--- loncom/Lond.pm	2022/02/07 18:32:34	1.8.2.3.2.2
+++ loncom/Lond.pm	2022/02/20 21:06:30	1.8.2.3.2.3
@@ -1,6 +1,6 @@
 # The LearningOnline Network
 #
-# $Id: Lond.pm,v 1.8.2.3.2.2 2022/02/07 18:32:34 raeburn Exp $
+# $Id: Lond.pm,v 1.8.2.3.2.3 2022/02/20 21:06:30 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -38,6 +38,7 @@ use LONCAPA;
 use Apache::lonnet;
 use GDBM_File;
 use Net::OAuth;
+use Crypt::CBC;
 
 sub dump_with_regexp {
     my ( $tail, $clientversion ) = @_;
@@ -830,6 +831,56 @@ sub get_dom {
     return $qresult;
 }
 
+sub store_dom {
+    my ($userinput) = @_;
+    my ($cmd,$dom,$namespace,$rid,$what) =split(/:/,$userinput);
+    my $hashref  = &tie_domain_hash($dom,$namespace,&GDBM_WRCREAT(),"S","$rid:$what") or
+        return "error: ".($!+0)." tie(GDBM) Failed while attempting $cmd";
+    $hashref->{"version:$rid"}++;
+    my $version=$hashref->{"version:$rid"};
+    my $allkeys='';
+    my @pairs=split(/\&/,$what);
+    foreach my $pair (@pairs) {
+        my ($key,$value)=split(/=/,$pair);
+        $allkeys.=$key.':';
+        $hashref->{"$version:$rid:$key"}=$value;
+    }
+    my $now = time;
+    $hashref->{"$version:$rid:timestamp"}=$now;
+    $allkeys.='timestamp';
+    $hashref->{"$version:keys:$rid"}=$allkeys;
+    &untie_user_hash($hashref) or
+        return "error: ".($!+0)." untie(GDBM) Failed while attempting $cmd";
+    return 'ok';
+}
+
+sub restore_dom {
+    my ($userinput) = @_;
+    my ($cmd,$dom,$namespace,$rid) = split(/:/,$userinput);
+    my $hashref = &tie_domain_hash($dom,$namespace,&GDBM_READER()) or
+        return "error: ".($!+0)." tie(GDBM) Failed while attempting $cmd";
+    my $qresult='';
+    if (ref($hashref)) {
+        chomp($rid);
+        my $version=$hashref->{"version:$rid"};
+        $qresult.="version=$version&";
+        my $scope;
+        for ($scope=1;$scope<=$version;$scope++) {
+            my $vkeys=$hashref->{"$scope:keys:$rid"};
+            my @keys=split(/:/,$vkeys);
+            my $key;
+            $qresult.="$scope:keys=$vkeys&";
+            foreach $key (@keys) {
+                $qresult.="$scope:$key=".$hashref->{"$scope:$rid:$key"}."&";
+            }
+        }
+        $qresult=~s/\&$//;
+    }
+    &untie_user_hash($hashref) or
+        return "error: ".($!+0)." untie(GDBM) Failed while attempting $cmd";
+    return $qresult;
+}
+
 sub crslti_itemid {
     my ($cdom,$cnum,$url,$method,$params,$loncaparev) = @_;
     unless (ref($params) eq 'HASH') {
@@ -876,9 +927,22 @@ sub crslti_itemid {
 
     return if (!keys(%crslti_by_key));
 
+    my %courselti = &Apache::lonnet::get_course_lti($cnum,$cdom,'provider');
+
     if (ref($crslti_by_key{$consumer_key}) eq 'ARRAY') {
         foreach my $id (@{$crslti_by_key{$consumer_key}}) {
             my $secret = $crslti{$id}{'secret'};
+            if (ref($courselti{$id}) eq 'HASH') {
+                if ((exists($courselti{$id}{'cipher'})) &&
+                    ($courselti{$id}{'cipher'} =~ /^\d+$/)) {
+                    my $keynum = $courselti{$id}{'cipher'};
+                    my $privkey = &get_dom("getdom:$cdom:private:$keynum:lti:key");
+                    if ($privkey ne '') {
+                        my $cipher = new Crypt::CBC($privkey);
+                        $secret = $cipher->decrypt_hex($secret);
+                    }
+                }
+            }
             my $request = Net::OAuth->request('request token')->from_hash($params,
                                               request_url => $url,
                                               request_method => $method,
@@ -911,65 +975,58 @@ sub domlti_itemid {
     my $consumer_key = $params->{'oauth_consumer_key'};
     return if ($consumer_key eq '');
 
+    my ($name,$cachename);
+    if ($context eq 'linkprot') {
+        $name = $context;
+    } else {
+        $name = 'lti';
+    }
+    $cachename = $name.'enc';
     my %ltienc;
-    my ($encresult,$enccached)=&Apache::lonnet::is_cached_new('ltienc',$dom);
+    my ($encresult,$enccached)=&Apache::lonnet::is_cached_new($cachename,$dom);
     if (defined($enccached)) {
         if (ref($encresult) eq 'HASH') {
             %ltienc = %{$encresult};
         }
     } else {
-        my $reply = &get_dom("getdom:$dom:encconfig:lti");
+        my $reply = &get_dom("getdom:$dom:encconfig:$name");
         my $ltiencref = &Apache::lonnet::thaw_unescape($reply);
         if (ref($ltiencref) eq 'HASH') {
             %ltienc = %{$ltiencref};
         }
         my $cachetime = 24*60*60;
-        &Apache::lonnet::do_cache_new('ltienc',$dom,\%ltienc,$cachetime);
+        &Apache::lonnet::do_cache_new($cachename,$dom,\%ltienc,$cachetime);
     }
 
     return if (!keys(%ltienc));
 
-    my %lti;
-    if ($context eq 'deeplink') {
-        my ($result,$cached)=&Apache::lonnet::is_cached_new('lti',$dom);
-        if (defined($cached)) {
-            if (ref($result) eq 'HASH') {
-                %lti = %{$result};
-            }
-        } else {
-            my $reply = &get_dom("getdom:$dom:configuration:lti");
-            my $ltiref = &Apache::lonnet::thaw_unescape($reply);
-            if (ref($ltiref) eq 'HASH') {
-                %lti = %{$ltiref};
-            }
-            my $cachetime = 24*60*60;
-            &Apache::lonnet::do_cache_new('lti',$dom,\%lti,$cachetime);
-        }
-    }
-    return if (!keys(%lti));
-
     my %lti_by_key;
     foreach my $id (keys(%ltienc)) {
         if (ref($ltienc{$id}) eq 'HASH') {
             my $key = $ltienc{$id}{'key'};
             if (($key ne '') && ($ltienc{$id}{'secret'} ne '')) {
-                if ($context eq 'deeplink') {
-                    if (ref($lti{$id}) eq 'HASH') {
-                        if (!$lti{$id}{'requser'}) {
-                            push(@{$lti_by_key{$key}},$id);
-                        }
-                    }
-                } else {
-                    push(@{$lti_by_key{$key}},$id);
-                }
+                push(@{$lti_by_key{$key}},$id);
             }
         }
     }
     return if (!keys(%lti_by_key));
 
+    my %lti = &Apache::lonnet::get_domain_lti($dom,$context);
+
     if (ref($lti_by_key{$consumer_key}) eq 'ARRAY') {
         foreach my $id (@{$lti_by_key{$consumer_key}}) {
             my $secret = $ltienc{$id}{'secret'};
+            if (ref($lti{$id}) eq 'HASH') {
+                if ((exists($lti{$id}{'cipher'})) &&
+                    ($lti{$id}{'cipher'} =~ /^\d+$/)) {
+                    my $keynum = $lti{$id}{'cipher'};
+                    my $privkey = &get_dom("getdom:$dom:private:$keynum:lti:key");
+                    if ($privkey ne '') {
+                        my $cipher = new Crypt::CBC($privkey);
+                        $secret = $cipher->decrypt_hex($secret);
+                    }
+                }
+            }
             my $request = Net::OAuth->request('request token')->from_hash($params,
                                               request_url => $url,
                                               request_method => $method,