembershipService::PagePresenter.new(@context,
                                                   @current_user,
                                                   request.base_url,
                                                   membership_service_params)

render json: @page
    end

def membership_service_params
      keys = %w[role page per_page]
      params.select { |k, _| keys.include?(k) }
    end

def lti_tool_access_enabled?
      @context.root_account.feature_enabled?(:membership_service_for_lti_tools)
    end
  end
end

CANCEL

Name	Type	Size	Modified	Actions
↩ ..	DIR	—	—
📁 concerns/	DIR	—	2023-09-24 03:36
📁 ims/	DIR	—	2023-09-24 03:39
📄 account_external_tools_controller.rb	RB	3.8 KB	2023-09-24 03:36	EDIT
📄 account_lookup_controller.rb	RB	3.4 KB	2023-09-24 03:36	EDIT
📄 data_services_controller.rb	RB	10.5 KB	2023-09-24 03:36	EDIT
📄 feature_flags_controller.rb	RB	2.7 KB	2023-09-24 03:36	EDIT
📄 lti_apps_controller.rb	RB	4 KB	2023-09-24 03:36	EDIT
📄 membership_service_controller.rb	RB	2.4 KB	2023-09-24 03:36	EDIT
📄 message_controller.rb	RB	12.2 KB	2023-09-24 03:39	EDIT
📄 originality_reports_api_controller.rb	RB	17.7 KB	2023-09-24 03:36	EDIT
📄 plagiarism_assignments_api_controller.rb	RB	5.3 KB	2023-09-24 03:36	EDIT
📄 platform_storage_controller.rb	RB	5.2 KB	2023-09-24 03:39	EDIT
📄 public_jwk_controller.rb	RB	6 KB	2023-09-24 03:36	EDIT
📄 submissions_api_controller.rb	RB	9.1 KB	2023-09-24 03:36	EDIT
📄 subscriptions_api_controller.rb	RB	6.6 KB	2023-09-24 03:36	EDIT
📄 subscriptions_validator.rb	RB	2.9 KB	2023-09-24 03:36	EDIT
📄 token_controller.rb	RB	2.7 KB	2023-09-24 03:36	EDIT
📄 tool_configurations_api_controller.rb	RB	7.6 KB	2023-09-24 03:36	EDIT
📄 tool_proxy_controller.rb	RB	3.9 KB	2023-09-24 03:36	EDIT
📄 users_api_controller.rb	RB	3.7 KB	2023-09-24 03:36	EDIT