JSON configuration for LTI tools is ignoring the `privacy_level` key

[lf-]

Summary:

When a LTI 1.3 tool is added via the JSON settings, the privacy_level attribute is ignored, and the privacy level is always set to private.

Steps to reproduce:

Enter the dialog on the account admin page to create a new LTI Developer Key with the following JSON (from https://canvas.instructure.com/doc/api/file.lti_dev_key_config.html):

{  
   "title":"The Best Tool",
   "description":"1.3 Test Tool used for documentation purposes.",
   "privacy_level":"public",
   "oidc_initiation_url":"https://your.oidc_initiation_url",
   "target_link_uri":"https://your.target_link_uri",
   "scopes":[
       "https://purl.imsglobal.org/spec/lti-ags/scope/lineitem",
       "https://purl.imsglobal.org/spec/lti-ags/scope/result.readonly"
    ],
   "extensions":[  
      {  
         "domain":"thebesttool.com",
         "tool_id":"the-best-tool",
         "platform":"canvas.instructure.com",
         "settings":{  
            "text":"Launch The Best Tool",
            "icon_url":"https://some.icon.url/tool-level.png",
            "selection_height": 800,
            "selection_width": 800,
            "placements":[  
               {  
                  "text":"User Navigation Placement",
                  "enabled":true,
                  "icon_url":"https://some.icon.url/my_dashboard.png",
                  "placement":"user_navigation",
                  "message_type":"LtiResourceLinkRequest",
                  "target_link_uri":"https://your.target_link_uri/my_dashboard",
                  "canvas_icon_class":"icon-lti",
                  "custom_fields":{  
                     "foo":"$Canvas.user.id"
                   }
               },
               {  
                  "text":"Editor Button Placement",
                  "enabled":true,
                  "icon_url":"https://some.icon.url/editor_tool.png",
                  "placement":"editor_button",
                  "message_type":"LtiDeepLinkingRequest",
                  "target_link_uri":"https://your.target_link_uri/content_selector",
                  "selection_height": 500,
                  "selection_width": 500
               }
            ]
         }
      }
   ],
   "public_jwk":{  
      "kty":"RSA",
      "alg":"RS256",
      "e":"AQAB",
      "kid":"8f796169-0ac4-48a3-a202-fa4f3d814fcd",
      "n":"nZD7QWmIwj-3N_RZ1qJjX6CdibU87y2l02yMay4KunambalP9g0fU9yZLwLX9WYJINcXZDUf6QeZ-SSbblET-h8Q4OvfSQ7iuu0WqcvBGy8M0qoZ7I-NiChw8dyybMJHgpiP_AyxpCQnp3bQ6829kb3fopbb4cAkOilwVRBYPhRLboXma0cwcllJHPLvMp1oGa7Ad8osmmJhXhM9qdFFASg_OCQdPnYVzp8gOFeOGwlXfSFEgt5vgeU25E-ycUOREcnP7BnMUk7wpwYqlE537LWGOV5z_1Dqcqc9LmN-z4HmNV7b23QZW4_mzKIOY4IqjmnUGgLU9ycFj5YGDCts7Q",
      "use":"sig"
   },
   "custom_fields":{  
      "bar":"$Canvas.user.sisid"
   }

}

Note that although it lists "privacy_level": "public":

if we tab over to the Method of "Manual Entry", under "Additional Settings", the privacy is set to private:

It appears to also be behaving as if the privacy level is private as well, as we have been having issues with our LTI tool not getting all the data it's supposed to when our own config was pasted in.

Expected behavior:

The privacy level on the LTI key should be public per the privacy_level parameter in the JSON.

Actual behavior:

The privacy_level key is ignored and the private privacy level is always selected.

Additional notes:

Reproduced on a production cloud Canvas and also this version running in docker:

~/canvas-lms$ git describe --long
release/2020-12-16.47-15539-g008ea7fd2f

[cmcfadden]

I just ran into this too. Looking through the code, it seems like it should work with that keyword?

[lf-]

I was talking to a Canvas expert at my uni and he was saying that it's possible the documentation is wrong as to which section it has to be in. But I don't know if we ended up figuring out what exactly was incorrect.

[simonnorr]

I had the same issue and your canvas expert was right @lf-, I tried moving privacy_level: "public" inside the "settings" which worked. In hindsight, it's quite logical when looking at the UI for Manual Entry.

So using the example above, the correct set-up should be:

{  
   "title":"The Best Tool",
   "description":"1.3 Test Tool used for documentation purposes.",
   "oidc_initiation_url":"https://your.oidc_initiation_url",
   "target_link_uri":"https://your.target_link_uri",
   "scopes":[
       "https://purl.imsglobal.org/spec/lti-ags/scope/lineitem",
       "https://purl.imsglobal.org/spec/lti-ags/scope/result.readonly"
    ],
   "extensions":[  
      {  
         "domain":"thebesttool.com",
         "tool_id":"the-best-tool",
         "platform":"canvas.instructure.com",
         "settings":{  
            "text":"Launch The Best Tool",
            "icon_url":"https://some.icon.url/tool-level.png",
            "selection_height": 800,
            "selection_width": 800,
            "privacy_level":"public", // <---- Insert down here instead
            "placements":[  
               {  
                  "text":"User Navigation Placement",
                  "enabled":true,
                  "icon_url":"https://some.icon.url/my_dashboard.png",
                  "placement":"user_navigation",
                  "message_type":"LtiResourceLinkRequest",
                  "target_link_uri":"https://your.target_link_uri/my_dashboard",
                  "canvas_icon_class":"icon-lti",
                  "custom_fields":{  
                     "foo":"$Canvas.user.id"
                   }
               },
               {  
                  "text":"Editor Button Placement",
                  "enabled":true,
                  "icon_url":"https://some.icon.url/editor_tool.png",
                  "placement":"editor_button",
                  "message_type":"LtiDeepLinkingRequest",
                  "target_link_uri":"https://your.target_link_uri/content_selector",
                  "selection_height": 500,
                  "selection_width": 500
               }
            ]
         }
      }
   ],
   "public_jwk":{  
      "kty":"RSA",
      "alg":"RS256",
      "e":"AQAB",
      "kid":"8f796169-0ac4-48a3-a202-fa4f3d814fcd",
      "n":"nZD7QWmIwj-3N_RZ1qJjX6CdibU87y2l02yMay4KunambalP9g0fU9yZLwLX9WYJINcXZDUf6QeZ-SSbblET-h8Q4OvfSQ7iuu0WqcvBGy8M0qoZ7I-NiChw8dyybMJHgpiP_AyxpCQnp3bQ6829kb3fopbb4cAkOilwVRBYPhRLboXma0cwcllJHPLvMp1oGa7Ad8osmmJhXhM9qdFFASg_OCQdPnYVzp8gOFeOGwlXfSFEgt5vgeU25E-ycUOREcnP7BnMUk7wpwYqlE537LWGOV5z_1Dqcqc9LmN-z4HmNV7b23QZW4_mzKIOY4IqjmnUGgLU9ycFj5YGDCts7Q",
      "use":"sig"
   },
   "custom_fields":{  
      "bar":"$Canvas.user.sisid"
   }

}

[lf-]

PR'd. Thanks for finding this.