{"action":"created","comment":{"url":"https://api.github.com/repos/edx/edx-platform/pulls/comments/37264314","id":37264314,"diff_hunk":"@@ -0,0 +1,142 @@\n+import logging\n+import calendar\n+import time\n+\n+from django.contrib.auth import REDIRECT_FIELD_NAME, logout\n+from oauthlib.common import Request\n+from oauthlib.oauth1.rfc5849.signature import normalize_base_string_uri, normalize_parameters, collect_parameters, \\\n+    construct_base_string, sign_hmac_sha1\n+from social.backends.base import BaseAuth\n+from social.exceptions import AuthFailed\n+from social.utils import sanitize_redirect\n+\n+log = logging.getLogger(__name__)\n+\n+LTI_PARAMS_KEY = 'tpa-lti-params'\n+\n+\n+class LTIAuthBackend(BaseAuth):\n+    name = 'lti'\n+\n+    def start(self, redirect_name=REDIRECT_FIELD_NAME):\n+        \"\"\"\n+        Prepare to handle a login request. This method replaces\n+        social.actions.do_auth and must be kept in sync with any\n+        upstream changes in that method.\n+        \"\"\"\n+\n+        # Clean any partial pipeline data\n+        self.strategy.clean_partial_pipeline()\n+\n+        # Save validated LTI parameters (or None if invalid or not submitted)\n+        validated_lti_params = self.get_validated_lti_params(self.strategy)\n+        if not validated_lti_params:\n+            self.strategy.session_set(LTI_PARAMS_KEY, None)\n+            raise AuthFailed(self)\n+        else:\n+            logout(self.strategy.request)\n+            self.strategy.session_set(LTI_PARAMS_KEY, validated_lti_params)\n+\n+        # Save extra data into session.\n+        # While Basic LTI 1.0 specifies that the message is to be signed using OAuth, implying\n+        # that any GET parameters should be stripped from the base URL and included as signed\n+        # parameters, typical LTI Tool Consumer implementations do not support this behaviour. As\n+        # a workaround, we accept TPA parameters from LTI custom parameters prefixed with \"tpa_\".\n+\n+        for field_name in self.setting('FIELDS_STORED_IN_SESSION', []):\n+            if 'custom_tpa_' + field_name in validated_lti_params:\n+                self.strategy.session_set(field_name, validated_lti_params['custom_tpa_' + field_name])\n+\n+        if 'custom_tpa_' + redirect_name in validated_lti_params:\n+            # Check and sanitize a user-defined GET/POST next field value\n+            redirect_uri = validated_lti_params['custom_tpa_' + redirect_name]\n+            if self.setting('SANITIZE_REDIRECTS', True):\n+                redirect_uri = sanitize_redirect(self.strategy.request_host(), redirect_uri)\n+            self.strategy.session_set(redirect_name, redirect_uri or self.setting('LOGIN_REDIRECT_URL'))\n+\n+        # Set a auth_entry here so we don't have to receive that as a custom parameter\n+        self.strategy.session_setdefault('auth_entry', 'login')\n+\n+    def auth_complete(self, *args, **kwargs):\n+        lti_params = self.strategy.session_get(LTI_PARAMS_KEY)\n+        kwargs.update({'response': {LTI_PARAMS_KEY: lti_params}, 'backend': self})\n+        return self.strategy.authenticate(*args, **kwargs)\n+\n+    def get_user_id(self, details, response):\n+        lti_params = response[LTI_PARAMS_KEY]\n+        return lti_params['oauth_consumer_key'] + \":\" + lti_params['user_id']\n+\n+    def get_user_details(self, response):\n+        details = {}\n+        lti_params = response[LTI_PARAMS_KEY]\n+\n+        def add_if_exists(lti_key, details_key):\n+            if lti_key in lti_params and lti_params[lti_key]:\n+                details.update({details_key: lti_params[lti_key]})\n+\n+        add_if_exists('email', 'email')\n+        add_if_exists('lis_person_name_full', 'fullname')\n+        add_if_exists('lis_person_name_given', 'first_name')\n+        add_if_exists('lis_person_name_family', 'last_name')\n+        return details\n+\n+    @classmethod\n+    def get_validated_lti_params(cls, strategy):\n+        request = Request(uri=strategy.request.build_absolute_uri(),\n+                          http_method=strategy.request.method, body=strategy.request.body)\n+        lti_consumer_key = request.oauth_consumer_key\n+        (lti_consumer_valid, lti_consumer_secret, lti_max_timestamp_age) = cls.load_lti_consumer(lti_consumer_key)\n+        current_time = calendar.timegm(time.gmtime())\n+        return cls._get_validated_lti_params_from_values(request=request, current_time=current_time,\n+                                                         lti_consumer_valid=lti_consumer_valid,\n+                                                         lti_consumer_secret=lti_consumer_secret,\n+                                                         lti_max_timestamp_age=lti_max_timestamp_age)\n+\n+    @classmethod\n+    def _get_validated_lti_params_from_values(cls, request, current_time,\n+                                              lti_consumer_valid, lti_consumer_secret, lti_max_timestamp_age):\n+        # Taking a cue from oauthlib, to avoid leaking information through a timing attack,\n+        # we proceed through the entire validation before rejecting any request for any reason.\n+        # However, as noted there, the value of doing this is dubious.\n+\n+        base_uri = normalize_base_string_uri(request.uri)\n+        parameters = collect_parameters(uri_query=request.uri_query, body=request.body)\n+        parameters_string = normalize_parameters(parameters)\n+        base_string = construct_base_string(request.http_method, base_uri, parameters_string)\n+\n+        computed_signature = sign_hmac_sha1(base_string, unicode(lti_consumer_secret), '')\n+        submitted_signature = request.oauth_signature\n+\n+        data = {k[0]: k[1] for k in parameters}\n+\n+        def safe_int(value):\n+            try:\n+                return int(value)\n+            except ValueError:\n+                return 0\n+            except TypeError:\n+                return 0\n+\n+        oauth_timestamp = safe_int(request.oauth_timestamp)\n+\n+        valid =  lti_consumer_valid\n+        valid &= submitted_signature == computed_signature\n+        valid &= request.oauth_version == '1.0'\n+        valid &= request.oauth_signature_method == 'HMAC-SHA1'\n+        valid &= 'user_id' in data  # Not required by LTI but can't log in without one\n+        valid &= oauth_timestamp >= current_time - lti_max_timestamp_age\n+        valid &= oauth_timestamp <= current_time","path":"common/djangoapps/third_party_auth/lti.py","position":178,"original_position":128,"commit_id":"d38db45c204a1a757333187babf316466142c03b","original_commit_id":"8b8466fb59cc547c15067d11ea80d30fca01eeee","user":{"login":"bradenmacdonald","id":945577,"avatar_url":"https://avatars.githubusercontent.com/u/945577?v=3","gravatar_id":"","url":"https://api.github.com/users/bradenmacdonald","html_url":"https://github.com/bradenmacdonald","followers_url":"https://api.github.com/users/bradenmacdonald/followers","following_url":"https://api.github.com/users/bradenmacdonald/following{/other_user}","gists_url":"https://api.github.com/users/bradenmacdonald/gists{/gist_id}","starred_url":"https://api.github.com/users/bradenmacdonald/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bradenmacdonald/subscriptions","organizations_url":"https://api.github.com/users/bradenmacdonald/orgs","repos_url":"https://api.github.com/users/bradenmacdonald/repos","events_url":"https://api.github.com/users/bradenmacdonald/events{/privacy}","received_events_url":"https://api.github.com/users/bradenmacdonald/received_events","type":"User","site_admin":false},"body":"This can't be written as `valid = valid and (submitted_signature == computed_signature)` because that's vulnerable to the timing leak, but I think one could write it as:\r\n\r\n```python\r\nvalid =  lti_consumer_valid\r\nvalid = (submitted_signature == computed_signature) and valid\r\nvalid = (request.oauth_version == '1.0') and valid\r\nvalid = (request.oauth_signature_method == 'HMAC-SHA1') and valid\r\nvalid = ('user_id' in data) and valid  # Not required by LTI but can't log in without one\r\nvalid = (oauth_timestamp >= current_time - lti_max_timestamp_age) and valid\r\nvalid = (oauth_timestamp <= current_time) and valid\r\n```\r\n\r\nor\r\n\r\n```python\r\nchecks = [  # All of the following must be true and we must always evaluate each one\r\n    lti_consumer_valid,\r\n    submitted_signature == computed_signature,\r\n    request.oauth_version == '1.0',\r\n    request.oauth_signature_method == 'HMAC-SHA1',\r\n    'user_id' in data,  # Not required by LTI but can't log in without one\r\n    oauth_timestamp >= current_time - lti_max_timestamp_age,\r\n    oauth_timestamp <= current_time,\r\n]\r\nvalid = sum(1 for check in checks if check) == len(checks)\r\n```\r\n\r\nI'm personally OK with either of these or the original code being left as-is, *but* I'd like to see an explanatory comment added to the code. (Otherwise this could be unwittingly weakened in a future code refactor.)","created_at":"2015-08-18T05:02:10Z","updated_at":"2015-08-18T05:02:10Z","html_url":"https://github.com/edx/edx-platform/pull/8930#discussion_r37264314","pull_request_url":"https://api.github.com/repos/edx/edx-platform/pulls/8930","_links":{"self":{"href":"https://api.github.com/repos/edx/edx-platform/pulls/comments/37264314"},"html":{"href":"https://github.com/edx/edx-platform/pull/8930#discussion_r37264314"},"pull_request":{"href":"https://api.github.com/repos/edx/edx-platform/pulls/8930"}}},"pull_request":{"url":"https://api.github.com/repos/edx/edx-platform/pulls/8930","id":39967322,"html_url":"https://github.com/edx/edx-platform/pull/8930","diff_url":"https://github.com/edx/edx-platform/pull/8930.diff","patch_url":"https://github.com/edx/edx-platform/pull/8930.patch","issue_url":"https://api.github.com/repos/edx/edx-platform/issues/8930","number":8930,"state":"open","locked":false,"title":"Feature: LTI third-party-auth providers","user":{"login":"wmono","id":374925,"avatar_url":"https://avatars.githubusercontent.com/u/374925?v=3","gravatar_id":"","url":"https://api.github.com/users/wmono","html_url":"https://github.com/wmono","followers_url":"https://api.github.com/users/wmono/followers","following_url":"https://api.github.com/users/wmono/following{/other_user}","gists_url":"https://api.github.com/users/wmono/gists{/gist_id}","starred_url":"https://api.github.com/users/wmono/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wmono/subscriptions","organizations_url":"https://api.github.com/users/wmono/orgs","repos_url":"https://api.github.com/users/wmono/repos","events_url":"https://api.github.com/users/wmono/events{/privacy}","received_events_url":"https://api.github.com/users/wmono/received_events","type":"User","site_admin":false},"body":"Based on top of PR #8140, this change permits Learning Tools Interoperability (LTI) tool consumer applications to perform a session transfer into edX instances.\r\n\r\nAs the LTI login process is significantly different from other python-social auth providers (in particular, logins cannot be initiated by the application as there is no login page to redirect to) this auth provider has been added to third-party-auth instead.\r\n\r\nBackground reading: [Basic LTI implementation guide](http://www.imsglobal.org/lti/blti/bltiv1p0/ltiBLTIimgv1p0.html)\r\n\r\nTo test this change, first configure a LTI tool consumer in the Django admin interface, making up a consumer key and consumer secret as one would for an OAuth auth provider, then use the [LTI tool consumer reference implementation](http://www.imsglobal.org/developers/LTI/test/v1p1/lms.php) to launch https://yourserver.example.com/auth/login/lti/ . The trailing slash is mandatory.\r\n\r\nUnfortunately, the consumer/provider names can be awkward: edX is acting as an LTI tool provider -- that is, it is providing itself as a tool to an external tool consumer application -- but it does so by accepting that tool consumer as a third-party-auth auth provider.\r\n\r\nWe've been working with @ebporter on this change. Please note that this change is distinct from the similar work in PR #8347 as this one creates/associates fully functional users; the intent here is to use LTI as a session transfer mechanism, whereas the intent there is to embed edX into another application. Further work to merge these two approaches is under discussion.\r\n","created_at":"2015-07-14T21:52:45Z","updated_at":"2015-08-18T05:02:10Z","closed_at":null,"merged_at":null,"merge_commit_sha":"e641ddafc5f2b28019b5dc718a80983c8ad9b2fe","assignee":null,"milestone":null,"commits_url":"https://api.github.com/repos/edx/edx-platform/pulls/8930/commits","review_comments_url":"https://api.github.com/repos/edx/edx-platform/pulls/8930/comments","review_comment_url":"https://api.github.com/repos/edx/edx-platform/pulls/comments{/number}","comments_url":"https://api.github.com/repos/edx/edx-platform/issues/8930/comments","statuses_url":"https://api.github.com/repos/edx/edx-platform/statuses/d38db45c204a1a757333187babf316466142c03b","head":{"label":"ubc:wmono/lti-sso","ref":"wmono/lti-sso","sha":"d38db45c204a1a757333187babf316466142c03b","user":{"login":"ubc","id":1396118,"avatar_url":"https://avatars.githubusercontent.com/u/1396118?v=3","gravatar_id":"","url":"https://api.github.com/users/ubc","html_url":"https://github.com/ubc","followers_url":"https://api.github.com/users/ubc/followers","following_url":"https://api.github.com/users/ubc/following{/other_user}","gists_url":"https://api.github.com/users/ubc/gists{/gist_id}","starred_url":"https://api.github.com/users/ubc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ubc/subscriptions","organizations_url":"https://api.github.com/users/ubc/orgs","repos_url":"https://api.github.com/users/ubc/repos","events_url":"https://api.github.com/users/ubc/events{/privacy}","received_events_url":"https://api.github.com/users/ubc/received_events","type":"Organization","site_admin":false},"repo":{"id":30890299,"name":"edx-platform","full_name":"ubc/edx-platform","owner":{"login":"ubc","id":1396118,"avatar_url":"https://avatars.githubusercontent.com/u/1396118?v=3","gravatar_id":"","url":"https://api.github.com/users/ubc","html_url":"https://github.com/ubc","followers_url":"https://api.github.com/users/ubc/followers","following_url":"https://api.github.com/users/ubc/following{/other_user}","gists_url":"https://api.github.com/users/ubc/gists{/gist_id}","starred_url":"https://api.github.com/users/ubc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ubc/subscriptions","organizations_url":"https://api.github.com/users/ubc/orgs","repos_url":"https://api.github.com/users/ubc/repos","events_url":"https://api.github.com/users/ubc/events{/privacy}","received_events_url":"https://api.github.com/users/ubc/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/ubc/edx-platform","description":"Open edX, the edX platform that powers http://edx.org","fork":true,"url":"https://api.github.com/repos/ubc/edx-platform","forks_url":"https://api.github.com/repos/ubc/edx-platform/forks","keys_url":"https://api.github.com/repos/ubc/edx-platform/keys{/key_id}","collaborators_url":"https://api.github.com/repos/ubc/edx-platform/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/ubc/edx-platform/teams","hooks_url":"https://api.github.com/repos/ubc/edx-platform/hooks","issue_events_url":"https://api.github.com/repos/ubc/edx-platform/issues/events{/number}","events_url":"https://api.github.com/repos/ubc/edx-platform/events","assignees_url":"https://api.github.com/repos/ubc/edx-platform/assignees{/user}","branches_url":"https://api.github.com/repos/ubc/edx-platform/branches{/branch}","tags_url":"https://api.github.com/repos/ubc/edx-platform/tags","blobs_url":"https://api.github.com/repos/ubc/edx-platform/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/ubc/edx-platform/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/ubc/edx-platform/git/refs{/sha}","trees_url":"https://api.github.com/repos/ubc/edx-platform/git/trees{/sha}","statuses_url":"https://api.github.com/repos/ubc/edx-platform/statuses/{sha}","languages_url":"https://api.github.com/repos/ubc/edx-platform/languages","stargazers_url":"https://api.github.com/repos/ubc/edx-platform/stargazers","contributors_url":"https://api.github.com/repos/ubc/edx-platform/contributors","subscribers_url":"https://api.github.com/repos/ubc/edx-platform/subscribers","subscription_url":"https://api.github.com/repos/ubc/edx-platform/subscription","commits_url":"https://api.github.com/repos/ubc/edx-platform/commits{/sha}","git_commits_url":"https://api.github.com/repos/ubc/edx-platform/git/commits{/sha}","comments_url":"https://api.github.com/repos/ubc/edx-platform/comments{/number}","issue_comment_url":"https://api.github.com/repos/ubc/edx-platform/issues/comments{/number}","contents_url":"https://api.github.com/repos/ubc/edx-platform/contents/{+path}","compare_url":"https://api.github.com/repos/ubc/edx-platform/compare/{base}...{head}","merges_url":"https://api.github.com/repos/ubc/edx-platform/merges","archive_url":"https://api.github.com/repos/ubc/edx-platform/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/ubc/edx-platform/downloads","issues_url":"https://api.github.com/repos/ubc/edx-platform/issues{/number}","pulls_url":"https://api.github.com/repos/ubc/edx-platform/pulls{/number}","milestones_url":"https://api.github.com/repos/ubc/edx-platform/milestones{/number}","notifications_url":"https://api.github.com/repos/ubc/edx-platform/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/ubc/edx-platform/labels{/name}","releases_url":"https://api.github.com/repos/ubc/edx-platform/releases{/id}","created_at":"2015-02-16T21:54:25Z","updated_at":"2015-02-16T22:40:45Z","pushed_at":"2015-08-14T06:11:23Z","git_url":"git://github.com/ubc/edx-platform.git","ssh_url":"git@github.com:ubc/edx-platform.git","clone_url":"https://github.com/ubc/edx-platform.git","svn_url":"https://github.com/ubc/edx-platform","homepage":"http://openedx.org/","size":459737,"stargazers_count":0,"watchers_count":0,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"release"}},"base":{"label":"edx:master","ref":"master","sha":"8da4fcbbcbc32204dcd9b7c36700f88513aa1f5a","user":{"login":"edx","id":3179841,"avatar_url":"https://avatars.githubusercontent.com/u/3179841?v=3","gravatar_id":"","url":"https://api.github.com/users/edx","html_url":"https://github.com/edx","followers_url":"https://api.github.com/users/edx/followers","following_url":"https://api.github.com/users/edx/following{/other_user}","gists_url":"https://api.github.com/users/edx/gists{/gist_id}","starred_url":"https://api.github.com/users/edx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/edx/subscriptions","organizations_url":"https://api.github.com/users/edx/orgs","repos_url":"https://api.github.com/users/edx/repos","events_url":"https://api.github.com/users/edx/events{/privacy}","received_events_url":"https://api.github.com/users/edx/received_events","type":"Organization","site_admin":false},"repo":{"id":10391073,"name":"edx-platform","full_name":"edx/edx-platform","owner":{"login":"edx","id":3179841,"avatar_url":"https://avatars.githubusercontent.com/u/3179841?v=3","gravatar_id":"","url":"https://api.github.com/users/edx","html_url":"https://github.com/edx","followers_url":"https://api.github.com/users/edx/followers","following_url":"https://api.github.com/users/edx/following{/other_user}","gists_url":"https://api.github.com/users/edx/gists{/gist_id}","starred_url":"https://api.github.com/users/edx/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/edx/subscriptions","organizations_url":"https://api.github.com/users/edx/orgs","repos_url":"https://api.github.com/users/edx/repos","events_url":"https://api.github.com/users/edx/events{/privacy}","received_events_url":"https://api.github.com/users/edx/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/edx/edx-platform","description":"The Open edX platform, the software that powers edX!","fork":false,"url":"https://api.github.com/repos/edx/edx-platform","forks_url":"https://api.github.com/repos/edx/edx-platform/forks","keys_url":"https://api.github.com/repos/edx/edx-platform/keys{/key_id}","collaborators_url":"https://api.github.com/repos/edx/edx-platform/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/edx/edx-platform/teams","hooks_url":"https://api.github.com/repos/edx/edx-platform/hooks","issue_events_url":"https://api.github.com/repos/edx/edx-platform/issues/events{/number}","events_url":"https://api.github.com/repos/edx/edx-platform/events","assignees_url":"https://api.github.com/repos/edx/edx-platform/assignees{/user}","branches_url":"https://api.github.com/repos/edx/edx-platform/branches{/branch}","tags_url":"https://api.github.com/repos/edx/edx-platform/tags","blobs_url":"https://api.github.com/repos/edx/edx-platform/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/edx/edx-platform/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/edx/edx-platform/git/refs{/sha}","trees_url":"https://api.github.com/repos/edx/edx-platform/git/trees{/sha}","statuses_url":"https://api.github.com/repos/edx/edx-platform/statuses/{sha}","languages_url":"https://api.github.com/repos/edx/edx-platform/languages","stargazers_url":"https://api.github.com/repos/edx/edx-platform/stargazers","contributors_url":"https://api.github.com/repos/edx/edx-platform/contributors","subscribers_url":"https://api.github.com/repos/edx/edx-platform/subscribers","subscription_url":"https://api.github.com/repos/edx/edx-platform/subscription","commits_url":"https://api.github.com/repos/edx/edx-platform/commits{/sha}","git_commits_url":"https://api.github.com/repos/edx/edx-platform/git/commits{/sha}","comments_url":"https://api.github.com/repos/edx/edx-platform/comments{/number}","issue_comment_url":"https://api.github.com/repos/edx/edx-platform/issues/comments{/number}","contents_url":"https://api.github.com/repos/edx/edx-platform/contents/{+path}","compare_url":"https://api.github.com/repos/edx/edx-platform/compare/{base}...{head}","merges_url":"https://api.github.com/repos/edx/edx-platform/merges","archive_url":"https://api.github.com/repos/edx/edx-platform/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/edx/edx-platform/downloads","issues_url":"https://api.github.com/repos/edx/edx-platform/issues{/number}","pulls_url":"https://api.github.com/repos/edx/edx-platform/pulls{/number}","milestones_url":"https://api.github.com/repos/edx/edx-platform/milestones{/number}","notifications_url":"https://api.github.com/repos/edx/edx-platform/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/edx/edx-platform/labels{/name}","releases_url":"https://api.github.com/repos/edx/edx-platform/releases{/id}","created_at":"2013-05-30T20:20:38Z","updated_at":"2015-08-18T02:39:16Z","pushed_at":"2015-08-18T03:42:19Z","git_url":"git://github.com/edx/edx-platform.git","ssh_url":"git@github.com:edx/edx-platform.git","clone_url":"https://github.com/edx/edx-platform.git","svn_url":"https://github.com/edx/edx-platform","homepage":"http://open.edx.org/","size":2089447,"stargazers_count":2075,"watchers_count":2075,"language":"Python","has_issues":false,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":1222,"mirror_url":null,"open_issues_count":133,"forks":1222,"open_issues":133,"watchers":2075,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/edx/edx-platform/pulls/8930"},"html":{"href":"https://github.com/edx/edx-platform/pull/8930"},"issue":{"href":"https://api.github.com/repos/edx/edx-platform/issues/8930"},"comments":{"href":"https://api.github.com/repos/edx/edx-platform/issues/8930/comments"},"review_comments":{"href":"https://api.github.com/repos/edx/edx-platform/pulls/8930/comments"},"review_comment":{"href":"https://api.github.com/repos/edx/edx-platform/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/edx/edx-platform/pulls/8930/commits"},"statuses":{"href":"https://api.github.com/repos/edx/edx-platform/statuses/d38db45c204a1a757333187babf316466142c03b"}}}}