brightspace-mcp-server 1.2.6 → 1.5.1

package/build/auth/purdue-sso.js

@@ -1,6 +1,6 @@
 /**
  * Purdue Brightspace MCP Server
- * Copyright (c) 2025 Rohan Muppa. All rights reserved.
+ * Copyright (c) 2026 Rohan Muppa. All rights reserved.
  * Licensed under MIT — see LICENSE file for details.
  */
 import { BrowserAuthError } from "../utils/errors.js";
@@ -10,7 +10,28 @@ const SELECTORS = {
     passwordInput: "input#password",
     submitButton: 'button[name="_eventId_proceed"]',
     staySignedInYes: "input[type=submit][value='Yes']",
+    // Purdue's proceed button, D2L's own, and the generic submit used by Entra
+    // (input#idSIButton9) and most other identity providers.
+    formSubmit: 'button[name="_eventId_proceed"], button.d2l-button, input[type="submit"]',
 };
+// Entra labels the account-name button "Next" and only shows "Sign in" on the
+// view that follows. Both are input#idSIButton9, so the label tells them apart.
+const ACCOUNT_NAME_BUTTON = /^next$/i;
+/**
+ * Entra's number-match digits. The tenant shows a two-digit number that has to
+ * be typed into Microsoft Authenticator, and nothing else on the machine
+ * reveals it, so a headless run stalls forever unless this is scraped and
+ * logged. Plain DOM text, no OCR.
+ */
+const NUMBER_MATCH_SELECTOR = "#idRichContext_DisplaySign";
+/** How often to look for the number while waiting on MFA. */
+const NUMBER_MATCH_POLL_MS = 2000;
+/** A person has to find their phone, unlock it, and read a prompt. */
+const MFA_TIMEOUT_MS = 5 * 60 * 1000;
+/** Visible text of a button, or the value of a submit input. */
+async function controlLabel(handle) {
+    return handle.evaluate((el) => (el.value || el.textContent || "").trim());
+}
 export class PurdueSSOFlow {
     config;
     constructor(config) {
@@ -31,7 +52,7 @@ export class PurdueSSOFlow {
      */
     async login(page) {
         try {
-            log("INFO", "Starting Purdue SSO login flow");
+            log("INFO", "Starting SSO login flow");
             // Step 1: Handle campus selector on purdue.brightspace.com/d2l/login
             await this.handleCampusSelector(page);
             // Step 2: Enter username + password on sso.purdue.edu (Shibboleth)
@@ -73,7 +94,7 @@ export class PurdueSSOFlow {
     }
     async handleCampusSelector(page) {
         const currentUrl = page.url();
-        if (currentUrl.includes("/d2l/login")) {
+        if (currentUrl.includes("purdue.brightspace.com") && currentUrl.includes("/d2l/login")) {
             // Campus selector buttons are inside a shadow DOM — navigate directly
             // to Purdue's Shibboleth SAML endpoint instead of clicking them
             const baseUrl = new URL(currentUrl).origin;
@@ -84,8 +105,11 @@ export class PurdueSSOFlow {
     }
     async enterCredentials(page) {
         try {
-            log("DEBUG", "Waiting for Shibboleth login form");
-            await page.waitForSelector(SELECTORS.usernameInput, { timeout: 30000 });
+            log("DEBUG", "Waiting for login form");
+            // Wait for either Purdue's username or Albany's userName (or typical email fields)
+            // Use a shorter timeout so it falls back to manual login quickly if unrecognized
+            const usernameSelector = 'input#username, input#userName, input[type="email"]';
+            await page.waitForSelector(usernameSelector, { timeout: 10000 });
             if (!this.config.username) {
                 throw new BrowserAuthError("Username is required for SSO login", "credentials");
             }
@@ -93,39 +117,142 @@ export class PurdueSSOFlow {
                 throw new BrowserAuthError("Password is required for SSO login", "credentials");
             }
             log("INFO", "Entering credentials");
-            await page.fill(SELECTORS.usernameInput, this.config.username);
-            await page.fill(SELECTORS.passwordInput, this.config.password);
-            await page.click(SELECTORS.submitButton);
+            const usernameField = await this.findVisible(page, usernameSelector);
+            if (usernameField) {
+                await usernameField.fill(this.config.username);
+            }
+            // Microsoft Entra puts a password box on its account-name page as well,
+            // but the button there only advances to the next view. Submit the account
+            // name first so the password lands on the page that actually signs in.
+            await this.submitAccountName(page);
+            const passwordSelector = 'input#password, input[type="password"]';
+            const passwordField = await this.findVisible(page, passwordSelector);
+            if (passwordField) {
+                await passwordField.fill(this.config.password);
+            }
+            const submitButton = await this.findVisible(page, SELECTORS.formSubmit);
+            if (submitButton) {
+                await submitButton.click();
+            }
+            else {
+                // Fallback: just hit Enter on the password field
+                await passwordField?.press('Enter');
+            }
             await page.waitForLoadState("networkidle");
         }
         catch (error) {
-            if (error instanceof BrowserAuthError)
-                throw error;
-            throw new BrowserAuthError("Failed to enter credentials", "credentials", error);
+            log("WARN", "Automated credentials entry failed, will fallback to manual login.", error);
+            throw error;
         }
     }
+    /**
+     * Resolve a control only when it is actually on screen.
+     *
+     * Entra is a single-page app: the account-name view stays in the DOM once
+     * the password view replaces it, so a plain page.$() returns the hidden
+     * first-page input or button that precedes the live one in document order.
+     * Filling or clicking those stalls on Playwright's actionability wait.
+     */
+    async findVisible(page, selector) {
+        for (const handle of await page.$$(selector)) {
+            if (await handle.isVisible())
+                return handle;
+        }
+        return null;
+    }
+    /**
+     * Advance Microsoft Entra's account-name page.
+     *
+     * That page carries a password box of its own, and Playwright reports it as
+     * visible, so presence cannot tell it apart from a single-page form. The
+     * button label can: it reads "Next" there and "Sign in" on the view that
+     * follows. Filling the password against the account-name page leaves the
+     * browser parked with both fields populated and nothing submitted.
+     */
+    async submitAccountName(page) {
+        const submit = await this.findVisible(page, SELECTORS.formSubmit);
+        if (!submit)
+            return;
+        if (!ACCOUNT_NAME_BUTTON.test(await controlLabel(submit)))
+            return;
+        log("INFO", "Account-name page detected — submitting account name");
+        await submit.click();
+        // The sign-in view has arrived once the button stops saying "Next".
+        for (let attempt = 0; attempt < 30; attempt += 1) {
+            await page.waitForTimeout(500);
+            const current = await this.findVisible(page, SELECTORS.formSubmit);
+            if (current && !ACCOUNT_NAME_BUTTON.test(await controlLabel(current)))
+                return;
+        }
+        log("WARN", "Sign-in page did not appear after submitting the account name");
+    }
     async handleMFA(page) {
+        // The number is only on screen while MFA is pending, so the scrape has to
+        // run alongside the wait rather than before or after it.
+        const pending = { done: false };
+        let release = () => { };
+        const released = new Promise((resolve) => {
+            release = resolve;
+        });
+        const watcher = this.watchNumberMatch(page, pending, released);
         try {
             log("WARN", "Waiting for Microsoft MFA approval on your device...");
-            log("INFO", "Timeout: 120 seconds");
-            log("INFO", "Browser is running in headed mode - please approve the MFA request on your phone");
+            log("INFO", "Timeout: 5 minutes");
+            log("INFO", "Approve the sign-in request in Microsoft Authenticator. If it shows a number, it is printed below.");
             // Wait for MFA approval by watching for the post-MFA redirect.
             // Using waitForURL instead of networkidle because networkidle fires
             // after 500ms of no network activity, which can happen while the MFA
-            // page UI finishes loading but before the user approves the Duo push.
+            // page UI finishes loading but before the user approves the request.
             await page.waitForURL((url) => {
                 const href = url.toString();
                 return href.includes("/d2l/") ||
                     href.includes("kmsi") ||
                     href.includes("/sso/") ||
                     href.includes("SAMLResponse");
-            }, { timeout: 120000 });
-            log("INFO", `MFA completed — redirected to: ${page.url()}`);
+            }, { timeout: MFA_TIMEOUT_MS });
+            log("INFO", `MFA completed - redirected to: ${page.url()}`);
         }
         catch (error) {
-            throw new BrowserAuthError("MFA approval timed out after 120 seconds", "mfa_approval", error);
+            throw new BrowserAuthError("MFA approval timed out after 5 minutes", "mfa_approval", error);
+        }
+        finally {
+            pending.done = true;
+            release();
+            await watcher;
+        }
+    }
+    /**
+     * Log Entra's number-match digits until the MFA wait is over.
+     *
+     * Only a CHANGED value is logged: Entra re-mints the number whenever the
+     * user asks for a new request, and repeating the same digits every two
+     * seconds would bury everything else in the log.
+     */
+    async watchNumberMatch(page, pending, released) {
+        let last = null;
+        while (!pending.done) {
+            const number = await this.readNumberMatch(page);
+            if (number && number !== last) {
+                last = number;
+                log("WARN", `Number match: ${number}. Enter it in Microsoft Authenticator.`);
+            }
+            // Racing the release keeps the wait from outliving the MFA it watches.
+            await Promise.race([
+                page.waitForTimeout(NUMBER_MATCH_POLL_MS).catch(() => { }),
+                released,
+            ]);
         }
     }
+    /** The digits on screen, or null when Entra is not showing any. */
+    async readNumberMatch(page) {
+        const sign = page.locator(NUMBER_MATCH_SELECTOR).first();
+        // isVisible answers immediately rather than waiting out a timeout, so the
+        // runs that never show a number keep the poll on its two-second rhythm.
+        if (!(await sign.isVisible().catch(() => false)))
+            return null;
+        const text = await sign.textContent().catch(() => null);
+        return text?.trim() || null;
+    }
     async handleStaySignedIn(page) {
         try {
             log("DEBUG", "Checking for 'Stay signed in?' prompt");

package/build/auth/purdue-sso.js.map

@@ -1 +1 @@
-{"version":3,"file":"purdue-sso.js","sourceRoot":"","sources":["../../src/auth/purdue-sso.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAEzC,MAAM,SAAS,GAAG;IAChB,aAAa,EAAE,gBAAgB;IAC/B,aAAa,EAAE,gBAAgB;IAC/B,YAAY,EAAE,iCAAiC;IAC/C,eAAe,EAAE,iCAAiC;CAC1C,CAAC;AAOX,MAAM,OAAO,aAAa;IAChB,MAAM,CAAkB;IAEhC,YAAY,MAAuB;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,CAAC,IAAU;QACpB,IAAI,CAAC;YACH,GAAG,CAAC,MAAM,EAAE,gCAAgC,CAAC,CAAC;YAE9C,qEAAqE;YACrE,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAEtC,mEAAmE;YACnE,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAElC,yDAAyD;YACzD,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAE3B,0CAA0C;YAC1C,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAEpC,2DAA2D;YAC3D,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1D,GAAG,CAAC,MAAM,EAAE,6CAA6C,CAAC,CAAC;YAE3D,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,OAAO,EAAE,uBAAuB,EAAE,KAAK,CAAC,CAAC;YAC7C,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,IAAU;QAC1B,IAAI,CAAC;YACH,GAAG,CAAC,MAAM,EAAE,mDAAmD,CAAC,CAAC;YACjE,GAAG,CAAC,MAAM,EAAE,0DAA0D,CAAC,CAAC;YAExE,6EAA6E;YAC7E,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAEtC,+DAA+D;YAC/D,GAAG,CAAC,MAAM,EAAE,8DAA8D,CAAC,CAAC;YAC5E,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1D,GAAG,CAAC,MAAM,EAAE,oDAAoD,CAAC,CAAC;YAElE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,OAAO,EAAE,uCAAuC,EAAE,KAAK,CAAC,CAAC;YAC7D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,IAAU;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,IAAI,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACtC,sEAAsE;YACtE,gEAAgE;YAChE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;YAC3C,GAAG,CAAC,MAAM,EAAE,kEAAkE,CAAC,CAAC;YAChF,MAAM,IAAI,CAAC,IAAI,CACb,GAAG,OAAO,iFAAiF,EAC3F,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,CAC7C,CAAC;QACJ,CAAC;QACD,wEAAwE;IAC1E,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,IAAU;QACvC,IAAI,CAAC;YACH,GAAG,CAAC,OAAO,EAAE,mCAAmC,CAAC,CAAC;YAClD,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAExE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,gBAAgB,CACxB,oCAAoC,EACpC,aAAa,CACd,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,gBAAgB,CACxB,oCAAoC,EACpC,aAAa,CACd,CAAC;YACJ,CAAC;YAED,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;YACpC,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC/D,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC/D,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;YACzC,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,gBAAgB;gBAAE,MAAM,KAAK,CAAC;YACnD,MAAM,IAAI,gBAAgB,CACxB,6BAA6B,EAC7B,aAAa,EACb,KAAc,CACf,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,IAAU;QAChC,IAAI,CAAC;YACH,GAAG,CAAC,MAAM,EAAE,sDAAsD,CAAC,CAAC;YACpE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;YACpC,GAAG,CAAC,MAAM,EAAE,kFAAkF,CAAC,CAAC;YAEhG,+DAA+D;YAC/D,oEAAoE;YACpE,qEAAqE;YACrE,sEAAsE;YACtE,MAAM,IAAI,CAAC,UAAU,CACnB,CAAC,GAAG,EAAE,EAAE;gBACN,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;oBACtB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACrB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;oBACtB,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YACvC,CAAC,EACD,EAAE,OAAO,EAAE,MAAM,EAAE,CACpB,CAAC;YACF,GAAG,CAAC,MAAM,EAAE,kCAAkC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,gBAAgB,CACxB,0CAA0C,EAC1C,cAAc,EACd,KAAc,CACf,CAAC;QACJ,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,IAAU;QACzC,IAAI,CAAC;YACH,GAAG,CAAC,OAAO,EAAE,uCAAuC,CAAC,CAAC;YACtD,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,eAAe,CACnD,SAAS,CAAC,eAAe,EACzB,EAAE,OAAO,EAAE,KAAK,EAAE,CACnB,CAAC;YACF,IAAI,kBAAkB,EAAE,CAAC;gBACvB,GAAG,CAAC,MAAM,EAAE,4CAA4C,CAAC,CAAC;gBAC1D,MAAM,kBAAkB,CAAC,KAAK,EAAE,CAAC;gBACjC,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yCAAyC;YACzC,GAAG,CAAC,OAAO,EAAE,oDAAoD,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"purdue-sso.js","sourceRoot":"","sources":["../../src/auth/purdue-sso.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAEzC,MAAM,SAAS,GAAG;IAChB,aAAa,EAAE,gBAAgB;IAC/B,aAAa,EAAE,gBAAgB;IAC/B,YAAY,EAAE,iCAAiC;IAC/C,eAAe,EAAE,iCAAiC;IAClD,2EAA2E;IAC3E,yDAAyD;IACzD,UAAU,EAAE,0EAA0E;CAC9E,CAAC;AAEX,8EAA8E;AAC9E,gFAAgF;AAChF,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,qBAAqB,GAAG,4BAA4B,CAAC;AAE3D,6DAA6D;AAC7D,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAElC,sEAAsE;AACtE,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAErC,gEAAgE;AAChE,KAAK,UAAU,YAAY,CACzB,MAA+C;IAE/C,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,CAC5B,CAAE,EAAuB,CAAC,KAAK,IAAI,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAChE,CAAC;AACJ,CAAC;AAOD,MAAM,OAAO,aAAa;IAChB,MAAM,CAAkB;IAEhC,YAAY,MAAuB;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,CAAC,IAAU;QACpB,IAAI,CAAC;YACH,GAAG,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;YAEvC,qEAAqE;YACrE,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAEtC,mEAAmE;YACnE,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAElC,yDAAyD;YACzD,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAE3B,0CAA0C;YAC1C,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAEpC,2DAA2D;YAC3D,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1D,GAAG,CAAC,MAAM,EAAE,6CAA6C,CAAC,CAAC;YAE3D,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,OAAO,EAAE,uBAAuB,EAAE,KAAK,CAAC,CAAC;YAC7C,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,IAAU;QAC1B,IAAI,CAAC;YACH,GAAG,CAAC,MAAM,EAAE,mDAAmD,CAAC,CAAC;YACjE,GAAG,CAAC,MAAM,EAAE,0DAA0D,CAAC,CAAC;YAExE,6EAA6E;YAC7E,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAEtC,+DAA+D;YAC/D,GAAG,CAAC,MAAM,EAAE,8DAA8D,CAAC,CAAC;YAC5E,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1D,GAAG,CAAC,MAAM,EAAE,oDAAoD,CAAC,CAAC;YAElE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,OAAO,EAAE,uCAAuC,EAAE,KAAK,CAAC,CAAC;YAC7D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,IAAU;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,IAAI,UAAU,CAAC,QAAQ,CAAC,wBAAwB,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACvF,sEAAsE;YACtE,gEAAgE;YAChE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;YAC3C,GAAG,CAAC,MAAM,EAAE,kEAAkE,CAAC,CAAC;YAChF,MAAM,IAAI,CAAC,IAAI,CACb,GAAG,OAAO,iFAAiF,EAC3F,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,CAC7C,CAAC;QACJ,CAAC;QACD,wEAAwE;IAC1E,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,IAAU;QACvC,IAAI,CAAC;YACH,GAAG,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;YAEvC,mFAAmF;YACnF,iFAAiF;YACjF,MAAM,gBAAgB,GAAG,qDAAqD,CAAC;YAC/E,MAAM,IAAI,CAAC,eAAe,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAEjE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,gBAAgB,CACxB,oCAAoC,EACpC,aAAa,CACd,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,gBAAgB,CACxB,oCAAoC,EACpC,aAAa,CACd,CAAC;YACJ,CAAC;YAED,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;YACpC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;YACrE,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACjD,CAAC;YAED,wEAAwE;YACxE,0EAA0E;YAC1E,uEAAuE;YACvE,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAEnC,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;YAClE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;YACrE,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACjD,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;YACxE,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,YAAY,CAAC,KAAK,EAAE,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,iDAAiD;gBACjD,MAAM,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACtC,CAAC;YAED,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,EAAE,oEAAoE,EAAE,KAAK,CAAC,CAAC;YACzF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,WAAW,CACvB,IAAU,EACV,QAAgB;QAEhB,KAAK,MAAM,MAAM,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7C,IAAI,MAAM,MAAM,CAAC,SAAS,EAAE;gBAAE,OAAO,MAAM,CAAC;QAC9C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,iBAAiB,CAAC,IAAU;QACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;YAAE,OAAO;QAElE,GAAG,CAAC,MAAM,EAAE,sDAAsD,CAAC,CAAC;QACpE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QAErB,oEAAoE;QACpE,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;YACnE,IAAI,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;gBAAE,OAAO;QAChF,CAAC;QACD,GAAG,CAAC,MAAM,EAAE,+DAA+D,CAAC,CAAC;IAC/E,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,IAAU;QAChC,0EAA0E;QAC1E,yDAAyD;QACzD,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAChC,IAAI,OAAO,GAAe,GAAG,EAAE,GAAE,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC7C,OAAO,GAAG,OAAO,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAE/D,IAAI,CAAC;YACH,GAAG,CAAC,MAAM,EAAE,sDAAsD,CAAC,CAAC;YACpE,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;YAClC,GAAG,CAAC,MAAM,EAAE,oGAAoG,CAAC,CAAC;YAElH,+DAA+D;YAC/D,oEAAoE;YACpE,qEAAqE;YACrE,qEAAqE;YACrE,MAAM,IAAI,CAAC,UAAU,CACnB,CAAC,GAAG,EAAE,EAAE;gBACN,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;oBACtB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACrB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;oBACtB,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YACvC,CAAC,EACD,EAAE,OAAO,EAAE,cAAc,EAAE,CAC5B,CAAC;YACF,GAAG,CAAC,MAAM,EAAE,kCAAkC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,gBAAgB,CACxB,wCAAwC,EACxC,cAAc,EACd,KAAc,CACf,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YACpB,OAAO,EAAE,CAAC;YACV,MAAM,OAAO,CAAC;QAChB,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,gBAAgB,CAC5B,IAAU,EACV,OAA0B,EAC1B,QAAuB;QAEvB,IAAI,IAAI,GAAkB,IAAI,CAAC;QAC/B,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,MAAM,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBAC9B,IAAI,GAAG,MAAM,CAAC;gBACd,GAAG,CAAC,MAAM,EAAE,iBAAiB,MAAM,wCAAwC,CAAC,CAAC;YAC/E,CAAC;YACD,uEAAuE;YACvE,MAAM,OAAO,CAAC,IAAI,CAAC;gBACjB,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;gBACzD,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,mEAAmE;IAC3D,KAAK,CAAC,eAAe,CAAC,IAAU;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,KAAK,EAAE,CAAC;QACzD,0EAA0E;QAC1E,wEAAwE;QACxE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACxD,OAAO,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC9B,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,IAAU;QACzC,IAAI,CAAC;YACH,GAAG,CAAC,OAAO,EAAE,uCAAuC,CAAC,CAAC;YACtD,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,eAAe,CACnD,SAAS,CAAC,eAAe,EACzB,EAAE,OAAO,EAAE,KAAK,EAAE,CACnB,CAAC;YACF,IAAI,kBAAkB,EAAE,CAAC;gBACvB,GAAG,CAAC,MAAM,EAAE,4CAA4C,CAAC,CAAC;gBAC1D,MAAM,kBAAkB,CAAC,KAAK,EAAE,CAAC;gBACjC,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yCAAyC;YACzC,GAAG,CAAC,OAAO,EAAE,oDAAoD,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;CACF"}

package/build/auth/session-store.d.ts

@@ -1,7 +1,7 @@
 /**
  * Purdue Brightspace MCP Server
  * Copyright (c) 2026 Rohan Muppa. All rights reserved.
- * Licensed under AGPL-3.0 — see LICENSE file for details.
+ * Licensed under MIT — see LICENSE file for details.
  */
 import type { TokenData } from "../types/index.js";
 /**

package/build/auth/session-store.js

@@ -1,7 +1,7 @@
 /**
  * Purdue Brightspace MCP Server
  * Copyright (c) 2026 Rohan Muppa. All rights reserved.
- * Licensed under AGPL-3.0 — see LICENSE file for details.
+ * Licensed under MIT — see LICENSE file for details.
  */
 import * as crypto from "node:crypto";
 import * as fs from "node:fs/promises";

package/build/auth/sso-flow.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Brightspace MCP Server
+ * Copyright (c) 2026 Rohan Muppa. All rights reserved.
+ * Licensed under MIT — see LICENSE file for details.
+ */
+import type { Page } from "playwright";
+import type { AppConfig } from "../types/index.js";
+/** The browser login sequence for one institution's identity provider. */
+export interface SSOFlow {
+    /** True when saved credentials allow an automated sign-in attempt. */
+    hasCredentials(): boolean;
+    /** Drive the sign-in form. Resolves false on timeout so the caller can fall back. */
+    login(page: Page): Promise<boolean>;
+    /** Wait for the user to sign in themselves in a visible browser. */
+    manualLogin(page: Page): Promise<boolean>;
+}
+/**
+ * Pick the login sequence for the configured Brightspace host. Schools whose
+ * identity provider needs extra steps get their own handler here; everything
+ * else uses the default flow, which already covers the common Shibboleth,
+ * CAS, and Microsoft Entra forms.
+ */
+export declare function createSSOFlow(config: AppConfig): SSOFlow;
+//# sourceMappingURL=sso-flow.d.ts.map

package/build/auth/sso-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-flow.d.ts","sourceRoot":"","sources":["../../src/auth/sso-flow.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAInD,0EAA0E;AAC1E,MAAM,WAAW,OAAO;IACtB,sEAAsE;IACtE,cAAc,IAAI,OAAO,CAAC;IAC1B,qFAAqF;IACrF,KAAK,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,oEAAoE;IACpE,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC3C;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAQxD"}

package/build/auth/sso-flow.js

@@ -0,0 +1,21 @@
+/**
+ * Brightspace MCP Server
+ * Copyright (c) 2026 Rohan Muppa. All rights reserved.
+ * Licensed under MIT — see LICENSE file for details.
+ */
+import { PurdueSSOFlow } from "./purdue-sso.js";
+import { SunySSOFlow, isSunyBrightspace } from "./suny-sso.js";
+/**
+ * Pick the login sequence for the configured Brightspace host. Schools whose
+ * identity provider needs extra steps get their own handler here; everything
+ * else uses the default flow, which already covers the common Shibboleth,
+ * CAS, and Microsoft Entra forms.
+ */
+export function createSSOFlow(config) {
+    const credentials = { username: config.username, password: config.password };
+    if (isSunyBrightspace(config.baseUrl)) {
+        return new SunySSOFlow({ ...credentials, campus: config.campus });
+    }
+    return new PurdueSSOFlow(credentials);
+}
+//# sourceMappingURL=sso-flow.js.map

package/build/auth/sso-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso-flow.js","sourceRoot":"","sources":["../../src/auth/sso-flow.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAY/D;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,MAAiB;IAC7C,MAAM,WAAW,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IAE7E,IAAI,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,WAAW,CAAC,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,IAAI,aAAa,CAAC,WAAW,CAAC,CAAC;AACxC,CAAC"}

package/build/auth/suny-sso.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Brightspace MCP Server
+ * Copyright (c) 2026 Rohan Muppa. All rights reserved.
+ * Licensed under MIT — see LICENSE file for details.
+ */
+import type { Page } from "playwright";
+interface SunySSOConfig {
+    username?: string;
+    password?: string;
+    /** Campus name or numeric code, matched against SUNY's own dropdown. */
+    campus?: string;
+}
+/** True for the shared SUNY Brightspace instance. */
+export declare function isSunyBrightspace(baseUrl: string): boolean;
+/**
+ * Login flow for the shared SUNY Brightspace instance.
+ *
+ * SUNY puts two extra pages in front of the campus identity provider: the
+ * Brightspace campus selector, whose buttons sit in a shadow DOM, and SUNY's
+ * own campus dropdown at idm.suny.edu. This handler clears both, then hands
+ * off to the default flow, which already knows the Shibboleth, CAS, and
+ * Microsoft Entra sign-in forms the individual campuses use.
+ */
+export declare class SunySSOFlow {
+    private config;
+    private defaultFlow;
+    constructor(config: SunySSOConfig);
+    hasCredentials(): boolean;
+    login(page: Page): Promise<boolean>;
+    manualLogin(page: Page): Promise<boolean>;
+    /**
+     * Brightspace's own campus selector renders its buttons in a shadow DOM, so
+     * go straight to the SAML endpoint that selector would have reached.
+     */
+    private startSamlLogin;
+    /**
+     * Answer SUNY's "Select Campus" dropdown. Without a configured campus the
+     * page is left for the user, who is already at the browser for MFA.
+     */
+    private selectCampus;
+    /**
+     * Resolve the configured campus against SUNY's live option list, so no copy
+     * of the campus table has to be kept in this repo. Matches a numeric code or
+     * a campus name, exactly first and then as a prefix.
+     */
+    private findCampus;
+}
+export {};
+//# sourceMappingURL=suny-sso.d.ts.map

package/build/auth/suny-sso.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"suny-sso.d.ts","sourceRoot":"","sources":["../../src/auth/suny-sso.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAcvC,UAAU,aAAa;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAOD,qDAAqD;AACrD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAM1D;AAcD;;;;;;;;GAQG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,WAAW,CAAgB;gBAEvB,MAAM,EAAE,aAAa;IAQjC,cAAc,IAAI,OAAO;IAInB,KAAK,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAWnC,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAY/C;;;OAGG;YACW,cAAc;IAY5B;;;OAGG;YACW,YAAY;IAwC1B;;;;OAIG;IACH,OAAO,CAAC,UAAU;CAUnB"}

package/build/auth/suny-sso.js

@@ -0,0 +1,146 @@
+/**
+ * Brightspace MCP Server
+ * Copyright (c) 2026 Rohan Muppa. All rights reserved.
+ * Licensed under MIT — see LICENSE file for details.
+ */
+import { PurdueSSOFlow } from "./purdue-sso.js";
+import { log } from "../utils/logger.js";
+/** SUNY campuses share one Brightspace tenant behind one Shibboleth IdP. */
+const SUNY_BRIGHTSPACE_HOST = "mylearning.suny.edu";
+const SUNY_IDP_ENTITY_ID = "https://idm.suny.edu/shibboleth/idp/";
+const SUNY_IDM_HOST = "idm.suny.edu";
+const SELECTORS = {
+    campusSelect: "select#campus",
+    campusSubmit: '#selectionForm button[type="submit"]',
+};
+/** True for the shared SUNY Brightspace instance. */
+export function isSunyBrightspace(baseUrl) {
+    try {
+        return new URL(baseUrl).hostname.toLowerCase() === SUNY_BRIGHTSPACE_HOST;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * SUNY carries its own hostname inside the redirect parameters it round-trips,
+ * so compare the host rather than searching the whole URL.
+ */
+function isSunyIdp(url) {
+    try {
+        return new URL(url).hostname.toLowerCase() === SUNY_IDM_HOST;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Login flow for the shared SUNY Brightspace instance.
+ *
+ * SUNY puts two extra pages in front of the campus identity provider: the
+ * Brightspace campus selector, whose buttons sit in a shadow DOM, and SUNY's
+ * own campus dropdown at idm.suny.edu. This handler clears both, then hands
+ * off to the default flow, which already knows the Shibboleth, CAS, and
+ * Microsoft Entra sign-in forms the individual campuses use.
+ */
+export class SunySSOFlow {
+    config;
+    defaultFlow;
+    constructor(config) {
+        this.config = config;
+        this.defaultFlow = new PurdueSSOFlow({
+            username: config.username,
+            password: config.password,
+        });
+    }
+    hasCredentials() {
+        return this.defaultFlow.hasCredentials();
+    }
+    async login(page) {
+        try {
+            await this.startSamlLogin(page);
+            await this.selectCampus(page);
+        }
+        catch (error) {
+            log("ERROR", "SUNY campus selection failed", error);
+            return false;
+        }
+        return this.defaultFlow.login(page);
+    }
+    async manualLogin(page) {
+        try {
+            // Clear the shadow-DOM selector and, when configured, the campus
+            // dropdown, so the user lands directly on their campus sign-in page.
+            await this.startSamlLogin(page);
+            await this.selectCampus(page);
+        }
+        catch (error) {
+            log("DEBUG", "Could not pre-fill SUNY campus selection", error);
+        }
+        return this.defaultFlow.manualLogin(page);
+    }
+    /**
+     * Brightspace's own campus selector renders its buttons in a shadow DOM, so
+     * go straight to the SAML endpoint that selector would have reached.
+     */
+    async startSamlLogin(page) {
+        const currentUrl = page.url();
+        if (!currentUrl.includes("/d2l/login"))
+            return;
+        const origin = new URL(currentUrl).origin;
+        log("INFO", "Campus selector detected — navigating directly to SUNY's SAML endpoint");
+        await page.goto(`${origin}/d2l/lp/auth/saml/initiate-login?entityId=${SUNY_IDP_ENTITY_ID}`, { waitUntil: "domcontentloaded", timeout: 30000 });
+    }
+    /**
+     * Answer SUNY's "Select Campus" dropdown. Without a configured campus the
+     * page is left for the user, who is already at the browser for MFA.
+     */
+    async selectCampus(page) {
+        if (!isSunyIdp(page.url()))
+            return;
+        try {
+            // idm.suny.edu sits behind a bot check, so the form can take a few
+            // seconds to appear even on a fast connection.
+            await page.waitForSelector(SELECTORS.campusSelect, { timeout: 45000 });
+        }
+        catch {
+            log("DEBUG", "No SUNY campus dropdown found — continuing to the sign-in form");
+            return;
+        }
+        const options = await page.$$eval(`${SELECTORS.campusSelect} option`, (nodes) => nodes
+            .map((node) => ({
+            value: node.value,
+            label: (node.textContent ?? "").trim(),
+        }))
+            .filter((option) => option.value !== ""));
+        if (!this.config.campus) {
+            log("WARN", "No campus configured — choose your campus in the browser window.");
+            log("INFO", "Set one with: brightspace-mcp-server setup --suny");
+            return;
+        }
+        const match = this.findCampus(options);
+        if (!match) {
+            log("WARN", `Campus "${this.config.campus}" did not match any SUNY campus.`);
+            log("INFO", `Available: ${options.map((o) => o.label).join(", ")}`);
+            log("WARN", "Choose your campus in the browser window to continue.");
+            return;
+        }
+        log("INFO", `Selecting campus ${match.label} (${match.value})`);
+        await page.selectOption(SELECTORS.campusSelect, match.value);
+        await page.click(SELECTORS.campusSubmit);
+    }
+    /**
+     * Resolve the configured campus against SUNY's live option list, so no copy
+     * of the campus table has to be kept in this repo. Matches a numeric code or
+     * a campus name, exactly first and then as a prefix.
+     */
+    findCampus(options) {
+        const wanted = this.config.campus?.trim().toLowerCase();
+        if (!wanted)
+            return undefined;
+        return (options.find((option) => option.value.toLowerCase() === wanted) ??
+            options.find((option) => option.label.toLowerCase() === wanted) ??
+            options.find((option) => option.label.toLowerCase().startsWith(wanted)));
+    }
+}
+//# sourceMappingURL=suny-sso.js.map

package/build/auth/suny-sso.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"suny-sso.js","sourceRoot":"","sources":["../../src/auth/suny-sso.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAEzC,4EAA4E;AAC5E,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AACpD,MAAM,kBAAkB,GAAG,sCAAsC,CAAC;AAClE,MAAM,aAAa,GAAG,cAAc,CAAC;AAErC,MAAM,SAAS,GAAG;IAChB,YAAY,EAAE,eAAe;IAC7B,YAAY,EAAE,sCAAsC;CAC5C,CAAC;AAcX,qDAAqD;AACrD,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,qBAAqB,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,SAAS,CAAC,GAAW;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,aAAa,CAAC;IAC/D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,OAAO,WAAW;IACd,MAAM,CAAgB;IACtB,WAAW,CAAgB;IAEnC,YAAY,MAAqB;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,IAAI,aAAa,CAAC;YACnC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC,cAAc,EAAE,CAAC;IAC3C,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAU;QACpB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,OAAO,EAAE,8BAA8B,EAAE,KAAK,CAAC,CAAC;YACpD,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAAU;QAC1B,IAAI,CAAC;YACH,iEAAiE;YACjE,qEAAqE;YACrE,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,OAAO,EAAE,0CAA0C,EAAE,KAAK,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,cAAc,CAAC,IAAU;QACrC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC;YAAE,OAAO;QAE/C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;QAC1C,GAAG,CAAC,MAAM,EAAE,wEAAwE,CAAC,CAAC;QACtF,MAAM,IAAI,CAAC,IAAI,CACb,GAAG,MAAM,6CAA6C,kBAAkB,EAAE,EAC1E,EAAE,SAAS,EAAE,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,CAClD,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,YAAY,CAAC,IAAU;QACnC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YAAE,OAAO;QAEnC,IAAI,CAAC;YACH,mEAAmE;YACnE,+CAA+C;YAC/C,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,OAAO,EAAE,gEAAgE,CAAC,CAAC;YAC/E,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC,YAAY,SAAS,EAAE,CAAC,KAAK,EAAE,EAAE,CAC9E,KAAK;aACF,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACd,KAAK,EAAG,IAA0B,CAAC,KAAK;YACxC,KAAK,EAAE,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;SACvC,CAAC,CAAC;aACF,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,EAAE,CAAC,CAC3C,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACxB,GAAG,CAAC,MAAM,EAAE,kEAAkE,CAAC,CAAC;YAChF,GAAG,CAAC,MAAM,EAAE,mDAAmD,CAAC,CAAC;YACjE,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,GAAG,CAAC,MAAM,EAAE,WAAW,IAAI,CAAC,MAAM,CAAC,MAAM,kCAAkC,CAAC,CAAC;YAC7E,GAAG,CAAC,MAAM,EAAE,cAAc,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACpE,GAAG,CAAC,MAAM,EAAE,uDAAuD,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QAED,GAAG,CAAC,MAAM,EAAE,oBAAoB,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC7D,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC3C,CAAC;IAED;;;;OAIG;IACK,UAAU,CAAC,OAAuB;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QACxD,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAC;QAE9B,OAAO,CACL,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;YAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;YAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CACxE,CAAC;IACJ,CAAC;CACF"}

package/build/auth/token-manager.d.ts

@@ -1,9 +1,19 @@
 /**
  * Purdue Brightspace MCP Server
- * Copyright (c) 2025 Rohan Muppa. All rights reserved.
- * Licensed under AGPL-3.0 — see LICENSE file for details.
+ * Copyright (c) 2026 Rohan Muppa. All rights reserved.
+ * Licensed under MIT — see LICENSE file for details.
  */
 import type { TokenData } from "../types/index.js";
+import { mintAccessToken } from "./token-mint.js";
+export interface TokenManagerOptions {
+    sessionDir?: string;
+    /** Tenant base URL. Without it the cookie mint is not attempted. */
+    baseUrl?: string;
+    /** Lifetime in seconds stamped on a minted token. */
+    tokenTtl?: number;
+    /** Injection seam for tests. */
+    mint?: typeof mintAccessToken;
+}
 /**
  * TokenManager manages token lifecycle with in-memory caching and disk persistence.
  * Handles expiry detection with a configurable refresh buffer.
@@ -11,13 +21,30 @@ import type { TokenData } from "../types/index.js";
 export declare class TokenManager {
     private cachedToken;
     private readonly sessionStore;
+    private readonly baseUrl?;
+    private readonly tokenTtl;
+    private readonly mint;
+    /** Single in-flight mint, so concurrent callers share one request. */
+    private mintInFlight;
     constructor(sessionDir?: string);
+    constructor(options: TokenManagerOptions);
     /**
      * Get the current token if valid, otherwise null.
      * Checks memory cache first, then loads from disk if needed.
      * Returns null if token is expired or within refresh buffer.
      */
     getToken(): Promise<TokenData | null>;
+    /**
+     * First candidate that carries both the cookie header and the XSRF token,
+     * or null when neither can be used to mint.
+     */
+    private pickMintable;
+    /**
+     * Mint a fresh token from the stale one's session material, collapsing
+     * concurrent callers onto a single request.
+     */
+    private mintFromSession;
+    private runMint;
     /**
      * Set a new token, caching in memory and persisting to disk.
      */

package/build/auth/token-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token-manager.d.ts","sourceRoot":"","sources":["../../src/auth/token-manager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAUnD;;;GAGG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,WAAW,CAA0B;IAC7C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;gBAEhC,UAAU,CAAC,EAAE,MAAM;IAI/B;;;;OAIG;IACG,QAAQ,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAmB3C;;OAEG;IACG,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAM/C;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAMjC;;;OAGG;IACH,OAAO,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO;IAiBlC;;;OAGG;IACG,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC;CAIvC"}
+{"version":3,"file":"token-manager.d.ts","sourceRoot":"","sources":["../../src/auth/token-manager.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAYlD,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gCAAgC;IAChC,IAAI,CAAC,EAAE,OAAO,eAAe,CAAC;CAC/B;AAED;;;GAGG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,WAAW,CAA0B;IAC7C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;IAC5C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyB;IAC9C,sEAAsE;IACtE,OAAO,CAAC,YAAY,CAA0C;gBAElD,UAAU,CAAC,EAAE,MAAM;gBACnB,OAAO,EAAE,mBAAmB;IAaxC;;;;OAIG;IACG,QAAQ,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IA2B3C;;;OAGG;IACH,OAAO,CAAC,YAAY;IAUpB;;;OAGG;YACW,eAAe;YAaf,OAAO;IAkCrB;;OAEG;IACG,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAM/C;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;IAMjC;;;OAGG;IACH,OAAO,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO;IAiBlC;;;OAGG;IACG,YAAY,IAAI,OAAO,CAAC,OAAO,CAAC;CAIvC"}