This API acts as a bridge between OnTrack’s Ruby API and LTI.js. The Angular frontend communicates with:
• LTI Dashboard → http://localhost:4200/lti
• LTI.js API → http://localhost:4200/lti/api
• Ruby API → http://localhost:4200/api
LTI.js simplifies integration with LMS platforms, while the Ruby API manages most permissions and institution-specific logic. Together, they enable enrolment syncing, and grade exchange between OnTrack and an LMS.
Units are linked to an LMS course by launching OnTrack from the LMS. After that, convenors manage the integration from the unit's LMS tab in OnTrack, which Rails serves by calling this bridge server-to-server. Launches of a linked course keep the stored service details (platform, Names and Roles memberships URL, course-data endpoint) current, so these calls need no user launch. They are served on INTERNAL_PORT (default 3003), not the public port, so the reverse proxy cannot route to them:
X-Internal-Key: <LTI_INTERNAL_SYNC_KEY>
GET /lti/api/internal/units/:unitId/link link details and available capabilities
DELETE /lti/api/internal/units/:unitId/link unlink (link again from an LMS launch)
GET /lti/api/internal/units/:unitId/members Names and Role Provisioning members
POST /lti/api/internal/units/:unitId/course-data Moodle plugin data: { "include": ["users"], "assignmentId": 456 }
GET /lti/api/internal/units/:unitId/grade-line-item linked grade item
POST /lti/api/internal/units/:unitId/grade-line-item find or create the linked grade item
POST /lti/api/internal/units/:unitId/scores { "scores": [{ "userId": "3", "scoreGiven": 85 }] }
A unit can only be linked to one LMS course. Names and Role Provisioning is the baseline and works with any LTI 1.3 platform.
The LMS tab shows an external-link icon beside the course name when the link response includes courseUrl. This URL is captured on each signed launch and stored on the existing MongoDB unit link; existing links gain it on their next LMS launch.
For Moodle, the bridge checks the launch's tool_platform.product_family_code and combines the registered platform URL with Moodle's numeric context.id to build course/view.php?id=…, preserving any installation subdirectory. Other LMS platforms can supply the full course-page URL in the custom launch parameter ontrack_course_url; this takes precedence over the Moodle default. Only absolute HTTP(S) URLs without embedded credentials are accepted. If no course URL can be resolved, the icon is hidden.
LTI 1.3 does not define a universal course-page URL. Its optional launch_presentation.return_url is a return destination for the current launch, not necessarily the course home; Moodle's version contains a session key, so it is not persisted for this feature.
Moodle groups, assignments and assignment extensions are not all available through standard LTI services. The companion ltiservice_ontrack Moodle plugin provides one read-only course-data service without enabling Moodle's generic Web Services subsystem.
When the plugin is installed and enabled for the OnTrack external tool, Moodle advertises its endpoint and custom OAuth scope in the signed launch. The bridge stores it on the unit link and probes it when the unit is linked and on each staff launch, so OnTrack only unlocks group mapping and extension imports when the plugin works. Group membership is represented once as groups[].member_user_ids.
Most permissions are handled by OnTrack's Ruby API. This means you will already need to have the Convenor role of a unit to be able to link the unit to a Context, and run actions such as syncing enrolments, and importing portfolio grades. These permissions can be modified in the Institution Settings within the Ruby API.
- Can link LMS course contexts to OnTrack units.
- Can sync LMS enrolments into OnTrack.
- Can import OnTrack portfolio grades.
- Any user launching the external tool gets an OnTrack account automatically, using the email and account details used in the LMS.
- If a unit is linked, they are auto-enrolled.
Tool Name: OnTrack
Tool URL: http://localhost:4200/lti/api/
LTI Version: LTI 1.3
Public Key Type: Keyset URL
Public keyset URL: http://localhost:4200/lti/api/keys
# If moodle is running in a Docker container, you need to specify `host.docker.internal` so that it can make a fetch request to moodles public keys
Public keyset URL: http://host.docker.internal:3001/lti/api/keys
# These routes are loaded in the browser, and can reach localhost
Initiate login URL: http://localhost:4200/lti/api/login
Redirection URI(s): http://localhost:4200/lti/api/# Base URL used by the LTI server to call the Rails API.
# Use http://apiserver:3000 when both containers share a Docker network;
# otherwise use an API URL reachable from the LTI container, such as
# https://ontrack.example.com.
API_HOST: http://apiserver:3000
# Public OnTrack URL used for redirects sent to the user's browser.
APP_HOST: https://ontrack.example.com
PORT: 3002
# Internal API port, called only by OnTrack's Rails API; set Rails' LTI_INTERNAL_URL to it.
INTERNAL_PORT: 3003
LTI_KEY: your-secret-lti-key
PLATFORM_URL: https://moodle.example.com
# Optional: links OnTrack back to the LMS course page. {COURSE_ID} is the LTI context id.
# Moodle: https://moodle.example.com/course/view.php?id={COURSE_ID}
# Canvas: https://canvas.example.com/courses/{COURSE_ID}
PLATFORM_COURSE_URL:
PLATFORM_NAME: Moodle Test Environment
# Once you have added OnTrack as an external tool, you can retrieve its client ID and add it here
PLATFORM_CLIENT_ID: your-client-id
PLATFORM_AUTHENTICATION_ENDPOINT: https://moodle.example.com/mod/lti/auth.php
PLATFORM_ACCESS_TOKEN_ENDPOINT: https://moodle.example.com/mod/lti/token.php
PLATFORM_AUTHCONFIG_METHOD: JWK_SET
PLATFORM_AUTHCONFIG_KEY: https://moodle.example.com/mod/lti/certs.php
# MongoDB details
DB_HOST: localhost:27017
DB_NAME: ltidb
DB_USER:
DB_PASS:
# Secret key used by the Ruby API to decode our custom LTI tokens.
# Must match the value configured in the Ruby API.
LTI_SHARED_API_SECRET: your-secret-shared-api-secret
# Shared only between Rails and this bridge, under the same name in both. It enables the OnTrack LMS tab.
LTI_INTERNAL_SYNC_KEY: your-random-internal-sync-key
# Per-client rate limits for the window below.
LTI_RATE_LIMIT_WINDOW_MS: 60000
LTI_LAUNCH_RATE_LIMIT_MAX: 20
LTI_API_RATE_LIMIT_MAX: 120
# Production defaults are true and none. Override both for plain-HTTP local development.
LTI_COOKIES_SECURE: true
LTI_COOKIES_SAMESITE: strictAPI_HOST must be reachable from the LTI server and must include the URL scheme, but no
trailing slash or /api suffix. An internal service URL such as http://apiserver:3000
works only when the LTI and Rails API containers share a Docker network. If they do not,
use a remote URL that the LTI container can reach, such as https://ontrack.example.com.
APP_HOST must always be OnTrack's public, browser-accessible URL. Do not set it to an
internal Docker hostname or to the Moodle URL.
