From 89cba33e91f25b9e894b945bb767c38c4550cddd Mon Sep 17 00:00:00 2001
From: Jake Dallimore <jake@moodle.com>
Date: Thu, 3 Nov 2022 11:42:14 +0800
Subject: [PATCH] MDL-76170 enrol_lti: fix missing secret in enrol_lti_users

If member sync runs before the user launches the tool, a partial record
is created, without consumer secret. Subsequent launches of the tool by
that member don't resolve this and this results in grade sync failing
for any affected users. This patch:
- data fixes the existing affected rows
- fixes the launch code, ensuring secret is recorded on launch,
irrespective of whether the user info record has been created already
or not.
---
 enrol/lti/classes/tool_provider.php |  3 +++
 enrol/lti/db/upgrade.php            | 21 +++++++++++++++++++++
 enrol/lti/version.php               |  2 +-
 3 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/enrol/lti/classes/tool_provider.php b/enrol/lti/classes/tool_provider.php
index ab5ed85fe91..ad96103cb1b 100644
--- a/enrol/lti/classes/tool_provider.php
+++ b/enrol/lti/classes/tool_provider.php
@@ -344,6 +344,9 @@ class tool_provider extends ToolProvider {
             if ($userlog->serviceurl != $serviceurl) {
                 $userlog->serviceurl = $serviceurl;
             }
+            if (empty($userlog->consumersecret)) {
+                $userlog->consumersecret = $this->consumer->secret;
+            }
             $userlog->lastaccess = time();
             $DB->update_record('enrol_lti_users', $userlog);
         } else {
diff --git a/enrol/lti/db/upgrade.php b/enrol/lti/db/upgrade.php
index 12899b4b65c..396ad92d8f1 100644
--- a/enrol/lti/db/upgrade.php
+++ b/enrol/lti/db/upgrade.php
@@ -90,5 +90,26 @@ function xmldb_enrol_lti_upgrade($oldversion) {
         upgrade_plugin_savepoint(true, 2021051702, 'enrol', 'lti');
     }
 
+    if ($oldversion < 2021051703) {
+        // Update lti user information for any users missing a consumer secret.
+        // This applies to any user who has launched the tool (i.e. has lastaccess) but who doesn't have a secret recorded.
+        // This fixes a bug where enrol_lti_users records are created first during a member sync, and are missing the secret,
+        // even despite having launched the tool subsequently.
+        $sql = "SELECT lu.id, lc.secret
+                  FROM {enrol_lti_users} lu
+                  JOIN {enrol_lti_lti2_consumer} lc
+                    ON (lu.consumerkey = lc.consumerkey256)
+                 WHERE lu.consumersecret IS NULL
+                   AND lu.lastaccess IS NOT NULL";
+        $affectedltiusersrs = $DB->get_recordset_sql($sql);
+        foreach ($affectedltiusersrs as $ltiuser) {
+            $DB->set_field('enrol_lti_users', 'consumersecret', $ltiuser->secret, ['id' => $ltiuser->id]);
+        }
+        $affectedltiusersrs->close();
+
+        // Lti savepoint reached.
+        upgrade_plugin_savepoint(true, 2021051703, 'enrol', 'lti');
+    }
+
     return true;
 }
diff --git a/enrol/lti/version.php b/enrol/lti/version.php
index d9eb0038c6d..d3d5b100f8f 100644
--- a/enrol/lti/version.php
+++ b/enrol/lti/version.php
@@ -24,6 +24,6 @@
 
 defined('MOODLE_INTERNAL') || die();
 
-$plugin->version = 2021051702; // The current plugin version (Date: YYYYMMDDXX).
+$plugin->version = 2021051703; // The current plugin version (Date: YYYYMMDDXX).
 $plugin->requires = 2021051100; // Requires this Moodle version.
 $plugin->component = 'enrol_lti'; // Full name of the plugin (used for diagnostics).