joeyr
released this
2026-10-06 21:00:50 -05:00
| 13 commits to main since this release
Added
get_quiz_results: a graded New Quiz, question by question — every question, every
option, which one the user picked, which one was correct, the points on each question and
any feedback. It is C8, opened because a person asked to see their answers on a graded
homework and the tenant could give only the score. The Canvas tenant is at thirteen tools.- No published API returns this, so it reads what the results page reads. Nine
requests across three hosts: on Canvas the assignment, the course's account, the
assignment's launch page (the first HTML this tenant parses) and a token mint; on
quiz-lti the LTI launch and each attempt's results key; on quiz-api the attempt, its
questions and its scored answers. Every request shape was read out of the page's code or
the owner's network panel and driven end to end before a line was written. A step that
answers in any other shape is refused with the step named (failed_step), never
returned as a partial answer.
- Two POSTs, the browser's own, and no others. The mint on Canvas and the launch on
quiz-lti sit at constant paths and carry nothing from a tool argument; a test walks the
package's source and fails on a third non-GET, and another checks a full call's traffic.
Neither changes coursework.
- Five credentials, each to one host. The session cookie and CSRF token stay on
Canvas; the minted token and the access token go to quiz-lti as Bearer; the results
token goes to quiz-api bare, because Bearer there is a 401. Quiz hosts are named by
responses, so each must be HTTPS under the Canvas host's parent domain before anything
is sent. No token is logged, cached past one call, or returned.
- Finished attempts only. Canvas must call the quiz graded before any quiz host is
contacted. The launch's own session must be graded or pending (the next attempt, not
started); anything else may be an open attempt and refuses the whole call, earlier
attempts included, because they hold the same questions. Each attempt is then gated on
its own session, its can_see_results_* flags and its quiz-api status. A hidden result
comes back results_hidden, not empty.
- Five question types rendered, as measured: single choice, multiple answer,
true-false, formula (with the variables that attempt drew) and matching (as prompt pairs
and the answer bank). Anything else is type_not_rendered. The correct answer is the
option that scores — on a miss the unpicked option at 1 — and a formula's
correct_answer; where none is sent the question says correct_answer_not_sent, and a
wrong multiple-answer or matching question, never yet seen, is read the same way under
correct_answer_unverified. The owner decided on 2026-10-06 to show correct answers.
- The attempt that counts is the service's
authoritative one, never the latest by
assumption; attempt reads any other. percent is on 0-100, because the service's
percentage is a fraction, and scores are rounded off the service's float noise.
Changed
get_submission_feedback names get_quiz_results on every graded New Quiz. The row
carries opens_with beside the course_id and assignment_id it takes, and a graded
New Quiz now always earns a row, comment or not. Without that the pair could not fire:
an autograded quiz carries no comment and no rubric, so the live pass found no row to
name the tool on at all. A classic quiz's row says its results are only in Canvas.list_assignments and get_assignment mark a New Quiz new_quiz: true, because
external_tool alone is any LTI tool.- Every request the Canvas client makes goes through one
_exchange, so the four
cookie rules are written once for the GETs, the launch page and the mint.
docs/canvas-plan.md is deleted again: C8 was its only item. Its four outstanding live
checks moved to CLAUDE.md first, which now lists seven.
Downloads