From 53176786c81f0f890eb6513669f8cc9f2080e1fc Mon Sep 17 00:00:00 2001
From: Jake Dallimore <jake@moodle.com>
Date: Wed, 3 Apr 2024 14:04:52 +0800
Subject: [PATCH] MDL-81409 enrol_lti: fixes to dynamic registration to support
 Blackboard

The following fixes resolve issues when used with Blackboard Learn:
- Set registration request Content-Type header to application/json
- Make registration_token optional, per the spec:
https://www.imsglobal.org/node/200666#step-1-registration-initiation-request
- Conditionally create the deployment since it's optional in
lti-tool-configuration:
https://www.imsglobal.org/node/200666#lti-configuration-0
- Remove empty custom_parameters property, since that's optional too:
https://www.imsglobal.org/node/200666#lti-configuration-0
- Remove overly-strict validation on registration_token. This was
validating the param as a JWT, but since the spec has stabilised, this
is not always the case. It's a Bearer token that's opaque to the tool
(i.e. it's just passed back unmodified), so while it could be validated
against RFC6750, it's simplest to just remove the validation entirely.
- change targetOrigin of the postMessage to '*' as per the spec:
https://www.imsglobal.org/node/200666#step-4-registration-completed-and-activation
---
 enrol/lti/register.php | 25 ++++++++++++++-----------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/enrol/lti/register.php b/enrol/lti/register.php
index b5e3bf34830..cda46d1f2bc 100644
--- a/enrol/lti/register.php
+++ b/enrol/lti/register.php
@@ -52,11 +52,8 @@ $PAGE->set_pagelayout('popup');
 // URL to the platform's OpenID configuration.
 $openidconfigurl = required_param('openid_configuration', PARAM_URL);
 
-// Token generated by the platform, which must be sent back in registration request.
-$regtoken = required_param('registration_token', PARAM_RAW);
-if (!preg_match('/[a-zA-Z0-9-_.]+/', $regtoken)) { // 0 on no match, FALSE on error.
-    throw new coding_exception('Invalid registration_token.');
-}
+// Token generated by the platform, which must be sent back in registration request. This is opaque to the tool.
+$regtoken = optional_param('registration_token', null, PARAM_RAW);
 
 // Moodle-specific token used to secure the dynamic registration URL.
 $token = required_param('token', PARAM_ALPHANUM);
@@ -122,7 +119,6 @@ $regrequest = (object) [
     'https://purl.imsglobal.org/spec/lti-tool-configuration' => [
         'domain' => $parsed['host'],
         'target_link_uri' => $CFG->wwwroot . '/enrol/lti/launch.php',
-        'custom_parameters' => [],
         'claims' => [
             'iss',
             'sub',
@@ -157,7 +153,10 @@ $regrequest = (object) [
     ]
 ];
 
-$curl->setHeader(['Authorization: Bearer ' . $regtoken]);
+if (!is_null($regtoken)) {
+    $curl->setHeader(['Authorization: Bearer ' . $regtoken]);
+}
+$curl->setHeader('Content-Type: application/json');
 $regrequest = json_encode($regrequest);
 $regresponse = $curl->post($regendpoint, $regrequest);
 $errno = $curl->get_errno();
@@ -184,12 +183,16 @@ if ($regresponse) {
         $draftreg->complete_registration();
         $appreg = $appregrepo->save($draftreg);
 
-        $deployment = $appreg->add_tool_deployment($toolconfig->deployment_id, $toolconfig->deployment_id);
-        $deploymentrepo = new deployment_repository();
-        $deploymentrepo->save($deployment);
+        // Deployment id is optional.
+        // If this isn't provided by the platform at this time, it must be manually set in Site admin before launches can happen.
+        if (!empty($toolconfig->deployment_id)) {
+            $deployment = $appreg->add_tool_deployment($toolconfig->deployment_id, $toolconfig->deployment_id);
+            $deploymentrepo = new deployment_repository();
+            $deploymentrepo->save($deployment);
+        }
     }
 }
 
 echo "<script>
-(window.opener || window.parent).postMessage({subject: 'org.imsglobal.lti.close'}, '$openidconfig->issuer');
+(window.opener || window.parent).postMessage({subject: 'org.imsglobal.lti.close'}, '*');
 </script>";