mako/coldcall_lti
1
0
Fork 0
Code Activity

Phase 2: LTI plumbing, roster sync, and fake-launch dev mode

Browse Source 
OIDC login, launch, and JWKS endpoints built on pylti1p3next's Flask
adapter, with launch-claim processing split into a testable module.
Instructor launches refresh the roster through NRPS; the sync code is
source-agnostic and also drives the dev-mode fake roster. Dev mode
(COLDCALL_DEV_MODE=1) provides fake instructor and student personas
that set up the same session state as a real launch, so the rest of
the app can be developed before a Canvas Developer Key exists.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Benjamin Mako Hill
2026-07-31 16:33:08 -07:00
parent 8d8a463f81
commit 52afc57ebd
18 changed files with 764 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
README.md
View File

@@ -61,5 +61,43 @@ Create the database and run the tests:
```
Configuration is by environment variable: `COLDCALL_DATABASE_URL` (any
SQLAlchemy URL; defaults to an SQLite file under `instance/`) and
`COLDCALL_SECRET_KEY` for Flask sessions.
SQLAlchemy URL; defaults to an SQLite file under `instance/`),
`COLDCALL_SECRET_KEY` for Flask sessions, `COLDCALL_LTI_CONFIG` (path
to the LTI platform configuration), and `COLDCALL_DEV_MODE=1` to enable
the fake-launch pages.
## Connecting to Canvas
The tool speaks LTI 1.3, which requires a Developer Key created by a
Canvas account admin. The key points Canvas at three endpoints here:
`/lti/login` (OIDC initiation), `/lti/launch` (the launch target), and
`/lti/jwks` (this tool's public keys). The platform side is described
in a JSON file — copy `lti_config.example.json` to
`instance/lti_config.json` and fill in the client id and deployment id
from the Developer Key. Generate the tool's keypair alongside it:
```
openssl genrsa -out instance/private.key 4096
openssl rsa -in instance/private.key -pubout -out instance/public.key
```
On each instructor launch the tool refreshes the course roster from
Canvas through the Names and Role Provisioning Service, so enrollment
changes appear without any manual step.
## Developing without Canvas
Because a Developer Key takes institutional approval to get, the app
has a fake-launch mode for local development:
```
COLDCALL_DEV_MODE=1 .venv/bin/flask --app coldcall_lti run --debug
```
Then open http://localhost:5000/dev and launch as the fake instructor
or any of the fake students. This sets up exactly the session state a
real launch would, and the fake roster flows through the same sync code
as real NRPS data, so everything past the launch behaves identically.
Dev mode also relaxes the cookie settings that Canvas's iframe
embedding requires in production (SameSite=None; Secure), which would
otherwise break plain-http localhost use.