panda_pal 5.19.0 → 5.19.2

data/docs/deep-linking.md

@@ -0,0 +1,355 @@
+# Deep Linking Configuration
+
+This document explains how to configure and implement LTI Deep Linking in your PandaPal application.
+
+## Configuration Options
+
+### 1. Placement-Specific Configuration (Recommended)
+
+Configure redirect URLs for specific deep linking placements:
+
+```ruby
+# config/initializers/lti.rb
+
+# Content selection with explicit redirect URL
+PandaPal.stage_placement(:content_selection, {
+  deep_linking: true,
+  deep_link_redirect_url: :content_selection_url,
+  text: 'Select Content',
+  enabled: true
+})
+
+# Module selection using default placement route
+PandaPal.stage_placement(:module_selection, {
+  deep_linking: true,
+  text: 'Select Module',
+  enabled: true,
+  url: :module_selection_url  # Will be used as fallback redirect
+})
+```
+
+### 2. Global Configuration
+
+Set a global default for all deep linking requests:
+
+```ruby
+# config/initializers/lti.rb
+
+PandaPal.lti_options = {
+  title: 'My LTI Tool',
+  deep_link_redirect_url: :deep_link_selection_url
+}
+```
+
+## Implementation
+
+### 1. Create Deep Linking Controller
+
+Create a controller in your main application to handle content selection:
+
+```ruby
+# app/controllers/content_selection_controller.rb
+class ContentSelectionController < ApplicationController
+  include PandaPal::Helpers::ControllerHelper
+  include PandaPal::DeepLinkingHelpers
+
+  def index
+    render component: 'ContentSelection', layout: 'application', prerender: false
+  end
+
+  def create
+    # Handle the content selection and build response
+    selected_content = params[:selected_content_ids]
+    content_items = build_content_items_for_selection(selected_content)
+
+    # Render the deep linking response (this will redirect back to Canvas)
+    render_deep_linking_response(content_items)
+  end
+
+  private
+
+  def build_content_items_for_selection(selected_ids)
+    content_items = []
+
+    selected_ids.each do |content_id|
+      content = find_content(content_id)
+
+      content_items << build_link_content_item(
+        url: panda_pal.v1p3_resource_link_request_url,
+        title: content.title,
+        text: content.description,
+        icon: content.icon_url,
+        thumbnail: content.thumbnail_url,
+        custom: {
+          content_id: content.id,
+          launch_type: :content_launch  # REQUIRED: Used for routing in resource_link_request
+        }
+      )
+    end
+
+    content_items
+  end
+end
+```
+
+### 2. Add Routes
+
+```ruby
+# config/routes.rb
+Rails.application.routes.draw do
+  get '/content-selection', to: 'content_selection#index', as: :content_selection
+  post '/content-selection', to: 'content_selection#create'
+
+  # For simple single content selection
+  post '/quiz-selection', to: 'quiz_selection#create', as: :quiz_selection
+
+  # Add launch routes for your content types
+  lti_nav content_launch: 'content#launch'
+  lti_nav quiz_launch: 'quiz#launch'
+end
+```
+
+### 3. Create Views
+
+#### ERB Template Example
+
+```erb
+<!-- app/views/content_selection/index.html.erb -->
+<h2>Select Content to Add</h2>
+
+<%= form_with url: content_selection_path, method: :post do |form| %>
+  <% @available_content.each do |content| %>
+    <div class="content-item">
+      <%= form.check_box :selected_content_ids, { multiple: true }, content.id, nil %>
+      <%= form.label "selected_content_ids_#{content.id}", content.title %>
+      <p><%= content.description %></p>
+    </div>
+  <% end %>
+
+  <%= form.submit "Add Selected Content" %>
+<% end %>
+```
+
+#### React Component Example
+
+```jsx
+// app/javascript/components/ContentSelection.jsx
+import React, { useState } from 'react';
+
+const ContentSelection = ({ availableContent, submitUrl, csrfToken }) => {
+  const [selectedContentIds, setSelectedContentIds] = useState([]);
+
+  const handleContentToggle = (contentId) => {
+    setSelectedContentIds(prev =>
+      prev.includes(contentId)
+        ? prev.filter(id => id !== contentId)
+        : [...prev, contentId]
+    );
+  };
+
+  const handleSubmit = (e) => {
+    e.preventDefault();
+
+    if (selectedContentIds.length === 0) {
+      alert('Please select at least one content item');
+      return;
+    }
+
+    // Submit the form programmatically
+    e.target.submit();
+  };
+
+  return (
+    <div className="content-selection">
+      <h2>Select Content to Add</h2>
+
+      <form action={submitUrl} method="POST" onSubmit={handleSubmit}>
+        <input type="hidden" name="authenticity_token" value={csrfToken} />
+
+        {availableContent.map(content => (
+          <div key={content.id} className="content-item">
+            <label>
+              <input
+                type="checkbox"
+                checked={selectedContentIds.includes(content.id)}
+                onChange={() => handleContentToggle(content.id)}
+              />
+              <span>{content.title}</span>
+              <p>{content.description}</p>
+            </label>
+          </div>
+        ))}
+
+        {selectedContentIds.map(id => (
+          <input key={id} type="hidden" name="selected_content_ids[]" value={id} />
+        ))}
+
+        <button type="submit" disabled={selectedContentIds.length === 0}>
+          Add {selectedContentIds.length} Selected Item{selectedContentIds.length !== 1 ? 's' : ''}
+        </button>
+      </form>
+    </div>
+  );
+};
+
+export default ContentSelection;
+```
+
+## Helper Methods
+
+PandaPal provides several helper methods to make deep linking easier:
+
+### Content Item Builders
+
+**IMPORTANT: All content items MUST include `launch_type` in the `custom` hash for proper routing.**
+
+```ruby
+# Link content item - REQUIRED: launch_type in custom hash
+build_link_content_item(
+  url: panda_pal.v1p3_resource_link_request_url,
+  title: 'My Content',
+  text: 'Description of the content',
+  icon: 'https://example.com/icon.png',
+  thumbnail: 'https://example.com/thumb.jpg',
+  custom: {
+    content_id: 123,
+    launch_type: :content_launch  # REQUIRED for proper routing
+  }
+)
+
+# File content item - REQUIRED: launch_type in custom hash
+build_file_content_item(
+  url: 'https://example.com/files/document.pdf',
+  title: 'Important Document',
+  text: 'A very important PDF document',
+  media_type: 'application/pdf',
+  icon: 'https://example.com/pdf-icon.png',
+  custom: {
+    document_id: 456,
+    launch_type: :document_launch  # REQUIRED for proper routing
+  }
+)
+
+# HTML content item - REQUIRED: launch_type in custom hash
+build_html_content_item(
+  html: '<h1>Hello World</h1><p>This is embedded HTML content.</p>',
+  title: 'Custom HTML Content',
+  text: 'Custom HTML that will be embedded',
+  custom: {
+    template_id: 789,
+    launch_type: :html_launch  # REQUIRED for proper routing
+  }
+)
+```
+
+### Launch Type Requirement
+
+The `launch_type` parameter in the `custom` hash is **mandatory** because:
+
+1. When Canvas launches your content, it calls the `resource_link_request` action
+2. This action uses the `launch_type` from custom parameters to determine which route to redirect to
+3. Without `launch_type`, the launch will fail to route properly
+
+Make sure to:
+- Define corresponding `lti_nav` routes for each `launch_type`
+- Use descriptive, unique `launch_type` values (e.g., `:quiz_launch`, `:assignment_launch`, `:content_launch`)
+
+### Response Builder
+
+```ruby
+# Simply pass content items to render the deep linking response
+# The helper will automatically use current_session, current_organization, and build custom data
+render_deep_linking_response(content_items)
+
+# You can also pass optional custom data if needed
+render_deep_linking_response(content_items, custom_data: {
+  selection_time: Time.now,
+  selected_by_user_id: current_user.id
+})
+```
+
+## Priority Order
+
+The deep linking redirect URL is determined in this order:
+
+1. **Placement-specific** `deep_link_redirect_url` (highest priority)
+2. **Global** `deep_link_redirect_url` from `PandaPal.lti_options`
+
+If neither is configured, an error will be returned.
+
+## Auto-Submit Form
+
+The `render_deep_linking_response` method automatically builds the JWT response and renders the PandaPal auto-submit form partial (`panda_pal/partials/auto_submit_form`) which will immediately redirect the user back to Canvas with the selected content. All the necessary session data, organization info, and JWT signing is handled automatically.
+
+## Example: Simple Single Content Selection
+
+For a simple case where you always return the same content:
+
+```ruby
+class QuizController < ApplicationController
+  include PandaPal::Helpers::ControllerHelper
+  include PandaPal::DeepLinkingHelpers
+
+  def create
+    # Build a single content item
+    content_item = build_link_content_item(
+      url: panda_pal.v1p3_resource_link_request_url,
+      title: "Quiz: #{@quiz.title}",
+      text: @quiz.description,
+      custom: {
+        quiz_id: params[:quiz_id],
+        launch_type: :quiz_launch  # REQUIRED for proper routing
+      }
+    )
+
+    # Render response immediately
+    render_deep_linking_response([content_item])
+  end
+end
+```
+
+## Complete Example: Group Quiz Selection
+
+```ruby
+class GroupQuizSelectionController < ApplicationController
+  include PandaPal::DeepLinkingHelpers
+
+  def create
+    group_quiz = GroupQuiz.find(params[:group_quiz_id])
+
+    content_item = build_link_content_item(
+      url: panda_pal.v1p3_resource_link_request_url,
+      title: "Group Quiz: #{group_quiz.title}",
+      text: group_quiz.description,
+      custom: {
+        group_quiz_id: group_quiz.id,
+        launch_type: :deep_link_group_quiz  # REQUIRED for proper routing
+      }
+    )
+
+    render_deep_linking_response([content_item])
+  end
+end
+```
+
+And the corresponding route configuration:
+
+```ruby
+# config/routes.rb
+Rails.application.routes.draw do
+  # Deep linking selection routes
+  post '/group-quiz-selection', to: 'group_quiz_selection#create', as: :group_quiz_selection
+
+  # Launch routes (required for the launch_type values used above)
+  lti_nav deep_link_group_quiz: 'group_quiz#launch'
+end
+```
+
+## Troubleshooting
+
+- **Missing launch_type error**: Ensure all content items include `launch_type` in the `custom` hash
+- **Route not found after launch**: Make sure you have corresponding `lti_nav` routes for each `launch_type`
+- Ensure your deep linking URLs are properly configured in the LTI placement
+- Make sure to include the `PandaPal::DeepLinkingHelpers` module in your controllers
+- The auto-submit form requires JavaScript to be enabled in the browser
+- Check that your content URLs are accessible and properly formatted

data/docs/development.md

@@ -0,0 +1,31 @@
+# Developing PandaPal.
+
+PandaPal is a gem, so it has no app of its own to run. The specs use the
+[Combustion](https://github.com/pat/combustion) gem's Rails app in `spec/internal`, which only has a
+`test` database config.
+
+## Requirements.
+
+- Ruby 3.0 or later. `mise.toml` pins the local version.
+- Postgres and Redis. Run them however you like, for example `docker run postgres:17` and
+  `docker run redis`.
+
+## Running specs.
+
+```bash
+bundle install
+bundle exec rspec spec                 # Default bundle (Rails version depends on your Ruby)
+bundle exec appraisal install          # Generate gemfiles/rails_*.gemfile
+bundle exec appraisal rspec spec       # Every Rails version your Ruby supports
+COVERAGE=1 bundle exec rspec spec      # SimpleCov report in coverage/
+```
+
+CI runs Ruby 3.0 and 3.4 against Rails 6.1, 7.1, and 8.0, wherever the Ruby version supports that
+Rails version. See `Appraisals` and `.github/workflows/ci.yml`.
+
+`Gemfile.lock` is gitignored on purpose, because this is a library.
+
+## Specs that change global config.
+
+Tag specs that call `PandaPal.define_tool`, `stage_placement`, or other global LTI config with
+`:isolated_lti_config`, so the changes don't leak into other specs.

data/docs/frontend.md

@@ -0,0 +1,129 @@
+# Frontend with `@inst_proserv/toolkit`.
+
+`@inst_proserv/toolkit` is the CustomDev frontend package for PandaPal apps. It reads the session
+from the page, sends it with API calls, mints limited-use panda tokens in the browser, and opens
+authenticated ActionCable connections. This page covers the parts that talk to PandaPal. The
+package also has InstUI-based components (tables, trays, alerts, prompts, and more).
+
+Modules are imported by path, for example `@inst_proserv/toolkit/cable`. Many apps alias
+`@toolkit` to `@inst_proserv/toolkit` in webpack and `tsconfig.json`.
+
+## Passing the environment to the page.
+
+Toolkit loads app-wide values from a `js-env` meta tag into `env`
+(`@inst_proserv/toolkit/environment`). It also reads `csrf_token` from Rails' `csrf-token` meta tag.
+
+```erb
+<%# app/views/layouts/application.html.erb %>
+<%= csrf_meta_tags %>
+<meta name="js-env" content="<%= js_env.to_json %>">
+```
+
+PandaPal doesn't define `js_env`. Each app defines its own helper. A typical one:
+
+```ruby
+# app/controllers/application_controller.rb
+def js_env
+  @js_env ||= {
+    csrf_token: form_authenticity_token,
+    organization_id: current_organization&.id,
+    base_path: url_for(path: nil, only_path: true),
+    canvas_url: current_organization&.canvas_url,
+  }.tap do |env|
+    if current_session.present?
+      env[:session_key] = current_session.session_key # Full-key panda token
+      env[:launch_params] = current_session.launch_params
+      # Lets toolkit components talk to the Canvas window via postMessage
+      env[:post_message_token] = current_session.get_lti_cust_param(:canvas_post_message_token)
+    end
+  end
+end
+helper_method :js_env
+```
+
+These are the keys toolkit reads:
+
+| Key | Used by |
+| --- | --- |
+| `session_key` | `APIBase`, `panda_tokens`, and `cable`. It must be the full-key panda token from `current_session.session_key`. |
+| `csrf_token` | `APIBase` sends it as `X-CSRF-Token`. |
+| `post_message_token` | `AlertManager` and `ScrollHacksManager`, for Canvas `postMessage` calls. Add `custom_canvas_post_message_token` to `PandaPal.lti_custom_params` to get it from the launch. |
+
+Add your own keys with `setEnvVars({...})`, or extend the `Environment` TypeScript interface.
+
+## API calls.
+
+`APIBase` (`@inst_proserv/toolkit/api`) is an Axios instance preconfigured for PandaPal:
+
+- It sends `Authorization: token=<session_key>` and `X-CSRF-Token` on every request. PandaPal still
+  accepts this legacy header form (see [sessions.md](sessions.md#passing-the-token-to-the-frontend)).
+- `create_href(path)` builds a link with `?session_key=<session_key>`.
+- `download_file(url)` signs same-origin URLs with a `T-URL` panda token that expires after 30
+  seconds, then downloads the file (or opens it in a tab with `in_tab: true`).
+- `protectedRequest` shows the `error` or `message` from a 4xx response as an alert, maps
+  validation `errors` onto a form, and reports anything else to Sentry.
+
+```ts
+import { APIBase } from "@inst_proserv/toolkit/api";
+
+export const api = new APIBase({ subURL: `/organizations/${env.organization_id}/api/v1` });
+const { data } = await api.get("/reports");
+```
+
+## Minting panda tokens in the browser.
+
+`@inst_proserv/toolkit/panda_tokens` signs URLs with the session secret from `env.session_key`, so
+the browser can make `GET` links (downloads, images, and new tabs) without a round trip to the
+server.
+
+```ts
+import { signURL } from "@inst_proserv/toolkit/panda_tokens";
+
+const url = await signURL("/organizations/1/reports/5.csv", {
+  params: { format: "csv" },  // Added to the URL before signing
+  claims: { exp: 60 },        // Seconds. Defaults to 15 minutes. Pass false for no expiration.
+});
+window.open(url);
+```
+
+`signURL` creates a `T-URL` token, which PandaPal accepts as `T-URI`. The token covers the URL's path
+and query, so changing either breaks the signature. It only works for `GET` requests.
+
+Call `configure({ default_expiration, session_secret, ... })` to change the defaults.
+
+## ActionCable.
+
+`@inst_proserv/toolkit/cable` opens an ActionCable connection to `/cable`, authenticated with a
+signed `T-URL` panda token. It works with PandaPal's `connection.panda_session` (see
+[action-cable.md](action-cable.md)).
+
+- The token lasts about six minutes and refreshes every five.
+- Before every connect or reconnect (including after the computer wakes from sleep), toolkit checks
+  the token and refreshes it first if it's stale, so it never connects with an expired token.
+- Subscriptions with the same channel and params share one ActionCable subscription.
+
+```ts
+import { subscribe_channel, useChannelSubscription, useModelSubscription } from "@inst_proserv/toolkit/cable";
+
+// Plain subscription. Returns an unsubscribe function.
+const unsubscribe = subscribe_channel("BackgroundTaskChannel", { id: task.id }, (data) => {
+  console.log(data);
+});
+
+// React hook version
+useChannelSubscription("BackgroundTaskChannel", { id: task.id }, (data) => setProgress(data.progress));
+
+// Keep a MobX model up to date. Each message is merged into the instance.
+useModelSubscription(report, "ReportChannel"); // Subscribes with { id: report.id }
+```
+
+`SubscribeChannel` and `SubscribeModel` are component versions of the hooks. To connect somewhere
+other than `/cable`, or without a panda token, pass your own consumer to
+`setDefaultCableConsumer(...)`, or create a `new CableSubscriptionManager(consumer)`.
+
+## Routing inside the iframe.
+
+`createLtiHistory` (`@inst_proserv/toolkit/extra/LtiHistory`) is a React Router (v5) history that
+keeps the app's location in `history.state` instead of the URL. The iframe URL, and its panda token,
+stay the same while the user moves around the app, and the browser back button still works.
+`<LtiRouter>` from the same module wraps it as a ready-made `<Router>`.

data/docs/grade-passback.md

@@ -0,0 +1,27 @@
+# LTI 1.1 grade passback.
+
+For LTI 1.0/1.1 launches, `PandaPal::Jobs::GradePassbackJob` posts a score back to Canvas with the
+LTI Basic Outcomes service, signed with the Organization's key and secret. For LTI 1.3, use
+[AGS](ags.md) instead.
+
+```ruby
+PandaPal::Jobs::GradePassbackJob.perform_later(current_organization, {
+  passback_guid: launch_params['lis_result_sourcedid'],
+  passback_url: launch_params['lis_outcome_service_url'],
+  score: 0.8,
+})
+```
+
+| Option | Required | Notes |
+| --- | --- | --- |
+| `passback_guid` | Yes | The launch's `lis_result_sourcedid`. |
+| `passback_url` | Yes | The launch's `lis_outcome_service_url`. |
+| `score` and/or `total_score` | Yes, at least one | |
+| `text`, `cdata_text`, `url`, `lti_launch_url`, `submitted_at` | No | Canvas submission extensions. |
+
+The job raises `PandaPal::Jobs::MissingGradePassbackParams` when a required option is missing, and
+`PandaPal::Jobs::GradePassbackFailure` when Canvas rejects the result. On Sidekiq, it retries five
+times.
+
+See the [Canvas assignment tools docs](https://canvas.instructure.com/doc/api/file.assignment_tools.html)
+for what each option does.

data/docs/installation.md

@@ -0,0 +1,129 @@
+# Installing into Canvas.
+
+PandaPal can create an Organization and install the tool into Canvas for it, from the console or
+with rake tasks. Automatic installs need the `bearcat` gem and a Canvas API token in the
+Organization's settings (`settings[:canvas][:api_token]` and `settings[:canvas][:base_url]`).
+
+## From the console.
+
+```ruby
+org.install_lti(
+  host: "https://your_lti.herokuapp.com",
+  context: :org_account,       # (Optional) Where to install. See "Contexts" below.
+  exists: :error,              # (Optional) :error, :replace, :duplicate, or :update
+  version: "v1p3",             # (Optional) "v1p3" or "v1p0"
+  dedicated_deployment: false, # (Optional, LTI 1.3 only, experimental) Link the Organization to one deployment instead of the whole Developer Key
+  tool: :default,              # (Optional) Which tool to install. See multiple-tools.md.
+)
+```
+
+`org.reinstall_lti!(...)` is the same as `install_lti(..., exists: :replace)`.
+`org.lti_installations(context)` lists the matching external tools already in Canvas.
+
+### Contexts.
+
+| Value | Installs into |
+| --- | --- |
+| `:org_account` (default) | The Organization's `canvas_account_id` |
+| `:root_account` | `account/self`, the root account of the API token |
+| `"account/3"`, `"course/1"` | That account or course |
+
+### What `exists:` does when the tool is already installed.
+
+| Value | Behavior |
+| --- | --- |
+| `:error` (default) | Raise an error. |
+| `:update` | Update the existing install. |
+| `:replace` | Delete the existing install, then create a new one. |
+| `:duplicate` | Create another install alongside it. |
+
+### Versions.
+
+`version:` defaults to the tool's `lti_spec_version` option, then `v1p3`. It also accepts `"1.3"`,
+`"1.1"`, and `"v1p1"`. LTI 1.1 installs use the `v1p0` endpoints.
+
+On LTI 1.3, `install_lti`:
+
+- Creates (or reuses) a Developer Key, and sets the Organization's `key` and `secret` right away, so
+  a failed install retries against the same key instead of making another one.
+- Turns the key's account binding on.
+- Turns off `lock_deploying` on the key's LTI Registration during the install if Canvas turned it on, then
+  turns it back on, even if the install fails. The API token needs permission to update LTI
+  Registrations for this to work.
+
+## Install callbacks.
+
+`before_lti_install`, `around_lti_install`, and `after_lti_install` callbacks run around every
+install. Inside them, `current_lti_install` describes the install in progress: `tool`, `host`,
+`context`, `version`, `exists`, `dedicated_deployment`, and, after the install, the Canvas
+`installation`.
+
+```ruby
+# app/models/organization_extension.rb
+module OrganizationExtension
+  extend ActiveSupport::Concern
+
+  included do
+    after_lti_install :configure_canvas
+  end
+
+  def configure_canvas
+    puts "Installed #{current_lti_install.tool} as external tool #{current_lti_install.installation[:id]}"
+  end
+end
+```
+
+The interactive install (`interactive_install!`, used by the rake tasks) also runs
+`panda_pal_interactive_install` callbacks around the whole prompt-and-install loop, inside the
+Organization's tenant:
+
+```ruby
+included do
+  after_panda_pal_interactive_install :seed_defaults
+end
+```
+
+## Rake tasks.
+
+| Task | What it does |
+| --- | --- |
+| `panda_pal:org:new[name]` | Opens `$EDITOR` to create an Organization. The file is prefilled with every setting, with optional ones commented out. |
+| `panda_pal:org:edit[name]` | Same as `new`, for an existing Organization. |
+| `panda_pal:org:install[name,host]` | Installs the tool into Canvas, or updates an existing install (`exists: :update`). |
+| `panda_pal:org:reinstall[name,host]` | Deletes the existing install, then installs again (`exists: :replace`). |
+| `panda_pal:org:dev` | Development only. Creates a `local` Organization with development defaults. |
+| `panda_pal:clean_sessions` | Deletes sessions not updated in the last week. See [sessions.md](sessions.md#session-cleanup). |
+
+Both `install` tasks prompt for the host when it isn't given, and offer to retry if the install
+fails.
+
+### `~/pandapalrc.yml`.
+
+`panda_pal:org:dev` and the interactive install read defaults from `~/pandapalrc.yml`:
+
+```yml
+lti_host: http://localhost:5000
+settings:
+  canvas:
+    base_url: http://localhost:3000
+    api_token: <your local Canvas API token>
+```
+
+Entries under `settings` that aren't in the `settings_structure` are ignored.
+
+## LTI 1.3 checklist.
+
+1. Configure a private key. See [configuration.md](configuration.md#lti-13-private-key).
+    This is optional if you're only interested in LTI launching / Canvas initiates all LTI messages
+2. In production, use a `Rails.cache` store that every app process shares, such as Redis. LTI 1.3
+   replay protection and the JWKS cache depend on it. See
+   [architecture.md](architecture.md#shared-state-that-needs-a-shared-cache).
+3. If you run Canvas locally, make sure `config/redis.yml`, `config/dynamic_settings.yml`, and
+   `config/security.yml` exist in Canvas, and set `development.lti_iss` in `security.yml` to
+   `'http://localhost:3000'` (your Canvas port).
+4. Install with `install_lti`, or set it up by hand. When you set it up by hand, the Organization's
+   `key` is `CLIENT_ID/DEPLOYMENT_ID` (both are in Canvas). Leave off `/DEPLOYMENT_ID` to accept every
+   deployment of the key (the most common approach for CDev).
+
+The tool configuration is served at `<mount>/v1p3/config` (LTI 1.3 JSON) and `<mount>/v1p0/config`
+(LTI 1.0 XML). `<mount>/config` is a legacy alias for the LTI 1.0 XML.