General Info

• Pivotal Tracker Story
• Breaking?

Changes

Audited and fixed 7 bugs in the Canvas assignment override update/post flow, addressing correctness issues around shared overrides, pagination, base due dates, and error handling.

Critical fixes:

1. Shared overrides were being destroyed — the old flow deleted a student's entire override before re-creating one, wiping extensions for all other students in a shared group (e.g. "1 day extension"). Now: single-student overrides are updated in place; shared overrides have only the one student removed, preserving the title and dates for remaining students.

2. update_assignment_override silently no-oped — params weren't nested under assignment_override as Canvas requires. Un-nested params are silently ignored by Canvas, meaning override updates (including renames) never applied. Override renames now go through correctly.

3. Override lookups only read page 1 — Canvas paginates overrides (default 10/page), so with many overrides a student's existing override was never found, leading to duplicate create attempts and 400 errors. get_assignment_overrides now requests 100 items/page and a new get_all_assignment_overrides depaginates fully.

Base due date fix (>25 overrides):

4. Incorrect base due dates — get_all_assignments relied on all_dates, which Canvas omits when an assignment has more than 25 dates. The top-level due_at can then reflect an override's date. A new get_base_dates method uses the date_details endpoint (whose top-level dates are always the base/"Everyone" dates) and is called whenever all_dates is missing and has_overrides is true. The controller now uses this for initial_due_date as well.

Other fixes:

5. Failed Canvas requests recorded as success — non-2xx create/update responses were wrapped in an Override with a nil id and the request was marked approved. provision_extension now raises CanvasAPIError on failure.
6. Auth token leaked into paginated URLs — depaginate_response was passing headers: auth_header as Faraday query params, appending Authorization=Bearer ... to follow-up page URLs. The connection's default headers already carry auth.
7. Smaller fixes — remove_student_from_override no longer mutates the caller's array; updates no longer reset unlock_at to "now"; override_has_errors? renamed to override_taken_error? with correct semantics; Lmss::Canvas::Assignment no longer falls back to a potentially override-tainted top-level date when base date info is present; Lmss::Canvas::Override exposes the full override fields needed by the controller.

Testing

• Updated existing specs to reflect the corrected behavior (param nesting, no delete_assignment_override calls, correct unlock_at preservation).
• Added new specs for: pagination of override lookups (override found on page 2), override rename on update, shared override preservation when a student is removed, lookup/create race condition recovery ("taken" recovery), get_base_dates (success/failure/bad JSON), date_details fallback in get_all_assignments, failure-status raising, and non-mutation of student_ids.
• Full suite: 423 examples, 0 failures, rubocop clean.

Documentation

No documentation changes required.

Checklist

• Name of branch corresponds to story

Superconductor Ticket Implementation | App Preview | Guided Review