Only return admistarting courses

app/controllers/lti_controller.rb

@@ -37,7 +37,7 @@ def do_redirect
 
   def content_selection
     @supported = @lti_message.accept_types.include?(LTI::Messages::Types::DeepLinkingResponse::LtiResourceLink::TYPE)
-    @grouped_courses = policy_scope(Course.all).group_by(&:year)
+    @grouped_courses = current_user.administrating_courses.group_by(&:year)
     @multiple = @lti_message.accept_multiple
   end
 

app/policies/lti_policy.rb

@@ -0,0 +1,23 @@
+class LabelPolicy < ApplicationPolicy
+  class Scope < Scope
+    def resolve
+      scope
+    end
+  end
+
+  def content_selection?
+    current_user&.a_course_admin?
+  end
+
+  def redirect?
+    true
+  end
+
+  def do_redirect?
+    true
+  end
+
+  def series_and_activities?
+    Course.find_by(id: params[:id]).each { |c| current_user&.admin_of?(c) }
+  end
+end