Source auto-disable, Blackboard LTI on existing integrations, and Meta mapping APIs

Over the past week we've shipped source auto-disable when the last integration is destroyed, Blackboard LTI setup on an existing Blackboard integration, MFA session invalidation, Meta APIs for identifier mappings, and Schoolbox, SSO, and iSAMS improvements.

API Updates

• Applications: Destroyed applications cannot initiate SSO (InvalidClientID) and cannot authenticate with an application secret (This application is destroyed.).
• SSO: When Google or Microsoft source token exchange does not yield a refresh token, Edlink redirects back to the provider with consent / login so the upstream grant can be completed.
• MFA: Confirming MFA keeps the session that submitted the code and invalidates every other dashboard session for that user.
• Schoolbox: Creating or updating a Schoolbox source copies configuration.access_token onto source_access_token (same pattern as Toddle).
• Code mappings: The Meta API can list and update identifier mappings for grade levels, attendance flags, statuses, and types, enrollment roles (including district and school), gender identities, and calendar day incidents — including bulk PATCH. See Code Mappings and Mapping Custom Data Types.

Dashboard Updates

• Applications: Enabling or disabling a data provider client asks for confirmation and warns that the change may immediately affect live traffic.
• Blackboard: Districts that already connected Blackboard as a data source can save LTI 1.3 Client ID and Deployment ID on that integration under SSO Configuration → LTI 1.3, instead of starting a new LTI Advantage onboarding. See LTI 1.3 (Blackboard + LTI).

Pipeline Updates

• iSAMS: Staff role mapping is case-insensitive and recognizes Teacher, Assistant Teacher, and leadership/admin titles, with the teaching-staff flag as a fallback when no title matches.