The current behavior when a LORI API call is trying to insert a new content item based on an addResource request, it looks for a LTI tool configuration in the site or a tool configuration that is global and visible. And then if it does not find either, it adds a partially configured tool configuration to the site.
This is a bad idea as we a) want to hide the global tool configuration and b) it would better to simply error out if there is neither a global or local tool configuration that matches the launch URL.
So the new code will look for a global tool configuration that is visible or stealthed that matches the launch url and none if found then check in the site for a tool configuration that matches the launch url. If neither are found cause an error return in the API.
This bug also triggered a thorough look at how the *Dao versions of the LTI service determined isAdmin and isMaintain when being called Dao-style. This review identified some issues that were cleaned up.