Currently I'm working on an LTI tool that turns a Canvas quiz into an immediate feedback self-test for teams. I'm basically just grabbing all the multiple choice items in the selected quiz, and presenting them to the selected group set teams to be taken collaboratively. Each time a team selects an answer option, they see the feedback associated with that response, and their score is adjusted. You lose half the points a question is worth each time you pick a wrong answer, but you get to try again. The entire team gets points for the assignment (not the quiz, which does not need to be published).
One thing I am struggling with is how often to push grades back to Canvas. Right now I do it every time an answer is selected, and I'm putting any incorrectly chosen options into a comment. That generated a long list of comments and grading events. I could of course withhold grades until the entire quiz has been completed, but I don't want data to be lost if something happens mid-quiz. I've taken pains to prevent teams from trying to restart the quiz as a way of cheating, so if someone's computer crashes, that team has no way to get back in to try again or pick up where they left off. It would be good for an instructor to know how far they got. Better, of course, if I store the info in such a way that I can reconstruct their responses, but I haven't tackled that piece yet.
The other thing I'm debating is what to do about masquerading. The easiest way to determine which group a logged-in student is in is to hit the groups endpoint 'as' him/her, but since faculty can't masquerade, I have to use an admin API token to do it. That's fine for us, but if I ever decide to go public with this, it would be best if faculty could use their own tokens. I also masquerade when submitting the grades, using the id of whoever chose the quiz and group-set during the resource selection phase. If faculty use their own tokens, that wouldn't be necessary, so if I do create a version that works for faculty, I might need a way to branch the code. I don't know what happens when you use as_user_id and your token has no masquerading privileges. The documentation suggests that masquerading will fail, no matter what you are trying to do. But the question is, if the masquerade fails, does the rest of the API request fail with it, even if the user is not asking for anything they couldn't do themselves? I'm thinking yes, but I haven't tested. I'm hoping that this might be a good place to collect that sort of information.
