So, in LTI, there is something called a context id. Best I can tell, it is a unique identifier for an LTI  course site. I don’t know how unique it really is, though. For example, is it possible for sites from two different LMS vendors to have courses with the same context id? You’d hope not, but you’d guess it might be possible, unless each vendor is issued some sort of unique string they and only they are to start their ids with. I don’t know much about the rules from the provider side.

So, this post is about a problem I just encountered in a tool I am playing with. The tool is currently storing some csv data, one record per course. Naturally, I am storing them under the contextid for the course. But, we have two Canvas instances at our disposal, the production and the test instance. The test instance is cloned from the production once a week or so. Recently I was playing with my tool using the test instance, and then realized that the contextids are the same for both. I suppose that’s not surprising given that they are clones, but the sub-domains are different. I was not actually expecting the upload I made on the test site to impact the data viewed on the production site. After all, that’s kind of the point of having a test site, so you can play without messing anything up on the real site. In retrospect, it should have been obvious that if I could SEE the data that had been stored on the production site, I would also be able to overwrite it.

So now I’m left with a thorny issue. How do I protect the real data from corruption based on actions taken in the test site? I think I’m going to have to put an extra column in my database for the site’s domain, and use a combination as a key. If I do that, then the weekly clones will not be able to see the same data that is in the production copy, which is sort of a bummer, but better than the alternative.

The other solution is to stop storing data in external databases, and switch instead to putting hidden files into the Canvas file system. I was planning to do that anyway, as much as possible. I don’t think I will attempt it for my Peer Evaluation tool, because the data is too complex, but for Post’Em and SBG, it should be no problem.