Michael Wheeler

Use PyPI trusted publishing

1

PyPI has introduced [trusted publishing](https://blog.pypi.org/posts/2023-04-20-introducing-trusted-publishers/) via a GitHub action. An example setup is described at https://pgjones.dev/blog/trusted-plublishing-2023/.

Canvas JSON tool configuration

4

We can provide a view or utility to help applications generate a [JSON tool configuration appropriate for Canvas](https://canvas.instructure.com/doc/api/file.lti_dev_key_config.html#configuring-the-tool-in-canvas).

Add support for LTI Dynamic Registration

6

Spec available at https://www.imsglobal.org/spec/lti-dr/v1p0 > Defines a way to automate the exchange of registration information between platforms and tools that use the OpenId Connect and oAuth 2 registration flows, allowing...

It would be useful to build a [Django Debug Toolbar Panel](https://django-debug-toolbar.readthedocs.io/en/latest/panels.html#api-for-third-party-panels) that would display LTI Launch contents.

Add Authentication Backend

7

It seems like it might be useful to create a [Django Authentication Backend](https://docs.djangoproject.com/en/4.0/topics/auth/customizing/#other-authentication-sources) to allow apps to authenticate users based on LTILaunch information. The backend might be something as simple...

This library could provide default forms and views for platform configuration, similar to how `django.contrib.auth` provides [built-in forms](https://docs.djangoproject.com/en/3.2/topics/auth/default/#module-django.contrib.auth.forms) and [built-in views](https://docs.djangoproject.com/en/3.2/topics/auth/default/#module-django.contrib.auth.views).

Support more secure Content-Security-Policy headers

2

Currently to make Django projects embeddable within an LMS, we need to disable the `django.middleware.clickjacking.XFrameOptionsMiddleware` middleware. This eliminates a barrier, but opens the site up to potential clickjacking attacks. The...

These would act as a replacement for [`pylti1p3.deep_link_resource.DeepLinkResource`](https://github.com/dmitry-viskov/pylti1.3/blob/d8fa43e1ace2885e84dfa4067f0f7379aaa86826/pylti1p3/deep_link_resource.py#L5). It seems like the only crucial interface is an [`as_dict`](https://github.com/dmitry-viskov/pylti1.3/blob/d8fa43e1ace2885e84dfa4067f0f7379aaa86826/pylti1p3/deep_link_resource.py#L63-L96) method. Defining content item classes within `django-lti` would allow for an improved...

Since the [default configuration](https://docs.djangoproject.com/en/4.2/ref/settings/#std:setting-CACHES) will cause unexpected issues in production.