default to launch url for content-items missing url

refs PLAT-1571

test plan:
return a content item LTI Link that is missing a URL
it should use the URL for the content item launch

Change-Id: I8bf991202b89b2e64a190046c664cca52d5bccb0
Reviewed-on: https://gerrit.instructure.com/82449
Tested-by: Jenkins
Reviewed-by: Andrew Butterfield <abutterfield@instructure.com>
QA-Review: August Thornton <august@instructure.com>
Product-Review: Nathan Mills <nathanm@instructure.com>

Author: rivernate

app/controllers/external_content_controller.rb

@@ -56,7 +56,6 @@ def success
     if params[:id]
       message_auth = Lti::MessageAuthenticator.new(request.original_url, request.GET.merge(request.POST))
       render_unauthorized_action and return unless message_auth.valid?
-      json_data = (params[:data] && Canvas::Security.decode_jwt(params[:data])) || {}
       render_unauthorized_action and return unless json_data[:content_item_id] == params[:id]
       render_unauthorized_action and return unless json_data[:oauth_consumer_key] == params[:oauth_consumer_key]
     end
@@ -112,7 +111,8 @@ def content_items_for_canvas
     content_item_selection.map do |item|
       item.placement_advice ||= default_placement_advice
       if item.type == IMS::LTI::Models::ContentItems::LtiLinkItem::TYPE
-        url_gen_params = {url: item.url}
+        launch_url = item.url || json_data[:default_launch_url]
+        url_gen_params = {url: launch_url}
         url_gen_params[:display] = 'borderless' if item.placement_advice.presentation_document_target == 'iframe'
         item.canvas_url = named_context_url(@context, :retrieve_context_external_tools_path, url_gen_params)
       end
@@ -164,4 +164,8 @@ def default_placement_advice
     )
   end
 
+  def json_data
+    @json_data ||= ((params[:data] && Canvas::Security.decode_jwt(params[:data])) || {}).with_indifferent_access
+  end
+
 end

app/controllers/external_tools_controller.rb

@@ -488,18 +488,21 @@ def content_item_selection_request(tool, placement, opts = {})
     accept_unsigned= true
     auto_create= false
     return_url_opts = {service: 'external_tool_dialog'}
+    launch_url = opts[:launch_url] || tool.extension_setting(placement, :url)
+    data_hash = {default_launch_url: launch_url}
     if opts[:content_item_id]
-      extra_params[:data] = Canvas::Security.create_jwt(
-        {
-          content_item_id: opts[:content_item_id],
-          oauth_consumer_key: tool.consumer_key
-        }
-      )
+        data_hash.merge!(
+          {
+            content_item_id: opts[:content_item_id],
+            oauth_consumer_key: tool.consumer_key
+          }
+        )
       return_url_opts[:id] = opts[:content_item_id]
       return_url = polymorphic_url([@context, :external_content_update], return_url_opts)
     else
       return_url = polymorphic_url([@context, :external_content_success], return_url_opts)
     end
+    extra_params[:data] = Canvas::Security.create_jwt(data_hash)
     # choose accepted return types based on placement
     # todo, make return types configurable at installation?
     case placement
@@ -549,7 +552,7 @@ def content_item_selection_request(tool, placement, opts = {})
     }).merge(extra_params).merge(variable_expander(tool:tool).expand_variables!(tool.set_custom_fields(placement)))
 
     lti_launch = @tool.settings['post_only'] ? Lti::Launch.new(post_only: true) : Lti::Launch.new
-    lti_launch.resource_url = opts[:launch_url]|| tool.extension_setting(placement, :url)
+    lti_launch.resource_url = launch_url
     lti_launch.params = Lti::Security.signed_post_params(
       params,
       lti_launch.resource_url,

spec/controllers/external_content_controller_spec.rb

@@ -166,6 +166,25 @@
       expect(data.first.placement_advice.display_height).to eq(600)
       expect(data.first.placement_advice.display_width).to eq(800)
     end
+
+    it "uses the default url if one isn't provided" do
+      c = course
+      json = JSON.parse(File.read(File.join(Rails.root, 'spec', 'fixtures', 'lti', 'content_items_2.json')))
+      json['@graph'][0].delete('url')
+      launch_url = 'http://example.com/launch'
+      post(:success, service: 'external_tool_dialog', course_id: c.id, lti_message_type: 'ContentItemSelection',
+           lti_version: 'LTI-1p0',
+           data: Canvas::Security.create_jwt({default_launch_url: launch_url}),
+           content_items: json.to_json,
+           lti_msg: '',
+           lti_log: '',
+           lti_errormsg: '',
+           lti_errorlog: '')
+
+      data = controller.js_env[:retrieved_data]
+      expect(data.first.canvas_url).to include "http%3A%2F%2Fexample.com%2Flaunch"
+    end
+
   end
 
 end

spec/controllers/external_tools_controller_spec.rb

@@ -705,6 +705,18 @@ def new_valid_tool(course)
       expect(json_data[:oauth_consumer_key]).to eq tool.consumer_key
     end
 
+    it 'adds to the data element the default launch url' do
+      u = user(active_all: true)
+      account.account_users.create!(user:u)
+      user_session u
+      tool.collaboration = { message_type: 'ContentItemSelectionRequest' }
+      tool.save!
+      get :retrieve, {url: tool.url, course_id: @course.id, placement: 'collaboration', content_item_id:3 }
+      data = assigns[:lti_launch].params['data']
+      json_data = Canvas::Security.decode_jwt(data)
+      expect(json_data[:default_launch_url]).to eq tool.url
+    end
+
   end
 
   describe "GET 'resource_selection'" do