Get admin roles through API

[chriscas]

Hi all, I'm hoping someone might be able to help me out, as I'm running in to some brick walls on a project...

I'm trying to create a javascript function to be used for customizations in our theme that will return what I refer to as a users roles in context...  What I mean by that is that if the user is on a page in course X which belongs in subaccount Z, my function would ideally return that user's role in course X, along with their roles in subaccount Z and any parents accounts of that, but not subccounts in different branches of the account structure.  This is similar to the ENV.current_user_roles variable, but my my function would include the actual roles (not just the types) and would be in context, unlike the ENV variable which essentially says the user is a teacher somewhere in the Canvas instance, but maybe not on the page that's loaded right now. I hope this makes sense...

I believe I have this working for course roles, but I'm running into a problem trying to list out admin roles.  I am currently using the admins api to call 'https://<instance>.instructure.com/api/v1/accounts/134/admins?user_id[]=ENV.current_user_id' if ENV.current_user_roles indicates the user has admin access somewhere.  This all works great using my account, which is a full root admin.  What I've discovered in testing is that that API call only seems to work if the user's admin role includes the "Admins add / remove" permission.  I want my function to work somewhat universally, and for many reasons, I can't give every one of our account roles the ability to add other admins.

Anyone have any suggestions on a different API call I could use for this purpose, or a different way to approach it?  I know enough javascript (and how to google things) to be dangerous, but I'm definitely not a full expert.  I know I could somehow use a root admin token to make the API call, but we definitely can't put a key like that in our javascript file that anyone can access.  This is my first time i'm trying to do API calls within the javascript file at all, so I could be approaching this completely incorrectly or inefficiently.  I'm hoping theres an easy solution for this that I just don't know the term to search and find though.

If anyone is interested, I put my rough code on my GitHub at https://github.com/cmcasey79/canvas-customizations-by-chris/blob/master/get_user_context_roles.js.

Thanks in advance for any help someone might be able to provide!

-Chris

[melodyc_lam]

@chriscas Hey! Have you tried using JQuery and Google App Script to get around the issue with the token? You can basically do an HTTP call with JQuery into a Google App Script, and the Google App Script would handle any calls that need a token -- that way it's not publicly exposed in the script or Google App Script.

[chriscas]

Hi @melodyc_lam,

That sounds like it could be the solution I'm looking for (unless Instructure makes changes to the API permissions so people without the add/remove permission could run the API themselves).  I'm usually a learn by example kind of person...  Do you have any links to a project that's taken this approach, or maybe a guide that would walk me through things?  Conceptually I think I understand how this would work, I just need to know how to actually implement it without having to sift through tons of documentation I don't need just to find the relevant parts I do need!

-Chris

[JamesSekcienski]

I have also been hoping to be able to figure this out.  Thanks for sharing what you did to get it working for course roles at least.  I also had trouble figuring out a solution to know the admin role in context.

Depending on what you are trying to achieve, you could look at the user's permissions within the course.  Then if an admin role gives a user access to a course, the permissions for the things they can do should be reflected. Course Permissions 

[chriscas]

Thanks to those that replied here!  I think I was able to figure out the method @melodyc_lam was suggesting to hide the required admin user api key from script viewers (I hope I got that right).

I just updated the javascript file on GitHub to something that appears to be working for me in general.  I'm not exactly sure if this is the most efficient way to go about this task, but I think it may be easier for others to suggest optimizations to working code than starting from scratch.  The google apps script portion of this, where admin roles are being collected can be especially slow depending how deep inside of a subaccount tree you're at in Canvas, as the script has to check each subaccount for roles, then go to the parent account and do the same (repeat all the way to the root account).  I haven't been able to find a better way to do this, but maybe someone will have a suggestion!

I'd love if others could check out the code and maybe even try it out in a test/beta Canvas environment to see how it works and if there are any unanticipated results in areas of Canvas I may not have thought to check.

-Chris