Fix policy applied to dashboard API endpoints

hypothesis · May 22, 2024 · f80166c · f80166c
1 parent bc5b173
commit f80166c
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/lms/security.py b/lms/security.py
@@ -138,7 +138,7 @@ def get_policy(request: Request):
             # LTUser serialized as query param for authorization failures
             return QueryStringBearerTokenLTIUserPolicy()
 
-        if path.startswith("/api") or path in {
+        if path.startswith(("/api", "/dashboard/api/")) or path in {
             "/lti/1.3/deep_linking/form_fields",
             "/lti/1.1/deep_linking/form_fields",
             "/lti/reconfigure",

diff --git a/tests/unit/lms/security_test.py b/tests/unit/lms/security_test.py
@@ -468,6 +468,10 @@ def test_get_policy_google(self, pyramid_request, path, LMSGoogleSecurityPolicy)
             ("/api/canvas/pages/proxy", QueryStringBearerTokenLTIUserPolicy),
             ("/api/canvas/files", HeadersBearerTokenLTIUserPolicy),
             ("/api/blackboard/groups", HeadersBearerTokenLTIUserPolicy),
+            ("/dashboard/api/assignment/X", HeadersBearerTokenLTIUserPolicy),
+            ("/dashboard/api/assignment/X/stats", HeadersBearerTokenLTIUserPolicy),
+            ("/dashboard/api/course/X", HeadersBearerTokenLTIUserPolicy),
+            ("/dashboard/api/course/X/stats", HeadersBearerTokenLTIUserPolicy),
             ("/lti/1.3/deep_linking/form_fields", HeadersBearerTokenLTIUserPolicy),
             ("/lti/1.1/deep_linking/form_fields", HeadersBearerTokenLTIUserPolicy),
             ("/lti/reconfigure", HeadersBearerTokenLTIUserPolicy),