brightspace-mcp-server 3.10.16 → 3.11.0

package/README.md

@@ -95,7 +95,7 @@ All optional, set in your AI app's MCP `env` config or your shell. The full list
 
 | Setting | What it does |
 |---------|--------------|
-| `D2L_REMEMBER_MFA=true` | Tick Microsoft's "Don't ask again" box so later sign-ins skip the second factor (off by default; not for shared computers) |
+| `D2L_REMEMBER_MFA=true` | Tick Microsoft's "Don't ask again" box so later sign-ins skip the second factor (off by default; not for shared computers). `setup` asks this and saves it as `rememberMfa` in `config.json`; the env var overrides it |
 | `D2L_HEADLESS=false` | Show the browser window during sign-in, for MFA methods that need a click |
 | `D2L_DUO_PASSCODE=1` | On Duo, type a passcode instead of waiting for a push |
 | `D2L_SESSION_COOKIE` / `D2L_ACCESS_TOKEN` | Skip the browser entirely with a pasted cookie or token ([how](docs/sign-in.md#no-browser-paste-a-session-cookie-or-token)) |

package/build/setup.js

@@ -355,6 +355,8 @@ export function buildConfigToSave(existing, answers) {
         password: answers.password,
         headless: answers.headless,
     };
+    if (answers.rememberMfa !== undefined)
+        config.rememberMfa = answers.rememberMfa;
     if (answers.campus)
         config.campus = answers.campus;
     return config;
@@ -484,8 +486,11 @@ async function main() {
     console.log("    1. I approve on my phone, or I type a code from an authenticator app (recommended)");
     console.log("    2. Something else — open a browser window I can use");
     let savedHeadless;
+    let savedRememberMfa;
     try {
-        savedHeadless = configStoreExists() ? loadConfigStore().headless : undefined;
+        const saved = configStoreExists() ? loadConfigStore() : undefined;
+        savedHeadless = saved?.headless;
+        savedRememberMfa = saved?.rememberMfa;
     }
     catch {
         // An invalid old config is replaced by the setup values below.
@@ -502,12 +507,26 @@ async function main() {
         ? "  Authentication will run without a browser window."
         : "  A browser window will open when authentication is needed."));
     console.log("");
+    // Opt-in only: a shared computer must never skip MFA unless asked to.
+    const defaultRemember = savedRememberMfa === true ? "yes" : "no";
+    let rememberAnswer = "";
+    while (!/^(y(es)?|no?)$/i.test(rememberAnswer)) {
+        rememberAnswer = await ask(rl2, `  Remember this device so later sign-ins can skip the second factor? Not for shared computers. (yes/no) [${defaultRemember}]: `) || defaultRemember;
+        if (!/^(y(es)?|no?)$/i.test(rememberAnswer))
+            console.log(yellow("  Please enter yes or no."));
+    }
+    const rememberMfa = /^y/i.test(rememberAnswer);
+    console.log(dim(rememberMfa
+        ? "  Later sign-ins will ask Microsoft not to repeat the second factor on this device."
+        : "  Every sign-in will ask for the second factor."));
+    console.log("");
     // ── Step 5: Save config ──────────────────────────────────────────
     const config = buildConfigToSave(readExistingConfig(), {
         baseUrl,
         username,
         password,
         headless,
+        rememberMfa,
         campus: campus || undefined,
     });
     await saveSecureConfig(config);

package/build/utils/config.js

@@ -48,9 +48,11 @@ export async function loadConfig() {
         ?? store?.headless
         ?? true;
     // Opt-in: ask Microsoft to skip the second factor for its "Don't ask again"
-    // window. Off unless D2L_REMEMBER_MFA=true, so a shared machine never
-    // remembers MFA without the user choosing it.
-    const rememberMfa = envBoolean(process.env.D2L_REMEMBER_MFA, "D2L_REMEMBER_MFA") ?? false;
+    // window. Off unless the user said yes in setup or set D2L_REMEMBER_MFA=true,
+    // so a shared machine never remembers MFA without the user choosing it.
+    const rememberMfa = envBoolean(process.env.D2L_REMEMBER_MFA, "D2L_REMEMBER_MFA")
+        ?? store?.rememberMfa
+        ?? false;
     // Resolve tokenTtl: env > store > default (3600)
     const tokenTtl = positiveSeconds(process.env.D2L_TOKEN_TTL, "D2L_TOKEN_TTL")
         ?? positiveSeconds(store?.tokenTtl, "tokenTtl in config.json")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "3.10.16",
+  "version": "3.11.0",
   "mcpName": "io.github.RohanMuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",