v1.2

What's Changed

Canvas Sync

• Introduces the ability for users to connect a Canvas account, link a Canvas class and automatically sync a Pingpong group's roster with said Canvas class' roster.
• When users disconnect their class or account, a modal asks users to confirm whether they want to remove or keep users imported through Canvas.
• Other users have an option to disconnect the current connection to establish a new connection.
• Email invites are not sent when users are synced through Canvas Sync.
• Merges accounts based on SSO identifiers already known for each user.

Manage Group Page

• Adds documentation link for Moderators at the top right of the Manage Group page.
• Introduces a dialog prompt to let users confirm their intention to set the group as private. Then, the setting is locked in client- and server-side.

User Management

• Removes options to change the user role or remove a user in the following cases:
  • User being edited is the same as the user requesting.
  • Requesting user has lower permissions than the user being edited.
  • User being edited was imported by an LMS.
• These permission checks are also enforced server-side.

Bug Fixes

• Users might not have been able to sync the course roster in Canvas when the DB PK did not match the LMS Course ID, returning error Forbidden.
• Messages including LaTeX \begin{} ... \end{} blocks might not have rendered as expected in the thread view.
• Users might not have been able to access PingPong when they had created threads in classes they are no longer part of.
• Adding users might fail when choosing not to send out email invites.
• Moderators might not have been able to remove users in their group.
• Moderators might have been able to remove Administrators in their group.

Related PRs

• Canvas Integration by @ekassos in #405
• Patch: send_invites accepts 4 arguments by @ekassos in #450
• Canvas: Add scope information to OAuth2 Call by @ekassos in #451
• Canvas: Logging with stack trace by @ekassos in #453
• Pass LMS Course ID instead of DB PK when interacting with Canvas API by @ekassos in #455
• Bump flask-cors from 4.0.1 to 5.0.0 in the pip group across 1 directory by @dependabot in #464
• Bump svelte from 4.2.8 to 4.2.19 in /web/pingpong in the npm_and_yarn group across 1 directory by @dependabot in #460
• 454 / Add support for LaTeX \begin{} ... \end{} blocks by @jnu in #456
• Call DELETE Canvas OAuth2 endpoint on disconnect by @ekassos in #463
• Fix: Thread.get_n_by_id might return threads a user does not have access to by @ekassos in #459
• Fix: Adding users silently might fail by @ekassos in #467
• Canvas: Ensure removal of LMSClass objects by @ekassos in #458
• Fix svelte check and lint from upgraded dev dependencies by @jnu in #471
• Confirm whether to remove imported users before removing Canvas or Class connection by @ekassos in #462
• Hide editing or removing options for imported or higher permission users by @ekassos in #461
• Canvas Sync: Suppress email invites by @ekassos in #477
• Add documentation link for Mods in Manage Group page by @ekassos in #476
• Canvas Sync: Option for other users to disconnect an account by @ekassos in #473
• Canvas Sync: Merge duplicate accounts based on SSO by @ekassos in #474
• Make Private group setting permanent by @ekassos in #475
• Patch: previous_ids extra column in Alembic script by @ekassos in #478
• Patch: keep_users should be included as a parameter by @ekassos in #479

Full Changelog: 392-srv65-web48...414-srv83-web58