Add API token management system

Gemfile

@@ -32,6 +32,9 @@ gem 'tzinfo-data', platforms: %i[windows jruby]
 # Reduces boot times through caching; required in config/boot.rb
 gem 'bootsnap', require: false
 
+# Loads environment variables from .env (local dev/test only, not Heroku)
+gem 'dotenv-rails', groups: [ :development, :test ]
+
 # Alternative Canvas API. We probably don't need this.
 # Verify instances of `LMS::Canvas`
 gem 'lms-api'
@@ -73,6 +76,7 @@ gem 'dotenv-rails', require: 'dotenv/load'
 #
 gem 'blazer'
 gem 'hypershield'
+gem 'good_job', '~> 4.0'
 
 #### Frontend related tools
 # The original asset pipeline for Rails [https://github.com/rails/sprockets-rails]

Gemfile.lock

@@ -193,6 +193,8 @@ GEM
     dumb_delegator (1.1.0)
     erb (6.0.2)
     erubi (1.13.1)
+    et-orbi (1.4.0)
+      tzinfo
     factory_bot (6.5.6)
       activesupport (>= 6.1.0)
     factory_bot_rails (6.5.1)
@@ -219,8 +221,18 @@ GEM
       sassc (~> 2.0)
     formatador (1.2.3)
       reline
+    fugit (1.12.1)
+      et-orbi (~> 1.4)
+      raabro (~> 1.4)
     globalid (1.3.0)
       activesupport (>= 6.1)
+    good_job (4.14.2)
+      activejob (>= 6.1.0)
+      activerecord (>= 6.1.0)
+      concurrent-ruby (>= 1.3.1)
+      fugit (>= 1.11.0)
+      railties (>= 6.1.0)
+      thor (>= 1.0.0)
     guard (2.20.1)
       formatador (>= 0.2.4)
       listen (>= 2.7, < 4.0)
@@ -386,6 +398,7 @@ GEM
     public_suffix (7.0.5)
     puma (7.2.0)
       nio4r (~> 2.0)
+    raabro (1.4.0)
     racc (1.8.1)
     rack (3.2.6)
     rack-protection (4.2.1)
@@ -633,6 +646,7 @@ DEPENDENCIES
   faraday
   faraday-cookie_jar
   font-awesome-sass
+  good_job (~> 4.0)
   guard-rspec
   hypershield
   importmap-rails

Procfile

@@ -0,0 +1,2 @@
+web: bundle exec rails server -p $PORT
+worker: bundle exec good_job start

app/controllers/api_tokens_controller.rb

@@ -0,0 +1,28 @@
+class APITokensController < ApplicationController
+  before_action :authenticated!
+  before_action :authenticate_user
+  before_action :set_course
+  before_action :ensure_instructor_role
+  before_action :set_pending_request_count
+
+  def index
+    @api_tokens = @course.api_tokens.includes(:user).order(created_at: :desc)
+  end
+
+  def destroy
+    @api_token = @course.api_tokens.find_by(id: params[:id])
+
+    if @api_token
+      @api_token.revoke!
+      redirect_to course_api_tokens_path(@course), notice: 'API token revoked successfully.'
+    else
+      redirect_to course_api_tokens_path(@course), alert: 'API token not found.'
+    end
+  end
+
+  private
+
+  def set_pending_request_count
+    @pending_requests_count = Request.where(course_id: @course&.id, status: 'pending').count
+  end
+end

app/controllers/assignments_controller.rb

@@ -17,4 +17,38 @@ def toggle_enabled
       render json: { redirect_to: course_path(course) }, status: :unprocessable_content
     end
   end
+
+  def bulk_update_enabled
+    course = Course.find_by(id: params[:course_id])
+    unless course
+      return render json: { error: 'Course not found.' }, status: :not_found
+    end
+
+    @role = params[:role] || course.user_role(@user)
+
+    unless @role == 'instructor'
+      Rails.logger.error "Role #{@role} does not have permission to bulk toggle assignment enabled status"
+      flash.now[:alert] = 'You do not have permission to perform this action.'
+      return render json: { redirect_to: course_path(course) }, status: :forbidden
+    end
+
+    enabled = ActiveModel::Type::Boolean.new.cast(params[:enabled])
+
+    scope = course.assignments
+    if enabled
+      eligible_scope = scope.where.not(due_date: nil)
+      updated_count = eligible_scope.update_all(enabled: true)
+      skipped_count = scope.count - updated_count
+    else
+      updated_count = scope.update_all(enabled: false)
+      skipped_count = 0
+    end
+
+    render json: {
+      success: true,
+      enabled: enabled,
+      updated_count: updated_count,
+      skipped_count: skipped_count
+    }, status: :ok
+  end
 end

app/controllers/courses_controller.rb

@@ -1,6 +1,6 @@
 class CoursesController < ApplicationController
   before_action :authenticate_user
-  before_action :set_course, only: %i[show edit sync_assignments sync_enrollments enrollments delete]
+  before_action :set_course, only: %i[show edit sync_assignments sync_enrollments sync_status enrollments delete]
   before_action :set_pending_request_count
   before_action :determine_user_role
 
@@ -89,6 +89,16 @@ def sync_enrollments
     render json: { message: 'Users synced successfully.' }, status: :ok
   end
 
+  def sync_status
+    course_to_lms = @course.course_to_lms(1)
+    return render json: { error: 'LMS connection not found.' }, status: :not_found unless course_to_lms
+
+    render json: {
+      roster_synced_at: course_to_lms.recent_roster_sync&.dig('synced_at'),
+      assignments_synced_at: course_to_lms.recent_assignment_sync&.dig('synced_at')
+    }, status: :ok
+  end
+
   def enrollments
     @side_nav = 'enrollments'
     return redirect_to courses_path, alert: 'You do not have access to this page.' unless @role == 'instructor'

app/controllers/requests_controller.rb

@@ -32,6 +32,7 @@ def index
   def show
     @assignment = @request.assignment
     @number_of_days = @request.calculate_days_difference if @request.requested_due_date.present? && @assignment&.due_date.present?
+    @student_enrollment = @course.user_to_courses.find_by(user: @request.user) if @role == 'instructor'
     render_role_based_view
   end
 
@@ -175,21 +176,35 @@ def mass_reject
     process_mass_action(:reject)
   end
 
+  # April 2026 - Migrated `courses.readonly_api_token` values into the new `api_tokens` table.
+  # The `readonly_api_token` query parameter is still accepted as an alias for `api_token` so
+  # previously distributed CSV/Sheets URLs keep working.
+  # Dec 2026 (or later): It is safe to remove the deprecated `readonly_api_token` query
+  # parameter and this comment.
   def export
     course = Course.find_by(id: params[:course_id])
-    token = params[:readonly_api_token]
+    raw_token = params[:readonly_api_token] || params[:api_token]
 
-    return render plain: 'Invalid or missing API token', status: :unauthorized unless course && ActiveSupport::SecurityUtils.secure_compare(course.readonly_api_token, token.to_s)
+    return render plain: 'Course not found', status: :not_found unless course
+    return render plain: 'Invalid or missing API token', status: :unauthorized if raw_token.blank?
 
+    api_token = APIToken.lookup_token(raw_token)
+    return render plain: 'Invalid or missing API token', status: :unauthorized unless api_token&.active? && api_token.course_id == course.id
+
+    api_token.touch_last_used!
+    export_csv(course)
+  end
+
+  private
+
+  def export_csv(course)
     requests = course.requests.includes(:assignment, :user)
     requests = requests.where(status: params[:status]) if params[:status].present?
 
     csv_data = Request.to_csv(requests)
     send_data csv_data, filename: 'requests.csv', type: 'text/csv'
   end
 
-  private
-
   def set_request
     @side_nav = 'requests'
     @request = @course.requests.includes(:assignment).find_by(id: params[:id])

app/controllers/user_to_courses_controller.rb

@@ -14,6 +14,16 @@ def toggle_allow_extended_requests
     end
   end
 
+  def update_notes
+    @enrollment = @course.user_to_courses.find(params[:id])
+
+    if @enrollment.update(notes: params[:notes])
+      render json: { success: true, notes: @enrollment.notes }, status: :ok
+    else
+      render json: { success: false, error: @enrollment.errors.full_messages.to_sentence }, status: :unprocessable_content
+    end
+  end
+
   private
 
   def ensure_course_admin

app/javascript/controllers/assignment_controller.js

@@ -5,8 +5,13 @@ import "datatables.net-responsive-bs5";
 
 // Connects to data-controller="assignment"
 export default class extends Controller {
-  static targets = ["checkbox"]
-  static values = { courseId: Number }
+  static targets = ["checkbox", "syncBtn", "syncLabel", "syncSpinner"]
+  static values = {
+    courseId: Number,
+    bulkUrl: String,
+    role: String,
+    userId: Number
+  }
 
   connect() {
     this.checkboxTargets.forEach((checkbox) => {
@@ -64,31 +69,101 @@ export default class extends Controller {
     }
   }
 
-  sync(event) {
-    const button = event.currentTarget;
+  enableAll(event) {
+    if (!confirm("Enable all assignments for this course? Assignments without a due date will be skipped.")) return;
+    this._bulkUpdate(event.currentTarget, true);
+  }
+
+  disableAll(event) {
+    if (!confirm("Disable all assignments for this course?")) return;
+    this._bulkUpdate(event.currentTarget, false);
+  }
+
+  _bulkUpdate(button, enabled) {
+    const url = this.bulkUrlValue;
+    if (!url) {
+      console.error("bulk-url-value is not set on the assignment controller element");
+      return;
+    }
     button.disabled = true;
-    const courseId = this.courseIdValue;
     const token = document.querySelector('meta[name="csrf-token"]').content;
-    fetch(`/courses/${courseId}/sync_assignments`, {
-      method: "POST",
+    fetch(url, {
+      method: "PATCH",
       headers: {
         "Content-Type": "application/json",
         "X-CSRF-Token": token,
       },
+      body: JSON.stringify({
+        course_id: this.courseIdValue,
+        enabled: enabled,
+        role: this.hasRoleValue ? this.roleValue : undefined,
+        user_id: this.hasUserIdValue ? this.userIdValue : undefined,
+      }),
     })
-      .then((response) => {
+      .then(async (response) => {
+        const data = await response.json();
         if (!response.ok) {
-          throw new Error("Failed to sync assignments.");
+          if (data.redirect_to) {
+            window.location.href = data.redirect_to;
+            return;
+          }
+          throw new Error(data.error || "Failed to update assignments.");
         }
-        return response.json();
-      })
-      .then((data) => {
-        flash("notice", data.message || "Assignments synced successfully.");
+        const action = enabled ? "enabled" : "disabled";
+        let message = `${data.updated_count} assignment(s) ${action}.`;
+        if (data.skipped_count && data.skipped_count > 0) {
+          message += ` ${data.skipped_count} skipped (missing due date).`;
+        }
+        flash("notice", message);
         location.reload();
       })
       .catch((error) => {
-        flash("alert", error.message || "An error occurred while syncing assignments.");
-        location.reload();
+        flash("alert", error.message || "An error occurred while updating assignments.");
+        button.disabled = false;
+      });
+  }
+
+  async sync() {
+    const button = this.syncBtnTarget;
+    const label = this.syncLabelTarget;
+    const spinner = this.syncSpinnerTarget;
+    const courseId = this.courseIdValue;
+    const token = document.querySelector('meta[name="csrf-token"]').content;
+
+    button.disabled = true;
+    label.textContent = "Syncing...";
+    spinner.classList.remove("d-none");
+
+    try {
+      const statusBefore = await fetch(`/courses/${courseId}/sync_status`).then(r => r.json());
+      const beforeTs = statusBefore.assignments_synced_at;
+
+      const response = await fetch(`/courses/${courseId}/sync_assignments`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", "X-CSRF-Token": token },
       });
+
+      if (!response.ok) throw new Error(`Failed to sync assignments. ${response.status}`);
+
+      await this._pollUntilDone(courseId, "assignments_synced_at", beforeTs);
+
+      flash("notice", "Assignments synced successfully.");
+      location.reload();
+    } catch (error) {
+      flash("alert", error.message || "An error occurred while syncing assignments.");
+      button.disabled = false;
+      label.textContent = "Sync Assignments";
+      spinner.classList.add("d-none");
+    }
+  }
+
+  async _pollUntilDone(courseId, key, beforeTs, intervalMs = 1000, timeoutMs = 60000) {
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+      await new Promise(resolve => setTimeout(resolve, intervalMs));
+      const status = await fetch(`/courses/${courseId}/sync_status`).then(r => r.json());
+      if (status[key] && status[key] !== beforeTs) return;
+    }
+    throw new Error("Sync timed out. Please refresh the page.");
   }
 }