feat: Report email with LIT authorization path

[arkirchner]

To act on spam reports the teacher needs to sign in through the
course to authenticate in the study group. The LTI return URL is used
to link back to the course.

Relates to #2715

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 70.06%. Comparing base (dc156e4) to head (3edf9cf).
Report is 7 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3011      +/-   ##
==========================================
+ Coverage   70.05%   70.06%   +0.01%     
==========================================
  Files         215      215              
  Lines        6846     6849       +3     
==========================================
+ Hits         4796     4799       +3     
  Misses       2050     2050              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Janis4411]

I'm not very familiar with CodeOcean, but the changes make sense to me.

[MrSerth]

As far as I understood the changes, the config setting is global. However, the URL is consumer-specific, which this setting doesn't reflect yet. Therefore, I would either use the "crazy" approach with the LTI params or add a new attribute to each consumer.

[arkirchner]

@MrSerth I think since we practically only have open.hpi.de as a consumer currently, this temporary solution is good enough.

• The LTI parameter association is has many and I can't tell what record to pick.
• Adding a new parameter for the consumer increases the complexity unnecessarily.

I want to release this once and then see what kind of management we need. For the platform moderation, we should be able to moderate all user data without the LTI limitations on the study group.

[MrSerth]

There are other consumers configured on CodeOcean (e.g., including a staging consumer for openHPI), and this feature would be the first to break the multi-tenant approach. Of course, most traffic currently originates from openHPI production.

Regarding the LTI parameter, there should be only a single instance matching all search criteria. This is ensured by a validation we have in place:

codeocean/app/models/lti_parameter.rb

Line 9 in 445113e

validates :external_user_id, uniqueness: {scope: %i[study_group_id exercise_id]}

[arkirchner]

@MrSerth I changed to the launch_presentation_return_url solution. I squashed and updated the description in the commit to reflect the change in the approach.

[MrSerth]

Thanks. I can confirm that the changes work as intended.

There is one implicit assumption made: The exercise URL is static and doesn't change on a per-user basis, since a random element is picked from the LTI parameters. For all use cases we currently have, this is valid, but it could potentially change in dynamic environments (or with the advanced content tree in openHPI and content A/B/n testing, where this assumption might not hold true). This would be circumvented by using the RfC author's LTI params (which, in an unlikely case, could be missing) or by adding a comment about this and changing it on demand in the future.

[arkirchner]

Thank you for this information.

I think this is a solution for right now. In the future, we might need to consider a cleaner approach.

Can this be approved as is?

[MrSerth]

I acknowledge that the solution might be sufficient for now. To clarify our thoughts and persist them, I suggested adding a short comment:

or by adding a comment about this and changing it on demand in the future.

[arkirchner]

I added a comment about the varying URL format.

[MrSerth]

Just to ensure there is no misunderstanding:

An hour ago, you wrote that you've added a comment (past tense), but I cannot see any differences in this PR, any other push activity in this repo, or within Slack/email. Since your previous post did not contain any other link or information on where to look for such a change, I am currently waiting patiently for further instructions. Please let me know if I am making a mistake and overlooking something obvious.

[arkirchner]

I am very sorry I overlooked that the push failed.

[MrSerth]

Thanks for pushing your changes, I just have a minor remark originally started by the spelling mistake.