-
Task
-
Resolution: Done
-
Minor
-
None
-
Future Dev
-
MDL-83954-rebased -
-
-
5
-
Team Alpha - Sprint 3 I4-2024, Team Alpha - Planning I1-2025, Team Alpha - Sprint 2 I1-2025
MDL-82919 introduces a new deep linking API within the core, enhancing functionality for integrating external tools. However, the current implementation lacks robust access control. The prior capability checks performed during the content item selection process were omitted as they were tailored to the mod_lti module and not generalized to be incorporated into the new core API.
This issue aims to evaluate and implement comprehensive access control mechanisms for the deep linking API to ensure secure and appropriate usage. This includes determining where the access control logic should reside - whether at the core API level, at the API caller level, or as a combination of both.
Scope:
- Assessment of the current access control
- Review the existing deep linking API implementation to identify gaps in access control.
- Core-level access control
- Implement generalized access control logic in the core API that applies universally to all tools leveraging the API.
- API Caller-Level Access Control:
- Identify any specific use cases where additional access control checks are required at the caller level.
- Allow API callers (e.g., mod_lti or other) to specify additional, tool-specific capability checks to enforce contextual restrictions.