atomic_lti 1.2.0 → 1.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7381dbf24886137688f92e773144dd5194746ad605b426d743221a7ba2ec25ba
-  data.tar.gz: ebc4d85849a13db6df43c0b6d906af6fe32b453fbbf3cf34934ff647a64d68c8
+  metadata.gz: a219867c2a1f19737d0222b0896e30a28144310a6032f1f6419443af37006304
+  data.tar.gz: ee72503b3f1066f5e3a5ea710da6d818eb2680d79d60e805c828b8f34ef95917
 SHA512:
-  metadata.gz: 129f9b79ae60f4bb7a00db8199c83ee0348a6d2484280f895736e89e9d26cf3531fe9b557072cd07011234675ce658a8dfe6e1227e81442c2cdbcb2dccd4e685
-  data.tar.gz: 955d5ff4465790e5106d9b551fdcd8b52b8a93cd41c919b16ac1d2c6b31cfd97f2637b8bd64aa5b26cd702e54c90ecb578749c9bc6ce8486057cb163d5978027
+  metadata.gz: 49fd684fa99b65a02402d968b2c53741af0ca19594f0a9ab083cc6d9e3e3a2780caeba0f4de3b31db200dcb8fa745d9b1771b0eae1ef7c025ad68baff5e49fb6
+  data.tar.gz: 8670e8c13dec604b3af371ad7bff7fb7102be8aac32e32ae0e3ebca80718546e1cab5dfb559f18455bddcd2535032310e6be6b12ad568e9d74b4dc1c29ba25c6

data/app/lib/atomic_lti/lti.rb

@@ -16,6 +16,19 @@ module AtomicLti
         errors.push("LTI token is missing required field sub")
       end
 
+      if decoded_token["aud"].blank?
+        errors.push("LTI token is missing required field aud")
+      end
+
+      if decoded_token["aud"].is_a?(Array) && decoded_token["aud"].length > 1
+        # OpenID Connect spec specifies the AZP should exist and be an AUD
+        if decoded_token["azp"].blank?
+          errors.push("LTI token has multiple aud and is missing required field azp")
+        elsif decoded_token["aud"].exclude?(decoded_token["azp"])
+          errors.push("LTI token azp is not one of the aud's")
+        end
+      end
+
       if decoded_token[AtomicLti::Definitions::DEPLOYMENT_ID].blank?
         errors.push(
           "LTI token is missing required field #{AtomicLti::Definitions::DEPLOYMENT_ID}"
@@ -90,5 +103,17 @@ module AtomicLti
         false
       end
     end
+
+    def self.client_id(decoded_token)
+      if decoded_token["aud"]&.is_a?(Array)
+        if decoded_token["aud"].length > 1
+          decoded_token["azp"]
+        else
+          decoded_token["aud"][0]
+        end
+      else
+        decoded_token["aud"]
+      end
+    end
   end
-end
+end

data/app/lib/atomic_lti/services/line_items.rb

@@ -27,7 +27,7 @@ module AtomicLti
           tag: tag,
           startDateTime: start_date_time,
           endDateTime: end_date_time,
-        }
+        }.compact
         attrs["resourceLinkId"] = resource_link_id if resource_link_id
         if external_tool_url
           attrs[AtomicLti::Definitions::CANVAS_SUBMISSION_TYPE] = {

data/lib/atomic_lti/open_id_middleware.rb

@@ -159,7 +159,7 @@ module AtomicLti
     end
 
     def update_install(id_token:)
-      client_id = id_token["aud"]
+      client_id = AtomicLti::Lti.client_id(id_token)
       iss = id_token["iss"]
 
       if client_id.present? && iss.present?
@@ -202,7 +202,7 @@ module AtomicLti
     end
 
     def update_deployment(id_token:)
-      client_id = id_token["aud"]
+      client_id = AtomicLti::Lti.client_id(id_token)
       iss = id_token["iss"]
       deployment_id = id_token[AtomicLti::Definitions::DEPLOYMENT_ID]
       platform_guid = id_token.dig(AtomicLti::Definitions::TOOL_PLATFORM_CLAIM, "guid")

data/lib/atomic_lti/version.rb

@@ -1,3 +1,3 @@
 module AtomicLti
-  VERSION = '1.2.0'
+  VERSION = '1.3.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: atomic_lti
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.3.0
 platform: ruby
 authors:
 - Matt Petro
@@ -10,36 +10,36 @@ authors:
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-03-21 00:00:00.000000000 Z
+date: 2023-03-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
-  name: rails
+  name: pg
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 7.0.3
+        version: '1.3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 7.0.3
+        version: '1.3'
 - !ruby/object:Gem::Dependency
-  name: pg
+  name: rails
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.3.5
+        version: '7.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - '='
+    - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.3.5
+        version: '7.0'
 description: AtomicLti implements the LTI Advantage specification. This gem does contain
   source code specific to other Atomic Jolt products
 email: