From eb27217b99234120eb2ed6e6b3d6cfcb5e23972d Mon Sep 17 00:00:00 2001
From: Kohei Watanabe <nebel@fogtype.com>
Date: Tue, 18 Jul 2023 19:26:54 +0900
Subject: [PATCH] =?UTF-8?q?fix:=20=E6=9C=80=E5=88=9D=E3=81=AB=E3=82=A2?=
 =?UTF-8?q?=E3=82=AF=E3=82=BB=E3=82=B9=E3=81=97=E3=81=9F=E6=95=99=E5=93=A1?=
 =?UTF-8?q?=E3=81=BE=E3=81=9F=E3=81=AF=E7=AE=A1=E7=90=86=E8=80=85=E3=82=92?=
 =?UTF-8?q?ltiResourceLink.creator=E3=81=A8=E3=81=97=E3=81=A6=E7=B4=90?=
 =?UTF-8?q?=E4=BB=98=E3=81=91=E3=82=89=E3=82=8C=E3=82=8B=E3=82=88=E3=81=86?=
 =?UTF-8?q?=E3=81=AB=E5=A4=89=E6=9B=B4?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

学生など、初回アクセスした教員・管理者以外の利用者が、意図せずltiResourceLink.creatorId として紐付けられる問題がありました。その問題を修正します。(教員・管理者が1度もアクセスしていないリンクにはアクセスできません。少なくとも1度、教員・管理者がアクセスする必要があります。)
---
 server/services/init.ts | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/server/services/init.ts b/server/services/init.ts
index 85941a8d5..f5766d2be 100644
--- a/server/services/init.ts
+++ b/server/services/init.ts
@@ -6,6 +6,7 @@ import {
   findLtiResourceLink,
   upsertLtiResourceLink,
 } from "$server/utils/ltiResourceLink";
+import { isInstructor } from "$server/utils/ltiv1p3/roles";
 import { getSystemSettings } from "$server/utils/systemSettings";
 import getValidUrl from "$server/utils/getValidUrl";
 
@@ -35,6 +36,7 @@ async function init({ session }: FastifyRequest) {
     ltiTargetLink.pathname === "/book" &&
     ltiTargetLink.searchParams.get("bookId");
   if (
+    isInstructor(session.ltiRoles) &&
     session.ltiMessageType === "LtiResourceLinkRequest" &&
     session.ltiResourceLinkRequest?.id &&
     typeof bookId === "string" &&
@@ -42,7 +44,7 @@ async function init({ session }: FastifyRequest) {
   ) {
     ltiResourceLink = {
       bookId: Number(bookId),
-      creatorId: session.user.id,
+      creatorId: ltiResourceLink?.creatorId ?? session.user.id,
       consumerId: session.oauthClient.id,
       contextId: session.ltiContext.id,
       id: session.ltiResourceLinkRequest.id,