brightspace-mcp-server 1.6.3 → 3.0.0

package/build/auth/session-store.js

@@ -1,192 +1,197 @@
 /**
- * Purdue Brightspace MCP Server
+ * Brightspace MCP Server
  * Copyright (c) 2026 Rohan Muppa. All rights reserved.
- * Licensed under MIT — see LICENSE file for details.
+ * Licensed under MIT. See LICENSE file for details.
  */
 import * as crypto from "node:crypto";
 import * as fs from "node:fs/promises";
-import * as fsSync from "node:fs";
 import * as path from "node:path";
 import * as os from "node:os";
 import { SessionStoreError } from "../utils/errors.js";
-import { log } from "../utils/logger.js";
-import { writeFileAtomic } from "../utils/atomic-write.js";
+import { acquireProcessLock, AuthenticationInProgressError } from "./auth-lock.js";
+import { NativeCredentialStoreError } from "./credential-store.js";
+import { decrypt, readEncryptedRecord, saveEncryptedRecord, trashFile } from "./encrypted-store.js";
 const DEFAULT_SESSION_DIR = path.join(os.homedir(), ".d2l-session");
-const SESSION_FILE_NAME = "session.json";
-const SESSION_VERSION = 1;
-// Encryption constants
-const ALGORITHM = "aes-256-gcm";
-const IV_LENGTH = 12; // GCM recommended IV length
-const AUTH_TAG_LENGTH = 16; // GCM auth tag length
-const SALT_LENGTH = 16;
-const SALT_FILE_NAME = "salt";
-/**
- * SessionStore manages encrypted token persistence to disk.
- * Uses AES-256-GCM for encryption with a key derived from username + hostname.
- */
+function validTenantOrigin(origin) {
+    if (origin === undefined)
+        return true;
+    if (typeof origin !== "string")
+        return false;
+    try {
+        const parsed = new URL(origin);
+        return parsed.protocol === "https:" && parsed.origin === origin;
+    }
+    catch {
+        return false;
+    }
+}
+function validToken(value) {
+    const token = value;
+    return !!token && typeof token.accessToken === "string" && Number.isFinite(token.capturedAt) && Number.isFinite(token.expiresAt)
+        && (token.source === "browser" || token.source === "cache")
+        && (token.cookieHeader === undefined || typeof token.cookieHeader === "string")
+        && (token.csrfToken === undefined || typeof token.csrfToken === "string")
+        && validTenantOrigin(token.tenantOrigin);
+}
+function equalToken(a, b) {
+    return a === b || (!!a && !!b && a.accessToken === b.accessToken && a.capturedAt === b.capturedAt
+        && a.expiresAt === b.expiresAt && a.source === b.source && a.cookieHeader === b.cookieHeader && a.csrfToken === b.csrfToken && a.tenantOrigin === b.tenantOrigin);
+}
+/** AES-GCM session persistence with a random key held by the native secret store. */
 export class SessionStore {
+    options;
     sessionDir;
     sessionFilePath;
-    constructor(sessionDir) {
-        this.sessionDir = sessionDir ?? DEFAULT_SESSION_DIR;
-        this.sessionFilePath = path.join(this.sessionDir, SESSION_FILE_NAME);
+    constructor(sessionDir = DEFAULT_SESSION_DIR, options = {}) {
+        this.options = options;
+        this.sessionDir = sessionDir;
+        this.sessionFilePath = path.join(sessionDir, "session.json");
     }
-    /**
-     * Get or create a random salt unique to this installation.
-     * Stored at ~/.d2l-session/salt with restricted permissions.
-     */
-    getOrCreateSalt() {
-        const saltPath = path.join(this.sessionDir, SALT_FILE_NAME);
+    async withWriteLock(operation) {
+        await fs.mkdir(this.sessionDir, { recursive: true, mode: 0o700 });
+        let release;
+        for (let attempt = 0; attempt < 100; attempt++) {
+            try {
+                release = await acquireProcessLock(path.join(this.sessionDir, ".session-write.lock"));
+                break;
+            }
+            catch (error) {
+                if (!(error instanceof AuthenticationInProgressError) || attempt === 99)
+                    throw error;
+                await new Promise((resolve) => setTimeout(resolve, 25));
+            }
+        }
         try {
-            return fsSync.readFileSync(saltPath);
-        }
-        catch {
-            // Salt doesn't exist yet — create session dir and generate one
-            const isWindows = process.platform === "win32";
-            fsSync.mkdirSync(this.sessionDir, {
-                recursive: true,
-                ...(isWindows ? {} : { mode: 0o700 }),
-            });
-            const salt = crypto.randomBytes(SALT_LENGTH);
-            fsSync.writeFileSync(saltPath, salt, {
-                ...(isWindows ? {} : { mode: 0o600 }),
-            });
-            return salt;
+            return await operation();
+        }
+        finally {
+            await release?.();
         }
     }
-    /**
-     * Derive AES-256 key from username and hostname using scrypt.
-     * Uses a per-installation random salt to prevent precomputation attacks.
-     */
-    deriveKey() {
-        // Deliberately NOT the hostname. On a campus network os.hostname() is a
-        // DHCP reverse-DNS name (pal-nat186-166-147.itap.purdue.edu), so it
-        // changes with the lease. Keying on it meant that moving between networks
-        // silently made the saved session undecryptable, and the user paid for it
-        // with a full MFA login. The per-install random salt already provides the
-        // uniqueness the hostname was there for, and it is stable.
-        const username = os.userInfo().username;
-        const salt = this.getOrCreateSalt();
-        // Use scrypt to derive a 32-byte key (256 bits for AES-256)
-        return crypto.scryptSync(username, salt, 32);
+    async readFile() {
+        try {
+            return JSON.parse(await fs.readFile(this.sessionFilePath, "utf8"));
+        }
+        catch (error) {
+            if (error.code === "ENOENT")
+                return null;
+            throw error;
+        }
     }
-    /**
-     * Encrypt plaintext using AES-256-GCM.
-     * Returns IV, auth tag, and ciphertext as hex strings.
-     */
-    encrypt(plaintext) {
-        const key = this.deriveKey();
-        const iv = crypto.randomBytes(IV_LENGTH);
-        const cipher = crypto.createCipheriv(ALGORITHM, key, iv);
-        let encrypted = cipher.update(plaintext, "utf8", "hex");
-        encrypted += cipher.final("hex");
-        const authTag = cipher.getAuthTag();
-        return {
-            iv: iv.toString("hex"),
-            authTag: authTag.toString("hex"),
-            data: encrypted,
-        };
+    async decode(record) {
+        let token;
+        if (record.version === 2) {
+            token = await readEncryptedRecord(this.sessionDir, record, "session", this.options);
+        }
+        else if (record.version === 1) {
+            // Never generate a salt when loading old data. That would make recovery harder.
+            const salt = await fs.readFile(path.join(this.sessionDir, "salt"));
+            const username = os.userInfo().username;
+            let lastError;
+            for (const material of [username, username + os.hostname()]) {
+                try {
+                    token = JSON.parse(decrypt(record.encrypted, crypto.scryptSync(material, salt, 32)));
+                    break;
+                }
+                catch (error) {
+                    lastError = error;
+                }
+            }
+            if (!token)
+                throw lastError;
+        }
+        else {
+            throw new Error("Unsupported saved session version.");
+        }
+        if (!validToken(token))
+            throw new Error("Invalid saved session contents.");
+        return token;
     }
-    /**
-     * Decrypt ciphertext using AES-256-GCM.
-     * Returns plaintext string, or throws if auth tag verification fails.
-     */
-    decrypt(encrypted) {
-        const key = this.deriveKey();
-        const iv = Buffer.from(encrypted.iv, "hex");
-        const authTag = Buffer.from(encrypted.authTag, "hex");
-        const decipher = crypto.createDecipheriv(ALGORITHM, key, iv);
-        decipher.setAuthTag(authTag);
-        let decrypted = decipher.update(encrypted.data, "hex", "utf8");
-        decrypted += decipher.final("utf8");
-        return decrypted;
+    async loadUnlocked() {
+        const record = await this.readFile();
+        if (!record)
+            return null;
+        const token = await this.decode(record);
+        if (record.version === 1)
+            await this.saveUnlocked(token);
+        return token;
+    }
+    async saveUnlocked(token) {
+        if (!validToken(token))
+            throw new Error("Invalid session token.");
+        await saveEncryptedRecord(this.sessionDir, this.sessionFilePath, "session", token, this.options);
+    }
+    storeError(action, error) {
+        if (error instanceof NativeCredentialStoreError || error instanceof AuthenticationInProgressError)
+            throw error;
+        throw new SessionStoreError(`Failed to ${action} session. Existing session data was preserved.`, error instanceof Error ? error : new Error(String(error)));
     }
-    /**
-     * Save token to disk with encryption.
-     * Creates session directory if it doesn't exist.
-     */
     async save(token) {
         try {
-            // Ensure session directory exists with restricted permissions (owner-only on Unix)
-            const isWindows = process.platform === "win32";
-            await fs.mkdir(this.sessionDir, {
-                recursive: true,
-                ...(isWindows ? {} : { mode: 0o700 }),
+            await this.withWriteLock(async () => {
+                const current = await this.readFile();
+                if (current)
+                    await this.decode(current);
+                await this.saveUnlocked(token);
             });
-            const plaintext = JSON.stringify(token);
-            const encrypted = this.encrypt(plaintext);
-            const sessionFile = {
-                version: SESSION_VERSION,
-                encrypted,
-                createdAt: Date.now(),
-                expiresAt: token.expiresAt,
-            };
-            // Staged and renamed, so the auth CLI and a running server can never
-            // leave each other a half-written file.
-            await writeFileAtomic(this.sessionFilePath, JSON.stringify(sessionFile, null, 2), isWindows ? {} : { mode: 0o600 });
-            log("DEBUG", `Session saved to ${this.sessionFilePath}`);
         }
         catch (error) {
-            const err = error instanceof Error ? error : new Error(String(error));
-            log("ERROR", `Failed to save session: ${err.message}`);
-            throw new SessionStoreError("Failed to save session", err);
+            this.storeError("save", error);
         }
     }
-    /**
-     * Load token from disk with decryption.
-     * Returns null if file doesn't exist or is corrupted (graceful degradation).
-     */
+    /** Missing files return null. Damaged or inaccessible secrets fail without MFA. */
     async load() {
         try {
-            // Check if file exists
-            try {
-                await fs.access(this.sessionFilePath);
-            }
-            catch {
-                log("DEBUG", "No session file found");
+            const record = await this.readFile();
+            if (!record)
                 return null;
-            }
-            // Read and parse session file
-            const fileContent = await fs.readFile(this.sessionFilePath, "utf-8");
-            const sessionFile = JSON.parse(fileContent);
-            // Decrypt token data
-            const plaintext = this.decrypt(sessionFile.encrypted);
-            const token = JSON.parse(plaintext);
-            log("DEBUG", `Session loaded from ${this.sessionFilePath}`);
-            return token;
+            if (record.version === 1)
+                return await this.withWriteLock(() => this.loadUnlocked());
+            return await this.decode(record);
         }
         catch (error) {
-            const err = error instanceof Error ? error : new Error(String(error));
-            log("WARN", `Failed to load session: ${err.message}`);
-            // A session this install cannot read is never going to become readable:
-            // it was written by an older build whose key derivation differed, or the
-            // file is damaged. Removing it means the next run does one clean login
-            // instead of logging the same warning on every start forever.
-            try {
-                await fs.rm(this.sessionFilePath, { force: true });
-                log("DEBUG", "Removed the unreadable session file, a fresh login is needed");
-            }
-            catch {
-                // Nothing more to do: the caller re-authenticates either way.
-            }
-            // Return null instead of throwing - graceful degradation
-            return null;
+            this.storeError("load", error);
         }
     }
-    /**
-     * Clear session by deleting the session file.
-     */
     async clear() {
         try {
-            await fs.unlink(this.sessionFilePath);
-            log("DEBUG", `Session cleared: ${this.sessionFilePath}`);
+            await this.withWriteLock(async () => {
+                const current = await this.readFile();
+                if (!current)
+                    return;
+                await this.decode(current);
+                await trashFile(this.sessionFilePath, this.options);
+            });
         }
         catch (error) {
-            // Ignore ENOENT errors - file already doesn't exist
-            if (error.code !== "ENOENT") {
-                const err = error instanceof Error ? error : new Error(String(error));
-                log("WARN", `Failed to clear session: ${err.message}`);
-            }
+            this.storeError("clear", error);
+        }
+    }
+    /** Prevent a slow mint from replacing credentials saved by a newer login. */
+    async saveIfCurrent(token, expected) {
+        try {
+            return await this.withWriteLock(async () => {
+                if (!equalToken(await this.loadUnlocked(), expected))
+                    return false;
+                await this.saveUnlocked(token);
+                return true;
+            });
+        }
+        catch (error) {
+            this.storeError("save", error);
+        }
+    }
+    async clearIfCurrent(expected) {
+        try {
+            return await this.withWriteLock(async () => {
+                if (!equalToken(await this.loadUnlocked(), expected))
+                    return false;
+                await trashFile(this.sessionFilePath, this.options);
+                return true;
+            });
+        }
+        catch (error) {
+            this.storeError("clear", error);
         }
     }
 }

package/build/auth/session-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-store.js","sourceRoot":"","sources":["../../src/auth/session-store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,MAAM,MAAM,SAAS,CAAC;AAClC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,GAAG,EAAE,MAAM,oBAAoB,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAE3D,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;AACpE,MAAM,iBAAiB,GAAG,cAAc,CAAC;AACzC,MAAM,eAAe,GAAG,CAAC,CAAC;AAE1B,uBAAuB;AACvB,MAAM,SAAS,GAAG,aAAa,CAAC;AAChC,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC,4BAA4B;AAClD,MAAM,eAAe,GAAG,EAAE,CAAC,CAAC,sBAAsB;AAClD,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B;;;GAGG;AACH,MAAM,OAAO,YAAY;IACN,UAAU,CAAS;IACnB,eAAe,CAAS;IAEzC,YAAY,UAAmB;QAC7B,IAAI,CAAC,UAAU,GAAG,UAAU,IAAI,mBAAmB,CAAC;QACpD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IACvE,CAAC;IAED;;;OAGG;IACK,eAAe;QACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,OAAO,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;YAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;YAC/C,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE;gBAChC,SAAS,EAAE,IAAI;gBACf,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;aACtC,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC;YAC7C,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE;gBACnC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;aACtC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,SAAS;QACf,wEAAwE;QACxE,oEAAoE;QACpE,0EAA0E;QAC1E,0EAA0E;QAC1E,0EAA0E;QAC1E,2DAA2D;QAC3D,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAEpC,4DAA4D;QAC5D,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED;;;OAGG;IACK,OAAO,CAAC,SAAiB;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAEzC,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAEzD,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACxD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEjC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEpC,OAAO;YACL,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;YACtB,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;YAChC,IAAI,EAAE,SAAS;SAChB,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,OAAO,CAAC,SAAwB;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;QAC7B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAEtD,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7D,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE7B,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC/D,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI,CAAC,KAAgB;QACzB,IAAI,CAAC;YACH,mFAAmF;YACnF,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;YAC/C,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE;gBAC9B,SAAS,EAAE,IAAI;gBACf,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;aACtC,CAAC,CAAC;YAEH,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACxC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YAE1C,MAAM,WAAW,GAAgB;gBAC/B,OAAO,EAAE,eAAe;gBACxB,SAAS;gBACT,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAC;YAEF,qEAAqE;YACrE,wCAAwC;YACxC,MAAM,eAAe,CACnB,IAAI,CAAC,eAAe,EACpB,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EACpC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CACjC,CAAC;YAEF,GAAG,CAAC,OAAO,EAAE,oBAAoB,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GACP,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC5D,GAAG,CAAC,OAAO,EAAE,2BAA2B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACvD,MAAM,IAAI,iBAAiB,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,uBAAuB;YACvB,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;gBACtC,OAAO,IAAI,CAAC;YACd,CAAC;YAED,8BAA8B;YAC9B,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;YACrE,MAAM,WAAW,GAAgB,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YAEzD,qBAAqB;YACrB,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;YACtD,MAAM,KAAK,GAAc,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAE/C,GAAG,CAAC,OAAO,EAAE,uBAAuB,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;YAC5D,OAAO,KAAK,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GACP,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;YAC5D,GAAG,CAAC,MAAM,EAAE,2BAA2B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACtD,wEAAwE;YACxE,yEAAyE;YACzE,uEAAuE;YACvE,8DAA8D;YAC9D,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBACnD,GAAG,CAAC,OAAO,EAAE,8DAA8D,CAAC,CAAC;YAC/E,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;YAChE,CAAC;YACD,yDAAyD;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACtC,GAAG,CAAC,OAAO,EAAE,oBAAoB,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,oDAAoD;YACpD,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC5B,MAAM,GAAG,GACP,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC5D,GAAG,CAAC,MAAM,EAAE,4BAA4B,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"session-store.js","sourceRoot":"","sources":["../../src/auth/session-store.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAE9B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AACnF,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,SAAS,EAAiD,MAAM,sBAAsB,CAAC;AAEnJ,MAAM,mBAAmB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;AAEpE,SAAS,iBAAiB,CAAC,MAAe;IACxC,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,MAAM,KAAK,GAAG,KAAyB,CAAC;IACxC,OAAO,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC;WAC3H,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC;WACxD,CAAC,KAAK,CAAC,YAAY,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC;WAC5E,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CAAC;WACtE,iBAAiB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,UAAU,CAAC,CAAmB,EAAE,CAAmB;IAC1D,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,UAAU;WAC5F,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC;AACtK,CAAC;AAED,qFAAqF;AACrF,MAAM,OAAO,YAAY;IAIwC;IAH9C,UAAU,CAAS;IACnB,eAAe,CAAS;IAEzC,YAAY,UAAU,GAAG,mBAAmB,EAAmB,UAA8B,EAAE;QAAhC,YAAO,GAAP,OAAO,CAAyB;QAC7F,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAC/D,CAAC;IAEO,KAAK,CAAC,aAAa,CAAI,SAA2B;QACxD,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,IAAI,OAA0C,CAAC;QAC/C,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,GAAG,EAAE,OAAO,EAAE,EAAE,CAAC;YAC/C,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC,CAAC;gBACtF,MAAM;YACR,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,CAAC,KAAK,YAAY,6BAA6B,CAAC,IAAI,OAAO,KAAK,EAAE;oBAAE,MAAM,KAAK,CAAC;gBACrF,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,EAAE,CAAC;QAC3B,CAAC;gBAAS,CAAC;YACT,MAAM,OAAO,EAAE,EAAE,CAAC;QACpB,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,QAAQ;QACpB,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACpE,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,MAAqC;QACxD,IAAI,KAAc,CAAC;QACnB,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACtF,CAAC;aAAM,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YAChC,gFAAgF;YAChF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;YACnE,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC;YACxC,IAAI,SAAkB,CAAC;YACvB,KAAK,MAAM,QAAQ,IAAI,CAAC,QAAQ,EAAE,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;gBAC5D,IAAI,CAAC;oBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;oBACrF,MAAM;gBACR,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,SAAS,GAAG,KAAK,CAAC;gBACpB,CAAC;YACH,CAAC;YACD,IAAI,CAAC,KAAK;gBAAE,MAAM,SAAS,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QAC3E,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,YAAY;QACxB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;QACrC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;YAAE,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QACzD,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,KAAgB;QACzC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAClE,MAAM,mBAAmB,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACnG,CAAC;IAEO,UAAU,CAAC,MAAc,EAAE,KAAc;QAC/C,IAAI,KAAK,YAAY,0BAA0B,IAAI,KAAK,YAAY,6BAA6B;YAAE,MAAM,KAAK,CAAC;QAC/G,MAAM,IAAI,iBAAiB,CAAC,aAAa,MAAM,gDAAgD,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9J,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,KAAgB;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,IAAI,EAAE;gBAClC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACtC,IAAI,OAAO;oBAAE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBACxC,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,mFAAmF;IACnF,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;YACrC,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;gBAAE,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;YACrF,OAAO,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,IAAI,EAAE;gBAClC,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACtC,IAAI,CAAC,OAAO;oBAAE,OAAO;gBACrB,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC3B,MAAM,SAAS,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;YACtD,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,aAAa,CAAC,KAAgB,EAAE,QAA0B;QAC9D,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,IAAI,EAAE;gBACzC,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,EAAE,QAAQ,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACnE,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;gBAC/B,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAmB;QACtC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,aAAa,CAAC,KAAK,IAAI,EAAE;gBACzC,IAAI,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,YAAY,EAAE,EAAE,QAAQ,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACnE,MAAM,SAAS,CAAC,IAAI,CAAC,eAAe,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBACpD,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;CACF"}

package/build/auth/sso-flow.d.ts

@@ -5,14 +5,26 @@
  */
 import type { Page } from "playwright";
 import type { AppConfig } from "../types/index.js";
+import { BrowserAuthError } from "../utils/errors.js";
+export type RequestMfaCode = () => Promise<string>;
+export declare class UnsupportedAuthenticationError extends BrowserAuthError {
+    readonly code = "AUTH_UNSUPPORTED";
+    constructor(message: string, cause?: Error);
+}
+export declare class MfaApprovalError extends BrowserAuthError {
+    readonly code = "AUTH_MFA_FAILED";
+    constructor(cause?: Error);
+}
 /** The browser login sequence for one institution's identity provider. */
 export interface SSOFlow {
+    /** Pass known school and campus selectors without entering credentials. */
+    prepareLogin?(page: Page): Promise<void>;
+    /** Submit only the public account name so a saved IdP session can resume. */
+    identifyAccount?(page: Page): Promise<boolean>;
     /** True when saved credentials allow an automated sign-in attempt. */
     hasCredentials(): boolean;
-    /** Drive the sign-in form. Resolves false on timeout so the caller can fall back. */
+    /** Drive the supported headless sign-in form, surfacing MFA in terminal logs. */
     login(page: Page): Promise<boolean>;
-    /** Wait for the user to sign in themselves in a visible browser. */
-    manualLogin(page: Page): Promise<boolean>;
 }
 /**
  * Pick the login sequence for the configured Brightspace host. Schools whose
@@ -20,5 +32,5 @@ export interface SSOFlow {
  * else uses the default flow, which already covers the common Shibboleth,
  * CAS, and Microsoft Entra forms.
  */
-export declare function createSSOFlow(config: AppConfig): SSOFlow;
+export declare function createSSOFlow(config: AppConfig, requestMfaCode?: RequestMfaCode): SSOFlow;
 //# sourceMappingURL=sso-flow.d.ts.map

package/build/auth/sso-flow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sso-flow.d.ts","sourceRoot":"","sources":["../../src/auth/sso-flow.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAInD,0EAA0E;AAC1E,MAAM,WAAW,OAAO;IACtB,sEAAsE;IACtE,cAAc,IAAI,OAAO,CAAC;IAC1B,qFAAqF;IACrF,KAAK,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,oEAAoE;IACpE,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAC3C;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,GAAG,OAAO,CAQxD"}
+{"version":3,"file":"sso-flow.d.ts","sourceRoot":"","sources":["../../src/auth/sso-flow.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAGnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAGtD,MAAM,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;AAEnD,qBAAa,8BAA+B,SAAQ,gBAAgB;IAClE,QAAQ,CAAC,IAAI,sBAAsB;gBACvB,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK;CAI3C;AAED,qBAAa,gBAAiB,SAAQ,gBAAgB;IACpD,QAAQ,CAAC,IAAI,qBAAqB;gBACtB,KAAK,CAAC,EAAE,KAAK;CAI1B;AAED,0EAA0E;AAC1E,MAAM,WAAW,OAAO;IACtB,2EAA2E;IAC3E,YAAY,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACzC,6EAA6E;IAC7E,eAAe,CAAC,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,sEAAsE;IACtE,cAAc,IAAI,OAAO,CAAC;IAC1B,iFAAiF;IACjF,KAAK,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACrC;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,cAAc,CAAC,EAAE,cAAc,GAAG,OAAO,CAczF"}

package/build/auth/sso-flow.js

@@ -5,14 +5,36 @@
  */
 import { PurdueSSOFlow } from "./purdue-sso.js";
 import { SunySSOFlow, isSunyBrightspace } from "./suny-sso.js";
+import { BrowserAuthError } from "../utils/errors.js";
+import { AUTH_COMMAND } from "../utils/commands.js";
+export class UnsupportedAuthenticationError extends BrowserAuthError {
+    code = "AUTH_UNSUPPORTED";
+    constructor(message, cause) {
+        super(message, "headless_login", cause);
+        this.name = "UnsupportedAuthenticationError";
+    }
+}
+export class MfaApprovalError extends BrowserAuthError {
+    code = "AUTH_MFA_FAILED";
+    constructor(cause) {
+        super(`MFA approval failed or timed out after 5 minutes. Run ${AUTH_COMMAND} to retry.`, "mfa_approval", cause);
+        this.name = "MfaApprovalError";
+    }
+}
 /**
  * Pick the login sequence for the configured Brightspace host. Schools whose
  * identity provider needs extra steps get their own handler here; everything
  * else uses the default flow, which already covers the common Shibboleth,
  * CAS, and Microsoft Entra forms.
  */
-export function createSSOFlow(config) {
-    const credentials = { username: config.username, password: config.password };
+export function createSSOFlow(config, requestMfaCode) {
+    const credentials = {
+        username: config.username,
+        password: config.password,
+        baseUrl: config.baseUrl,
+        headless: config.headless,
+        requestMfaCode,
+    };
     if (isSunyBrightspace(config.baseUrl)) {
         return new SunySSOFlow({ ...credentials, campus: config.campus });
     }

package/build/auth/sso-flow.js.map

@@ -1 +1 @@
-{"version":3,"file":"sso-flow.js","sourceRoot":"","sources":["../../src/auth/sso-flow.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAY/D;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,MAAiB;IAC7C,MAAM,WAAW,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;IAE7E,IAAI,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,WAAW,CAAC,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,IAAI,aAAa,CAAC,WAAW,CAAC,CAAC;AACxC,CAAC"}
+{"version":3,"file":"sso-flow.js","sourceRoot":"","sources":["../../src/auth/sso-flow.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAIpD,MAAM,OAAO,8BAA+B,SAAQ,gBAAgB;IACzD,IAAI,GAAG,kBAAkB,CAAC;IACnC,YAAY,OAAe,EAAE,KAAa;QACxC,KAAK,CAAC,OAAO,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AAED,MAAM,OAAO,gBAAiB,SAAQ,gBAAgB;IAC3C,IAAI,GAAG,iBAAiB,CAAC;IAClC,YAAY,KAAa;QACvB,KAAK,CAAC,yDAAyD,YAAY,YAAY,EAAE,cAAc,EAAE,KAAK,CAAC,CAAC;QAChH,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAcD;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,MAAiB,EAAE,cAA+B;IAC9E,MAAM,WAAW,GAAG;QAClB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,cAAc;KACf,CAAC;IAEF,IAAI,iBAAiB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,OAAO,IAAI,WAAW,CAAC,EAAE,GAAG,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,IAAI,aAAa,CAAC,WAAW,CAAC,CAAC;AACxC,CAAC"}

package/build/auth/suny-sso.d.ts

@@ -1,14 +1,17 @@
 /**
  * Brightspace MCP Server
  * Copyright (c) 2026 Rohan Muppa. All rights reserved.
- * Licensed under MIT — see LICENSE file for details.
+ * Licensed under MIT : see LICENSE file for details.
  */
 import type { Page } from "playwright";
+import type { RequestMfaCode } from "./sso-flow.js";
 interface SunySSOConfig {
     username?: string;
     password?: string;
     /** Campus name or numeric code, matched against SUNY's own dropdown. */
     campus?: string;
+    headless?: boolean;
+    requestMfaCode?: RequestMfaCode;
 }
 /** True for the shared SUNY Brightspace instance. */
 export declare function isSunyBrightspace(baseUrl: string): boolean;
@@ -26,8 +29,9 @@ export declare class SunySSOFlow {
     private defaultFlow;
     constructor(config: SunySSOConfig);
     hasCredentials(): boolean;
+    prepareLogin(page: Page): Promise<void>;
+    identifyAccount(page: Page): Promise<boolean>;
     login(page: Page): Promise<boolean>;
-    manualLogin(page: Page): Promise<boolean>;
     /**
      * Brightspace's own campus selector renders its buttons in a shadow DOM, so
      * go straight to the SAML endpoint that selector would have reached.

package/build/auth/suny-sso.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"suny-sso.d.ts","sourceRoot":"","sources":["../../src/auth/suny-sso.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAcvC,UAAU,aAAa;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAOD,qDAAqD;AACrD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAM1D;AAcD;;;;;;;;GAQG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,WAAW,CAAgB;gBAEvB,MAAM,EAAE,aAAa;IAQjC,cAAc,IAAI,OAAO;IAInB,KAAK,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAWnC,WAAW,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAY/C;;;OAGG;YACW,cAAc;IAY5B;;;OAGG;YACW,YAAY;IAwC1B;;;;OAIG;IACH,OAAO,CAAC,UAAU;CAUnB"}
+{"version":3,"file":"suny-sso.d.ts","sourceRoot":"","sources":["../../src/auth/suny-sso.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAIvC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAYpD,UAAU,aAAa;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAOD,qDAAqD;AACrD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAM1D;AAcD;;;;;;;;GAQG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,WAAW,CAAgB;gBAEvB,MAAM,EAAE,aAAa;IAWjC,cAAc,IAAI,OAAO;IAInB,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAKvC,eAAe,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAI7C,KAAK,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC;IAUzC;;;OAGG;YACW,cAAc;IAY5B;;;OAGG;YACW,YAAY;IAmC1B;;;;OAIG;IACH,OAAO,CAAC,UAAU;CAUnB"}

package/build/auth/suny-sso.js

@@ -1,10 +1,11 @@
 /**
  * Brightspace MCP Server
  * Copyright (c) 2026 Rohan Muppa. All rights reserved.
- * Licensed under MIT — see LICENSE file for details.
+ * Licensed under MIT : see LICENSE file for details.
  */
 import { PurdueSSOFlow } from "./purdue-sso.js";
 import { log } from "../utils/logger.js";
+import { UnsupportedAuthenticationError } from "./sso-flow.js";
 /** SUNY campuses share one Brightspace tenant behind one Shibboleth IdP. */
 const SUNY_BRIGHTSPACE_HOST = "mylearning.suny.edu";
 const SUNY_IDP_ENTITY_ID = "https://idm.suny.edu/shibboleth/idp/";
@@ -51,34 +52,31 @@ export class SunySSOFlow {
         this.defaultFlow = new PurdueSSOFlow({
             username: config.username,
             password: config.password,
+            baseUrl: `https://${SUNY_BRIGHTSPACE_HOST}`,
+            headless: config.headless,
+            requestMfaCode: config.requestMfaCode,
         });
     }
     hasCredentials() {
         return this.defaultFlow.hasCredentials();
     }
+    async prepareLogin(page) {
+        await this.startSamlLogin(page);
+        await this.selectCampus(page);
+    }
+    async identifyAccount(page) {
+        return this.defaultFlow.identifyAccount(page);
+    }
     async login(page) {
         try {
             await this.startSamlLogin(page);
             await this.selectCampus(page);
         }
         catch (error) {
-            log("ERROR", "SUNY campus selection failed", error);
-            return false;
+            throw new UnsupportedAuthenticationError("SUNY campus selection could not complete headlessly. Run brightspace-mcp-server setup --suny and select a campus.", error);
         }
         return this.defaultFlow.login(page);
     }
-    async manualLogin(page) {
-        try {
-            // Clear the shadow-DOM selector and, when configured, the campus
-            // dropdown, so the user lands directly on their campus sign-in page.
-            await this.startSamlLogin(page);
-            await this.selectCampus(page);
-        }
-        catch (error) {
-            log("DEBUG", "Could not pre-fill SUNY campus selection", error);
-        }
-        return this.defaultFlow.manualLogin(page);
-    }
     /**
      * Brightspace's own campus selector renders its buttons in a shadow DOM, so
      * go straight to the SAML endpoint that selector would have reached.
@@ -88,7 +86,7 @@ export class SunySSOFlow {
         if (!currentUrl.includes("/d2l/login"))
             return;
         const origin = new URL(currentUrl).origin;
-        log("INFO", "Campus selector detected — navigating directly to SUNY's SAML endpoint");
+        log("INFO", "Campus selector detected : navigating directly to SUNY's SAML endpoint");
         await page.goto(`${origin}/d2l/lp/auth/saml/initiate-login?entityId=${SUNY_IDP_ENTITY_ID}`, { waitUntil: "domcontentloaded", timeout: 30000 });
     }
     /**
@@ -104,7 +102,7 @@ export class SunySSOFlow {
             await page.waitForSelector(SELECTORS.campusSelect, { timeout: 45000 });
         }
         catch {
-            log("DEBUG", "No SUNY campus dropdown found — continuing to the sign-in form");
+            log("DEBUG", "No SUNY campus dropdown found : continuing to the sign-in form");
             return;
         }
         const options = await page.$$eval(`${SELECTORS.campusSelect} option`, (nodes) => nodes
@@ -114,16 +112,11 @@ export class SunySSOFlow {
         }))
             .filter((option) => option.value !== ""));
         if (!this.config.campus) {
-            log("WARN", "No campus configured — choose your campus in the browser window.");
-            log("INFO", "Set one with: brightspace-mcp-server setup --suny");
-            return;
+            throw new UnsupportedAuthenticationError("No SUNY campus configured. Run brightspace-mcp-server setup --suny.");
         }
         const match = this.findCampus(options);
         if (!match) {
-            log("WARN", `Campus "${this.config.campus}" did not match any SUNY campus.`);
-            log("INFO", `Available: ${options.map((o) => o.label).join(", ")}`);
-            log("WARN", "Choose your campus in the browser window to continue.");
-            return;
+            throw new UnsupportedAuthenticationError(`Configured campus did not match SUNY. Available campuses: ${options.map((o) => o.label).join(", ")}`);
         }
         log("INFO", `Selecting campus ${match.label} (${match.value})`);
         await page.selectOption(SELECTORS.campusSelect, match.value);