Plugin: LTI: Fix lineitem.readonly scope in AGS

plugin/ims_lti/auth.php

@@ -207,14 +207,20 @@ try {
             if (LtiAssignmentGradesService::AGS_NONE !== $advServices['ags']) {
                 $agsClaim = [
                     'scope' => [
-                        LtiAssignmentGradesService::SCOPE_LINE_ITEM,
                         LtiAssignmentGradesService::SCOPE_LINE_ITEM_READ,
+                        LtiAssignmentGradesService::SCOPE_RESULT_READ,
+                        LtiAssignmentGradesService::SCOPE_SCORE_WRITE,
                     ],
-                    'lineitems' => LtiAssignmentGradesService::getLineItemsUrl(
+                ];
+
+                if (LtiAssignmentGradesService::AGS_FULL === $advServices['ags']) {
+                    $agsClaim['scope'][] = LtiAssignmentGradesService::SCOPE_LINE_ITEM;
+                }
+
+                $agsClaim['lineitems'] = LtiAssignmentGradesService::getLineItemsUrl(
                     $course->getId(),
                     $tool->getId()
-                    ),
+                );
-                ];
 
                 if ($tool->getLineItems()->count() === 1) {
                     $agsClaim['lineitem'] = LtiAssignmentGradesService::getLineItemUrl(

plugin/ims_lti/src/Service/Resource/LtiLineItemResource.php

@@ -56,12 +56,20 @@ class LtiLineItemResource extends LtiAdvantageServiceResource
                 $this->processGet();
                 break;
             case Request::METHOD_PUT:
+                if (LtiAssignmentGradesService::AGS_FULL !== $this->tool->getAdvantageServices()['ags']) {
+                    throw new MethodNotAllowedHttpException([Request::METHOD_GET]);
+                }
+
                 $this->validateToken(
                     [LtiAssignmentGradesService::SCOPE_LINE_ITEM]
                 );
                 $this->processPut();
                 break;
             case Request::METHOD_DELETE:
+                if (LtiAssignmentGradesService::AGS_FULL !== $this->tool->getAdvantageServices()['ags']) {
+                    throw new MethodNotAllowedHttpException([Request::METHOD_GET]);
+                }
+
                 $this->validateToken(
                     [LtiAssignmentGradesService::SCOPE_LINE_ITEM]
                 );

plugin/ims_lti/src/Service/Resource/LtiLineItemsResource.php

@@ -67,6 +67,10 @@ class LtiLineItemsResource extends LtiAdvantageServiceResource
     {
         switch ($this->request->getMethod()) {
             case Request::METHOD_POST:
+                if (LtiAssignmentGradesService::AGS_FULL !== $this->tool->getAdvantageServices()['ags']) {
+                    throw new MethodNotAllowedHttpException([Request::METHOD_GET]);
+                }
+
                 $this->validateToken(
                     [
                         LtiAssignmentGradesService::SCOPE_LINE_ITEM,