[Saaweel]

An embedded launch of an LTI Advantage tool can fail when another request of the same session runs in parallel, for example the asynchronous requests of the tree in the main bar or the same object in two tabs. The same can happen to a Deep Linking request and a Dynamic Registration.

ilLTIAdvantagePendingRequests keeps what waits to be answered (a login, a Deep Linking request, a Dynamic Registration) in the session. ILIAS writes the whole session back at the end of every request, so a parallel request that read the session earlier removes it again. Besides, the login of a launch is kept under the ref id of the object, so two launches of the same object replace each other.

Fix

• The pending requests are kept in the new table lti_pending_requests, one row per request, for the session (only a hash of the session id is stored). They still expire as before and are used once; expired ones are removed with the next request of the same kind.
• Each launch gets a message hint of its own, so launches of the same object running at the same time do not replace each other.
• PRIVACY.md and README.md describe the new table.

Testing

On a test installation with saLTIre:

• Dynamic Registration of the tool and Deep Linking to create an object.
• Embedded launch with the tree of the main bar open, and with the object open in two tabs at the same time: ILIAS sends the id_token to both launches.
• ilLTIAdvantagePendingRequestsTest covers the storage, expiry, single use and the separation of sessions and kinds.