Ability to serve LO Blocks via LO while signing in through Canvas - #246
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| 'family_name': claims.get('family_name', ''), | ||
| 'picture': claims.get('picture', ''), | ||
| 'role': learning_observer.auth.ROLES.TEACHER if is_instructor else learning_observer.auth.ROLES.STUDENT, | ||
| 'authorized': is_instructor, | ||
| # TODO determine how to determine authorized for both instructors and students | ||
| 'authorized': True, |
There was a problem hiding this comment.
The LTI SSO flow now sets 'authorized': True for every user regardless of their roles, replacing the previous is_instructor check. Downstream guards such as auth.utils._role_required and the client-side authorized() checks gate access primarily on the authorized flag before role-specific logic, so this change treats all LTI students as fully authenticated and bypasses the unauthorized view even when no instructor role is present. Unless the intent is to grant teacher-level access to all LTI roles, authorized should remain tied to the role check or the role gate should be strengthened to avoid exposing protected dashboards to students.
Useful? React with 👍 / 👎.
|
@codex review |
|
Codex Review: Didn't find any major issues. Delightful! ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1 participant
No description provided.