Add admin controls for courses.mooc.fi migration status

Author: nygrenh

app/controllers/participants_controller.rb

@@ -131,6 +131,36 @@ def password_reset_link
     @password_reset_link = @user.generate_password_reset_link
   end
 
+  def check_courses_mooc_fi
+    @user = User.find(params[:id])
+    authorize! :view_participant_information, @user
+    return respond_forbidden('This feature is only available to admins') unless current_user.administrator?
+
+    @courses_mooc_fi_status = @user.find_on_courses_mooc_fi
+  end
+
+  def force_migrate_to_courses_mooc_fi
+    @user = User.find(params[:id])
+    authorize! :view_participant_information, @user
+    return respond_forbidden('This feature is only available to admins') unless current_user.administrator?
+    return respond_forbidden('This feature is disabled for admin accounts') if @user.administrator?
+
+    if @user.managed_externally?
+      return redirect_to participant_path(@user), alert: 'User is already managed by courses.mooc.fi.'
+    end
+
+    if @user.find_on_courses_mooc_fi == true
+      return redirect_to participant_path(@user), alert: 'User already exists on courses.mooc.fi; refusing to force migrate.'
+    end
+
+    result = @user.force_migrate_to_courses_mooc_fi
+    if result[:success]
+      redirect_to participant_path(@user), notice: 'User force-migrated to courses.mooc.fi.'
+    else
+      redirect_to participant_path(@user), alert: "Force migration to courses.mooc.fi failed: #{result[:error]}"
+    end
+  end
+
   private
     def index_json_data
       result = []

app/models/user.rb

@@ -363,6 +363,90 @@ def post_new_user_to_courses_mooc_fi(password)
     end
   end
 
+  # Admin-triggered override of the normal login/password-change-triggered migration: creates
+  # the user on courses.mooc.fi with a throwaway random password nobody needs to know, since the
+  # user gets a real one later via password reset once courses.mooc.fi confirms the account
+  # (see set_password_managed_by_courses_mooc_fi). Returns the raw status/body on failure rather
+  # than a guessed message, since we don't control courses.mooc.fi's error schema.
+  def force_migrate_to_courses_mooc_fi
+    create_url = SiteSetting.value('courses_mooc_fi_create_user_url')
+    password = SecureRandom.hex(24)
+
+    conn = Faraday.new(request: { open_timeout: 2, timeout: 10 }) do |f|
+      f.request :json
+      f.response :json
+    end
+
+    response = conn.post(create_url) do |req|
+      req.headers['Content-Type'] = 'application/json'
+      req.headers['Accept'] = 'application/json'
+      req.headers['Authorization'] = Rails.application.secrets.tmc_server_secret_for_communicating_to_secret_project
+      req.body = { upstream_id: id, password: normalize_password(password) }
+    end
+
+    data = response.body
+    if response.status == 200 && data.is_a?(Hash) && data['user'].present?
+      Rails.logger.info("User #{self.email} force-migrated to courses.mooc.fi by an admin")
+      { success: true }
+    else
+      Rails.logger.error("Force migration to courses.mooc.fi failed for user #{self.email}: status=#{response.status}, body=#{data.inspect}")
+      { success: false, error: "status=#{response.status}, body=#{data.inspect}" }
+    end
+
+  rescue Faraday::ClientError => e
+    status = e.response&.dig(:status)
+    body = e.response&.dig(:body)
+    Rails.logger.error("Force migration to courses.mooc.fi errored for user #{self.email}: status=#{status}, body=#{body.inspect}")
+    { success: false, error: "status=#{status}, body=#{body.inspect}" }
+
+  rescue => e
+    Rails.logger.error("Force migration to courses.mooc.fi unexpectedly failed for user #{self.email}: #{e.message}")
+    { success: false, error: e.message }
+  end
+
+  # Returns true/false if courses.mooc.fi confirms presence/absence of this user, or nil if the
+  # lookup itself failed (network error, unexpected status) and presence is therefore unknown.
+  def find_on_courses_mooc_fi
+    lookup_url = SiteSetting.value('courses_mooc_fi_user_lookup_url')
+    return nil if lookup_url.blank?
+
+    conn = Faraday.new(request: { open_timeout: 2, timeout: 10 }) do |f|
+      f.request :json
+      f.response :json
+    end
+
+    response = conn.get("#{lookup_url}/#{id}") do |req|
+      req.headers['Accept'] = 'application/json'
+      req.headers['Authorization'] = Rails.application.secrets.tmc_server_secret_for_communicating_to_secret_project
+    end
+
+    case response.status
+    when 200
+      true
+    when 404
+      false
+    else
+      Rails.logger.error("Looking up user #{self.email} on courses.mooc.fi returned unexpected status: status=#{response.status}, request-id=#{response.headers['request-id']}, body=#{response.body.inspect}")
+      nil
+    end
+
+  rescue Faraday::ClientError => e
+    status = e.response&.dig(:status)
+    request_id = e.response&.dig(:headers, 'request-id')
+    body = e.response&.dig(:body)
+    Rails.logger.error("Looking up user #{self.email} on courses.mooc.fi failed: status=#{status}, request-id=#{request_id}, body=#{body.inspect}")
+    nil
+  end
+
+  def courses_mooc_fi_profile_url
+    return nil if courses_mooc_fi_user_id.blank?
+
+    base_url = SiteSetting.value('courses_mooc_fi_manage_user_url')
+    return nil if base_url.blank?
+
+    "#{base_url}/#{courses_mooc_fi_user_id}"
+  end
+
   def password_reset_key
     action_tokens.find { |t| t.action == 'reset_password' }
   end

app/views/participants/check_courses_mooc_fi.html.erb

@@ -0,0 +1,11 @@
+<div>
+  <p>courses.mooc.fi lookup for <%= link_to @user.email, participant_path(@user) %>:</p>
+  <% case @courses_mooc_fi_status %>
+  <% when true %>
+    <p>Found on courses.mooc.fi.</p>
+  <% when false %>
+    <p>Not found on courses.mooc.fi.</p>
+  <% else %>
+    <p>Could not determine status &mdash; the lookup failed. Check the logs for details.</p>
+  <% end %>
+</div>

app/views/participants/show.html.erb

@@ -20,6 +20,15 @@
       <% if current_user.administrator? && !@user.administrator? %>
         <li><%= link_to 'Generate password reset link', password_reset_link_participant_path, class: 'btn btn-primary' %> (shown to you because you're an admin)</li>
       <% end %>
+      <% if current_user.administrator? %>
+        <li><%= link_to 'Check courses.mooc.fi status', check_courses_mooc_fi_participant_path, class: 'btn btn-primary' %> (shown to you because you're an admin)</li>
+      <% end %>
+      <% if current_user.administrator? && !@user.administrator? && !@user.managed_externally? %>
+        <li><%= button_to 'Force migrate to courses.mooc.fi', force_migrate_to_courses_mooc_fi_participant_path, method: :post, class: 'btn btn-primary', data: { confirm: "Force migrate #{@user.email} to courses.mooc.fi now?" } %> (shown to you because you're an admin)</li>
+      <% end %>
+      <% if current_user.administrator? && @user.courses_mooc_fi_profile_url %>
+        <li><%= link_to 'View on courses.mooc.fi', @user.courses_mooc_fi_profile_url, target: '_blank', rel: 'noopener', class: 'btn btn-primary' %> (shown to you because you're an admin)</li>
+      <% end %>
       </ul>
   </section>
 </div>

config/routes.rb

@@ -276,6 +276,8 @@
     end
     member do
       get 'password_reset_link', to: 'participants#password_reset_link'
+      get 'check_courses_mooc_fi', to: 'participants#check_courses_mooc_fi'
+      post 'force_migrate_to_courses_mooc_fi', to: 'participants#force_migrate_to_courses_mooc_fi'
     end
   end
 

config/site.defaults.yml

@@ -143,3 +143,5 @@ teacher_manual_url: http://testmycode.github.io/tmc-server/usermanual/
 courses_mooc_fi_auth_url:
 courses_mooc_fi_update_password_url:
 courses_mooc_fi_create_user_url:
+courses_mooc_fi_user_lookup_url:
+courses_mooc_fi_manage_user_url:

spec/controllers/participants_controller_spec.rb

@@ -27,4 +27,102 @@
       end
     end
   end
+
+  describe 'GET /check_courses_mooc_fi' do
+    describe 'when logged in as an admin' do
+      before :each do
+        controller.current_user = FactoryBot.create(:admin)
+      end
+
+      it 'shows the user as found when the lookup succeeds' do
+        expect_any_instance_of(User).to receive(:find_on_courses_mooc_fi).and_return(true)
+        get :check_courses_mooc_fi, params: { id: @user.id }
+        expect(response).to be_successful
+        expect(assigns(:courses_mooc_fi_status)).to eq(true)
+      end
+
+      it 'shows the user as not found when the lookup succeeds' do
+        expect_any_instance_of(User).to receive(:find_on_courses_mooc_fi).and_return(false)
+        get :check_courses_mooc_fi, params: { id: @user.id }
+        expect(response).to be_successful
+        expect(assigns(:courses_mooc_fi_status)).to eq(false)
+      end
+
+      it 'shows the status as unknown when the lookup fails' do
+        expect_any_instance_of(User).to receive(:find_on_courses_mooc_fi).and_return(nil)
+        get :check_courses_mooc_fi, params: { id: @user.id }
+        expect(response).to be_successful
+        expect(assigns(:courses_mooc_fi_status)).to be_nil
+      end
+    end
+
+    describe 'when logged in as a non-admin' do
+      before :each do
+        controller.current_user = @user
+      end
+
+      it 'is forbidden' do
+        get :check_courses_mooc_fi, params: { id: @user.id }
+        expect(response.code.to_i).to eq(403)
+      end
+    end
+  end
+
+  describe 'POST /force_migrate_to_courses_mooc_fi' do
+    describe 'when logged in as a non-admin' do
+      before :each do
+        controller.current_user = @user
+      end
+
+      it 'is forbidden' do
+        post :force_migrate_to_courses_mooc_fi, params: { id: @user.id }
+        expect(response.code.to_i).to eq(403)
+      end
+    end
+
+    describe 'when logged in as an admin' do
+      before :each do
+        controller.current_user = FactoryBot.create(:admin)
+      end
+
+      it 'is forbidden when the target user is an admin' do
+        admin_target = FactoryBot.create(:admin)
+        expect_any_instance_of(User).not_to receive(:force_migrate_to_courses_mooc_fi)
+        post :force_migrate_to_courses_mooc_fi, params: { id: admin_target.id }
+        expect(response.code.to_i).to eq(403)
+      end
+
+      it 'refuses when the user is already managed externally' do
+        @user.update!(password_managed_by_courses_mooc_fi: true, courses_mooc_fi_user_id: SecureRandom.uuid)
+        expect_any_instance_of(User).not_to receive(:force_migrate_to_courses_mooc_fi)
+        post :force_migrate_to_courses_mooc_fi, params: { id: @user.id }
+        expect(response).to redirect_to(participant_path(@user))
+        expect(flash[:alert]).to match(/already managed/)
+      end
+
+      it 'refuses when courses.mooc.fi already has the user' do
+        expect_any_instance_of(User).to receive(:find_on_courses_mooc_fi).and_return(true)
+        expect_any_instance_of(User).not_to receive(:force_migrate_to_courses_mooc_fi)
+        post :force_migrate_to_courses_mooc_fi, params: { id: @user.id }
+        expect(response).to redirect_to(participant_path(@user))
+        expect(flash[:alert]).to match(/already exists/)
+      end
+
+      it 'migrates the user when the lookup is inconclusive and the migration succeeds' do
+        expect_any_instance_of(User).to receive(:find_on_courses_mooc_fi).and_return(nil)
+        expect_any_instance_of(User).to receive(:force_migrate_to_courses_mooc_fi).and_return({ success: true })
+        post :force_migrate_to_courses_mooc_fi, params: { id: @user.id }
+        expect(response).to redirect_to(participant_path(@user))
+        expect(flash[:notice]).to match(/force-migrated/)
+      end
+
+      it 'shows the exact error when the migration fails' do
+        expect_any_instance_of(User).to receive(:find_on_courses_mooc_fi).and_return(false)
+        expect_any_instance_of(User).to receive(:force_migrate_to_courses_mooc_fi).and_return({ success: false, error: 'status=422, body={"error"=>"boom"}' })
+        post :force_migrate_to_courses_mooc_fi, params: { id: @user.id }
+        expect(response).to redirect_to(participant_path(@user))
+        expect(flash[:alert]).to match(/status=422/)
+      end
+    end
+  end
 end

spec/models/user_spec.rb

@@ -270,6 +270,27 @@
     expect(User.authenticate('root', 'ilikecookies')).to be_nil
   end
 
+  describe 'courses_mooc_fi_profile_url' do
+    it 'is nil when the user has no courses.mooc.fi id' do
+      user = User.create!(login: 'localuser', password: 'secret123', email: 'localuser@example.com')
+      SiteSetting.all_settings['courses_mooc_fi_manage_user_url'] = 'https://courses.mooc.fi/manage/users'
+      expect(user.courses_mooc_fi_profile_url).to be_nil
+    end
+
+    it 'is nil when courses_mooc_fi_manage_user_url is not configured' do
+      user = User.create!(login: 'manageduser', password: 'secret123', email: 'managed@example.com', courses_mooc_fi_user_id: SecureRandom.uuid)
+      SiteSetting.all_settings['courses_mooc_fi_manage_user_url'] = nil
+      expect(user.courses_mooc_fi_profile_url).to be_nil
+    end
+
+    it 'builds the profile url from the configured base url and the courses.mooc.fi id' do
+      id = SecureRandom.uuid
+      user = User.create!(login: 'manageduser', password: 'secret123', email: 'managed@example.com', courses_mooc_fi_user_id: id)
+      SiteSetting.all_settings['courses_mooc_fi_manage_user_url'] = 'https://courses.mooc.fi/manage/users'
+      expect(user.courses_mooc_fi_profile_url).to eq("https://courses.mooc.fi/manage/users/#{id}")
+    end
+  end
+
   describe 'migrating to courses.mooc.fi on login' do
     it 'posts a locally-managed user on successful authentication' do
       user = User.create!(login: 'localuser', password: 'secret123', email: 'localuser@example.com')