brightspace-mcp-server 1.6.3 → 3.0.0

package/build/auth/purdue-sso.js

@@ -1,22 +1,17 @@
 /**
  * Purdue Brightspace MCP Server
  * Copyright (c) 2026 Rohan Muppa. All rights reserved.
- * Licensed under MIT — see LICENSE file for details.
+ * Licensed under MIT : see LICENSE file for details.
  */
 import { BrowserAuthError } from "../utils/errors.js";
 import { log } from "../utils/logger.js";
-const SELECTORS = {
-    usernameInput: "input#username",
-    passwordInput: "input#password",
-    submitButton: 'button[name="_eventId_proceed"]',
-    staySignedInYes: "input[type=submit][value='Yes']",
-    // Purdue's proceed button, D2L's own, and the generic submit used by Entra
-    // (input#idSIButton9) and most other identity providers.
-    formSubmit: 'button[name="_eventId_proceed"], button.d2l-button, input[type="submit"]',
-};
-// Entra labels the account-name button "Next" and only shows "Sign in" on the
-// view that follows. Both are input#idSIButton9, so the label tells them apart.
-const ACCOUNT_NAME_BUTTON = /^next$/i;
+import { MfaApprovalError, UnsupportedAuthenticationError } from "./sso-flow.js";
+import { AUTH_COMMAND } from "../utils/commands.js";
+const EMAIL_SELECTORS = ["input[type=email]", "input[name=loginfmt]"];
+const PASSWORD_SELECTORS = ["input[type=password]", "input[name=passwd]"];
+const SUBMIT_SELECTORS = ["#idSIButton9", "input[type=submit]", "button[type=submit]"];
+const FIELD_TIMEOUT_MS = 30_000;
+const FIELD_POLL_MS = 250;
 /**
  * Entra's number-match digits. The tenant shows a two-digit number that has to
  * be typed into Microsoft Authenticator, and nothing else on the machine
@@ -24,16 +19,22 @@ const ACCOUNT_NAME_BUTTON = /^next$/i;
  * logged. Plain DOM text, no OCR.
  */
 const NUMBER_MATCH_SELECTOR = "#idRichContext_DisplaySign";
+const MFA_CODE_SELECTORS = ["#idTxtBx_SAOTCC_OTC", 'input[name="otc"]'];
+const MFA_CODE_SUBMIT_SELECTORS = ["#idSubmit_SAOTCC_Continue", "#idSIButton9"];
 /** How often to look for the number while waiting on MFA. */
 const NUMBER_MATCH_POLL_MS = 2000;
 /** A person has to find their phone, unlock it, and read a prompt. */
 const MFA_TIMEOUT_MS = 5 * 60 * 1000;
-/** Visible text of a button, or the value of a submit input. */
-async function controlLabel(handle) {
-    return handle.evaluate((el) => (el.value || el.textContent || "").trim());
+/** Microsoft expects Purdue's full sign-in name, while setup also accepts a career account. */
+function signInName(username, baseUrl) {
+    const isPurdue = baseUrl && new URL(baseUrl).hostname.toLowerCase() === "purdue.brightspace.com";
+    return isPurdue && !username.includes("@") ? `${username}@purdue.edu` : username;
 }
 export class PurdueSSOFlow {
     config;
+    accountHintSubmitted = false;
+    /** One authenticator code per login. See submitMfaCode. */
+    mfaCodeSubmitted = false;
     constructor(config) {
         this.config = config;
     }
@@ -43,204 +44,236 @@ export class PurdueSSOFlow {
     hasCredentials() {
         return Boolean(this.config.username && this.config.password);
     }
+    async prepareLogin(page) {
+        await this.handleCampusSelector(page);
+    }
+    /** First half of Brightspace Bar's choreography, with no password access. */
+    async identifyAccount(page) {
+        if (!this.config.username)
+            return false;
+        const email = signInName(this.config.username, this.config.baseUrl);
+        if (!await this.fillWhenReady(page, EMAIL_SELECTORS, email))
+            return false;
+        if (!await this.clickWhenReady(page, SUBMIT_SELECTORS))
+            return false;
+        this.accountHintSubmitted = true;
+        return true;
+    }
     /**
      * Execute the complete Microsoft Entra ID SSO login flow for Purdue.
-     * Handles institution selector, email/password entry, MFA (TOTP or manual), and "stay signed in" prompt.
+     * Handles the school selector, saved credentials, device MFA approval, and stay-signed-in.
      *
      * @param page - Playwright page instance (already navigated to Brightspace or redirected to login)
-     * @returns true on successful login (URL contains /d2l/home), false on timeout/failure
+     * @returns true after reaching Brightspace home; failures are typed errors
      */
     async login(page) {
         try {
             log("INFO", "Starting SSO login flow");
             // Step 1: Handle campus selector on purdue.brightspace.com/d2l/login
             await this.handleCampusSelector(page);
-            // Step 2: Enter username + password on sso.purdue.edu (Shibboleth)
-            await this.enterCredentials(page);
-            // Step 3: Handle MFA (TOTP automated or manual approval)
+            // Restored Microsoft state can lead directly to MFA or stay-signed-in.
+            const postCredential = await this.anyVisible(page, [
+                NUMBER_MATCH_SELECTOR,
+                "#idDiv_SAOTCAS_Title",
+                "#idDiv_SAOTCC_Title",
+                "#KmsiCheckboxField",
+            ]);
+            const kmsi = await page.getByText("Stay signed in?").first().isVisible().catch(() => false);
+            if (!page.url().includes("/d2l/home") && !postCredential && !kmsi)
+                await this.enterCredentials(page);
+            // Wait for device approval and print Microsoft's number match.
             await this.handleMFA(page);
-            // Step 4: Handle "Stay signed in?" prompt
-            await this.handleStaySignedIn(page);
-            // Step 5: Wait for successful redirect to Brightspace home
-            await page.waitForURL(/\/d2l\/home/, { timeout: 120000 });
-            log("INFO", "Login successful - reached Brightspace home");
             return true;
         }
         catch (error) {
-            log("ERROR", "SSO login flow failed", error);
-            return false;
-        }
-    }
-    /**
-     * Manual login fallback: let the user type credentials and complete MFA themselves.
-     * The browser stays open in headed mode while we wait for /d2l/home.
-     */
-    async manualLogin(page) {
-        try {
-            log("INFO", "Starting manual login flow (no saved credentials)");
-            log("INFO", "Please log in using the browser window that just opened.");
-            // Navigate past the campus selector so the user lands on the Shibboleth form
-            await this.handleCampusSelector(page);
-            // Wait up to 5 minutes for the user to complete login manually
-            log("INFO", "Waiting up to 5 minutes for you to complete login and MFA...");
-            await page.waitForURL(/\/d2l\/home/, { timeout: 300000 });
-            log("INFO", "Manual login successful - reached Brightspace home");
-            return true;
-        }
-        catch (error) {
-            log("ERROR", "Manual login flow failed or timed out", error);
-            return false;
+            if (error instanceof BrowserAuthError)
+                throw error;
+            throw new UnsupportedAuthenticationError("The identity provider could not complete headless sign-in. Check saved credentials and supported MFA settings.", error);
         }
     }
     async handleCampusSelector(page) {
         const currentUrl = page.url();
         if (currentUrl.includes("purdue.brightspace.com") && currentUrl.includes("/d2l/login")) {
-            // Campus selector buttons are inside a shadow DOM — navigate directly
-            // to Purdue's Shibboleth SAML endpoint instead of clicking them
+            // Follow the live Purdue control first, as Brightspace Bar does, so a
+            // tenant-side destination change does not leave this client behind.
+            const campus = page.getByText(/Purdue West Lafayette/i).first();
+            if (await campus.isVisible().catch(() => false)) {
+                log("INFO", "Campus selector detected : selecting Purdue West Lafayette");
+                await campus.click();
+                return;
+            }
+            // Retain the known endpoint as a fallback if the control has not rendered.
             const baseUrl = new URL(currentUrl).origin;
-            log("INFO", "Campus selector detected — navigating directly to Shibboleth IdP");
-            await page.goto(`${baseUrl}/d2l/lp/auth/saml/initiate-login?entityId=https://idp.purdue.edu/idp/shibboleth`, { waitUntil: "networkidle", timeout: 30000 });
+            log("INFO", "Campus selector detected : navigating directly to Shibboleth IdP");
+            await page.goto(`${baseUrl}/d2l/lp/auth/saml/initiate-login?entityId=https://idp.purdue.edu/idp/shibboleth`, { waitUntil: "domcontentloaded", timeout: 30000 });
         }
-        // Already on sso.purdue.edu or past the campus selector — nothing to do
+        // Already on sso.purdue.edu or past the campus selector : nothing to do
     }
     async enterCredentials(page) {
-        try {
-            log("DEBUG", "Waiting for login form");
-            // Wait for either Purdue's username or Albany's userName (or typical email fields)
-            // Use a shorter timeout so it falls back to manual login quickly if unrecognized
-            const usernameSelector = 'input#username, input#userName, input[type="email"]';
-            await page.waitForSelector(usernameSelector, { timeout: 10000 });
-            if (!this.config.username) {
-                throw new BrowserAuthError("Username is required for SSO login", "credentials");
-            }
-            if (!this.config.password) {
-                throw new BrowserAuthError("Password is required for SSO login", "credentials");
+        if (!this.config.username)
+            throw new BrowserAuthError("Username is required for SSO login", "credentials");
+        if (!this.config.password)
+            throw new BrowserAuthError("Password is required for SSO login", "credentials");
+        log("INFO", "Entering credentials");
+        if (!this.accountHintSubmitted) {
+            const email = signInName(this.config.username, this.config.baseUrl);
+            if (!await this.fillWhenReady(page, EMAIL_SELECTORS, email)) {
+                throw new UnsupportedAuthenticationError("The Microsoft email field did not appear. Headless sign-in cannot continue.");
             }
-            log("INFO", "Entering credentials");
-            const usernameField = await this.findVisible(page, usernameSelector);
-            if (usernameField) {
-                await usernameField.fill(this.config.username);
+            if (!await this.clickWhenReady(page, SUBMIT_SELECTORS)) {
+                throw new UnsupportedAuthenticationError("The Microsoft email submit button did not appear. Headless sign-in cannot continue.");
             }
-            // Microsoft Entra puts a password box on its account-name page as well,
-            // but the button there only advances to the next view. Submit the account
-            // name first so the password lands on the page that actually signs in.
-            await this.submitAccountName(page);
-            const passwordSelector = 'input#password, input[type="password"]';
-            const passwordField = await this.findVisible(page, passwordSelector);
-            if (passwordField) {
-                await passwordField.fill(this.config.password);
-            }
-            const submitButton = await this.findVisible(page, SELECTORS.formSubmit);
-            if (submitButton) {
-                await submitButton.click();
+        }
+        this.accountHintSubmitted = false;
+        if (!await this.fillWhenReady(page, PASSWORD_SELECTORS, this.config.password)) {
+            throw new UnsupportedAuthenticationError("The Microsoft password field did not appear. Headless sign-in cannot continue.");
+        }
+        if (!await this.clickWhenReady(page, SUBMIT_SELECTORS)) {
+            throw new UnsupportedAuthenticationError("The Microsoft password submit button did not appear. Headless sign-in cannot continue.");
+        }
+    }
+    /** Ported from Brightspace Bar's proven four-step Entra choreography. */
+    async actWhenReady(page, selectors, act) {
+        const deadline = Date.now() + FIELD_TIMEOUT_MS;
+        do {
+            for (const selector of selectors) {
+                const target = page.locator(selector).first();
+                if (await target.isVisible().catch(() => false)) {
+                    await act(target);
+                    return true;
+                }
             }
-            else {
-                // Fallback: just hit Enter on the password field
-                await passwordField?.press('Enter');
+            await page.waitForTimeout(FIELD_POLL_MS);
+        } while (Date.now() < deadline);
+        return false;
+    }
+    async fillWhenReady(page, selectors, value) {
+        return this.actWhenReady(page, selectors, target => target.fill(value));
+    }
+    async clickWhenReady(page, selectors) {
+        // Entra often detaches the button after the click has already navigated.
+        return this.actWhenReady(page, selectors, target => target.click().catch(() => { }));
+    }
+    /** Match Brightspace Bar's selector loop instead of trusting the first DOM match. */
+    async anyVisible(page, selectors) {
+        for (const selector of selectors) {
+            if (await page.locator(selector).first().isVisible().catch(() => false))
+                return true;
+        }
+        return false;
+    }
+    /** Brightspace Bar's bounded number/auth/KMSI polling loop. */
+    async handleMFA(page) {
+        if (!this.config.baseUrl) {
+            throw new UnsupportedAuthenticationError("A school URL is required to verify headless authentication.");
+        }
+        const deadline = Date.now() + MFA_TIMEOUT_MS;
+        let challenged = false;
+        let announced = null;
+        try {
+            while (Date.now() < deadline) {
+                if (await this.submitMfaCode(page))
+                    challenged = true;
+                const number = await this.readNumberMatch(page);
+                const challengeVisible = number !== null ||
+                    await page.locator("#idDiv_SAOTCAS_Title").first().isVisible().catch(() => false) ||
+                    await page.locator("#idDiv_SAOTCC_Title").first().isVisible().catch(() => false);
+                if (challengeVisible && !challenged) {
+                    challenged = true;
+                    log("WARN", "Waiting up to 5 minutes for Microsoft MFA approval on your device.");
+                }
+                if (number && number !== announced) {
+                    announced = number;
+                    log("WARN", `Number match: ${number}. Enter it in Microsoft Authenticator.`);
+                }
+                if (await this.isAuthenticated(page)) {
+                    log("INFO", "Login successful - verified Brightspace home");
+                    return;
+                }
+                await this.clickProvenKmsi(page);
+                await page.waitForTimeout(NUMBER_MATCH_POLL_MS);
             }
-            await page.waitForLoadState("networkidle");
         }
         catch (error) {
-            log("WARN", "Automated credentials entry failed, will fallback to manual login.", error);
-            throw error;
+            if (error instanceof BrowserAuthError)
+                throw error;
+            if (challenged)
+                throw new MfaApprovalError(error);
+            throw new UnsupportedAuthenticationError("Headless sign-in stopped before a supported MFA challenge completed.", error);
         }
+        if (challenged)
+            throw new MfaApprovalError();
+        throw new UnsupportedAuthenticationError("Sign-in did not reach a supported MFA challenge or Brightspace within 5 minutes.");
     }
-    /**
-     * Resolve a control only when it is actually on screen.
-     *
-     * Entra is a single-page app: the account-name view stays in the DOM once
-     * the password view replaces it, so a plain page.$() returns the hidden
-     * first-page input or button that precedes the live one in document order.
-     * Filling or clicking those stalls on Playwright's actionability wait.
-     */
-    async findVisible(page, selector) {
-        for (const handle of await page.$$(selector)) {
-            if (await handle.isVisible())
-                return handle;
+    async submitMfaCode(page) {
+        const input = await this.firstVisible(page, MFA_CODE_SELECTORS);
+        if (!input)
+            return false;
+        if (this.config.headless === false)
+            return false;
+        // Ask once per login. This runs on every two-second poll, and Microsoft
+        // commonly leaves the field on screen while it validates, so without this
+        // a correct code gets a second prompt on the next tick. That prompt blocks
+        // on stdin, and the deadline is only checked between iterations, so the
+        // five-minute budget can never fire while parked there.
+        if (this.mfaCodeSubmitted)
+            return false;
+        if (!this.config.requestMfaCode) {
+            throw new UnsupportedAuthenticationError(`This MFA method requires a code. Run \`${AUTH_COMMAND}\` in a terminal to enter it.`);
         }
-        return null;
+        this.mfaCodeSubmitted = true;
+        const code = await this.config.requestMfaCode();
+        if (!/^\d{6,8}$/.test(code))
+            throw new UnsupportedAuthenticationError("The MFA code must contain 6-8 digits.");
+        await input.fill(code);
+        const submit = await this.firstVisible(page, MFA_CODE_SUBMIT_SELECTORS);
+        if (submit)
+            await submit.click();
+        else
+            await input.press("Enter");
+        log("INFO", "Authenticator code submitted");
+        return true;
     }
-    /**
-     * Advance Microsoft Entra's account-name page.
-     *
-     * That page carries a password box of its own, and Playwright reports it as
-     * visible, so presence cannot tell it apart from a single-page form. The
-     * button label can: it reads "Next" there and "Sign in" on the view that
-     * follows. Filling the password against the account-name page leaves the
-     * browser parked with both fields populated and nothing submitted.
-     */
-    async submitAccountName(page) {
-        const submit = await this.findVisible(page, SELECTORS.formSubmit);
-        if (!submit)
-            return;
-        if (!ACCOUNT_NAME_BUTTON.test(await controlLabel(submit)))
-            return;
-        log("INFO", "Account-name page detected — submitting account name");
-        await submit.click();
-        // The sign-in view has arrived once the button stops saying "Next".
-        for (let attempt = 0; attempt < 30; attempt += 1) {
-            await page.waitForTimeout(500);
-            const current = await this.findVisible(page, SELECTORS.formSubmit);
-            if (current && !ACCOUNT_NAME_BUTTON.test(await controlLabel(current)))
-                return;
+    async firstVisible(page, selectors) {
+        for (const selector of selectors) {
+            const target = page.locator(selector).first();
+            if (await target.isVisible().catch(() => false))
+                return target;
         }
-        log("WARN", "Sign-in page did not appear after submitting the account name");
+        return null;
     }
-    async handleMFA(page) {
-        // The number is only on screen while MFA is pending, so the scrape has to
-        // run alongside the wait rather than before or after it.
-        const pending = { done: false };
-        let release = () => { };
-        const released = new Promise((resolve) => {
-            release = resolve;
-        });
-        const watcher = this.watchNumberMatch(page, pending, released);
+    /** The login shell also exposes D2L.LP, so verify origin and home as well. */
+    async isAuthenticated(page) {
         try {
-            log("WARN", "Waiting for Microsoft MFA approval on your device...");
-            log("INFO", "Timeout: 5 minutes");
-            log("INFO", "Approve the sign-in request in Microsoft Authenticator. If it shows a number, it is printed below.");
-            // Wait for MFA approval by watching for the post-MFA redirect.
-            // Using waitForURL instead of networkidle because networkidle fires
-            // after 500ms of no network activity, which can happen while the MFA
-            // page UI finishes loading but before the user approves the request.
-            await page.waitForURL((url) => {
-                const href = url.toString();
-                return href.includes("/d2l/") ||
-                    href.includes("kmsi") ||
-                    href.includes("/sso/") ||
-                    href.includes("SAMLResponse");
-            }, { timeout: MFA_TIMEOUT_MS });
-            log("INFO", `MFA completed - redirected to: ${page.url()}`);
+            const expected = new URL(this.config.baseUrl);
+            const current = new URL(page.url());
+            if (current.origin !== expected.origin || !/^\/d2l\/home(?:\/|$)/.test(current.pathname))
+                return false;
+            const cookies = await page.context().cookies(expected.origin);
+            if (!cookies.some(cookie => cookie.name === "d2lSessionVal" && Boolean(cookie.value)))
+                return false;
+            return await page.evaluate(() => {
+                const d2l = window.D2L;
+                return Boolean(d2l?.LP);
+            });
         }
-        catch (error) {
-            throw new BrowserAuthError("MFA approval timed out after 5 minutes", "mfa_approval", error);
-        }
-        finally {
-            pending.done = true;
-            release();
-            await watcher;
+        catch {
+            // Redirects can replace the execution context. Keep polling; this
+            // verdict never causes credentials to be entered a second time.
+            return false;
         }
     }
-    /**
-     * Log Entra's number-match digits until the MFA wait is over.
-     *
-     * Only a CHANGED value is logged: Entra re-mints the number whenever the
-     * user asks for a new request, and repeating the same digits every two
-     * seconds would bury everything else in the log.
-     */
-    async watchNumberMatch(page, pending, released) {
-        let last = null;
-        while (!pending.done) {
-            const number = await this.readNumberMatch(page);
-            if (number && number !== last) {
-                last = number;
-                log("WARN", `Number match: ${number}. Enter it in Microsoft Authenticator.`);
-            }
-            // Racing the release keeps the wait from outliving the MFA it watches.
-            await Promise.race([
-                page.waitForTimeout(NUMBER_MATCH_POLL_MS).catch(() => { }),
-                released,
-            ]);
+    async clickProvenKmsi(page) {
+        if (new URL(page.url()).hostname !== "login.microsoftonline.com")
+            return;
+        const proven = await page.locator("#KmsiCheckboxField").first().isVisible().catch(() => false) ||
+            await page.getByText("Stay signed in?").first().isVisible().catch(() => false);
+        if (!proven)
+            return;
+        const yes = page.locator("#idSIButton9").first();
+        if (await yes.isVisible().catch(() => false)) {
+            await yes.click().catch(() => { });
+            log("DEBUG", 'Clicked Yes on "Stay signed in?"');
         }
     }
     /** The digits on screen, or null when Entra is not showing any. */
@@ -251,22 +284,8 @@ export class PurdueSSOFlow {
         if (!(await sign.isVisible().catch(() => false)))
             return null;
         const text = await sign.textContent().catch(() => null);
-        return text?.trim() || null;
-    }
-    async handleStaySignedIn(page) {
-        try {
-            log("DEBUG", "Checking for 'Stay signed in?' prompt");
-            const staySignedInButton = await page.waitForSelector(SELECTORS.staySignedInYes, { timeout: 10000 });
-            if (staySignedInButton) {
-                log("INFO", "Clicking 'Yes' on 'Stay signed in?' prompt");
-                await staySignedInButton.click();
-                await page.waitForLoadState("networkidle");
-            }
-        }
-        catch (error) {
-            // Prompt may not appear - this is normal
-            log("DEBUG", "No 'Stay signed in?' prompt found (this is normal)");
-        }
+        const number = text?.trim();
+        return number && /^\d{1,3}$/.test(number) ? number : null;
     }
 }
 //# sourceMappingURL=purdue-sso.js.map

package/build/auth/purdue-sso.js.map

@@ -1 +1 @@
-{"version":3,"file":"purdue-sso.js","sourceRoot":"","sources":["../../src/auth/purdue-sso.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AAEzC,MAAM,SAAS,GAAG;IAChB,aAAa,EAAE,gBAAgB;IAC/B,aAAa,EAAE,gBAAgB;IAC/B,YAAY,EAAE,iCAAiC;IAC/C,eAAe,EAAE,iCAAiC;IAClD,2EAA2E;IAC3E,yDAAyD;IACzD,UAAU,EAAE,0EAA0E;CAC9E,CAAC;AAEX,8EAA8E;AAC9E,gFAAgF;AAChF,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAEtC;;;;;GAKG;AACH,MAAM,qBAAqB,GAAG,4BAA4B,CAAC;AAE3D,6DAA6D;AAC7D,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAElC,sEAAsE;AACtE,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAErC,gEAAgE;AAChE,KAAK,UAAU,YAAY,CACzB,MAA+C;IAE/C,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,EAAE,CAC5B,CAAE,EAAuB,CAAC,KAAK,IAAI,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAChE,CAAC;AACJ,CAAC;AAOD,MAAM,OAAO,aAAa;IAChB,MAAM,CAAkB;IAEhC,YAAY,MAAuB;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,CAAC,IAAU;QACpB,IAAI,CAAC;YACH,GAAG,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;YAEvC,qEAAqE;YACrE,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAEtC,mEAAmE;YACnE,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAElC,yDAAyD;YACzD,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAE3B,0CAA0C;YAC1C,MAAM,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;YAEpC,2DAA2D;YAC3D,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1D,GAAG,CAAC,MAAM,EAAE,6CAA6C,CAAC,CAAC;YAE3D,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,OAAO,EAAE,uBAAuB,EAAE,KAAK,CAAC,CAAC;YAC7C,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,IAAU;QAC1B,IAAI,CAAC;YACH,GAAG,CAAC,MAAM,EAAE,mDAAmD,CAAC,CAAC;YACjE,GAAG,CAAC,MAAM,EAAE,0DAA0D,CAAC,CAAC;YAExE,6EAA6E;YAC7E,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAEtC,+DAA+D;YAC/D,GAAG,CAAC,MAAM,EAAE,8DAA8D,CAAC,CAAC;YAC5E,MAAM,IAAI,CAAC,UAAU,CAAC,aAAa,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;YAC1D,GAAG,CAAC,MAAM,EAAE,oDAAoD,CAAC,CAAC;YAElE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,OAAO,EAAE,uCAAuC,EAAE,KAAK,CAAC,CAAC;YAC7D,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,IAAU;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,IAAI,UAAU,CAAC,QAAQ,CAAC,wBAAwB,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACvF,sEAAsE;YACtE,gEAAgE;YAChE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;YAC3C,GAAG,CAAC,MAAM,EAAE,kEAAkE,CAAC,CAAC;YAChF,MAAM,IAAI,CAAC,IAAI,CACb,GAAG,OAAO,iFAAiF,EAC3F,EAAE,SAAS,EAAE,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,CAC7C,CAAC;QACJ,CAAC;QACD,wEAAwE;IAC1E,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,IAAU;QACvC,IAAI,CAAC;YACH,GAAG,CAAC,OAAO,EAAE,wBAAwB,CAAC,CAAC;YAEvC,mFAAmF;YACnF,iFAAiF;YACjF,MAAM,gBAAgB,GAAG,qDAAqD,CAAC;YAC/E,MAAM,IAAI,CAAC,eAAe,CAAC,gBAAgB,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAEjE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,gBAAgB,CACxB,oCAAoC,EACpC,aAAa,CACd,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC1B,MAAM,IAAI,gBAAgB,CACxB,oCAAoC,EACpC,aAAa,CACd,CAAC;YACJ,CAAC;YAED,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;YACpC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;YACrE,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACjD,CAAC;YAED,wEAAwE;YACxE,0EAA0E;YAC1E,uEAAuE;YACvE,MAAM,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAEnC,MAAM,gBAAgB,GAAG,wCAAwC,CAAC;YAClE,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;YACrE,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACjD,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;YACxE,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,YAAY,CAAC,KAAK,EAAE,CAAC;YAC7B,CAAC;iBAAM,CAAC;gBACN,iDAAiD;gBACjD,MAAM,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACtC,CAAC;YAED,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAC7C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,GAAG,CAAC,MAAM,EAAE,oEAAoE,EAAE,KAAK,CAAC,CAAC;YACzF,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,WAAW,CACvB,IAAU,EACV,QAAgB;QAEhB,KAAK,MAAM,MAAM,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7C,IAAI,MAAM,MAAM,CAAC,SAAS,EAAE;gBAAE,OAAO,MAAM,CAAC;QAC9C,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,iBAAiB,CAAC,IAAU;QACxC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;YAAE,OAAO;QAElE,GAAG,CAAC,MAAM,EAAE,sDAAsD,CAAC,CAAC;QACpE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QAErB,oEAAoE;QACpE,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,EAAE,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,UAAU,CAAC,CAAC;YACnE,IAAI,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;gBAAE,OAAO;QAChF,CAAC;QACD,GAAG,CAAC,MAAM,EAAE,+DAA+D,CAAC,CAAC;IAC/E,CAAC;IAEO,KAAK,CAAC,SAAS,CAAC,IAAU;QAChC,0EAA0E;QAC1E,yDAAyD;QACzD,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAChC,IAAI,OAAO,GAAe,GAAG,EAAE,GAAE,CAAC,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC7C,OAAO,GAAG,OAAO,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;QAE/D,IAAI,CAAC;YACH,GAAG,CAAC,MAAM,EAAE,sDAAsD,CAAC,CAAC;YACpE,GAAG,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;YAClC,GAAG,CAAC,MAAM,EAAE,oGAAoG,CAAC,CAAC;YAElH,+DAA+D;YAC/D,oEAAoE;YACpE,qEAAqE;YACrE,qEAAqE;YACrE,MAAM,IAAI,CAAC,UAAU,CACnB,CAAC,GAAG,EAAE,EAAE;gBACN,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;oBACtB,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;oBACrB,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;oBACtB,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;YACvC,CAAC,EACD,EAAE,OAAO,EAAE,cAAc,EAAE,CAC5B,CAAC;YACF,GAAG,CAAC,MAAM,EAAE,kCAAkC,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,gBAAgB,CACxB,wCAAwC,EACxC,cAAc,EACd,KAAc,CACf,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YACpB,OAAO,EAAE,CAAC;YACV,MAAM,OAAO,CAAC;QAChB,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,gBAAgB,CAC5B,IAAU,EACV,OAA0B,EAC1B,QAAuB;QAEvB,IAAI,IAAI,GAAkB,IAAI,CAAC;QAC/B,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,MAAM,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBAC9B,IAAI,GAAG,MAAM,CAAC;gBACd,GAAG,CAAC,MAAM,EAAE,iBAAiB,MAAM,wCAAwC,CAAC,CAAC;YAC/E,CAAC;YACD,uEAAuE;YACvE,MAAM,OAAO,CAAC,IAAI,CAAC;gBACjB,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;gBACzD,QAAQ;aACT,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,mEAAmE;IAC3D,KAAK,CAAC,eAAe,CAAC,IAAU;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,KAAK,EAAE,CAAC;QACzD,0EAA0E;QAC1E,wEAAwE;QACxE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACxD,OAAO,IAAI,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC9B,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,IAAU;QACzC,IAAI,CAAC;YACH,GAAG,CAAC,OAAO,EAAE,uCAAuC,CAAC,CAAC;YACtD,MAAM,kBAAkB,GAAG,MAAM,IAAI,CAAC,eAAe,CACnD,SAAS,CAAC,eAAe,EACzB,EAAE,OAAO,EAAE,KAAK,EAAE,CACnB,CAAC;YACF,IAAI,kBAAkB,EAAE,CAAC;gBACvB,GAAG,CAAC,MAAM,EAAE,4CAA4C,CAAC,CAAC;gBAC1D,MAAM,kBAAkB,CAAC,KAAK,EAAE,CAAC;gBACjC,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,yCAAyC;YACzC,GAAG,CAAC,OAAO,EAAE,oDAAoD,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"purdue-sso.js","sourceRoot":"","sources":["../../src/auth/purdue-sso.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,8BAA8B,EAAE,MAAM,eAAe,CAAC;AAEjF,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,MAAM,eAAe,GAAG,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,CAAC;AACtE,MAAM,kBAAkB,GAAG,CAAC,sBAAsB,EAAE,oBAAoB,CAAC,CAAC;AAC1E,MAAM,gBAAgB,GAAG,CAAC,cAAc,EAAE,oBAAoB,EAAE,qBAAqB,CAAC,CAAC;AACvF,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,aAAa,GAAG,GAAG,CAAC;AAE1B;;;;;GAKG;AACH,MAAM,qBAAqB,GAAG,4BAA4B,CAAC;AAC3D,MAAM,kBAAkB,GAAG,CAAC,qBAAqB,EAAE,mBAAmB,CAAC,CAAC;AACxE,MAAM,yBAAyB,GAAG,CAAC,2BAA2B,EAAE,cAAc,CAAC,CAAC;AAEhF,6DAA6D;AAC7D,MAAM,oBAAoB,GAAG,IAAI,CAAC;AAElC,sEAAsE;AACtE,MAAM,cAAc,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAUrC,+FAA+F;AAC/F,SAAS,UAAU,CAAC,QAAgB,EAAE,OAAgB;IACpD,MAAM,QAAQ,GAAG,OAAO,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,wBAAwB,CAAC;IACjG,OAAO,QAAQ,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,QAAQ,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnF,CAAC;AAED,MAAM,OAAO,aAAa;IAChB,MAAM,CAAkB;IACxB,oBAAoB,GAAG,KAAK,CAAC;IACrC,2DAA2D;IACnD,gBAAgB,GAAG,KAAK,CAAC;IAEjC,YAAY,MAAuB;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,cAAc;QACZ,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAU;QAC3B,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,eAAe,CAAC,IAAU;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1E,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC;YAAE,OAAO,KAAK,CAAC;QACrE,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,CAAC,IAAU;QACpB,IAAI,CAAC;YACH,GAAG,CAAC,MAAM,EAAE,yBAAyB,CAAC,CAAC;YAEvC,qEAAqE;YACrE,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC;YAEtC,uEAAuE;YACvE,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE;gBACjD,qBAAqB;gBACrB,sBAAsB;gBACtB,qBAAqB;gBACrB,oBAAoB;aACrB,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YAC5F,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAErG,+DAA+D;YAC/D,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAE3B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,gBAAgB;gBAAE,MAAM,KAAK,CAAC;YACnD,MAAM,IAAI,8BAA8B,CAAC,gHAAgH,EAAE,KAAc,CAAC,CAAC;QAC7K,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,oBAAoB,CAAC,IAAU;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,IAAI,UAAU,CAAC,QAAQ,CAAC,wBAAwB,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YACvF,sEAAsE;YACtE,oEAAoE;YACpE,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC,KAAK,EAAE,CAAC;YAChE,IAAI,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChD,GAAG,CAAC,MAAM,EAAE,4DAA4D,CAAC,CAAC;gBAC1E,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;gBACrB,OAAO;YACT,CAAC;YAED,2EAA2E;YAC3E,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC;YAC3C,GAAG,CAAC,MAAM,EAAE,kEAAkE,CAAC,CAAC;YAChF,MAAM,IAAI,CAAC,IAAI,CACb,GAAG,OAAO,iFAAiF,EAC3F,EAAE,SAAS,EAAE,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,CAClD,CAAC;QACJ,CAAC;QACD,wEAAwE;IAC1E,CAAC;IAEO,KAAK,CAAC,gBAAgB,CAAC,IAAU;QACvC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,gBAAgB,CAAC,oCAAoC,EAAE,aAAa,CAAC,CAAC;QAC3G,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,MAAM,IAAI,gBAAgB,CAAC,oCAAoC,EAAE,aAAa,CAAC,CAAC;QAE3G,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACpE,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,eAAe,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC5D,MAAM,IAAI,8BAA8B,CAAC,6EAA6E,CAAC,CAAC;YAC1H,CAAC;YACD,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,CAAC;gBACvD,MAAM,IAAI,8BAA8B,CAAC,qFAAqF,CAAC,CAAC;YAClI,CAAC;QACH,CAAC;QACD,IAAI,CAAC,oBAAoB,GAAG,KAAK,CAAC;QAClC,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9E,MAAM,IAAI,8BAA8B,CAAC,gFAAgF,CAAC,CAAC;QAC7H,CAAC;QACD,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,gBAAgB,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,8BAA8B,CAAC,wFAAwF,CAAC,CAAC;QACrI,CAAC;IACH,CAAC;IAED,yEAAyE;IACjE,KAAK,CAAC,YAAY,CAAC,IAAU,EAAE,SAAmB,EAAE,GAAuC;QACjG,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,CAAC;QAC/C,GAAG,CAAC;YACF,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;gBACjC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC;gBAC9C,IAAI,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;oBAChD,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC;oBAClB,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YACD,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;QAC3C,CAAC,QAAQ,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,IAAU,EAAE,SAAmB,EAAE,KAAa;QACxE,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1E,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,IAAU,EAAE,SAAmB;QAC1D,yEAAyE;QACzE,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,qFAAqF;IAC7E,KAAK,CAAC,UAAU,CAAC,IAAU,EAAE,SAA4B;QAC/D,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QACvF,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,+DAA+D;IACvD,KAAK,CAAC,SAAS,CAAC,IAAU;QAChC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,IAAI,8BAA8B,CAAC,6DAA6D,CAAC,CAAC;QAC1G,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC;QAC7C,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,SAAS,GAAkB,IAAI,CAAC;QACpC,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;gBAC7B,IAAI,MAAM,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;oBAAE,UAAU,GAAG,IAAI,CAAC;gBACtD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;gBAChD,MAAM,gBAAgB,GAAG,MAAM,KAAK,IAAI;oBACtC,MAAM,IAAI,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;oBACjF,MAAM,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;gBACnF,IAAI,gBAAgB,IAAI,CAAC,UAAU,EAAE,CAAC;oBACpC,UAAU,GAAG,IAAI,CAAC;oBAClB,GAAG,CAAC,MAAM,EAAE,oEAAoE,CAAC,CAAC;gBACpF,CAAC;gBACD,IAAI,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACnC,SAAS,GAAG,MAAM,CAAC;oBACnB,GAAG,CAAC,MAAM,EAAE,iBAAiB,MAAM,wCAAwC,CAAC,CAAC;gBAC/E,CAAC;gBACD,IAAI,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;oBACrC,GAAG,CAAC,MAAM,EAAE,8CAA8C,CAAC,CAAC;oBAC5D,OAAO;gBACT,CAAC;gBACD,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;gBACjC,MAAM,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,gBAAgB;gBAAE,MAAM,KAAK,CAAC;YACnD,IAAI,UAAU;gBAAE,MAAM,IAAI,gBAAgB,CAAC,KAAc,CAAC,CAAC;YAC3D,MAAM,IAAI,8BAA8B,CAAC,sEAAsE,EAAE,KAAc,CAAC,CAAC;QACnI,CAAC;QACD,IAAI,UAAU;YAAE,MAAM,IAAI,gBAAgB,EAAE,CAAC;QAC7C,MAAM,IAAI,8BAA8B,CAAC,kFAAkF,CAAC,CAAC;IAC/H,CAAC;IAEO,KAAK,CAAC,aAAa,CAAC,IAAU;QACpC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;QAChE,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QACzB,IAAI,IAAI,CAAC,MAAM,CAAC,QAAQ,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QACjD,wEAAwE;QACxE,0EAA0E;QAC1E,2EAA2E;QAC3E,wEAAwE;QACxE,wDAAwD;QACxD,IAAI,IAAI,CAAC,gBAAgB;YAAE,OAAO,KAAK,CAAC;QACxC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAChC,MAAM,IAAI,8BAA8B,CACtC,0CAA0C,YAAY,+BAA+B,CACtF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAChD,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,8BAA8B,CAAC,uCAAuC,CAAC,CAAC;QAC/G,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC;QACxE,IAAI,MAAM;YAAE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;;YAC5B,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAChC,GAAG,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,IAAU,EAAE,SAA4B;QACjE,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,CAAC;YAC9C,IAAI,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;gBAAE,OAAO,MAAM,CAAC;QACjE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8EAA8E;IACtE,KAAK,CAAC,eAAe,CAAC,IAAU;QACtC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAQ,CAAC,CAAC;YAC/C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YACpC,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;gBAAE,OAAO,KAAK,CAAC;YACvG,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC9D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAAE,OAAO,KAAK,CAAC;YACpG,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE;gBAC9B,MAAM,GAAG,GAAI,MAA6C,CAAC,GAA0C,CAAC;gBACtG,OAAO,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC1B,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,gEAAgE;YAChE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,IAAU;QACtC,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,KAAK,2BAA2B;YAAE,OAAO;QACzE,MAAM,MAAM,GACV,MAAM,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC;YAC/E,MAAM,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;QACjF,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,KAAK,EAAE,CAAC;QACjD,IAAI,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7C,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAClC,GAAG,CAAC,OAAO,EAAE,kCAAkC,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,mEAAmE;IAC3D,KAAK,CAAC,eAAe,CAAC,IAAU;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAC,KAAK,EAAE,CAAC;QACzD,0EAA0E;QAC1E,wEAAwE;QACxE,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,IAAI,EAAE,IAAI,EAAE,CAAC;QAC5B,OAAO,MAAM,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5D,CAAC;CAEF"}

package/build/auth/session-store.d.ts

@@ -1,50 +1,28 @@
 /**
- * Purdue Brightspace MCP Server
+ * Brightspace MCP Server
  * Copyright (c) 2026 Rohan Muppa. All rights reserved.
- * Licensed under MIT — see LICENSE file for details.
+ * Licensed under MIT. See LICENSE file for details.
  */
 import type { TokenData } from "../types/index.js";
-/**
- * SessionStore manages encrypted token persistence to disk.
- * Uses AES-256-GCM for encryption with a key derived from username + hostname.
- */
+import { type SecureStoreOptions } from "./encrypted-store.js";
+/** AES-GCM session persistence with a random key held by the native secret store. */
 export declare class SessionStore {
+    private readonly options;
     private readonly sessionDir;
     private readonly sessionFilePath;
-    constructor(sessionDir?: string);
-    /**
-     * Get or create a random salt unique to this installation.
-     * Stored at ~/.d2l-session/salt with restricted permissions.
-     */
-    private getOrCreateSalt;
-    /**
-     * Derive AES-256 key from username and hostname using scrypt.
-     * Uses a per-installation random salt to prevent precomputation attacks.
-     */
-    private deriveKey;
-    /**
-     * Encrypt plaintext using AES-256-GCM.
-     * Returns IV, auth tag, and ciphertext as hex strings.
-     */
-    private encrypt;
-    /**
-     * Decrypt ciphertext using AES-256-GCM.
-     * Returns plaintext string, or throws if auth tag verification fails.
-     */
-    private decrypt;
-    /**
-     * Save token to disk with encryption.
-     * Creates session directory if it doesn't exist.
-     */
+    constructor(sessionDir?: string, options?: SecureStoreOptions);
+    private withWriteLock;
+    private readFile;
+    private decode;
+    private loadUnlocked;
+    private saveUnlocked;
+    private storeError;
     save(token: TokenData): Promise<void>;
-    /**
-     * Load token from disk with decryption.
-     * Returns null if file doesn't exist or is corrupted (graceful degradation).
-     */
+    /** Missing files return null. Damaged or inaccessible secrets fail without MFA. */
     load(): Promise<TokenData | null>;
-    /**
-     * Clear session by deleting the session file.
-     */
     clear(): Promise<void>;
+    /** Prevent a slow mint from replacing credentials saved by a newer login. */
+    saveIfCurrent(token: TokenData, expected: TokenData | null): Promise<boolean>;
+    clearIfCurrent(expected: TokenData): Promise<boolean>;
 }
 //# sourceMappingURL=session-store.d.ts.map

package/build/auth/session-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../src/auth/session-store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,OAAO,KAAK,EAAE,SAAS,EAA8B,MAAM,mBAAmB,CAAC;AAgB/E;;;GAGG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;gBAE7B,UAAU,CAAC,EAAE,MAAM;IAK/B;;;OAGG;IACH,OAAO,CAAC,eAAe;IAmBvB;;;OAGG;IACH,OAAO,CAAC,SAAS;IAcjB;;;OAGG;IACH,OAAO,CAAC,OAAO;IAkBf;;;OAGG;IACH,OAAO,CAAC,OAAO;IAcf;;;OAGG;IACG,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAoC3C;;;OAGG;IACG,IAAI,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAuCvC;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAa7B"}
+{"version":3,"file":"session-store.d.ts","sourceRoot":"","sources":["../../src/auth/session-store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,mBAAmB,CAAC;AAIhE,OAAO,EAAsF,KAAK,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AA6BnJ,qFAAqF;AACrF,qBAAa,YAAY;IAIuB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAHtE,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;gBAE7B,UAAU,SAAsB,EAAmB,OAAO,GAAE,kBAAuB;YAKjF,aAAa;YAmBb,QAAQ;YASR,MAAM;YAyBN,YAAY;YAQZ,YAAY;IAK1B,OAAO,CAAC,UAAU;IAKZ,IAAI,CAAC,KAAK,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC;IAY3C,mFAAmF;IAC7E,IAAI,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;IAWjC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAa5B,6EAA6E;IACvE,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,GAAG,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAY7E,cAAc,CAAC,QAAQ,EAAE,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC;CAW5D"}