lti

lti/views.py

@@ -0,0 +1,379 @@
+"""
+LTI 1.3 Views for MediaCMS
+
+Implements the LTI 1.3 / LTI Advantage flow:
+- OIDC Login Initiation
+- LTI Launch (JWT validation and processing)
+- JWKS endpoint (public keys)
+- My Media view (iframe-compatible)
+- Embed Media view (LTI-authenticated)
+- Manual NRPS Sync
+"""
+
+import logging
+
+from django.http import HttpResponseRedirect, JsonResponse
+from django.shortcuts import get_object_or_404, render
+from django.urls import reverse
+from django.utils.decorators import method_decorator
+from django.views import View
+from django.views.decorators.clickjacking import xframe_options_exempt
+from django.views.decorators.csrf import csrf_exempt
+from pylti1p3.exception import LtiException
+from pylti1p3.message_launch import MessageLaunch
+from pylti1p3.oidc_login import OIDCLogin
+from rest_framework import status
+from rest_framework.permissions import IsAuthenticated
+from rest_framework.response import Response
+from rest_framework.views import APIView
+
+from files.models import Media
+from rbac.models import RBACMembership
+
+from .adapters import DjangoSessionService, DjangoToolConfig
+from .handlers import (
+    apply_lti_roles,
+    create_lti_session,
+    provision_lti_context,
+    provision_lti_user,
+    validate_lti_session,
+)
+from .models import LTILaunchLog, LTIPlatform, LTIResourceLink
+from .services import LTINRPSClient
+
+logger = logging.getLogger(__name__)
+
+
+def get_client_ip(request):
+    """Get client IP address from request"""
+    x_forwarded_for = request.META.get('HTTP_X_FORWARDED_FOR')
+    if x_forwarded_for:
+        ip = x_forwarded_for.split(',')[0]
+    else:
+        ip = request.META.get('REMOTE_ADDR')
+    return ip
+
+
+@method_decorator(csrf_exempt, name='dispatch')
+class OIDCLoginView(View):
+    """
+    OIDC Login Initiation - Step 1 of LTI 1.3 launch
+
+    Flow: Moodle → This endpoint → Redirect to Moodle auth endpoint
+    """
+
+    def get(self, request):
+        return self.handle_oidc_login(request)
+
+    def post(self, request):
+        return self.handle_oidc_login(request)
+
+    def handle_oidc_login(self, request):
+        """Handle OIDC login initiation"""
+        try:
+            # Get target_link_uri and other OIDC params
+            target_link_uri = request.GET.get('target_link_uri') or request.POST.get('target_link_uri')
+            iss = request.GET.get('iss') or request.POST.get('iss')
+            client_id = request.GET.get('client_id') or request.POST.get('client_id')
+
+            if not all([target_link_uri, iss, client_id]):
+                return JsonResponse({'error': 'Missing required OIDC parameters'}, status=400)
+
+            # Get platform configuration
+            platform = get_object_or_404(LTIPlatform, platform_id=iss, client_id=client_id, active=True)
+
+            # Create tool config for this platform
+            tool_config = DjangoToolConfig.from_platform(platform)
+
+            # Create OIDC login handler
+            launch_data_storage = DjangoSessionService(request)
+            oidc_login = OIDCLogin(request, tool_config, launch_data_storage=launch_data_storage)
+
+            # Redirect to platform's authorization endpoint
+            redirect_obj = oidc_login.enable_check_cookies().redirect(target_link_uri)
+
+            return HttpResponseRedirect(redirect_obj.get_redirect_url())
+
+        except LtiException as e:
+            logger.error(f"LTI OIDC Login Error: {str(e)}")
+            return render(request, 'lti/launch_error.html', {'error': 'OIDC Login Failed', 'message': str(e)}, status=400)
+        except Exception as e:
+            logger.error(f"OIDC Login Error: {str(e)}", exc_info=True)
+            return JsonResponse({'error': 'Internal server error during OIDC login'}, status=500)
+
+
+@method_decorator(csrf_exempt, name='dispatch')
+@method_decorator(xframe_options_exempt, name='dispatch')
+class LaunchView(View):
+    """
+    LTI Launch Handler - Step 3 of LTI 1.3 launch
+
+    Flow: Moodle → This endpoint (with JWT) → Validate → Provision → Session → Redirect
+    """
+
+    def post(self, request):
+        """Handle LTI launch with JWT validation"""
+        platform = None
+        user = None
+        error_message = ''
+        claims = {}
+
+        try:
+            # Get issuer from request
+            id_token = request.POST.get('id_token')
+            if not id_token:
+                raise ValueError("Missing id_token in launch request")
+
+            # Decode JWT to get issuer (without validation first)
+            import jwt
+
+            unverified = jwt.decode(id_token, options={"verify_signature": False})
+            iss = unverified.get('iss')
+            aud = unverified.get('aud')
+
+            # Get platform
+            platform = get_object_or_404(LTIPlatform, platform_id=iss, client_id=aud, active=True)
+
+            # Create tool config
+            tool_config = DjangoToolConfig.from_platform(platform)
+
+            # Validate JWT and get launch data
+            launch_data_storage = DjangoSessionService(request)
+            message_launch = MessageLaunch(request, tool_config, launch_data_storage=launch_data_storage)
+
+            # Get validated launch data
+            launch_data = message_launch.get_launch_data()
+            claims = self.sanitize_claims(launch_data)
+
+            # Extract key claims
+            sub = launch_data.get('sub')
+            resource_link = launch_data.get('https://purl.imsglobal.org/spec/lti/claim/resource_link', {})
+            resource_link_id = resource_link.get('id', 'default')
+            roles = launch_data.get('https://purl.imsglobal.org/spec/lti/claim/roles', [])
+
+            # Check launch type
+            message_type = launch_data.get('https://purl.imsglobal.org/spec/lti/claim/message_type')
+
+            if message_type == 'LtiDeepLinkingRequest':
+                # Deep linking request - handle separately
+                return self.handle_deep_linking_launch(request, message_launch, platform, launch_data)
+
+            # Provision user
+            if platform.auto_create_users:
+                user = provision_lti_user(platform, launch_data)
+            else:
+                # Must find existing user
+                from .models import LTIUserMapping
+
+                mapping = LTIUserMapping.objects.filter(platform=platform, lti_user_id=sub).first()
+                if not mapping:
+                    raise ValueError("User auto-creation disabled and no existing mapping found")
+                user = mapping.user
+
+            # Provision context (category + RBAC group)
+            if 'https://purl.imsglobal.org/spec/lti/claim/context' in launch_data:
+                category, rbac_group, resource_link_obj = provision_lti_context(platform, launch_data, resource_link_id)
+
+                # Apply roles
+                apply_lti_roles(user, platform, roles, rbac_group)
+            else:
+                # No context - might be a direct media embed
+                resource_link_obj = None
+
+            # Create session
+            create_lti_session(request, user, message_launch, platform)
+
+            # Log successful launch
+            LTILaunchLog.objects.create(platform=platform, user=user, resource_link=resource_link_obj, launch_type='resource_link', success=True, claims=claims, ip_address=get_client_ip(request))
+
+            # Determine where to redirect
+            redirect_url = self.determine_redirect(launch_data, resource_link_obj)
+
+            return HttpResponseRedirect(redirect_url)
+
+        except LtiException as e:
+            error_message = f"LTI Launch Error: {str(e)}"
+            logger.error(error_message)
+        except Exception as e:
+            error_message = f"Launch Error: {str(e)}"
+            logger.error(error_message, exc_info=True)
+
+        # Log failed launch
+        if platform:
+            LTILaunchLog.objects.create(platform=platform, user=user, launch_type='resource_link', success=False, error_message=error_message, claims=claims, ip_address=get_client_ip(request))
+
+        return render(request, 'lti/launch_error.html', {'error': 'LTI Launch Failed', 'message': error_message}, status=400)
+
+    def sanitize_claims(self, claims):
+        """Remove sensitive data from claims before logging"""
+        safe_claims = claims.copy()
+        # Remove any sensitive keys if needed
+        return safe_claims
+
+    def determine_redirect(self, launch_data, resource_link):
+        """Determine where to redirect after successful launch"""
+
+        # Check for custom parameters indicating what to show
+        custom = launch_data.get('https://purl.imsglobal.org/spec/lti/claim/custom', {})
+
+        # Check if specific media is requested
+        media_id = custom.get('media_id') or custom.get('media_friendly_token')
+        if media_id:
+            try:
+                media = Media.objects.get(friendly_token=media_id)
+                return reverse('lti:embed_media', args=[media.friendly_token])
+            except Media.DoesNotExist:
+                pass
+
+        # Check resource link for linked media
+        if resource_link and resource_link.media:
+            return reverse('lti:embed_media', args=[resource_link.media.friendly_token])
+
+        # Default: redirect to my media
+        return reverse('lti:my_media')
+
+    def handle_deep_linking_launch(self, request, message_launch, platform, launch_data):
+        """Handle deep linking request"""
+        # Store deep link data in session
+        deep_link = message_launch.get_deep_link()
+
+        request.session['lti_deep_link'] = {
+            'deep_link_return_url': deep_link.get_response_url(),
+            'deployment_id': launch_data.get('https://purl.imsglobal.org/spec/lti/claim/deployment_id'),
+            'platform_id': platform.id,
+        }
+
+        # Redirect to media selection page
+        return HttpResponseRedirect(reverse('lti:select_media'))
+
+
+class JWKSView(View):
+    """
+    JWKS Endpoint - Provides tool's public keys
+
+    Used by Moodle to validate signatures from MediaCMS
+    """
+
+    def get(self, request):
+        """Return tool's public JWK Set"""
+        # For now, return empty JWKS since we're not signing responses
+        # In the future, we can generate and store keys for signing deep linking responses
+        jwks = {"keys": []}
+
+        return JsonResponse(jwks, content_type='application/json')
+
+
+@method_decorator(xframe_options_exempt, name='dispatch')
+class MyMediaLTIView(View):
+    """
+    My Media page for LTI-authenticated users
+
+    Shows user's media profile in iframe
+    """
+
+    def get(self, request):
+        """Display my media page"""
+        # Validate LTI session
+        lti_session = validate_lti_session(request)
+
+        if not lti_session:
+            return JsonResponse({'error': 'Not authenticated via LTI'}, status=403)
+
+        # Redirect to user's profile page
+        # The existing user profile page is already iframe-compatible
+        return HttpResponseRedirect(f"/user/{request.user.username}")
+
+
+@method_decorator(xframe_options_exempt, name='dispatch')
+class EmbedMediaLTIView(View):
+    """
+    Embed media with LTI authentication
+
+    Pattern: Extends existing /embed functionality
+    """
+
+    def get(self, request, friendly_token):
+        """Display embedded media"""
+        media = get_object_or_404(Media, friendly_token=friendly_token)
+
+        # Check LTI session
+        lti_session = validate_lti_session(request)
+
+        if lti_session and request.user.is_authenticated:
+            # Check RBAC access via course membership
+            if request.user.has_member_access_to_media(media):
+                can_view = True
+            else:
+                can_view = False
+        else:
+            # Fall back to public state check
+            can_view = media.state == 'public'
+
+        if not can_view:
+            return JsonResponse({'error': 'Access denied', 'message': 'You do not have permission to view this media'}, status=403)
+
+        # Redirect to existing embed page
+        # The existing embed page already handles media display in iframes
+        return HttpResponseRedirect(f"/embed?m={friendly_token}")
+
+
+class ManualSyncView(APIView):
+    """
+    Manual NRPS sync for course members/roles
+
+    Endpoint: POST /lti/sync/<platform_id>/<context_id>/
+    Requires: User must be manager in the course RBAC group
+    """
+
+    permission_classes = [IsAuthenticated]
+
+    def post(self, request, platform_id, context_id):
+        """Manually trigger NRPS sync"""
+        try:
+            # Get platform
+            platform = get_object_or_404(LTIPlatform, id=platform_id, active=True)
+
+            # Find resource link by context
+            resource_link = LTIResourceLink.objects.filter(platform=platform, context_id=context_id).first()
+
+            if not resource_link:
+                return Response({'error': 'Context not found', 'message': f'No resource link found for context {context_id}'}, status=status.HTTP_404_NOT_FOUND)
+
+            # Verify user has manager role in the course
+            rbac_group = resource_link.rbac_group
+            if not rbac_group:
+                return Response({'error': 'No RBAC group', 'message': 'This context does not have an associated RBAC group'}, status=status.HTTP_400_BAD_REQUEST)
+
+            is_manager = RBACMembership.objects.filter(user=request.user, rbac_group=rbac_group, role='manager').exists()
+
+            if not is_manager:
+                return Response({'error': 'Insufficient permissions', 'message': 'You must be a course manager to sync members'}, status=status.HTTP_403_FORBIDDEN)
+
+            # Check NRPS is enabled
+            if not platform.enable_nrps:
+                return Response({'error': 'NRPS disabled', 'message': 'Names and Role Provisioning Service is disabled for this platform'}, status=status.HTTP_400_BAD_REQUEST)
+
+            # Get last successful launch for NRPS endpoint
+            last_launch = LTILaunchLog.objects.filter(platform=platform, resource_link=resource_link, success=True).order_by('-created_at').first()
+
+            if not last_launch:
+                return Response({'error': 'No launch data', 'message': 'No successful launch data found for NRPS'}, status=status.HTTP_400_BAD_REQUEST)
+
+            # Perform NRPS sync
+            nrps_client = LTINRPSClient(platform, last_launch.claims)
+            result = nrps_client.sync_members_to_rbac_group(rbac_group)
+
+            return Response(
+                {
+                    'status': 'success',
+                    'message': f'Successfully synced {result["synced"]} members',
+                    'synced_count': result['synced'],
+                    'removed_count': result.get('removed', 0),
+                    'synced_at': result['synced_at'],
+                },
+                status=status.HTTP_200_OK,
+            )
+
+        except Exception as e:
+            logger.error(f"NRPS sync error: {str(e)}", exc_info=True)
+            return Response({'error': 'Sync failed', 'message': str(e)}, status=status.HTTP_500_INTERNAL_SERVER_ERROR)