Phase 2: LTI plumbing, roster sync, and fake-launch dev mode

OIDC login, launch, and JWKS endpoints built on pylti1p3next's Flask
adapter, with launch-claim processing split into a testable module.
Instructor launches refresh the roster through NRPS; the sync code is
source-agnostic and also drives the dev-mode fake roster. Dev mode
(COLDCALL_DEV_MODE=1) provides fake instructor and student personas
that set up the same session state as a real launch, so the rest of
the app can be developed before a Canvas Developer Key exists.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_app.py

@@ -0,0 +1,58 @@
+import pytest
+
+from coldcall_lti import create_app
+from coldcall_lti.config import Config
+from coldcall_lti.db import Base
+
+
+def make_app(tmp_path, dev_mode):
+    class TestConfig(Config):
+        TESTING = True
+        DATABASE_URL = f"sqlite:///{tmp_path}/test.sqlite3"
+        DEV_MODE = dev_mode
+        SECRET_KEY = "test"
+
+    app = create_app(TestConfig)
+    Base.metadata.create_all(app.extensions["db_engine"])
+    return app
+
+
+@pytest.fixture
+def dev_client(tmp_path):
+    return make_app(tmp_path, dev_mode=True).test_client()
+
+
+def test_healthz(tmp_path):
+    client = make_app(tmp_path, dev_mode=False).test_client()
+    assert client.get("/healthz").json == {"status": "ok"}
+
+
+def test_dev_routes_absent_outside_dev_mode(tmp_path):
+    client = make_app(tmp_path, dev_mode=False).test_client()
+    assert client.get("/dev/").status_code == 404
+
+
+def test_views_require_launch(dev_client):
+    assert dev_client.get("/instructor").status_code == 403
+    assert dev_client.get("/me").status_code == 403
+
+
+def test_dev_instructor_launch_shows_roster(dev_client):
+    assert dev_client.get("/dev/").status_code == 200
+    resp = dev_client.post(
+        "/dev/launch/dev-instructor", follow_redirects=True
+    )
+    assert resp.status_code == 200
+    page = resp.get_data(as_text=True)
+    assert "8 active students" in page
+    assert "Ada Lovelace" in page
+
+
+def test_dev_student_launch(dev_client):
+    resp = dev_client.post(
+        "/dev/launch/dev-student-1", follow_redirects=True
+    )
+    page = resp.get_data(as_text=True)
+    assert "Ada Lovelace" in page
+    # A student cannot reach the instructor view.
+    assert dev_client.get("/instructor").status_code == 403

tests/test_launch.py

@@ -0,0 +1,51 @@
+from coldcall_lti import launch, models
+
+
+def sample_launch_data(is_instructor=False):
+    roles = [launch.ROLE_INSTRUCTOR] if is_instructor else [launch.ROLE_LEARNER]
+    return {
+        "sub": "canvas-user-42",
+        "name": "Pat Example",
+        "email": "pat@example.edu",
+        "picture": "https://example.edu/pat.png",
+        launch.CLAIM_DEPLOYMENT: "dep-1",
+        launch.CLAIM_CONTEXT: {"id": "ctx-abc", "title": "COM 999"},
+        launch.CLAIM_ROLES: roles,
+    }
+
+
+def test_extract_launch_info_student():
+    info = launch.extract_launch_info(sample_launch_data())
+    assert info.context_id == "ctx-abc"
+    assert info.course_title == "COM 999"
+    assert info.user_id == "canvas-user-42"
+    assert info.deployment_id == "dep-1"
+    assert not info.is_instructor
+
+
+def test_extract_launch_info_instructor():
+    info = launch.extract_launch_info(sample_launch_data(is_instructor=True))
+    assert info.is_instructor
+
+
+def test_upsert_launch_creates_and_is_idempotent(db_session):
+    info = launch.extract_launch_info(sample_launch_data())
+    course, student = launch.upsert_launch(db_session, info)
+    assert course.title == "COM 999"
+    assert student.canvas_user_id == "canvas-user-42"
+
+    course2, student2 = launch.upsert_launch(db_session, info)
+    assert course2.id == course.id
+    assert student2.id == student.id
+    assert db_session.query(models.Enrollment).count() == 1
+
+
+def test_upsert_launch_reactivates_dropped_enrollment(db_session):
+    info = launch.extract_launch_info(sample_launch_data())
+    course, student = launch.upsert_launch(db_session, info)
+    enrollment = db_session.query(models.Enrollment).one()
+    enrollment.active = False
+    db_session.flush()
+
+    launch.upsert_launch(db_session, info)
+    assert db_session.query(models.Enrollment).one().active

tests/test_roster.py

@@ -0,0 +1,82 @@
+from coldcall_lti import models
+from coldcall_lti.launch import ROLE_INSTRUCTOR, ROLE_LEARNER
+from coldcall_lti.roster import sync_roster
+
+
+def member(uid, name="A Student", roles=(ROLE_LEARNER,), status="Active", **kw):
+    return {
+        "user_id": uid,
+        "name": name,
+        "roles": list(roles),
+        "status": status,
+        **kw,
+    }
+
+
+def make_course(db):
+    course = models.Course(lti_context_id="ctx-1")
+    db.add(course)
+    db.flush()
+    return course
+
+
+def test_sync_creates_students_and_enrollments(db_session):
+    course = make_course(db_session)
+    active, deactivated = sync_roster(
+        db_session,
+        course,
+        [
+            member("u1", "Ada Lovelace", given_name="Ada", family_name="Lovelace"),
+            member("u2", "Grace Hopper"),
+            member("t1", "Teacher One", roles=[ROLE_INSTRUCTOR]),
+        ],
+    )
+    assert (active, deactivated) == (3, 0)
+
+    students = {
+        s.canvas_user_id: s for s in db_session.query(models.Student).all()
+    }
+    assert students["u1"].sortable_name == "Lovelace, Ada"
+
+    roles = {
+        e.student.canvas_user_id: e.role
+        for e in db_session.query(models.Enrollment).all()
+    }
+    assert roles == {"u1": "student", "u2": "student", "t1": "instructor"}
+
+
+def test_sync_deactivates_dropped_and_reactivates_returning(db_session):
+    course = make_course(db_session)
+    sync_roster(db_session, course, [member("u1"), member("u2")])
+
+    active, deactivated = sync_roster(db_session, course, [member("u1")])
+    assert (active, deactivated) == (1, 1)
+    dropped = (
+        db_session.query(models.Enrollment)
+        .join(models.Student)
+        .filter(models.Student.canvas_user_id == "u2")
+        .one()
+    )
+    assert not dropped.active
+
+    sync_roster(db_session, course, [member("u1"), member("u2")])
+    assert dropped.active
+
+
+def test_sync_skips_inactive_members(db_session):
+    course = make_course(db_session)
+    active, _ = sync_roster(
+        db_session,
+        course,
+        [member("u1"), member("u2", status="Inactive")],
+    )
+    assert active == 1
+    assert db_session.query(models.Student).count() == 1
+
+
+def test_sync_updates_changed_names(db_session):
+    course = make_course(db_session)
+    sync_roster(db_session, course, [member("u1", "Old Name")])
+    sync_roster(db_session, course, [member("u1", "New Name")])
+    student = db_session.query(models.Student).one()
+    assert student.name == "New Name"