How to set up LTI 1.3 authentication for Jupyterhub

[IvanYingX]

Heya @danielmcquillen! Not sure if I understand the question correctly, but if I do, then you are right, the oauth_callback can handle taking a user to a specific notebook. In fact, you can use LTI Deep Linking, you can add a claim to the token like this:
jwt["https://purl.imsglobal.org/spec/lti/claim/message_type"] = "LtiDeepLinkingRequest";
Instead of:
jwt["https://purl.imsglobal.org/spec/lti/claim/message_type"] = "LtiResourceLinkRequest";

And the you can add the deeplinking url:
https://purl.imsglobal.org/spec/lti-dl/claim/deep_linking_settings.

However, there is one thing I noticed when doing it that way, the user can still navigate through parent directories. So let’s say for example that in your LMS, you want that the user can only access a lesson at a time, but you have this tree in your repo:

lessons
|
|----Python Basics
            |
            |--- Sets
            |       |--- Notebook.ipynb
            |       |--- Test.txt
            |
            |---- Dictionaries
                    |--- Notebook.ipynb
                    |--- Test.txt               

If you want the user to only check the Notebooks inside lessons/Python Basics/Dictionaries, you should block any access to the parent directories.

I noticed that the way to set a notebook directory is by sending the details to the spawner and modify the notebook_dir env variable, whereas Deep Linking will redirect you to the dictionary, but will allow the user to “move up” from that directory.

Just to make sure we are in the same page. The call I am making here:

@IvanYingX

const launchJupyterHubServer = async (
  lessonName: string,
  lessonId: string,
  email: string
) => {
  const url = `${JUPYTERHUB_URL}/users/${email}/server`;
  const body = {
    "lesson_name": lessonName,
    "lesson_id": lessonId,
    "lesson_dir": lessonName,
  };
  const response = await fetch(url, {
    method: 'POST',
    headers: {
      'Content-Type': 'application/json',
      "Authorization": `token ${JUPYTERHUB_API_TOKEN}`
    },
    body: JSON.stringify(body),
  });
  return response;

does not open JupyterHub, it “simply” spawns a container for a user, but then, the actual workflow for opening JupyterHub in the LMS is done here:

@IvanYingX

const launchLtiInIframe = async () => {
    if (!launchParams) {
      return;
    }
    if (clientId === LTI_JUPYTERHUB_APPLICATION_ID) {
      await launchJupyterHub();
    }
    setIframeUrl(
      `${launchUrl}?${Object.entries(launchParams)
        .map(([key, value]) => `${key}=${value}`)
        .join('&')}`
    );
  };

Once again, not sure if that was the actual question, if not let me know