Testlify LTI 1.3 Advantage Plugin

Team & Timeline

25 commits over about 7 weeks (February to March 2026), with two collaborators alongside me. I wrote roughly 80% of the commits and drove the architecture and certification work; "lead engineer" is an accurate description of the role, not an inflated one.

Hand-Rolled, Not ltijs

ltijs is the standard Node.js library for LTI 1.3, and most integrations reach for it. This one doesn't depend on it. JWKS fetching, key matching, and RS256 JWT verification are implemented directly in this codebase, along with the stateless session pattern described in the companion blog post: a signed, 24-hour session token (ltik) carried in the URL instead of a cookie, sent as a bearer token on every API call, specifically so the integration keeps working when a browser blocks third-party cookies inside an LMS iframe. Getting a certified integration through 1EdTech's conformance testing means the security layer has to match the spec exactly; owning that code directly, instead of depending on a third-party library's release cycle and interpretation of the spec, made that easier to verify and certify.

NRPS and AGS, the two fully-built LTI Advantage services, go further than the spec's minimum: NRPS handles pagination via the LMS's own Link headers and normalizes role URNs across platforms that don't format them identically, with a client-side filter as a safety net for LMS platforms that don't fully comply with the spec.

Four LMS Platforms, One Local Test Harness

Moodle isn't spun up by this repo's own Docker Compose file; it joins the network of a separately-run moodle-docker project for local testing. Canvas is Instructure's own hosted SaaS with no equivalent self-hosted image to run locally, so it's tested against a live Canvas instance directly instead. Production runs on Vercel. A production Dockerfile existed early on and was later deleted once Vercel became the only real deployment target; only a dev-only Dockerfile remains, for local iteration, not as a self-host fallback. D2L Brightspace support was added later, by a dated commit adding registration support for a fourth LMS, not part of the original three.

Data Model & Scale

• Each registered LMS platform (a university or institution's Canvas/Moodle/Blackboard/Brightspace instance) is its own tenant record with its own registration keys, not a shared global credential.
• Separate service modules handle NRPS (roster retrieval) and AGS (line items and score submission) against the LTI Advantage spec, plus a dedicated score webhook endpoint.
• MongoDB via Mongoose backs platform configuration and assessment-assignment records.

The project outgrew its own README: a more detailed and more recently dated internal overview describes the complete, Vercel-deployed, 4-LMS architecture, with its own security, database, and API reference docs, that this integration actually became.

Build vs. Buy

Hand-rolled JWKS/JWT/session logic over the ltijs library: full control over spec compliance for a certification-gated integration, instead of inheriting a dependency's own interpretation of the spec. Vercel over self-hosting: once that became the only real deployment target, the production Dockerfile was deleted rather than kept around unused, leaving only a dev-only Dockerfile for local iteration.

Stack

Next.js 14, React 18, MongoDB with Mongoose, Docker Compose for local Moodle testing, deployed on Vercel, certified against the 1EdTech LTI Advantage (1.3) conformance suite.