feat(lti): Sync courses with Canvas Connect (#1383)

Resolves #1313

## Canvas Connect
### New Features
- PingPong group user lists can now be synced with Canvas Connect
rosters on a set schedule or manually.
- As with manual LTI launches from the course navigation, Canvas Connect
roster syncs fetch available SSO information, as determined during the
tool registration, along with the stable LTI user IDs.
- The required `resource_link_id` is saved when a user launches PingPong
from Canvas, or is retrieved from the first page of the Names and Role
API response as a fallback. The fallback works because all Canvas course
navigation placements share the same `context_id` as the
`resource_link_id`. See [this Instructure Community
discussion](https://community.instructure.com/en/discussion/419857/lti-1-3-same-resource-link-for-all-course-item-instances)
for more details.
### Resolved Issues
- Fixed: Canvas Connect cross-installation linking based on the Canvas
instance ID may fail because incomplete Canvas Connect course links are
considered for matching.

## External Logins
### New Features
- When merging user accounts, login emails from accounts that are about
to be merged into the primary account are added as secondary login
emails.
### Updates & Improvements
- When adding new users, more than one external login identifiers can be
specified at the user level. Providers can be different per user,
including users with no external login identifiers to be added.
Previously, only a single identifier was allowed per user from a single
provider for all users.

## UI
### New Features
- Use the new Canvas Connect sync roster button to sync all linked
Canvas Connect courses at once. Similar to Canvas Sync, rate limits
apply.
- Use the new quick Sync roster button to trigger a sync with Canvas
Connect or Canvas Sync without opening the detail view in Manage Group
page.

## Internal
### Updates & Improvements
- Centralized shared constants for LTI launch and Canvas Connect NRPS
sync and shared LTI role helpers.

Author: ekassos

alembic/versions/3cc56efe20a8_add_resource_link_id_in_lticlass.py

@@ -0,0 +1,33 @@
+"""Add resource_link_id in LTIClass
+
+Revision ID: 3cc56efe20a8
+Revises: a384f2bfddf4
+Create Date: 2026-02-10 18:00:43.449645
+
+"""
+
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = "3cc56efe20a8"
+down_revision: Union[str, None] = "a384f2bfddf4"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.add_column(
+        "lti_classes", sa.Column("resource_link_id", sa.String(), nullable=True)
+    )
+    # ### end Alembic commands ###
+
+
+def downgrade() -> None:
+    # ### commands auto generated by Alembic - please adjust! ###
+    op.drop_column("lti_classes", "resource_link_id")
+    # ### end Alembic commands ###

pingpong/__main__.py

@@ -56,6 +56,7 @@
 )
 from pingpong.now import _get_next_run_time, croner, utcnow
 from pingpong.schemas import LMSType, RunStatus
+from pingpong.lti.canvas_connect import canvas_connect_sync_all
 from pingpong.summary import send_class_summary_for_class
 
 from .auth import encode_auth_token
@@ -97,6 +98,12 @@ def lms() -> None:
     pass
 
 
+@cli.group("lti")
+def lti() -> None:
+    """LTI Advantage Service commands."""
+    pass
+
+
 @cli.group("export")
 def export() -> None:
     pass
@@ -946,6 +953,23 @@ async def _lms_sync_all(
             logger.info("Done!")
 
 
+async def _lti_sync_all(sync_classes_with_error_status: bool = False) -> None:
+    lti_settings = config.lti
+    if lti_settings is None:
+        logger.error("LTI service is not enabled in configuration")
+        return
+
+    await config.authz.driver.init()
+    async with config.db.driver.async_session() as session:
+        async with config.authz.driver.get_client() as c:
+            await canvas_connect_sync_all(
+                session=session,
+                authz_client=c,
+                sync_classes_with_error_status=sync_classes_with_error_status,
+            )
+            logger.info("Done!")
+
+
 @lms.command("sync-all")
 @click.option("--sync-with-error", default=False, is_flag=True)
 @click.option("--sync-without-sso", default=False, is_flag=True)
@@ -984,6 +1008,42 @@ async def _sync_pingpong_with_lms():
         asyncio.run(_sync_pingpong_with_lms())
 
 
+@lti.command("sync-all")
+@click.option("--sync-with-error", default=False, is_flag=True)
+def sync_lti_all(sync_with_error: bool) -> None:
+    """
+    Sync all classes linked through Canvas Connect.
+    """
+    asyncio.run(
+        _lti_sync_all(
+            sync_classes_with_error_status=sync_with_error,
+        )
+    )
+
+
+@lti.command("sync_pingpong_with_lti")
+@click.option("--crontime", default="0 * * * *")
+@click.option("--host", default="localhost")
+@click.option("--port", default=8001)
+def sync_pingpong_with_lti(crontime: str, host: str, port: int) -> None:
+    """
+    Run the LTI sync-all command in a background server.
+    """
+    server = get_server(host=host, port=port)
+
+    async def _sync_pingpong_with_lti():
+        async for _ in croner(crontime, logger=logger):
+            try:
+                await _lti_sync_all()
+                logger.info(f"LTI sync completed successfully at {datetime.now()}")
+            except Exception as e:
+                logger.exception(f"Error during LTI sync: {e}")
+
+    # Run the Uvicorn server in the background
+    with server.run_in_thread():
+        asyncio.run(_sync_pingpong_with_lti())
+
+
 @export.command("export_threads_with_emails")
 @click.argument("class_id", type=int)
 @click.argument("user_email")
@@ -1093,12 +1153,6 @@ async def _send_activity_summaries(
             await session.commit()
 
 
-@cli.group("lti")
-def lti() -> None:
-    """LTI Advantage Service commands."""
-    pass
-
-
 @lti.command("rotate-keys")
 @click.option("--key-size", default=2048, help="RSA key size in bits")
 @click.option("--retention-count", default=3, help="Number of keys to retain")
@@ -1233,6 +1287,7 @@ async def _test_jwks() -> None:
 FUNCTIONS_MAP: Dict[str, Callable] = {
     "batch_send_activity_summaries": _send_activity_summaries,
     "sync_pingpong_with_lms": lambda _, **kwargs: _lms_sync_all(**kwargs),
+    "sync_pingpong_with_lti": lambda _, **kwargs: _lti_sync_all(**kwargs),
 }
 
 

pingpong/config.py

@@ -328,6 +328,7 @@ class LTISettings(BaseSettings):
     """LTI Advantage Service settings."""
 
     key_store: LTIKeyStoreSettings
+    sync_wait: int = Field(60 * 10, gt=0)  # 10 mins
 
     # Key rotation settings
     rotation_schedule: str = Field("0 0 1 * *")  # First day of every month at midnight