brightspace-mcp-server 3.13.4 → 3.13.7

package/build/auth/auth-runner.js

@@ -4,6 +4,7 @@
  * Licensed under MIT — see LICENSE file for details.
  */
 import { spawn, execFileSync } from "node:child_process";
+import * as fs from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 import * as path from "node:path";
 import { log } from "../utils/logger.js";
@@ -11,7 +12,7 @@ import { AuthError } from "../utils/errors.js";
 import { AUTH_COMMAND } from "../utils/commands.js";
 import { devActivity } from "../utils/dev-activity.js";
 import { parsePhaseMarker } from "./auth-phases.js";
-import { AUTOMATIC_PENDING_MARKER, authLockPath, challengeRelayedAt } from "./mfa-challenge.js";
+import { AUTOMATIC_PENDING_MARKER, RELAYED_CHALLENGE_MARKER, authLockPath, challengeRelayedAt, relayChallenge } from "./mfa-challenge.js";
 /**
  * Timeout for the auth process. It has to outlast the child's own MFA wait,
  * which is five minutes: a person has to find their phone, unlock it, and read
@@ -53,6 +54,20 @@ const CALL_BUDGET_MS = 55000;
  * from another one) means nobody is approving.
  */
 const ABANDON_MS = MFA_POLL_MS;
+/**
+ * How often a caller waiting on ANOTHER process's sign-in looks at the lock.
+ * Each look also touches the challenge file (relayChallenge), which tells that
+ * process's abandonment watcher someone still wants its sign-in. It has to
+ * stay well under ABANDON_MS.
+ */
+const RELAY_POLL_MS = 1000;
+/**
+ * How long a relayed challenge stays "already told to a caller" for the rule
+ * that only a RETRY waits on another process's sign-in. The MFA window is five
+ * minutes, so a number reported longer ago than that belongs to a sign-in that
+ * is over; the same digits showing up again are a new challenge.
+ */
+const RELAY_TOLD_MS = 5 * 60 * 1000;
 /**
  * Calls arriving within this long of a batch's first call count as that batch
  * (issue #212). A client running tool calls in parallel sends them within
@@ -95,11 +110,12 @@ function mfaPendingFailure(numberMatch) {
  * on anyone's phone to approve, so a caller told "approve the request" would
  * send the user looking for a prompt that will never arrive.
  */
-const automaticPendingFailure = () => new AuthProcessError("automaticPending", "Sign-in is entering its own verification code in the background. Try again.");
+const automaticPendingFailure = (relayed = false) => new AuthProcessError("automaticPending", "Sign-in is entering its own verification code in the background. Try again.", undefined, false, relayed);
 export class AuthProcessError extends AuthError {
     kind;
     numberMatch;
     duplicate;
+    relayed;
     constructor(kind, message, 
     /**
      * Entra number-match digits, when the failure is "mfaPending". Crossed
@@ -113,11 +129,19 @@ export class AuthProcessError extends AuthError {
      * challenge to the user (issue #212), so this one should answer briefly
      * instead of repeating the number and the instructions.
      */
-    duplicate = false) {
+    duplicate = false, 
+    /**
+     * The challenge belongs to a sign-in in ANOTHER server process that holds
+     * the cross-process lock; this process's child only relayed it and
+     * exited. There is no local child to join, so a caller that wants to
+     * keep waiting watches the lock instead (see AuthRunner.attendRelay).
+     */
+    relayed = false) {
         super(message);
         this.kind = kind;
         this.numberMatch = numberMatch;
         this.duplicate = duplicate;
+        this.relayed = relayed;
         this.name = "AuthProcessError";
     }
 }
@@ -197,8 +221,10 @@ function dedupeChallenge(error, wave) {
         wave.closed = true;
         return error;
     }
-    return new AuthProcessError(error.kind, error.message, error.numberMatch, true);
+    return new AuthProcessError(error.kind, error.message, error.numberMatch, true, error.relayed);
 }
+/** Identifies a challenge for "was this already reported to a caller". */
+const relayKey = (kind, numberMatch) => `${kind}:${numberMatch ?? ""}`;
 export class AuthRunner {
     /**
      * The login this process already started, if one is still running.
@@ -237,6 +263,12 @@ export class AuthRunner {
      * childDone; this only stops every call in the batch repeating the number.
      */
     wave = null;
+    /**
+     * Challenges another process's sign-in is showing that a caller here was
+     * already told, by relayKey, and when. A retry of one of these waits on
+     * that sign-in instead of repeating the answer (see attendRelay).
+     */
+    relayTold = new Map();
     scriptPath;
     timeoutMs;
     onProgress;
@@ -268,11 +300,16 @@ export class AuthRunner {
     async run(onChallenge) {
         // Synchronous, before any await: calls in one tick cannot split a batch.
         const wave = this.joinWave();
+        // Also synchronous: what was already told BEFORE this call, so siblings in
+        // one parallel batch are not each other's "retry" (they answer briefly via
+        // dedupeChallenge instead of waiting).
+        const toldBefore = this.relayChallengesTold();
         this.waiting += 1;
         try {
-            return await this.attend(onChallenge);
+            return await this.attend(onChallenge, toldBefore);
         }
         catch (error) {
+            this.noteRelayReported(error);
             throw dedupeChallenge(error, wave);
         }
         finally {
@@ -280,6 +317,25 @@ export class AuthRunner {
             this.lastAttendedAt = Date.now();
         }
     }
+    relayChallengesTold() {
+        const now = Date.now();
+        const told = new Set();
+        for (const [key, at] of this.relayTold) {
+            if (now - at > RELAY_TOLD_MS)
+                this.relayTold.delete(key);
+            else
+                told.add(key);
+        }
+        return told;
+    }
+    /** A relayed challenge that went back to a caller counts as told. */
+    noteRelayReported(error) {
+        if (!(error instanceof AuthProcessError) || !error.relayed)
+            return;
+        if (error.kind !== "mfaPending" && error.kind !== "automaticPending")
+            return;
+        this.relayTold.set(relayKey(error.kind, error.numberMatch), Date.now());
+    }
     joinWave() {
         const now = Date.now();
         if (!this.wave || this.wave.closed || now - this.wave.openedAt > WAVE_MS) {
@@ -287,12 +343,15 @@ export class AuthRunner {
         }
         return this.wave;
     }
-    async attend(onChallenge) {
+    async attend(onChallenge, toldBefore) {
         const startedAt = Date.now();
         try {
             return await withinCallBudget(this.runOnce(startedAt), startedAt);
         }
         catch (error) {
+            if (this.sessionDir && error instanceof AuthProcessError && error.relayed) {
+                return this.attendRelay(error, startedAt, onChallenge, toldBefore);
+            }
             const childDone = this.childDone;
             if (!childDone || !(error instanceof AuthProcessError))
                 throw error;
@@ -314,6 +373,86 @@ export class AuthRunner {
             return this.awaitBackgroundChild(childDone, windowMs);
         }
     }
+    /**
+     * The caller's sign-in found ANOTHER process's sign-in holding the lock,
+     * and that process is showing a challenge. The local child has already
+     * exited, so unlike awaitBackgroundChild there is nothing here to join:
+     * the lock is the only thing to watch.
+     *
+     * The first answer is still immediate for a caller that cannot be told
+     * mid-call, because the number is what the user needs and every second
+     * before it is a second the other sign-in's window runs down. A RETRY of the
+     * same challenge (already reported to a caller in this process) waits, like
+     * a retry joining a local child, instead of re-answering at once: answering
+     * a loop of retries in milliseconds made a model conclude the approval
+     * window had closed while the other sign-in was still waiting. A caller
+     * that can be told mid-call is told and waits at once, and an owner
+     * answering its own code has nothing to relay, so every caller waits.
+     */
+    attendRelay(error, startedAt, onChallenge, toldBefore) {
+        const retry = toldBefore.has(relayKey(error.kind, error.numberMatch));
+        const waits = error.kind === "automaticPending"
+            || (error.kind === "mfaPending" && (Boolean(onChallenge) || retry));
+        if (!waits)
+            throw error;
+        const windowMs = pollWindowMs(Date.now() - startedAt);
+        if (windowMs <= 0)
+            throw error;
+        if (error.kind === "mfaPending" && onChallenge) {
+            try {
+                onChallenge(error.numberMatch);
+            }
+            catch { /* Announcing must not interrupt authentication. */ }
+            this.noteRelayReported(error);
+        }
+        return this.awaitRelayedOwner(error, windowMs);
+    }
+    /**
+     * Wait up to windowMs for another process's sign-in to finish, by watching
+     * its lock directory about once a second.
+     *
+     * Each look also relays the challenge, which touches its file: that is the
+     * signal the owner's abandonment watcher (ABANDON_MS) reads as "someone is
+     * still waiting", so the owner is not killed under a user who is approving.
+     * The lock disappearing means the owner is done, and the caller resolves
+     * true so the client re-reads the session. If the owner FAILED there is no
+     * session, and the client's own "session expired" 401 follows; the next call
+     * starts a fresh sign-in and gets the owner's cooldown or error as usual.
+     * Spawning another sign-in here instead would risk a second MFA prompt for
+     * a login that just succeeded. When the window ends with the lock still
+     * held, the caller gets the latest challenge the owner showed.
+     */
+    async awaitRelayedOwner(error, windowMs) {
+        const lockPath = authLockPath(this.sessionDir);
+        const deadline = Date.now() + windowMs;
+        let latest = {
+            automatic: error.kind === "automaticPending",
+            numberMatch: error.numberMatch,
+        };
+        for (;;) {
+            const held = await fs.access(lockPath).then(() => true, () => false);
+            if (!held) {
+                this.relayTold.clear();
+                return true;
+            }
+            const relayed = await relayChallenge(lockPath);
+            if (relayed) {
+                latest = relayed.kind === "automatic"
+                    ? { automatic: true }
+                    : { automatic: false, numberMatch: relayed.numberMatch ?? (latest.automatic ? undefined : latest.numberMatch) };
+            }
+            const remaining = deadline - Date.now();
+            if (remaining <= 0)
+                break;
+            await new Promise((resolve) => {
+                const timer = setTimeout(resolve, Math.min(RELAY_POLL_MS, remaining));
+                timer.unref?.();
+            });
+        }
+        if (latest.automatic)
+            throw automaticPendingFailure(true);
+        throw new AuthProcessError(...mfaPendingFailure(latest.numberMatch), latest.numberMatch, false, true);
+    }
     runOnce(startedAt) {
         if (this.inFlight) {
             log("DEBUG", "Joining the authentication already in flight");
@@ -429,6 +568,8 @@ export class AuthRunner {
             let childFinished = false;
             let numberMatch;
             let challengeSeen = false;
+            /** The child said the challenge it is about to print is another process's. */
+            let relayed = false;
             /** The child reported it is answering its own code (see the marker below). */
             let automaticSeen = false;
             /** watchAttention is armed once per child; a second timer could kill a live sign-in. */
@@ -542,7 +683,7 @@ export class AuthRunner {
                 if (firstChallenge)
                     resolveChallengeSignal();
                 if (!callerSettled) {
-                    settleCaller(new AuthProcessError(...mfaPendingFailure(this.pendingChallenge?.numberMatch), this.pendingChallenge?.numberMatch));
+                    settleCaller(new AuthProcessError(...mfaPendingFailure(this.pendingChallenge?.numberMatch), this.pendingChallenge?.numberMatch, false, relayed));
                 }
             };
             /**
@@ -558,7 +699,7 @@ export class AuthRunner {
                 this.pendingChallenge = { kind: "automaticPending" };
                 startWatching();
                 resolveChallengeSignal();
-                settleCaller(automaticPendingFailure());
+                settleCaller(automaticPendingFailure(relayed));
             };
             // Runs once the child is actually done. Settles the caller too, if an
             // early answer had not already done so; otherwise this is just the
@@ -621,6 +762,11 @@ export class AuthRunner {
                 else if (line === AUTOMATIC_PENDING_MARKER) {
                     publishAutomaticProgress();
                 }
+                else if (line === RELAYED_CHALLENGE_MARKER) {
+                    // Recorded as the line is read, so it is set before the challenge
+                    // marker that follows it settles the caller.
+                    relayed = true;
+                }
                 else {
                     log("DEBUG", line);
                 }
@@ -662,7 +808,8 @@ export class AuthRunner {
                         failures[2] = ["automaticPending", automaticPendingFailure().message];
                     const [kind, message] = failures[code ?? -1] ?? ["failed", `Authentication failed. Run ${AUTH_COMMAND} to try again.`];
                     kill("SIGKILL");
-                    finishChild(new AuthProcessError(kind, message, kind === "mfaPending" ? numberMatch : undefined));
+                    const challenged = kind === "mfaPending" || kind === "automaticPending";
+                    finishChild(new AuthProcessError(kind, message, kind === "mfaPending" ? numberMatch : undefined, false, relayed && challenged));
                 }
             });
         });

package/build/auth/mfa-challenge.js

@@ -77,6 +77,15 @@ export function challengeRelayedAt(lockPath) {
  * beside challengeMarker so the child and AuthRunner cannot drift apart.
  */
 export const AUTOMATIC_PENDING_MARKER = "AUTH_AUTOMATIC_PENDING";
+/**
+ * Printed on the line before a challenge marker when the challenge is another
+ * process's, relayed from the lock directory, rather than this child's own.
+ * The parent then knows its caller is waiting on a sign-in it does not own,
+ * which it can only watch through the lock (see AuthRunner.awaitRelayedOwner).
+ * The child is always the same build as the parent, so no negotiation is
+ * needed.
+ */
+export const RELAYED_CHALLENGE_MARKER = "AUTH_RELAYED";
 /** The stdout marker AuthRunner parses for a challenge. */
 export function challengeMarker(numberMatch) {
     return numberMatch ? `MFA_NUMBER:${numberMatch}` : "MFA_PENDING";

package/build/auth-cli.js

@@ -12,7 +12,7 @@ import { NativeCredentialStoreError } from "./auth/credential-store.js";
 import { retireLegacyProfile } from "./auth/legacy-profile.js";
 import { formatPhaseMarker } from "./auth/auth-phases.js";
 import { AuthenticationInProgressError } from "./auth/auth-lock.js";
-import { AUTOMATIC_PENDING_MARKER, challengeMarker } from "./auth/mfa-challenge.js";
+import { AUTOMATIC_PENDING_MARKER, RELAYED_CHALLENGE_MARKER, challengeMarker } from "./auth/mfa-challenge.js";
 import { runLogout } from "./auth/logout.js";
 import { configureDevActivity } from "./utils/dev-activity.js";
 import { AUTH_COMMAND, SETUP_COMMAND } from "./utils/commands.js";
@@ -112,6 +112,7 @@ async function main() {
         // Another process's sign-in holds the lock and is showing a challenge:
         // pass it on, so this caller can tell its user what to approve.
         if (automatic && error instanceof AuthenticationInProgressError && error.challenge) {
+            console.log(RELAYED_CHALLENGE_MARKER);
             console.log(error.challenge.kind === "automatic"
                 ? AUTOMATIC_PENDING_MARKER
                 : challengeMarker(error.challenge.numberMatch));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "3.13.4",
+  "version": "3.13.7",
   "mcpName": "io.github.RohanMuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",