System.php

<?php
 
namespace ceLTIc\LTI;
 
use ceLTIc\LTI\DataConnector\DataConnector;
use ceLTIc\LTI\Content\Item;
use ceLTIc\LTI\Http\HttpMessage;
use ceLTIc\LTI\OAuth;
use ceLTIc\LTI\Jwt\Jwt;
use ceLTIc\LTI\Jwt\ClientInterface;
use ceLTIc\LTI\Tool;
use ceLTIc\LTI\Util;
 
trait System
{
 
    public $ok = true;
 
    public $ltiVersion = null;
 
    public $name = null;
 
    public $secret = null;
 
    public $signatureMethod = 'HMAC-SHA1';
 
    public $encryptionMethod = '';
 
    public $dataConnector = null;
 
    public $rsaKey = null;
 
    public $requiredScopes = array();
 
    public $kid = null;
 
    public $jku = null;
 
    public $reason = null;
 
    public $details = array();
 
    public $warnings = array();
 
    public $debugMode = false;
 
    public $enabled = false;
 
    public $enableFrom = null;
 
    public $enableUntil = null;
 
    public $lastAccess = null;
 
    public $created = null;
 
    public $updated = null;
 
    protected $jwt = null;
 
    protected $rawParameters = null;
 
    protected $messageParameters = null;
 
    private $id = null;
 
    private $key = null;
 
    private $settings = null;
 
    private $settingsChanged = false;
 
    public function getRecordId()
    {
        return $this->id;
    }
 
    public function setRecordId($id)
    {
        $this->id = $id;
    }
 
    public function getKey()
    {
        return $this->key;
    }
 
    public function setKey($key)
    {
        $this->key = $key;
    }
 
    public function getSetting($name, $default = '')
    {
        if (array_key_exists($name, $this->settings)) {
            $value = $this->settings[$name];
        } else {
            $value = $default;
        }
 
        return $value;
    }
 
    public function setSetting($name, $value = null)
    {
        $old_value = $this->getSetting($name);
        if ($value !== $old_value) {
            if (!empty($value)) {
                $this->settings[$name] = $value;
            } else {
                unset($this->settings[$name]);
            }
            $this->settingsChanged = true;
        }
    }
 
    public function getSettings()
    {
        return $this->settings;
    }
 
    public function setSettings($settings)
    {
        $this->settings = $settings;
    }
 
    public function saveSettings()
    {
        if ($this->settingsChanged) {
            $ok = $this->save();
        } else {
            $ok = true;
        }
 
        return $ok;
    }
 
    public function hasJwt()
    {
        return !empty($this->jwt) && $this->jwt->hasJwt();
    }
 
    public function getJwt()
    {
        return $this->jwt;
    }
 
    public function getRawParameters()
    {
        if (is_null($this->rawParameters)) {
            $this->rawParameters = OAuth\OAuthUtil::parse_parameters(file_get_contents(OAuth\OAuthRequest::$POST_INPUT));
        }
 
        return $this->rawParameters;
    }
 
    public function getMessageClaims($fullyQualified = false)
    {
        $messageClaims = null;
        if (!is_null($this->messageParameters)) {
            $messageParameters = $this->messageParameters;
            $messageType = '';
            if (!empty($messageParameters['lti_message_type'])) {
                if (array_key_exists($messageParameters['lti_message_type'], Util::MESSAGE_TYPE_MAPPING)) {
                    $messageParameters['lti_message_type'] = Util::MESSAGE_TYPE_MAPPING[$messageParameters['lti_message_type']];
                }
                $messageType = $messageParameters['lti_message_type'];
            }
            if (!empty($messageParameters['accept_media_types'])) {
                $mediaTypes = array_map('trim', explode(',', $messageParameters['accept_media_types']));
                $mediaTypes = array_filter($mediaTypes);
                $types = array();
                if (!empty($messageParameters['accept_types'])) {
                    $types = array_map('trim', explode(',', $this->messageParameters['accept_types']));
                    $types = array_filter($types);
                    foreach ($mediaTypes as $mediaType) {
                        if (strpos($mediaType, 'application/vnd.ims.lti.') === 0) {
                            unset($mediaTypes[array_search($mediaType, $mediaTypes)]);
                        }
                    }
                    $messageParameters['accept_media_types'] = implode(',', $mediaTypes);
                } else {
                    foreach ($mediaTypes as $mediaType) {
                        if ($mediaType === Item::LTI_LINK_MEDIA_TYPE) {
                            unset($mediaTypes[array_search(Item::LTI_LINK_MEDIA_TYPE, $mediaTypes)]);
                            $messageParameters['accept_media_types'] = implode(',', $mediaTypes);
                            $types[] = Item::TYPE_LTI_LINK;
                        } elseif ($mediaType === Item::LTI_ASSIGNMENT_MEDIA_TYPE) {
                            unset($mediaTypes[array_search(Item::LTI_ASSIGNMENT_MEDIA_TYPE, $mediaTypes)]);
                            $messageParameters['accept_media_types'] = implode(',', $mediaTypes);
                            $types[] = Item::TYPE_LTI_ASSIGNMENT;
                        } elseif (substr($mediaType, 0, 6) === 'image/') {
                            $types[] = 'image';
                            $types[] = 'link';
                            $types[] = 'file';
                        } elseif ($mediaType === 'text/html') {
                            $types[] = 'html';
                            $types[] = 'link';
                            $types[] = 'file';
                        } elseif ($mediaType === '*/*') {
                            $types[] = 'html';
                            $types[] = 'image';
                            $types[] = 'file';
                            $types[] = 'link';
                        } else {
                            $types[] = 'file';
                        }
                    }
                    $types = array_unique($types);
                    $messageParameters['accept_types'] = implode(',', $types);
                }
            }
            if (!empty($messageParameters['accept_presentation_document_targets'])) {
                $documentTargets = array_map('trim', explode(',', $messageParameters['accept_presentation_document_targets']));
                $documentTargets = array_filter($documentTargets);
                $targets = array();
                foreach ($documentTargets as $documentTarget) {
                    switch ($documentTarget) {
                        case 'frame':
                        case 'popup':
                        case 'overlay':
                        case 'none':
                            break;
                        default:
                            $targets[] = $documentTarget;
                            break;
                    }
                }
                $targets = array_unique($targets);
                $messageParameters['accept_presentation_document_targets'] = implode(',', $targets);
            }
            $messageClaims = array();
            if (!empty($messageParameters['oauth_consumer_key'])) {
                $messageClaims['aud'] = array($messageParameters['oauth_consumer_key']);
            }
            foreach ($messageParameters as $key => $value) {
                $ok = true;
                if (array_key_exists($key, Util::JWT_CLAIM_MAPPING)) {
                    if (array_key_exists("{$key}.{$messageType}", Util::JWT_CLAIM_MAPPING)) {
                        $mapping = Util::JWT_CLAIM_MAPPING["{$key}.{$messageType}"];
                    } else {
                        $mapping = Util::JWT_CLAIM_MAPPING[$key];
                    }
                    if (isset($mapping['isObject']) && $mapping['isObject']) {
                        $value = Util::jsonDecode($value);
                    } elseif (isset($mapping['isArray']) && $mapping['isArray']) {
                        $value = array_map('trim', explode(',', $value));
                        $value = array_filter($value);
                        sort($value);
                    } elseif (isset($mapping['isBoolean']) && $mapping['isBoolean']) {
                        $value = (is_bool($value)) ? $value : $value === 'true';
                    } elseif (isset($mapping['isInteger']) && $mapping['isInteger']) {
                        $value = intval($value);
                    } elseif (is_bool($value)) {
                        $value = ($value) ? 'true' : 'false';
                    } else {
                        $value = strval($value);
                    }
                    $group = '';
                    $claim = Util::JWT_CLAIM_PREFIX;
                    if (!empty($mapping['suffix'])) {
                        $claim .= "-{$mapping['suffix']}";
                    }
                    $claim .= '/claim/';
                    if (is_null($mapping['group'])) {
                        $claim = $mapping['claim'];
                    } elseif (empty($mapping['group'])) {
                        $claim .= $mapping['claim'];
                    } else {
                        $group = $claim . $mapping['group'];
                        $claim = $mapping['claim'];
                    }
                } elseif (substr($key, 0, 7) === 'custom_') {
                    $group = Util::JWT_CLAIM_PREFIX . '/claim/custom';
                    $claim = substr($key, 7);
                } elseif (substr($key, 0, 4) === 'ext_') {
                    if ($key === 'ext_d2l_username') {
                        $group = 'http://www.brightspace.com';
                        $claim = 'username';
                    } else {
                        $group = Util::JWT_CLAIM_PREFIX . '/claim/ext';
                        $claim = substr($key, 4);
                    }
                } elseif (substr($key, 0, 7) === 'lti1p1_') {
                    $group = Util::JWT_CLAIM_PREFIX . '/claim/lti1p1';
                    $claim = substr($key, 7);
                    if (empty($value)) {
                        $value = null;
                    } else {
                        $json = Util::jsonDecode($value);
                        if (!is_null($json)) {
                            $value = $json;
                        }
                    }
                } else {
                    $ok = false;
                }
                if ($ok) {
                    if ($fullyQualified) {
                        if (empty($group)) {
                            $messageClaims = array_merge($messageClaims, self::fullyQualifyClaim($claim, $value));
                        } else {
                            $messageClaims = array_merge($messageClaims, self::fullyQualifyClaim("{$group}/{$claim}", $value));
                        }
                    } elseif (empty($group)) {
                        $messageClaims[$claim] = $value;
                    } else {
                        $messageClaims[$group][$claim] = $value;
                    }
                }
            }
            if (!empty($messageParameters['unmapped_claims'])) {
                $claims = Util::jsonDecode($messageParameters['unmapped_claims']);
                foreach ($claims as $claim => $value) {
                    if ($fullyQualified) {
                        $messageClaims = array_merge($messageClaims, self::fullyQualifyClaim($claim, $value));
                    } elseif (!is_object($value)) {
                        $messageClaims[$claim] = $value;
                    } elseif (!isset($messageClaims[$claim])) {
                        $messageClaims[$claim] = $value;
                    } else {
                        $objVars = get_object_vars($value);
                        foreach ($objVars as $attrName => $attrValue) {
                            if (is_object($messageClaims[$claim])) {
                                $messageClaims[$claim]->{$attrName} = $attrValue;
                            } else {
                                $messageClaims[$claim][$attrName] = $attrValue;
                            }
                        }
                    }
                }
            }
        }
 
        return $messageClaims;
    }
 
    public static function parseRoles($roles, $ltiVersion = Util::LTI_VERSION1, $addPrincipalRole = false)
    {
        if (!is_array($roles)) {
            $roles = array_map('trim', explode(',', $roles));
            $roles = array_filter($roles);
        }
        $parsedRoles = array();
        foreach ($roles as $role) {
            $role = trim($role);
            if ((substr($role, 0, 4) !== 'urn:') &&
                (substr($role, 0, 7) !== 'http://') && (substr($role, 0, 8) !== 'https://')) {
                switch ($ltiVersion) {
                    case Util::LTI_VERSION1:
                        $role = str_replace('#', '/', $role);
                        $role = "urn:lti:role:ims/lis/{$role}";
                        break;
                    case Util::LTI_VERSION2:
                    case Util::LTI_VERSION1P3:
                        $pos = strrpos($role, '#');
                        if ($pos === false) {
                            $sep = '#';
                        } else {
                            $sep = '/';
                        }
                        $role = "http://purl.imsglobal.org/vocab/lis/v2/membership{$sep}{$role}";
                        break;
                }
            }
            $systemRoles = array(
                'AccountAdmin',
                'Administrator',
                'Creator',
                'None',
                'SysAdmin',
                'SysSupport',
                'User');
            $institutionRoles = array(
//            'Administrator',  // System Administrator role takes precedence
                'Alumni',
                'Faculty',
                'Guest',
                'Instructor',
                'Learner',
                'Member',
                'Mentor',
                'None',
                'Observer',
                'Other',
                'ProspectiveStudent',
                'Staff',
                'Student'
            );
            switch ($ltiVersion) {
                case Util::LTI_VERSION1:
                    if (in_array(substr($role, 0, 53),
                            array('http://purl.imsglobal.org/vocab/lis/v2/system/person#',
                                'http://purl.imsglobal.org/vocab/lis/v2/system/person/'))) {
                        $role = 'urn:lti:sysrole:ims/lis/' . substr($role, 53);
                    } elseif (in_array(substr($role, 0, 58),
                            array('http://purl.imsglobal.org/vocab/lis/v2/institution/person#',
                                'http://purl.imsglobal.org/vocab/lis/v2/institution/person/'))) {
                        $role = 'urn:lti:instrole:ims/lis/' . substr($role, 58);
                    } elseif (substr($role, 0, 50) === 'http://purl.imsglobal.org/vocab/lis/v2/membership#') {
                        $principalRole = substr($role, 50);
                        if (($principalRole === 'Instructor') &&
                            (!empty(preg_grep('/^http:\/\/purl.imsglobal.org\/vocab\/lis\/v2\/membership\/Instructor#TeachingAssistant.*$/',
                                    $roles)) ||
                            !empty(preg_grep('/^Instructor#TeachingAssistant.*$/', $roles)))) {
                            $role = '';
                        } elseif (!empty(preg_grep("/^http:\/\/purl.imsglobal.org\/vocab\/lis\/v2\/membership\/{$principalRole}#.*$/",
                                    $roles)) ||
                            !empty(preg_grep('/^{$principalRole}#.*$/', $roles))) {
                            $role = '';
                        } else {
                            $role = "urn:lti:role:ims/lis/{$principalRole}";
                        }
                    } elseif (substr($role, 0, 50) === 'http://purl.imsglobal.org/vocab/lis/v2/membership/') {
                        $subroles = explode('#', substr($role, 50));
                        if (count($subroles) === 2) {
                            if (($subroles[0] === 'Instructor') && ($subroles[1] === 'TeachingAssistant')) {
                                $role = 'urn:lti:role:ims/lis/TeachingAssistant';
                            } elseif (($subroles[0] === 'Instructor') && (substr($subroles[1], 0, 17) === 'TeachingAssistant')) {
                                $role = "urn:lti:role:ims/lis/TeachingAssistant#{$subroles[1]}";
                            } else {
                                $role = "urn:lti:role:ims/lis/{$subroles[0]}/{$subroles[1]}";
                            }
                        } else {
                            $role = 'urn:lti:role:ims/lis/' . substr($role, 50);
                        }
                    } elseif (in_array(substr($role, 0, 46),
                            array('http://purl.imsglobal.org/vocab/lis/v2/person#',
                                'http://purl.imsglobal.org/vocab/lis/v2/person/'))) {
                        if (in_array(substr($role, 46), $systemRoles)) {
                            $role = 'urn:lti:sysrole:ims/lis/' . substr($role, 46);
                        } elseif (in_array(substr($role, 46), $institutionRoles)) {
                            $role = 'urn:lti:instrole:ims/lis/' . substr($role, 46);
                        }
                    } elseif (strpos($role, 'Instructor#TeachingAssistant') !== false) {
                        if (substr($role, -28) === 'Instructor#TeachingAssistant') {
                            $role = str_replace('Instructor#', '', $role);
                        } else {
                            $role = str_replace('Instructor#', 'TeachingAssistant/', $role);
                        }
                    } elseif ((substr($role, -10) === 'Instructor') &&
                        !empty(preg_grep('/^http:\/\/purl.imsglobal.org\/vocab\/lis\/v2\/membership\/Instructor#TeachingAssistant.*$/',
                                $roles))) {
                        $role = '';
                    }
                    $role = str_replace('#', '/', $role);
                    break;
                case Util::LTI_VERSION2:
                    $prefix = '';
                    if (substr($role, 0, 24) === 'urn:lti:sysrole:ims/lis/') {
                        $prefix = 'http://purl.imsglobal.org/vocab/lis/v2/person';
                        $role = substr($role, 24);
                    } elseif (substr($role, 0, 25) === 'urn:lti:instrole:ims/lis/') {
                        $prefix = 'http://purl.imsglobal.org/vocab/lis/v2/person';
                        $role = substr($role, 25);
                    } elseif (substr($role, 0, 21) === 'urn:lti:role:ims/lis/') {
                        $prefix = 'http://purl.imsglobal.org/vocab/lis/v2/membership';
                        $subroles = explode('/', substr($role, 21));
                        if (count($subroles) === 2) {
                            if (($subroles[0] === 'Instructor') && ($subroles[1] === 'TeachingAssistant')) {
                                $role = 'TeachingAssistant';
                            } elseif (($subroles[0] === 'Instructor') && (substr($subroles[1], 0, 17) === 'TeachingAssistant')) {
                                $role = "TeachingAssistant#{$subroles[1]}";
                            } else {
                                $role = "{$subroles[0]}#{$subroles[1]}";
                            }
                        } elseif ((count($subroles) === 1) && (!empty(preg_grep("/^http:\/\/purl.imsglobal.org\/vocab\/lis\/v2\/membership\/{$subroles[0]}#.*$/",
                                    $roles)) ||
                            !empty(preg_grep('/^{$subroles[0]#.*$/', $roles)))) {
                            $role = '';
                        } else {
                            $role = substr($role, 21);
                        }
                    } elseif (in_array(substr($role, 0, 53),
                            array('http://purl.imsglobal.org/vocab/lis/v2/system/person#',
                                'http://purl.imsglobal.org/vocab/lis/v2/system/person/'))) {
                        $prefix = 'http://purl.imsglobal.org/vocab/lis/v2/person';
                        $role = substr($role, 53);
                    } elseif (in_array(substr($role, 0, 58),
                            array('http://purl.imsglobal.org/vocab/lis/v2/institution/person#',
                                'http://purl.imsglobal.org/vocab/lis/v2/institution/person/'))) {
                        $prefix = 'http://purl.imsglobal.org/vocab/lis/v2/person';
                        $role = substr($role, 58);
                    } elseif (substr($role, 0, 50) === 'http://purl.imsglobal.org/vocab/lis/v2/membership#') {
                        $prefix = 'http://purl.imsglobal.org/vocab/lis/v2/membership';
                        $principalRole = substr($role, 50);
                        $principalRole2 = str_replace('/', '\\/', $principalRole);
                        if (($principalRole === 'Instructor') &&
                            (!empty(preg_grep('/^http:\/\/purl.imsglobal.org\/vocab\/lis\/v2\/membership\/Instructor#TeachingAssistant.*$/',
                                    $roles)) ||
                            !empty(preg_grep('/^Instructor#TeachingAssistant.*$/', $roles)))) {
                            $role = '';
                        } elseif (!empty(preg_grep("/^http:\/\/purl.imsglobal.org\/vocab\/lis\/v2\/membership\/{$principalRole2}#.*$/",
                                    $roles)) ||
                            !empty(preg_grep('/^{$principalRole2}#.*$/', $roles))) {
                            $role = '';
                        } else {
                            $role = $principalRole;
                        }
                    } elseif (substr($role, 0, 50) === 'http://purl.imsglobal.org/vocab/lis/v2/membership/') {
                        $prefix = 'http://purl.imsglobal.org/vocab/lis/v2/membership';
                        $subroles = explode('#', substr($role, 50));
                        if (count($subroles) === 2) {
                            if (($subroles[0] === 'Instructor') && ($subroles[1] === 'TeachingAssistant')) {
                                $role = 'TeachingAssistant';
                            } elseif (($subroles[0] === 'Instructor') && (substr($subroles[1], 0, 17) === 'TeachingAssistant')) {
                                $role = "TeachingAssistant#{$subroles[1]}";
                            } else {
                                $role = "{$subroles[0]}#{$subroles[1]}";
                            }
                        } else {
                            $role = substr($role, 50);
                        }
                    }
                    if (!empty($role)) {
                        $pos = strrpos($role, '/');
                        if ((strpos($role, '#') !== false) || ($pos !== false)) {
                            $prefix .= '/';
                            if ($pos !== false) {
                                $role = substr($role, 0, $pos) . '#' . substr($role, $pos + 1);
                            }
                        } else {
                            $prefix .= '#';
                        }
                        $role = "{$prefix}{$role}";
                    }
                    break;
                case Util::LTI_VERSION1P3:
                    $prefix = '';
                    if (substr($role, 0, 24) === 'urn:lti:sysrole:ims/lis/') {
                        $prefix = 'http://purl.imsglobal.org/vocab/lis/v2/system/person';
                        $role = substr($role, 24);
                    } elseif (substr($role, 0, 25) === 'urn:lti:instrole:ims/lis/') {
                        $prefix = 'http://purl.imsglobal.org/vocab/lis/v2/institution/person';
                        $role = substr($role, 25);
                    } elseif (substr($role, 0, 21) === 'urn:lti:role:ims/lis/') {
                        $prefix = 'http://purl.imsglobal.org/vocab/lis/v2/membership';
                        $subroles = explode('/', substr($role, 21));
                        if (count($subroles) === 2) {
                            if ($subroles[0] === 'TeachingAssistant') {
                                $role = "Instructor#{$subroles[1]}";
                                if ($addPrincipalRole) {
                                    $parsedRoles[] = "{$prefix}#Instructor";
                                }
                            } else {
                                $role = "{$subroles[0]}#{$subroles[1]}";
                                if ($addPrincipalRole) {
                                    $parsedRoles[] = "{$prefix}#{$subroles[0]}";
                                }
                            }
                        } elseif ($subroles[0] === 'TeachingAssistant') {
                            $role = 'Instructor#TeachingAssistant';
                            if ($addPrincipalRole) {
                                $parsedRoles[] = "{$prefix}#Instructor";
                            }
                        } else {
                            $role = substr($role, 21);
                        }
                    } elseif (substr($role, 0, 46) === 'http://purl.imsglobal.org/vocab/lis/v2/person#') {
                        if (in_array(substr($role, 46), $systemRoles)) {
                            $prefix = 'http://purl.imsglobal.org/vocab/lis/v2/system/person';
                        } elseif (in_array(substr($role, 46), $institutionRoles)) {
                            $prefix = 'http://purl.imsglobal.org/vocab/lis/v2/institution/person';
                        }
                        $role = substr($role, 46);
                        $pos = strrpos($role, '/');
                        if ($pos !== false) {
                            $role = substr($role, 0, $pos - 1) . '#' . substr($role, $pos + 1);
                        }
                    } elseif (substr($role, 0, 50) === 'http://purl.imsglobal.org/vocab/lis/v2/membership#') {
                        $prefix = 'http://purl.imsglobal.org/vocab/lis/v2/membership';
                        if (substr($role, 50, 18) === 'TeachingAssistant') {
                            $role = 'Instructor#TeachingAssistant';
                            if ($addPrincipalRole) {
                                $parsedRoles[] = "{$prefix}#Instructor";
                            }
                        } else {
                            $role = substr($role, 50);
                        }
                    } elseif (substr($role, 0, 50) === 'http://purl.imsglobal.org/vocab/lis/v2/membership/') {
                        $prefix = 'http://purl.imsglobal.org/vocab/lis/v2/membership';
                        $subroles = explode('#', substr($role, 50));
                        if (count($subroles) === 2) {
                            if ($subroles[0] === 'TeachingAssistant') {
                                $role = "Instructor#{subroles[1]}";
                                if ($addPrincipalRole) {
                                    $parsedRoles[] = "{$prefix}#Instructor";
                                }
                            } else {
                                $role = substr($role, 50);
                                if ($addPrincipalRole) {
                                    $parsedRoles[] = "{$prefix}#{$subroles[0]}";
                                }
                            }
                        } else {
                            $role = substr($role, 50);
                        }
                    }
                    if (!empty($prefix) && !empty($role)) {
                        $pos = strrpos($role, '/');
                        if ((strpos($role, '#') !== false) || ($pos !== false)) {
                            $prefix .= '/';
                            if ($pos !== false) {
                                $role = substr($role, 0, $pos) . '#' . substr($role, $pos + 1);
                            }
                        } else {
                            $prefix .= '#';
                        }
                        $role = "{$prefix}{$role}";
                    }
                    break;
            }
            if (!empty($role)) {
                $parsedRoles[] = $role;
            }
        }
 
        return array_unique($parsedRoles);
    }
 
    public function signParameters($url, $type, $version, $params)
    {
        if (!empty($url)) {
// Add standard parameters
            $params['lti_version'] = $version;
            $params['lti_message_type'] = $type;
// Add signature
            $params = $this->addSignature($url, $params, 'POST', 'application/x-www-form-urlencoded');
        }
 
        return $params;
    }
 
    public function signMessage(&$url, $type, $version, $params, $loginHint = null, $ltiMessageHint = null)
    {
        if (($this instanceof Platform) && ($this->ltiVersion === Util::LTI_VERSION1P3)) {
            if (!isset($loginHint) || (strlen($loginHint) <= 0)) {
                if (isset($params['user_id']) && (strlen($params['user_id']) > 0)) {
                    $loginHint = $params['user_id'];
                } else {
                    $loginHint = 'Anonymous';
                }
            }
// Add standard parameters
            $params['lti_version'] = $version;
            $params['lti_message_type'] = $type;
            $this->onInitiateLogin($url, $loginHint, $ltiMessageHint, $params);
 
            $params = array(
                'iss' => $this->platformId,
                'target_link_uri' => $url,
                'login_hint' => $loginHint
            );
            if (!is_null($ltiMessageHint)) {
                $params['lti_message_hint'] = $ltiMessageHint;
            }
            if (!empty($this->clientId)) {
                $params['client_id'] = $this->clientId;
            }
            if (!empty($this->deploymentId)) {
                $params['lti_deployment_id'] = $this->deploymentId;
            }
            if (!empty(Tool::$defaultTool)) {
                $url = Tool::$defaultTool->initiateLoginUrl;
            }
            if (!empty(static::$browserStorageFrame)) {
                if (strpos($url, '?') === false) {
                    $sep = '?';
                } else {
                    $sep = '&';
                }
                $url .= "{$sep}lti_storage_target=" . static::$browserStorageFrame;
            }
        } else {
            $params = $this->signParameters($url, $type, $version, $params);
        }
 
        return $params;
    }
 
    public function sendMessage($url, $type, $messageParams, $target = '', $userId = null, $hint = null)
    {
        $sendParams = $this->signMessage($url, $type, $this->ltiVersion, $messageParams, $userId, $hint);
        $html = Util::sendForm($url, $sendParams, $target);
 
        return $html;
    }
 
    public function signServiceRequest($url, $method, $type, $data = null)
    {
        $header = '';
        if (!empty($url)) {
            $header = $this->addSignature($url, $data, $method, $type);
        }
 
        return $header;
    }
 
    public function doServiceRequest($service, $method, $format, $data)
    {
        $header = $this->addSignature($service->endpoint, $data, $method, $format);
 
// Connect to platform
        $http = new HttpMessage($service->endpoint, $method, $data, $header);
// Parse JSON response
        if ($http->send() && !empty($http->response)) {
            $http->responseJson = Util::jsonDecode($http->response);
            $http->ok = !is_null($http->responseJson);
        }
 
        return $http;
    }
 
    public function useOAuth1()
    {
        return empty($this->signatureMethod) || (substr($this->signatureMethod, 0, 2) !== 'RS');
    }
 
    public function addSignature($endpoint, $data, $method = 'POST', $type = null, $nonce = '', $hash = null, $timestamp = null)
    {
        if ($this->useOAuth1()) {
            return $this->addOAuth1Signature($endpoint, $data, $method, $type, $hash, $timestamp);
        } else {
            return $this->addJWTSignature($endpoint, $data, $method, $type, $nonce, $timestamp);
        }
    }
 
    public function checkMessage()
    {
        $ok = $_SERVER['REQUEST_METHOD'] === 'POST';
        if (!$ok) {
            $this->reason = 'LTI messages must use HTTP POST';
        } elseif (!empty($this->jwt) && !empty($this->jwt->hasJwt())) {
            $ok = false;
            $context = $this->jwt->getClaim('https://purl.imsglobal.org/spec/lti/claim/context');
            $resourceLink = $this->jwt->getClaim('https://purl.imsglobal.org/spec/lti/claim/resource_link');
            if (is_null($this->messageParameters['oauth_consumer_key']) || (strlen($this->messageParameters['oauth_consumer_key']) <= 0)) {
                $this->reason = 'Missing iss claim';
            } elseif (empty($this->jwt->getClaim('iat', ''))) {
                $this->reason = 'Missing iat claim';
            } elseif (empty($this->jwt->getClaim('exp', ''))) {
                $this->reason = 'Missing exp claim';
            } elseif (intval($this->jwt->getClaim('iat')) > intval($this->jwt->getClaim('exp'))) {
                $this->reason = 'iat claim must not have a value greater than exp claim';
            } elseif (empty($this->jwt->getClaim('nonce', ''))) {
                $this->reason = 'Missing nonce claim';
            } elseif (!empty($context) && property_exists($context, 'id') && (empty($context->id) || !is_string($context->id))) {
                $this->reason = 'Invalid value for id property in https://purl.imsglobal.org/spec/lti/claim/context claim';
            } elseif (!empty($resourceLink) && property_exists($resourceLink, 'id') && (empty($resourceLink->id) || !is_string($resourceLink->id))) {
                $this->reason = 'Invalid value for id property in https://purl.imsglobal.org/spec/lti/claim/resource_link claim';
            } else {
                $ok = true;
            }
        }
// Set signature method from request
        if (isset($this->messageParameters['oauth_signature_method'])) {
            $this->signatureMethod = $this->messageParameters['oauth_signature_method'];
            if (($this instanceof Tool) && !empty($this->platform)) {
                $this->platform->signatureMethod = $this->signatureMethod;
            }
        }
// Check all required launch parameters
        if ($ok) {
            $ok = isset($this->messageParameters['lti_message_type']);
            if (!$ok) {
                $this->reason = 'Missing lti_message_type parameter.';
            }
        }
        if ($ok) {
            $ok = isset($this->messageParameters['lti_version']) && in_array($this->messageParameters['lti_version'],
                    Util::$LTI_VERSIONS);
            if (!$ok) {
                $this->reason = 'Invalid or missing lti_version parameter.';
            }
        }
 
        return $ok;
    }
 
    public function verifySignature()
    {
        $ok = false;
        $key = $this->key;
        if (!empty($key)) {
            $secret = $this->secret;
        } elseif (($this instanceof Tool) && !empty($this->platform)) {
            $key = $this->platform->getKey();
            $secret = $this->platform->secret;
        } elseif (($this instanceof Platform) && !empty(Tool::$defaultTool)) {
            $key = Tool::$defaultTool->getKey();
            $secret = Tool::$defaultTool->secret;
        }
        if ($this instanceof Tool) {
            $platform = $this->platform;
            $publicKey = $this->platform->rsaKey;
            $jku = $this->platform->jku;
        } else {
            $platform = $this;
            if (!empty(Tool::$defaultTool)) {
                $publicKey = Tool::$defaultTool->rsaKey;
                $jku = Tool::$defaultTool->jku;
            } else {
                $publicKey = $this->rsaKey;
                $jku = $this->jku;
            }
        }
        if (empty($this->jwt) || empty($this->jwt->hasJwt())) {  // OAuth-signed message
            try {
                $store = new OAuthDataStore($this);
                $server = new OAuth\OAuthServer($store);
                $method = new OAuth\OAuthSignatureMethod_HMAC_SHA224();
                $server->add_signature_method($method);
                $method = new OAuth\OAuthSignatureMethod_HMAC_SHA256();
                $server->add_signature_method($method);
                $method = new OAuth\OAuthSignatureMethod_HMAC_SHA384();
                $server->add_signature_method($method);
                $method = new OAuth\OAuthSignatureMethod_HMAC_SHA512();
                $server->add_signature_method($method);
                $method = new OAuth\OAuthSignatureMethod_HMAC_SHA1();
                $server->add_signature_method($method);
                $request = OAuth\OAuthRequest::from_request();
                if (isset($request->get_parameters()['_new_window']) && !isset($this->messageParameters['_new_window'])) {
                    $request->unset_parameter('_new_window');
                }
                $server->verify_request($request);
                $ok = true;
            } catch (\Exception $e) {
                if (empty($this->reason)) {
                    $oauthConsumer = new OAuth\OAuthConsumer($key, $secret);
                    $signature = $request->build_signature($method, $oauthConsumer, false);
                    if ($this->debugMode) {
                        $this->reason = $e->getMessage();
                    }
                    if (empty($this->reason)) {
                        $this->reason = 'OAuth signature check failed - perhaps an incorrect secret or timestamp.';
                    }
                    $this->details[] = "Shared secret: '{$secret}'";
                    $this->details[] = 'Current timestamp: ' . time();
                    $this->details[] = "Expected signature: {$signature}";
                    $this->details[] = "Base string: {$request->base_string}";
                }
            }
        } else {  // JWT-signed message
            $nonce = new PlatformNonce($platform, $this->jwt->getClaim('nonce'));
            $ok = !$nonce->load();
            if ($ok) {
                $ok = $nonce->save();
            }
            if (!$ok) {
                $this->reason = 'Invalid nonce.';
            } elseif (!empty($publicKey) || !empty($jku) || Jwt::$allowJkuHeader) {
                $ok = $this->jwt->verify($publicKey, $jku);
                if (!$ok) {
                    $this->reason = 'JWT signature check failed - perhaps an invalid public key or timestamp';
                }
            } else {
                $ok = false;
                $this->reason = 'Unable to verify JWT signature as neither a public key nor a JSON Web Key URL is specified';
            }
        }
 
        return $ok;
    }
 
###
###    PRIVATE METHODS
###
 
    private function parseMessage($strictMode, $disableCookieCheck, $generateWarnings)
    {
        if (is_null($this->messageParameters)) {
            $this->getRawParameters();
            if (isset($this->rawParameters['id_token']) || isset($this->rawParameters['JWT'])) {  // JWT-signed message
                try {
                    $this->jwt = Jwt::getJwtClient();
                    if (isset($this->rawParameters['id_token'])) {
                        $this->ok = $this->jwt->load($this->rawParameters['id_token'], $this->rsaKey);
                    } else {
                        $this->ok = $this->jwt->load($this->rawParameters['JWT'], $this->rsaKey);
                    }
                    if (!$this->ok) {
                        $this->reason = 'Message does not contain a valid JWT';
                    } else {
                        $this->ok = $this->jwt->hasClaim('iss') && $this->jwt->hasClaim('aud') && $this->jwt->hasClaim('nonce') &&
                            $this->jwt->hasClaim(Util::JWT_CLAIM_PREFIX . '/claim/deployment_id');
                        if ($this->ok) {
                            $iss = $this->jwt->getClaim('iss');
                            $aud = $this->jwt->getClaim('aud');
                            $deploymentId = $this->jwt->getClaim(Util::JWT_CLAIM_PREFIX . '/claim/deployment_id');
                            $this->ok = !empty($iss) && !empty($aud) && !empty($deploymentId);
                            if (!$this->ok) {
                                $this->reason = 'iss, aud and/or deployment_id claim is empty';
                            } elseif (is_array($aud)) {
                                if ($this->jwt->hasClaim('azp')) {
                                    $this->ok = !empty($this->jwt->getClaim('azp'));
                                    if (!$this->ok) {
                                        $this->reason = 'azp claim is empty';
                                    } else {
                                        $this->ok = in_array($this->jwt->getClaim('azp'), $aud);
                                        if ($this->ok) {
                                            $aud = $this->jwt->getClaim('azp');
                                        } else {
                                            $this->reason = 'azp claim value is not included in aud claim';
                                        }
                                    }
                                } else {
                                    $aud = $aud[0];
                                    $this->ok = !empty($aud);
                                    if (!$this->ok) {
                                        $this->reason = 'First element of aud claim is empty';
                                    }
                                }
                            } elseif ($this->jwt->hasClaim('azp')) {
                                $this->ok = $this->jwt->getClaim('azp') === $aud;
                                if (!$this->ok) {
                                    $this->reason = 'aud claim does not match the azp claim';
                                }
                            }
                            if ($this->ok) {
                                if ($this instanceof Tool) {
                                    $this->platform = Platform::fromPlatformId($iss, $aud, $deploymentId, $this->dataConnector);
                                    $this->platform->platformId = $iss;
                                    if (isset($this->rawParameters['id_token'])) {
                                        $this->ok = !empty($this->rawParameters['state']);
                                        if ($this->ok) {
                                            $state = $this->rawParameters['state'];
                                            $parts = explode('.', $state);
                                            if (!empty(session_id()) && (count($parts) > 1) && (session_id() !== $parts[1]) &&
                                                ($parts[1] !== 'platformStorage')) {  // Reset to original session
                                                session_abort();
                                                session_id($parts[1]);
                                                session_start();
                                                $this->onResetSessionId();
                                            }
                                            $usePlatformStorage = (substr($state, -16) === '.platformStorage');
                                            if ($usePlatformStorage) {
                                                $state = substr($state, 0, -16);
                                            }
                                            $this->onAuthenticate($state, $this->jwt->getClaim('nonce'), $usePlatformStorage);
                                            if (!$disableCookieCheck) {
                                                if (empty($_COOKIE) && !isset($_POST['_new_window'])) {  // Reopen in a new window
                                                    Util::setTestCookie();
                                                    $_POST['_new_window'] = '';
                                                    echo Util::sendForm($_SERVER['REQUEST_URI'], $_POST, '_blank');
                                                    exit;
                                                }
                                                Util::setTestCookie(true);
                                            }
                                        } else {
                                            $this->reason = 'state parameter is missing';
                                        }
                                        if ($this->ok) {
                                            $nonce = new PlatformNonce($this->platform, $state);
                                            $this->ok = $nonce->load();
                                            if (!$this->ok) {
                                                $platform = Platform::fromPlatformId($iss, $aud, null, $this->dataConnector);
                                                $nonce = new PlatformNonce($platform, $state);
                                                $this->ok = $nonce->load();
                                            }
                                            if (!$this->ok) {
                                                $platform = Platform::fromPlatformId($iss, null, null, $this->dataConnector);
                                                $nonce = new PlatformNonce($platform, $state);
                                                $this->ok = $nonce->load();
                                            }
                                            if ($this->ok) {
                                                $this->ok = $nonce->delete();
                                            }
                                            if (!$this->ok) {
                                                $this->reason = 'state parameter is invalid or has expired';
                                            }
                                        }
                                    }
                                }
                                $this->messageParameters = array();
                                if ($this->ok) {
                                    $this->messageParameters['oauth_consumer_key'] = $aud;
                                    $this->messageParameters['oauth_signature_method'] = $this->jwt->getHeader('alg');
                                    $this->parseClaims($strictMode, $generateWarnings);
                                }
                            }
                        } else {
                            $this->reason = 'iss, aud, deployment_id and/or nonce claim not found';
                        }
                    }
                } catch (\Exception $e) {
                    $this->ok = false;
                    $this->reason = 'Message does not contain a valid JWT';
                }
            } elseif (isset($this->rawParameters['error'])) {  // Error with JWT-signed message
                $this->ok = false;
                $this->reason = $this->rawParameters['error'];
                if (!empty($this->rawParameters['error_description'])) {
                    $this->reason .= ": {$this->rawParameters['error_description']}";
                }
            } else {  // OAuth
                if ($this instanceof Tool) {
                    if (isset($this->rawParameters['oauth_consumer_key'])) {
                        $this->platform = Platform::fromConsumerKey($this->rawParameters['oauth_consumer_key'], $this->dataConnector);
                    }
                    if (isset($this->rawParameters['tool_state'])) {  // Relaunch?
                        $state = $this->rawParameters['tool_state'];
                        if (!$disableCookieCheck) {
                            $parts = explode('.', $state);
                            if (empty($_COOKIE) && !isset($_POST['_new_window'])) {  // Reopen in a new window
                                Util::setTestCookie();
                                $_POST['_new_window'] = '';
                                echo Util::sendForm($_SERVER['REQUEST_URI'], $_POST, '_blank');
                                exit;
                            } elseif (!empty(session_id()) && (count($parts) > 1) && (session_id() !== $parts[1])) {  // Reset to original session
                                session_abort();
                                session_id($parts[1]);
                                session_start();
                                $this->onResetSessionId();
                            }
                            unset($this->rawParameters['_new_window']);
                            Util::setTestCookie(true);
                        }
                        $nonce = new PlatformNonce($this->platform, $state);
                        $this->ok = $nonce->load();
                        if (!$this->ok) {
                            $this->reason = "Invalid tool_state parameter: '{$state}'";
                        }
                    }
                }
                $this->messageParameters = $this->rawParameters;
            }
        }
    }
 
    private function parseClaims($strictMode, $generateWarnings)
    {
        $payload = Util::cloneObject($this->jwt->getPayload());
        $errors = array();
        foreach (Util::JWT_CLAIM_MAPPING as $key => $mapping) {
            $claim = Util::JWT_CLAIM_PREFIX;
            if (!empty($mapping['suffix'])) {
                $claim .= "-{$mapping['suffix']}";
            }
            $claim .= '/claim/';
            if (is_null($mapping['group'])) {
                $claim = $mapping['claim'];
            } elseif (empty($mapping['group'])) {
                $claim .= $mapping['claim'];
            } else {
                $claim .= $mapping['group'];
            }
            if ($this->jwt->hasClaim($claim)) {
                $value = null;
                if (empty($mapping['group'])) {
                    unset($payload->{$claim});
                    $value = $this->jwt->getClaim($claim);
                } else {
                    $group = $this->jwt->getClaim($claim);
                    if (is_array($group) && array_key_exists($mapping['claim'], $group)) {
                        unset($payload->{$claim}[$mapping['claim']]);
                        $value = $group[$mapping['claim']];
                    } elseif (is_object($group) && isset($group->{$mapping['claim']})) {
                        unset($payload->{$claim}->{$mapping['claim']});
                        $value = $group->{$mapping['claim']};
                    }
                }
                if (!is_null($value)) {
                    if (isset($mapping['isArray']) && $mapping['isArray']) {
                        if (!is_array($value)) {
                            $errors[] = "'{$claim}' claim must be an array";
                        } else {
                            $value = implode(',', $value);
                        }
                    } elseif (isset($mapping['isObject']) && $mapping['isObject']) {
                        $value = json_encode($value);
                    } elseif (isset($mapping['isBoolean']) && $mapping['isBoolean']) {
                        $value = $value ? 'true' : 'false';
                    } elseif (isset($mapping['isInteger']) && $mapping['isInteger']) {
                        $value = strval($value);
                    } elseif (!is_string($value)) {
                        if ($generateWarnings) {
                            $this->warnings[] = "Value of claim '{$claim}' is not a string: '{$value}'";
                        }
                        if (!$strictMode) {
                            $value = strval($value);
                        }
                    }
                }
                if (!is_null($value) && is_string($value)) {
                    $this->messageParameters[$key] = $value;
                }
            }
        }
        if (!empty($this->messageParameters['lti_message_type']) &&
            in_array($this->messageParameters['lti_message_type'], array_values(Util::MESSAGE_TYPE_MAPPING))) {
            $this->messageParameters['lti_message_type'] = array_search($this->messageParameters['lti_message_type'],
                Util::MESSAGE_TYPE_MAPPING);
        }
        if (!empty($this->messageParameters['accept_types'])) {
            $types = array_map('trim', explode(',', $this->messageParameters['accept_types']));
            $types = array_filter($types);
            $mediaTypes = array();
            if (!empty($this->messageParameters['accept_media_types'])) {
                $mediaTypes = array_map('trim', explode(',', $this->messageParameters['accept_media_types']));
                $mediaTypes = array_filter($mediaTypes);
            }
            if (in_array(Item::TYPE_LTI_LINK, $types)) {
                $mediaTypes[] = Item::LTI_LINK_MEDIA_TYPE;
            }
            if (in_array(Item::TYPE_LTI_ASSIGNMENT, $types)) {
                $mediaTypes[] = Item::LTI_ASSIGNMENT_MEDIA_TYPE;
            }
            if (in_array('html', $types) && !in_array('*/*', $mediaTypes)) {
                $mediaTypes[] = 'text/html';
            }
            if (in_array('image', $types) && !in_array('*/*', $mediaTypes)) {
                $mediaTypes[] = 'image/*';
            }
            $mediaTypes = array_unique($mediaTypes);
            $this->messageParameters['accept_media_types'] = implode(',', $mediaTypes);
        }
        $claim = Util::JWT_CLAIM_PREFIX . '/claim/custom';
        if ($this->jwt->hasClaim($claim)) {
            unset($payload->{$claim});
            $custom = $this->jwt->getClaim($claim);
            if (!is_array($custom) && !is_object($custom)) {
                $errors[] = "'{$claim}' claim must be an object";
            } else {
                foreach ($custom as $key => $value) {
                    $this->messageParameters["custom_{$key}"] = $value;
                }
            }
        }
        $claim = Util::JWT_CLAIM_PREFIX . '/claim/ext';
        if ($this->jwt->hasClaim($claim)) {
            unset($payload->{$claim});
            $ext = $this->jwt->getClaim($claim);
            if (!is_array($ext) && !is_object($ext)) {
                $errors[] = "'{$claim}' claim must be an object";
            } else {
                foreach ($ext as $key => $value) {
                    $this->messageParameters["ext_{$key}"] = $value;
                }
            }
        }
        $claim = Util::JWT_CLAIM_PREFIX . '/claim/lti1p1';
        if ($this->jwt->hasClaim($claim)) {
            unset($payload->{$claim});
            $lti1p1 = $this->jwt->getClaim($claim);
            if (!is_array($lti1p1) && !is_object($lti1p1)) {
                $errors[] = "'{$claim}' claim must be an object";
            } else {
                foreach ($lti1p1 as $key => $value) {
                    if (is_null($value)) {
                        $value = '';
                    } elseif (is_object($value)) {
                        $value = json_encode($value);
                    }
                    $this->messageParameters["lti1p1_{$key}"] = $value;
                }
            }
        }
        $claim = 'http://www.brightspace.com';
        if ($this->jwt->hasClaim($claim)) {
            $d2l = $this->jwt->getClaim($claim);
            if (is_array($d2l)) {
                if (!empty($d2l['username'])) {
                    $this->messageParameters['ext_d2l_username'] = $d2l['username'];
                    unset($payload->{$claim}['username']);
                }
            } else if (is_object($ext)) {
                if (!empty($d2l->username)) {
                    $this->messageParameters['ext_d2l_username'] = $d2l->username;
                    unset($payload->{$claim}->username);
                }
            }
        }
        if (!empty($payload)) {
            $objVars = get_object_vars($payload);
            foreach ($objVars as $attrName => $attrValue) {
                if (empty((array) $attrValue)) {
                    unset($payload->{$attrName});
                }
            }
            $this->messageParameters['unmapped_claims'] = json_encode($payload);
        }
        if (!empty($errors)) {
            $this->ok = false;
            $this->reason = 'Invalid JWT: ' . implode(', ', $errors);
        }
    }
 
    private function doCallback()
    {
        if (array_key_exists($this->messageParameters['lti_message_type'], Util::$METHOD_NAMES)) {
            $callback = Util::$METHOD_NAMES[$this->messageParameters['lti_message_type']];
        } else {
            $callback = "on{$this->messageParameters['lti_message_type']}";
        }
        if (method_exists($this, $callback)) {
            $this->$callback();
        } elseif ($this->ok) {
            $this->ok = false;
            $this->reason = "Message type not supported: {$this->messageParameters['lti_message_type']}";
        }
    }
 
    private function addOAuth1Signature($endpoint, $data, $method, $type, $hash, $timestamp)
    {
        $params = array();
        if (is_array($data)) {
            $params = $data;
            $params['oauth_callback'] = 'about:blank';
        }
// Check for query parameters which need to be included in the signature
        $queryString = parse_url($endpoint, PHP_URL_QUERY);
        $queryParams = OAuth\OAuthUtil::parse_parameters($queryString);
        $params = array_merge_recursive($queryParams, $params);
 
        if (!is_array($data)) {
            if (empty($hash)) {  // Calculate body hash
                if (is_null($data)) {
                    $data = '';
                }
                switch ($this->signatureMethod) {
                    case 'HMAC-SHA224':
                        $hash = base64_encode(hash('sha224', $data, true));
                        break;
                    case 'HMAC-SHA256':
                        $hash = base64_encode(hash('sha256', $data, true));
                        break;
                    case 'HMAC-SHA384':
                        $hash = base64_encode(hash('sha384', $data, true));
                        break;
                    case 'HMAC-SHA512':
                        $hash = base64_encode(hash('sha512', $data, true));
                        break;
                    default:
                        $hash = base64_encode(sha1($data, true));
                        break;
                }
            }
            $params['oauth_body_hash'] = $hash;
        }
        if (!empty($timestamp)) {
            $params['oauth_timestamp'] = $timestamp;
        }
 
// Add OAuth signature
        switch ($this->signatureMethod) {
            case 'HMAC-SHA224':
                $hmacMethod = new OAuth\OAuthSignatureMethod_HMAC_SHA224();
                break;
            case 'HMAC-SHA256':
                $hmacMethod = new OAuth\OAuthSignatureMethod_HMAC_SHA256();
                break;
            case 'HMAC-SHA384':
                $hmacMethod = new OAuth\OAuthSignatureMethod_HMAC_SHA384();
                break;
            case 'HMAC-SHA512':
                $hmacMethod = new OAuth\OAuthSignatureMethod_HMAC_SHA512();
                break;
            default:
                $hmacMethod = new OAuth\OAuthSignatureMethod_HMAC_SHA1();
                break;
        }
        $key = $this->key;
        $secret = $this->secret;
        if (empty($key)) {
            if (($this instanceof Tool) && !empty($this->platform)) {
                $key = $this->platform->getKey();
                $secret = $this->platform->secret;
            } elseif (($this instanceof Platform) && !empty(Tool::$defaultTool)) {
                $key = Tool::$defaultTool->getKey();
                $secret = Tool::$defaultTool->secret;
            }
        }
        $oauthConsumer = new OAuth\OAuthConsumer($key, $secret, null);
        $oauthReq = OAuth\OAuthRequest::from_consumer_and_token($oauthConsumer, null, $method, $endpoint, $params);
        $oauthReq->sign_request($hmacMethod, $oauthConsumer, null);
        if (!is_array($data)) {
            $header = $oauthReq->to_header();
            if (empty($data)) {
                if (!empty($type)) {
                    $header .= "\nAccept: {$type}";
                }
            } elseif (isset($type)) {
                $header .= "\nContent-Type: {$type}; charset=UTF-8";
                $header .= "\nContent-Length: " . strlen($data);
            }
            return $header;
        } else {
// Remove parameters from query string
            $params = $oauthReq->get_parameters();
            foreach ($queryParams as $key => $value) {
                if (!is_array($value)) {
                    if (!is_array($params[$key])) {
                        if ($params[$key] === $value) {
                            unset($params[$key]);
                        }
                    } else {
                        $params[$key] = array_diff($params[$key], array($value));
                    }
                } else {
                    foreach ($value as $element) {
                        $params[$key] = array_diff($params[$key], array($value));
                    }
                }
            }
// Remove any parameters comprising an empty array of values
            foreach ($params as $key => $value) {
                if (is_array($value)) {
                    if (count($value) <= 0) {
                        unset($params[$key]);
                    } elseif (count($value) === 1) {
                        $params[$key] = reset($value);
                    }
                }
            }
            return $params;
        }
    }
 
    private function addJWTSignature($endpoint, $data, $method, $type, $nonce, $timestamp)
    {
        $ok = false;
        if (is_array($data)) {
            $ok = true;
            if (empty($nonce)) {
                $nonce = Util::getRandomString(32);
            }
            $publicKey = null;
            if (!array_key_exists('grant_type', $data)) {
                $this->messageParameters = $data;
                $payload = $this->getMessageClaims();
                $privateKey = $this->rsaKey;
                $kid = $this->kid;
                $jku = $this->jku;
                if ($this instanceof Platform) {
                    if (!empty(Tool::$defaultTool)) {
                        $publicKey = Tool::$defaultTool->rsaKey;
                    }
                    $payload['iss'] = $this->platformId;
                    $payload['aud'] = array($this->clientId);
                    $payload['azp'] = $this->clientId;
                    $payload[Util::JWT_CLAIM_PREFIX . '/claim/deployment_id'] = $this->deploymentId;
                    $payload[Util::JWT_CLAIM_PREFIX . '/claim/target_link_uri'] = $endpoint;
                    $paramName = 'id_token';
                } else {
                    if (!empty($this->platform)) {
                        $publicKey = $this->platform->rsaKey;
                        $payload['iss'] = $this->platform->clientId;
                        $payload['aud'] = array($this->platform->platformId);
                        $payload['azp'] = $this->platform->platformId;
                        $payload[Util::JWT_CLAIM_PREFIX . '/claim/deployment_id'] = $this->platform->deploymentId;
                    }
                    $paramName = 'JWT';
                }
                $payload['nonce'] = $nonce;
            } else {
                $authorizationId = '';
                if ($this instanceof Tool) {
                    $sub = '';
                    if (!empty($this->platform)) {
                        $sub = $this->platform->clientId;
                        $authorizationId = $this->platform->authorizationServerId;
                        $publicKey = $this->platform->rsaKey;
                    }
                    $privateKey = $this->rsaKey;
                    $kid = $this->kid;
                    $jku = $this->jku;
                } else {  // Tool-hosted services not yet defined in LTI
                    $sub = $this->clientId;
                    $kid = $this->kid;
                    $jku = $this->jku;
                    $privateKey = $this->rsaKey;
                    if (!empty(Tool::$defaultTool)) {
                        $publicKey = Tool::$defaultTool->rsaKey;
                    }
                }
                $payload['iss'] = $sub;
                $payload['sub'] = $sub;
                if (empty($authorizationId)) {
                    $authorizationId = $endpoint;
                }
                $payload['aud'] = array($authorizationId);
                $payload['jti'] = $nonce;
                $params = $data;
                $paramName = 'client_assertion';
            }
        }
        if ($ok) {
            if (empty($timestamp)) {
                $timestamp = time();
            }
            $payload['iat'] = $timestamp;
            $payload['exp'] = $timestamp + Jwt::$life;
            try {
                $jwt = Jwt::getJwtClient();
                $params[$paramName] = $jwt::sign($payload, $this->signatureMethod, $privateKey, $kid, $jku, $this->encryptionMethod,
                        $publicKey);
            } catch (\Exception $e) {
                $params = array();
            }
 
            return $params;
        } else {
            $header = '';
            if ($this instanceof Tool) {
                $platform = $this->platform;
            } else {
                $platform = $this;
            }
            $accessToken = $platform->getAccessToken();
            if (empty($accessToken)) {
                $accessToken = new AccessToken($platform);
                $platform->setAccessToken($accessToken);
            }
            if (!$accessToken->hasScope()) {  // Check token has not expired
                $accessToken->get();
            }
            if (!empty($accessToken->token)) {
                $header = "Authorization: Bearer {$accessToken->token}";
            }
            if (empty($data) && ($method !== 'DELETE')) {
                if (!empty($type)) {
                    $header .= "\nAccept: {$type}";
                }
            } elseif (isset($type)) {
                $header .= "\nContent-Type: {$type}; charset=UTF-8";
                if (!empty($data) && is_string($data)) {
                    $header .= "\nContent-Length: " . strlen($data);
                }
            }
 
            return $header;
        }
    }
 
    private static function fullyQualifyClaim($claim, $value)
    {
        $claims = array();
        $empty = true;
        if (is_object($value)) {
            foreach ($value as $c => $v) {
                $empty = false;
                $claims = array_merge($claims, static::fullyQualifyClaim("{$claim}/{$c}", $v));
            }
        }
        if ($empty) {
            $claims[$claim] = $value;
        }
 
        return $claims;
    }
 
}