LTI: поддержка протокола LTI 1.3 для интеграции с внешними инструментами.

HwProj.APIGateway/HwProj.APIGateway.API/Controllers/CoursesController.cs

@@ -3,6 +3,7 @@
 using System.Net;
 using System.Threading.Tasks;
 using AutoMapper;
+using HwProj.APIGateway.API.Lti.Services;
 using HwProj.APIGateway.API.Models;
 using HwProj.AuthService.Client;
 using HwProj.CoursesService.Client;
@@ -22,16 +23,19 @@ namespace HwProj.APIGateway.API.Controllers;
 public class CoursesController : AggregationController
 {
     private readonly ICoursesServiceClient _coursesClient;
+    private readonly ILtiToolService _ltiToolService;
     private readonly IMapper _mapper;
     private readonly IStudentsInformationProvider _studentsInfo;
 
     public CoursesController(
         ICoursesServiceClient coursesClient,
+        ILtiToolService ltiToolService,
         IAuthServiceClient authServiceClient,
         IMapper mapper,
         IStudentsInformationProvider studentsInfo) : base(authServiceClient)
     {
         _coursesClient = coursesClient;
+        _ltiToolService = ltiToolService;
         _mapper = mapper;
         _studentsInfo = studentsInfo;
     }
@@ -103,6 +107,40 @@ public async Task<IActionResult> GetProgramNames()
     [ProducesResponseType(typeof(long), (int)HttpStatusCode.OK)]
     public async Task<IActionResult> CreateCourse(CreateCourseViewModel model)
     {
+        AccountDataDto? ltiBot = null;
+
+        if (!string.IsNullOrWhiteSpace(model.LtiToolName))
+        {
+            var ltiTool = _ltiToolService.GetByName(model.LtiToolName);
+            if (ltiTool == null)
+            {
+                return BadRequest($"LTI-инструмент '{model.LtiToolName}' не найден");
+            }
+
+            var botResult = await AuthServiceClient.GetOrCreateLtiBot(ltiTool.ClientId);
+            if (!botResult.Succeeded)
+            {
+                return StatusCode(
+                    (int)HttpStatusCode.ServiceUnavailable,
+                    botResult.Errors);
+            }
+
+            ltiBot = botResult.Value;
+            if (ltiBot == null)
+            {
+                return StatusCode(
+                    (int)HttpStatusCode.InternalServerError,
+                    "LTI-бот был создан, но его данные не найдены");
+            }
+
+            if (ltiBot.Role != Roles.ExpertRole)
+            {
+                return StatusCode(
+                    (int)HttpStatusCode.InternalServerError,
+                    "LTI-бот не имеет роли Expert");
+            }
+        }
+
         if (model.GroupNames.Any() && model.FetchStudents)
         {
             var studentCandidates = new List<StudentModel>();
@@ -138,9 +176,33 @@ public async Task<IActionResult> CreateCourse(CreateCourseViewModel model)
         }
 
         var result = await _coursesClient.CreateCourse(model);
-        return result.Succeeded
-            ? Ok(result.Value)
-            : BadRequest(result.Errors);
+        if (!result.Succeeded)
+        {
+            return BadRequest(result.Errors);
+        }
+
+        if (ltiBot != null)
+        {
+            var addExpertResult = await _coursesClient.AcceptLecturer(
+                result.Value,
+                ltiBot.Email,
+                ltiBot.UserId,
+                sendNotification: false);
+
+            if (!addExpertResult.Succeeded)
+            {
+                return StatusCode(
+                    (int)HttpStatusCode.InternalServerError,
+                    new
+                    {
+                        CourseId = result.Value,
+                        Errors = addExpertResult.Errors,
+                        Message = "Курс создан, но LTI-бот не был добавлен как эксперт"
+                    });
+            }
+        }
+
+        return Ok(result.Value);
     }
 
     [HttpPost("update/{courseId}")]
@@ -310,7 +372,8 @@ private async Task<CourseViewModel> ToCourseViewModel(CourseDTO course)
             Homeworks = course.Homeworks,
             Groups = course.Groups,
             IsCompleted = course.IsCompleted,
-            IsOpen = course.IsOpen
+            IsOpen = course.IsOpen,
+            LtiToolName =  course.LtiToolName,
         };
     }
 }

HwProj.APIGateway/HwProj.APIGateway.API/Controllers/SolutionsController.cs

@@ -138,6 +138,7 @@ public async Task<IActionResult> GetStudentSolution(long taskId, string studentI
         return Ok(new UserTaskSolutionsPageData
         {
             CourseId = course.Id,
+            LtiToolName = course.LtiToolName,
             CourseMates = accounts,
             TaskSolutions = taskSolutions
         });

HwProj.APIGateway/HwProj.APIGateway.API/HwProj.APIGateway.API.csproj

@@ -21,6 +21,7 @@
   </ItemGroup>
 
   <ItemGroup>
+    <PackageReference Include="LtiAdvantage" Version="3.0.0" />
     <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="8.0.20" />
     <PackageReference Include="Swashbuckle.AspNetCore" Version="9.0.4" />
     <PackageReference Include="AutoMapper" Version="15.0.1" />

HwProj.APIGateway/HwProj.APIGateway.API/Lti/Configuration/LtiPlatformConfig.cs

@@ -0,0 +1,19 @@
+namespace HwProj.APIGateway.API.Lti.Configuration;
+
+public class LtiPlatformConfig
+{
+    public string Issuer { get; set; }
+    public string OidcAuthorizationEndpoint { get; set; }
+    public string DeepLinkReturnUrl { get; set; }
+    public string ResourceLinkReturnUrl { get; set; }
+    public string AssignmentsGradesEndpoint { get; set; }
+    public string AccessTokenUrl { get; set; }
+    public string JwksEndpoint { get; set; }
+    public LtiSigningKeyConfig SigningKey { get; set; }
+}
+
+public class LtiSigningKeyConfig
+{
+    public string KeyId { get; set; }
+    public string PrivateKeyPem { get; set; }
+}

HwProj.APIGateway/HwProj.APIGateway.API/Lti/Configuration/LtiToolConfig.cs

@@ -0,0 +1,13 @@
+namespace HwProj.APIGateway.API.Lti.Configuration
+{
+    public class LtiToolConfig
+    {
+        public string Name { get; set; }
+        public string Issuer { get; set; } 
+        public string ClientId { get; set; }
+        public string JwksEndpoint { get; set; }
+        public string InitiateLoginUri { get; set; }
+        public string LaunchUrl { get; set; }
+        public string DeepLink { get; set; } 
+    }
+}

HwProj.APIGateway/HwProj.APIGateway.API/Lti/Controllers/JwksController.cs

@@ -0,0 +1,57 @@
+using System.Security.Cryptography;
+using HwProj.APIGateway.API.Lti.Configuration;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Options;
+using Microsoft.IdentityModel.Tokens;
+
+namespace HwProj.APIGateway.API.Lti.Controllers;
+
+[Route("api/lti")]
+[ApiController]
+public class JwksController(IOptions<LtiPlatformConfig> options) : ControllerBase
+{
+    private readonly LtiPlatformConfig _config = options.Value;
+
+    [HttpGet("jwks")]
+    [AllowAnonymous]
+    public IActionResult GetJwks()
+    {
+        var keyConfig = _config.SigningKey;
+
+        if (string.IsNullOrEmpty(keyConfig?.PrivateKeyPem))
+        {
+            return StatusCode(500, "Signing key is not configured.");
+        }
+
+        using var rsa = RSA.Create();
+        try
+        {
+            rsa.ImportFromPem(keyConfig.PrivateKeyPem);
+        }
+        catch (CryptographicException)
+        {
+            return StatusCode(500, "Invalid Private Key format in configuration.");
+        }
+
+        var publicParams = rsa.ExportParameters(false);
+
+        var jwks = new
+        {
+            keys = new[]
+            {
+                new
+                {
+                    kty = "RSA",
+                    e = Base64UrlEncoder.Encode(publicParams.Exponent),
+                    n = Base64UrlEncoder.Encode(publicParams.Modulus),
+                    kid = keyConfig.KeyId,
+                    alg = "RS256",
+                    use = "sig"
+                }
+            }
+        };
+
+        return Ok(jwks);
+    }
+}

HwProj.APIGateway/HwProj.APIGateway.API/Lti/Controllers/LtiAccessTokenController.cs

@@ -0,0 +1,113 @@
+using System;
+using System.IdentityModel.Tokens.Jwt;
+using System.Threading.Tasks;
+using HwProj.APIGateway.API.Lti.Configuration;
+using HwProj.APIGateway.API.Lti.Services;
+using HwProj.APIGateway.API.LTI.Services;
+using HwProj.AuthService.Client;
+using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Mvc;
+using Microsoft.Extensions.Options;
+using Microsoft.IdentityModel.Tokens;
+
+namespace HwProj.APIGateway.API.Lti.Controllers;
+
+[Route("api/lti")]
+[ApiController]
+public class LtiAccessTokenController(
+    IOptions<LtiPlatformConfig> options,
+    ILtiToolService toolService,
+    ILtiKeyService ltiKeyService,
+    ILtiTokenService tokenService,
+    IAuthServiceClient authServiceClient
+    ) : ControllerBase
+{
+    [HttpPost("token")]
+    [AllowAnonymous]
+    public async Task<IActionResult> GetTokenAsync([FromForm] IFormCollection form)
+    {
+        if (!form.TryGetValue("grant_type", out var grantType) || grantType != "client_credentials")
+        {
+            return BadRequest(new { error = "unsupported_grant_type", error_description = "Only 'client_credentials' is supported." });
+        }
+
+        if (!form.TryGetValue("client_assertion_type", out var assertionType) ||
+            assertionType != "urn:ietf:params:oauth:client-assertion-type:jwt-bearer")
+        {
+            return BadRequest(new { error = "invalid_request", error_description = "Invalid client_assertion_type." });
+        }
+
+        if (!form.TryGetValue("client_assertion", out var clientAssertion))
+        {
+            return BadRequest(new { error = "invalid_request", error_description = "Missing client_assertion." });
+        }
+
+        var handler = new JwtSecurityTokenHandler();
+        if (!handler.CanReadToken(clientAssertion))
+        {
+            return BadRequest(new { error = "invalid_client", error_description = "Invalid JWT structure." });
+        }
+
+        var unverifiedToken = handler.ReadJwtToken(clientAssertion);
+
+        var clientId = unverifiedToken.Issuer;
+
+        var tool = toolService.GetByClientId(clientId);
+        if (tool == null)
+        {
+            return Unauthorized(new { error = "invalid_client", error_description = $"Unknown clientId: {clientId}" });
+        }
+
+        var signingKeys = await ltiKeyService.GetKeysAsync(tool.JwksEndpoint);
+
+        try
+        {
+            var tokenEndpointUrl = options.Value.AccessTokenUrl;
+
+            handler.ValidateToken(clientAssertion, new TokenValidationParameters
+            {
+                ValidateIssuer = true,
+                ValidIssuer = tool.ClientId,
+
+                ValidateAudience = true,
+                ValidAudience = tokenEndpointUrl,
+
+                ValidateLifetime = true,
+                ClockSkew = TimeSpan.FromMinutes(5),
+
+                ValidateIssuerSigningKey = true,
+                IssuerSigningKeys = signingKeys
+            }, out _);
+        }
+        catch (Exception ex)
+        {
+            return Unauthorized(new { error = "invalid_client", error_description = $"Token validation failed: {ex.Message}" });
+        }
+
+        const string scope = "https://purl.imsglobal.org/spec/lti-ags/scope/score";
+
+        var botResult = await authServiceClient.GetOrCreateLtiBot(tool.ClientId);
+        if (!botResult.Succeeded || botResult.Value == null)
+        {
+            return StatusCode(StatusCodes.Status500InternalServerError, new
+            {
+                error = "server_error",
+                error_description = "Failed to resolve the LTI bot account."
+            });
+        }
+
+        var accessToken = tokenService.GenerateAccessTokenForLti(
+            tool.ClientId,
+            botResult.Value.UserId,
+            scope);
+
+        return Ok(new
+        {
+            access_token = accessToken,
+            token_type = "Bearer",
+            expires_in = 3600,
+            scope
+        });
+    }
+}