<commit_before>module Concerns
  module LtiSupport
    extend ActiveSupport::Concern

    included do
      helper_method :lti_provider
    end

    protected

    def do_lti
      if valid_lti_request?(current_application_instance.lti_secret)
        if user = user_from_lti
          # until the code to fix the valid lti request is up
          # then we will confirm emails here to use it on the course nav
          user.confirm unless user.confirmed?
          sign_in(user, event: :authentication)
          return
        end
      end
      user_not_authorized
    end

    def valid_lti_request?(lti_secret)
      authenticator = IMS::LTI::Services::MessageAuthenticator.new(request.url, request.request_parameters, lti_secret)
      authenticator.valid_signature? &&
        Nonce.valid?(request.request_parameters["oauth_nonce"]) &&
        valid_timestamp?
    end

    def lti_provider
      @lti_provider ||=
        params[:tool_consumer_instance_guid] ||
        UrlHelper.safe_host(
          request.referer ||
          params["launch_presentation_return_url"] ||
          params["custom_canvas_api_domain"],
        )
    end

    def user_from_lti
      lti_user_id = params[:user_id]

      # Match on both fields if possible
      user = User.find_by(lms_user_id: lms_user_id, lti_user_id: lti_user_id)

      # Match on only lms_user_id. This happens when a user uses OAuth to create and
      # account before they ever do an LTI launch.
      if user.blank?
        if user = User.find_by(lms_user_id: lms_user_id)
          if user.lti_user_id != lti_user_id
            user.update!(lti_user_id: lti_user_id)
          end
        end
      end

      # Find the user with just the lti_user_id
      user ||= User.find_by(lti_user_id: lti_user_id)

      if user.blank?
        user = _generate_new_lti_user(params)
        _attempt_uniq_email(user)
      else
        if user.lms_user_id.blank? && lms_user_id.present?
          user.lms_user_id = lms_user_id
          user.save
        end
        _update_roles(user, params)
      end

      user
    end

    private

    def valid_timestamp?
      # If timestamp is older than 5 minutes it's invalid<commit_msg>don't find users using nil<commit_after>module Concerns
  module LtiSupport
    extend ActiveSupport::Concern

    included do
      helper_method :lti_provider
    end

    protected

    def do_lti
      if valid_lti_request?(current_application_instance.lti_secret)
        if user = user_from_lti
          # until the code to fix the valid lti request is up
          # then we will confirm emails here to use it on the course nav
          user.confirm unless user.confirmed?
          sign_in(user, event: :authentication)
          return
        end
      end
      user_not_authorized
    end

    def valid_lti_request?(lti_secret)
      authenticator = IMS::LTI::Services::MessageAuthenticator.new(request.url, request.request_parameters, lti_secret)
      authenticator.valid_signature? &&
        Nonce.valid?(request.request_parameters["oauth_nonce"]) &&
        valid_timestamp?
    end

    def lti_provider
      @lti_provider ||=
        params[:tool_consumer_instance_guid] ||
        UrlHelper.safe_host(
          request.referer ||
          params["launch_presentation_return_url"] ||
          params["custom_canvas_api_domain"],
        )
    end

    def user_from_lti
      lti_user_id = params[:user_id]

      # Match on both fields if possible
      user = User.find_by(lms_user_id: lms_user_id, lti_user_id: lti_user_id)

      # Match on only lms_user_id. This happens when a user uses OAuth to create and
      # account before they ever do an LTI launch.
      if user.blank? && lms_user_id.present?
        if user = User.find_by(lms_user_id: lms_user_id)
          if user.lti_user_id != lti_user_id
            user.update!(lti_user_id: lti_user_id)
          end
        end
      end

      # Find the user with just the lti_user_id
      user ||= User.find_by(lti_user_id: lti_user_id)

      if user.blank?
        user = _generate_new_lti_user(params)
        _attempt_uniq_email(user)
      else
        if user.lms_user_id.blank? && lms_user_id.present?
          user.lms_user_id = lms_user_id
          user.save
        end
        _update_roles(user, params)
      end

      user
    end

    private

    def valid_timestamp?
      # If timestamp is older than 5 minutes it's invalid
{'fraction_non_alphanumeric': 0.0652222974497856, 'fraction_numerical': 0.0004513653802753329, 'mean_word_length': 2.3729071537290714, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3505163', 'n_tokens_mistral': 1427, 'n_tokens_neox': 1387, 'n_words': 332}