fix(lti): add NRPS pagination link headers

[navinkarkera]

Description

The LTI NRPS Context Membership endpoint (GET /memberships) currently returns all course members in a single response.

This PR adds manual pagination following the NRPS v2.0 specification:

• limit query param — maximum members per page. When absent, all members are returned (preserving backward compatibility).
• page query param — 1-indexed page number (default 1). Only consulted when limit is present and valid.
• Link: <url>; rel="next" header — emitted when more members remain after the current page. The URL carries the same limit and an incremented page, and preserves any other query params present on the original request.

Invalid/zero/negative limit silently falls back to no pagination. Invalid/zero/negative page defaults to page 1.

Co-authored by: GPT 5.5

Related

• LTI NRPS endpoint ignores limit and does not emit Link headers, causing IMS certification failure #669

Test instructions

Prerequisites

• Devstack running
• A course with at least a few enrolled users
• An LTI 1.3 block configured with NRPS enabled (lti_1p3_enable_nrps = True)

1. Get the LTI Configuration ID

Open an LMS Django shell:

# Inside the lms container or via
tutor dev exec lms bash

from lti_consumer.models import LtiConfiguration
from django.contrib.auth.models import User

# List LTI 1.3 configs
for c in LtiConfiguration.objects.filter(version=LtiConfiguration.LTI_1P3)[:10]:
    print(c.id, c.location)

Note the id of a config whose block has NRPS enabled. We'll call this <CONFIG_ID>.

2. Create a Bearer Token (dev-only)

In the same shell session:

from lti_consumer.models import LtiConfiguration

config = LtiConfiguration.objects.get(id=<CONFIG_ID>)
consumer = config.get_lti_consumer()

token = consumer.key_handler.encode_and_sign({
    "iss": "https://example.com",
    "scopes": "https://purl.imsglobal.org/spec/lti-nrps/scope/contextmembership.readonly",
})
print(token)

Copy the printed token. We'll call this <TOKEN>.

3. Test Without Pagination (Baseline)

curl -s -H "Authorization: Bearer <TOKEN>" \
  "http://localhost:18000/lti_consumer/v1/lti/<CONFIG_ID>/memberships" \
  | python -m json.tool | head -20

Expected:

• Status 200
• All enrolled members returned under members
• No Link header in the response

4. Test First Page with limit

curl -s -v -H "Authorization: Bearer <TOKEN>" \
  "http://localhost:18000/lti_consumer/v1/lti/<CONFIG_ID>/memberships?limit=2" \
  2>&1 | tee /tmp/nrps_page1.txt

Expected:

• Status 200
• Exactly 2 members in members
• Link header present with rel="next" containing limit=2&page=2

5. Test Second Page

Parse the Link header URL from step 4 and call it:

curl -s -v -H "Authorization: Bearer <TOKEN>" \
  "http://localhost:18000/lti_consumer/v1/lti/<CONFIG_ID>/memberships?limit=2&page=2" \
  2>&1 | tee /tmp/nrps_page2.txt

Expected:

• Status 200
• Next 2 members (or the remaining members)
• No Link header if this is the last page

6. Test Preserving Unrelated Params

curl -s -v -H "Authorization: Bearer <TOKEN>" \
  "http://localhost:18000/lti_consumer/v1/lti/<CONFIG_ID>/memberships?limit=2&role=instructor" \
  2>&1 | tee /tmp/nrps_role.txt

Expected:

• Status 200
• Link header URL contains role=instructor alongside limit=2&page=2

7. Test Invalid Limit (should return all members)

curl -s -H "Authorization: Bearer <TOKEN>" \
  "http://localhost:18000/lti_consumer/v1/lti/<CONFIG_ID>/memberships?limit=0" \
  | python -m json.tool | head -10

Expected:

• Status 200
• All members returned
• No Link header

8. Test Invalid Page (should default to page 1)

curl -s -H "Authorization: Bearer <TOKEN>" \
  "http://localhost:18000/lti_consumer/v1/lti/<CONFIG_ID>/memberships?limit=2&page=-1" \
  | python -m json.tool

Expected:

• Status 200
• Same result as limit=2 (page 1)

[openedx-webhooks]

Thanks for the pull request, @navinkarkera!

This repository is currently maintained by @Faraz32123.

Once you've gone through the following steps feel free to tag them in a comment and let them know that your changes are ready for engineering review.

🔘 Get product approval

If you haven't already, check this list to see if your contribution needs to go through the product review process.

• If it does, you'll need to submit a product proposal for your contribution, and have it reviewed by the Product Working Group.
  • This process (including the steps you'll need to take) is documented here.
• If it doesn't, simply proceed with the next step.

🔘 Provide context

To help your reviewers and other members of the community understand the purpose and larger context of your changes, feel free to add as much of the following information to the PR description as you can:

• Dependencies

  This PR must be merged before / after / at the same time as ...

• Blockers

  This PR is waiting for OEP-1234 to be accepted.

• Timeline information

  This PR must be merged by XX date because ...

• Partner information

  This is for a course on edx.org.

• Supporting documentation
• Relevant Open edX discussion forum threads

🔘 Get a green build

If one or more checks are failing, continue working on your changes until this is no longer the case and your build turns green.

Details

---

Where can I find more information?

If you'd like to get more details on all aspects of the review process for open source pull requests (OSPRs), check out the following resources:

• Overview of Review Process for Community Contributions
• Pull Request Status Guide
• Making changes to your pull request

When can I expect my changes to be merged?

Our goal is to get community contributions seen and reviewed as efficiently as possible.

However, the amount of time that it takes to review and merge a PR can vary significantly based on factors such as:

• The size and impact of the changes that it introduces
• The need for product review
• Maintenance status of the parent repository

💡 As a result it may take up to several weeks or months to complete a review and merge your PR.

[codecov]

Codecov Report

❌ Patch coverage is 98.42520% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 97.93%. Comparing base (afec956) to head (e919558).

Files with missing lines	Patch %	Lines
lti_consumer/plugin/views.py	95.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #670      +/-   ##
==========================================
+ Coverage   97.84%   97.93%   +0.09%     
==========================================
  Files          84       84              
  Lines        7918     8043     +125     
==========================================
+ Hits         7747     7877     +130     
+ Misses        171      166       -5     

Flag	Coverage Δ
unittests	97.93% <98.42%> (+0.09%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[feanil]

@navinkarkera sorry this took so long, I took a look through it and found one ordering issue, otherwise the fix makes sense. We should also bump the version and add a changelog entry before this is ready to merge.

[feanil]

This offset pagination isn't stable, because the underlying data has no defined order. compat.get_course_members → the platform's get_course_members (lms/djangoapps/course_api/api.py) builds its result dict by iterating two unordered querysets — CourseEnrollment.get_active_enrollments_in_course (which is .filter(...).select_related(...) with no .order_by()) and then CourseAccessRole.access_roles_in_course, appending role-only users afterward. So list(data.values()) has a DB-arbitrary order that can differ between the request for page 1 and the request for page 2 — meaning a client paging through can silently skip or duplicate members.

Since fixing it upstream alone wouldn't be enough (the role-only users are merged in after enrollments), I'd sort by a stable unique key here before slicing, e.g.:

members = sorted(data.values(), key=lambda m: m['id'])

A test that pages through the whole set and asserts the union equals all members (no dupes, no gaps) would lock this in. Marking this as blocking.

[navinkarkera]

@feanil Nice catch! Fixed it and added a test.

[navinkarkera]

@feanil Bumped version and updated the changelog. This is ready to be merged.