Safe LTI instructor provisioning

final class ResolveLtiProvisioningRole
{
    public function handle(array $launchData): string
    {
        $roles = Arr::wrap(Arr::get(
            $launchData,
            LtiContextRole::CLAIM,
            []
        ));

        return in_array(LtiContextRole::INSTRUCTOR, $roles, true)
            ? Role::INSTRUCTOR
            : Role::STUDENT;
    }
}

$launchRole = ResolveLtiProvisioningRole::run($launchData);

$roleToApply = $schoolUser
    ->accountUser
    ->roles()
    ->whereIn('name', [
        Role::SUPER_ADMIN,
        Role::DISTRICT_ADMIN,
        Role::INSTRUCTOR,
    ])
    ->exists()
        ? null       // Never demote a protected role.
        : $launchRole; // Student can be promoted to Instructor.

public function handle(
    LtiRegistrationDeployment $deployment,
    array $custom
): School {
    $lmsSchoolId = Arr::get($custom, 'lms_school_id');

    return $deployment
        ->schools()
        ->wherePivot('lms_school_id', $lmsSchoolId)
        ->firstOr(fn () => throw new SchoolNotLinkedToDeployment);
}

final class NormalizeLtiUserIdentifier
{
    public function handle(string $subject): string
    {
        // Phase 1 preserves current Schoology compatibility.
        return Str::of($subject)->before('::')->toString();
    }
}

$launchData = $ltiMessageLaunch->getLaunchData();
$role = ResolveLtiProvisioningRole::run($launchData);

throw_unless(
    $role === Role::INSTRUCTOR,
    new InstructorRoleRequiredForDeepLinking
);

$schoolUser = FindOrCreateUserForLtiContext::run(
    $deployment,
    $launchData
);