Skip to content

Releasing LTIJS v7

Latest
Latest

Choose a tag to compare

View all tags
@Cvmcosta Cvmcosta released this 09 Sep 02:14
· 23 commits to master since this release
v7.0.0
da2626a

LTIJS v7.0.0

After spending a lot of time trying to slowly introduce improvements to the old codebase, I decided to scrap the code I had written up to that point for v6 of LTIJS and start fresh.

It wasn't a very hard decision. Apart from the sunk cost of it all, LTIJS was first written many, many years ago, and the codebase no longer represented who I am as a developer, which means I now regret many of the architectural choices I had initially made.

v7 is a full, from-scratch TypeScript rewrite of LTIJS: a fully typed public API, input validation throughout (Zod), multiple security improvements, and new documentation guides to accompany it. This new version is much better written and organized than the old one. It was built with a few philosophical guidelines in mind (see Philosophy & Architecture for more):

  • Simplified API, so it's easier and more intuitive to use.
  • Less opinionated design, meaning it does what it needs to do without forcing additional things upon the user.
  • Much greater customizability. Together with the points above, it should allow users a lot of flexibility in how they build with LTIJS.

What's new

  • A real Provider class, constructed once with everything it needs, replacing the old singleton Provider.setup() call.
  • onResourceLink/onDeepLinking/onSubmissionReview handlers receive a LaunchContext, with context.grading/context.namesAndRoles/context.deepLinking already scoped to the current launch, no id_token or access token to pass around yourself.
  • No more session cookies. Login/launch state now round-trips through localStorage, falling back to the platform's own postMessage storage API, so LTIJS keeps working as more of the web restricts third-party cookies rather than depending on one.
  • Fully interchangeable backends for database, cache manager, HTTP framework, logger, etc. Allowing a great range of customizability.
  • Structured errors (LtijsError, ValidationError, HttpError) instead of string-matching err.message.
  • Two database backends: the default MongoDatabaseManager, or MongoLegacyDatabaseManager for an in-place upgrade from an existing v5 database with no data migration.
  • Optional Redis-backed caching for JWKS/keyset lookups, opt-in via RedisCacheManager.
  • Dynamic Registration's arbitrary registration-body overrides, present in legacy, restored.
  • And, of course, full TypeScript typing!

Breaking changes

This is a major rewrite; see the full Migrating from ltijs v5 guide, covering setup, calling services, route protection, default route paths, platform registration, error handling, and the id_token shape.

Requirements

Node 24 or newer (up from v5's Node 12.13).

Assets 2
Loading