brightspace-mcp-server 3.7.0 → 3.7.2

package/README.md

@@ -105,6 +105,8 @@ Run it from your home folder. On macOS, a terminal that lacks Files and Folders
 
 **MFA at Purdue** commonly uses Microsoft Authenticator number matching (some schools use Duo instead). When a sign-in needs it, the tool call itself returns quickly with the number to enter, rather than sitting silent for up to five minutes — approve it on your phone, then call the tool again; sign-in finishes in the background in the meantime. Google Authenticator and other one-time-code apps work too, with no setting to change: run the auth command above in a terminal and it prompts for the code when your provider asks for one. Pick the visible-browser option during setup only if your identity provider needs interaction the server cannot drive. The MCP also sends authentication progress as logging notifications to clients that display them, useful if you don't see the number in the tool response for some reason.
 
+**On a Duo tenant**, if Duo asks "Is this your device?" before it will send a push, automatic sign-in answers **yes** so the push can go out at all — a headless run has nobody to click it otherwise. That also makes Duo remember the device, which skips its own device check on later logins from this machine. Don't run automatic sign-in on a shared or public computer if you'd rather Duo keep asking. Setting `D2L_DUO_PASSCODE` to any value switches from waiting for a push to typing a code from Duo Mobile's passcode option instead.
+
 ## What You Can Ask About
 
 | Topic | Examples |

package/build/auth/browser-auth.js

@@ -19,7 +19,11 @@ const SILENT_SSO_POLL_MS = 1000;
 const INITIAL_NAVIGATION_TIMEOUT_MS = 60000;
 const VISIBLE_LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
 const SILENT_SSO = {
-    emailFields: ["input[type=email]", "input[name=loginfmt]"],
+    // Kept in sync with purdue-sso.ts's EMAIL_SELECTORS: awaitSilentSSO gates on
+    // this list before ever calling into that file, so a two-step Shibboleth/CAS
+    // IdP whose username field only matches j_username or #signinid would never
+    // get past this gate otherwise.
+    emailFields: ["input[type=email]", "input[name=loginfmt]", "input[name=j_username]", "input#signinid"],
     credentialFields: ['input#username', 'input#userName', 'input[type="password"]'],
     mfaChallenges: ["#idRichContext_DisplaySign", "#idDiv_SAOTCAS_Title", "#idDiv_SAOTCC_Title"],
     campusSaml: 'a[href*="/d2l/lp/auth/saml/initiate-login"]',

package/build/auth/duo-mfa.js

@@ -30,6 +30,8 @@ const PROMPT_SCOPE_SELECTORS = [
     "main",
     "body",
 ];
+/** Duo's own passcode field, which its Universal Prompt labels inconsistently. */
+const PASSCODE_INPUT_SELECTORS = ["#passcode-input", 'input[name="passcode"]'];
 /** The digits on a visible element, or null when it is absent or not digits. */
 async function readCodeFrom(target) {
     if (!await target.isVisible().catch(() => false))
@@ -53,6 +55,11 @@ export class DuoMfaHandler {
     approvalAnnounced = false;
     verificationCodeAnnounced = null;
     passcodeSubmitted = false;
+    /** True once Duo's remembered-device question has been answered this login. */
+    deviceQuestionAnswered = false;
+    /** Step guards for walking Duo's "Other options" menu to the passcode field. */
+    otherOptionsClicked = false;
+    passcodeChoiceClicked = false;
     /** True once onMfaChallenge has been told about this login, code or not. */
     announcedToCaller = false;
     constructor(options) {
@@ -61,10 +68,80 @@ export class DuoMfaHandler {
     isChallenge(page) {
         return isDuoPrompt(page);
     }
+    /**
+     * Some tenants gate the push behind a remembered-device question ("Is this
+     * your device?") that nothing proceeds past until it is answered. A headless
+     * run has nobody to click it, so the whole login stalls until the five-minute
+     * MFA deadline expires. Answering yes also makes Duo remember this device,
+     * which is what an unattended client wants.
+     */
+    async answerDeviceQuestion(page) {
+        if (this.deviceQuestionAnswered)
+            return false;
+        const candidates = [
+            page.getByRole("button", { name: /yes.*this is my device/i }).first(),
+            page.locator("button", { hasText: /yes.*this is my device/i }).first(),
+        ];
+        for (const candidate of candidates) {
+            if (!await candidate.isVisible().catch(() => false))
+                continue;
+            this.deviceQuestionAnswered = true;
+            log("INFO", "Answered Duo's remembered-device question with yes.");
+            await candidate.click().catch(() => { });
+            return true;
+        }
+        return false;
+    }
+    /** Duo's passcode field, whichever of its shapes is on screen. */
+    async passcodeInput(page) {
+        for (const selector of PASSCODE_INPUT_SELECTORS) {
+            const target = page.locator(selector).first();
+            if (await target.isVisible().catch(() => false))
+                return target;
+        }
+        const byRole = page.getByRole("textbox", { name: /passcode|verification code/i }).first();
+        return await byRole.isVisible().catch(() => false) ? byRole : null;
+    }
+    /**
+     * Duo opens on "Check for a Duo Push" and keeps the passcode field behind its
+     * "Other options" menu ("Select an option to log in" -> "Duo Mobile
+     * passcode"). Walking that path makes sign-in independent of push delivery
+     * and of the device Duo happens to pick. Each step is clicked at most once,
+     * so a re-render cannot bounce the page back and forth.
+     */
+    async openPasscodeEntry(page) {
+        if (await this.passcodeInput(page))
+            return;
+        if (!this.otherOptionsClicked) {
+            const other = page.getByRole("button", { name: /other options/i }).first();
+            if (await other.isVisible().catch(() => false)) {
+                this.otherOptionsClicked = true;
+                log("INFO", "Opening Duo's Other options menu for a passcode.");
+                await other.click().catch(() => { });
+                await page.waitForTimeout(1500);
+            }
+        }
+        if (this.passcodeChoiceClicked)
+            return;
+        const choice = page.getByRole("button", { name: /duo mobile passcode/i }).first();
+        if (await choice.isVisible().catch(() => false)) {
+            this.passcodeChoiceClicked = true;
+            log("INFO", "Choosing Duo Mobile passcode entry.");
+            await choice.click().catch(() => { });
+            await page.waitForTimeout(1500);
+        }
+    }
     /** Returns true while the page is on a Duo challenge. */
     async handle(page) {
         if (!this.isChallenge(page))
             return false;
+        // Answer before announcing the push: on a gated tenant no push is sent
+        // until this is answered, so announcing first would be a lie.
+        await this.answerDeviceQuestion(page);
+        // Opt-in, because it replaces a push with a typed code: without it a tenant
+        // whose pushes work keeps the zero-touch path.
+        if (process.env.D2L_DUO_PASSCODE)
+            await this.openPasscodeEntry(page);
         const verificationCode = await this.readVerificationCode(page);
         if (!this.approvalAnnounced) {
             this.approvalAnnounced = true;
@@ -126,8 +203,8 @@ export class DuoMfaHandler {
     async submitPasscode(page) {
         if (this.options.headless === false || this.passcodeSubmitted)
             return;
-        const input = page.getByRole("textbox", { name: /passcode|verification code/i }).first();
-        if (!await input.isVisible().catch(() => false))
+        const input = await this.passcodeInput(page);
+        if (!input)
             return;
         if (!this.options.requestMfaCode) {
             throw new UnsupportedAuthenticationError(`Duo requires a passcode. Run \`${AUTH_COMMAND}\` in a terminal to enter it.`);

package/build/auth/purdue-sso.js

@@ -8,7 +8,9 @@ import { log } from "../utils/logger.js";
 import { MfaApprovalError, UnsupportedAuthenticationError } from "./sso-flow.js";
 import { DuoMfaHandler } from "./duo-mfa.js";
 import { AUTH_COMMAND } from "../utils/commands.js";
-const EMAIL_SELECTORS = ["input[type=email]", "input[name=loginfmt]"];
+// Entra names its username field type=email/loginfmt; Shibboleth portals (USC's
+// login.usc.edu among them) use the protocol's j_username.
+const EMAIL_SELECTORS = ["input[type=email]", "input[name=loginfmt]", "input[name=j_username]", "input#signinid"];
 const PASSWORD_SELECTORS = ["input[type=password]", "input[name=passwd]"];
 const SUBMIT_SELECTORS = ["#idSIButton9", "input[type=submit]", "button[type=submit]"];
 const FIELD_TIMEOUT_MS = 30_000;
@@ -57,6 +59,14 @@ export class PurdueSSOFlow {
         const email = signInName(this.config.username, this.config.baseUrl);
         if (!await this.fillWhenReady(page, EMAIL_SELECTORS, email))
             return false;
+        // Reached via awaitSilentSSO, a single-page IdP (see enterCredentials)
+        // renders its password field next to the username too. Clicking submit
+        // without filling it first would post an empty password and burn the
+        // attempt, so detect and handle it here the same way.
+        if (this.config.password && await this.hasCoVisiblePassword(page)) {
+            if (!await this.fillWhenReady(page, PASSWORD_SELECTORS, this.config.password))
+                return false;
+        }
         if (!await this.clickWhenReady(page, SUBMIT_SELECTORS))
             return false;
         this.accountHintSubmitted = true;
@@ -125,17 +135,34 @@ export class PurdueSSOFlow {
         if (!hintAccepted) {
             const email = signInName(this.config.username, this.config.baseUrl);
             if (!await this.fillWhenReady(page, EMAIL_SELECTORS, email)) {
-                throw new UnsupportedAuthenticationError("The Microsoft email field did not appear. Automatic sign-in cannot continue.");
+                throw new UnsupportedAuthenticationError("The identity provider's username field did not appear. Automatic sign-in cannot continue.");
+            }
+            // A single-page identity provider (Shibboleth portals such as USC's
+            // login.usc.edu) renders the password field next to the username. Clicking
+            // submit between the two would post an empty password and spend the
+            // attempt, so fill both and click once. Entra can also flash a
+            // password-shaped decoy for a single instant while its email view is
+            // still initializing (see awaitSilentSSO's passwordPromptPolls in
+            // browser-auth.ts), so this only takes the single-page branch once the
+            // field survives two consecutive checks.
+            if (await this.hasCoVisiblePassword(page)) {
+                if (!await this.fillWhenReady(page, PASSWORD_SELECTORS, this.config.password)) {
+                    throw new UnsupportedAuthenticationError("The identity provider's password field did not appear. Automatic sign-in cannot continue.");
+                }
+                if (!await this.clickWhenReady(page, SUBMIT_SELECTORS)) {
+                    throw new UnsupportedAuthenticationError("The identity provider's submit button did not appear. Automatic sign-in cannot continue.");
+                }
+                return;
             }
             if (!await this.clickWhenReady(page, SUBMIT_SELECTORS)) {
-                throw new UnsupportedAuthenticationError("The Microsoft email submit button did not appear. Automatic sign-in cannot continue.");
+                throw new UnsupportedAuthenticationError("The identity provider's username submit button did not appear. Automatic sign-in cannot continue.");
             }
         }
         if (!await this.fillWhenReady(page, PASSWORD_SELECTORS, this.config.password)) {
-            throw new UnsupportedAuthenticationError("The Microsoft password field did not appear. Automatic sign-in cannot continue.");
+            throw new UnsupportedAuthenticationError("The identity provider's password field did not appear. Automatic sign-in cannot continue.");
         }
         if (!await this.clickWhenReady(page, SUBMIT_SELECTORS)) {
-            throw new UnsupportedAuthenticationError("The Microsoft password submit button did not appear. Automatic sign-in cannot continue.");
+            throw new UnsupportedAuthenticationError("The identity provider's password submit button did not appear. Automatic sign-in cannot continue.");
         }
     }
     /** Ported from Brightspace Bar's proven four-step Entra choreography. */
@@ -168,6 +195,22 @@ export class PurdueSSOFlow {
         }
         return false;
     }
+    /**
+     * True only when the password field is visible on two consecutive checks.
+     * Entra can transiently show a password-shaped control for a single
+     * instant while its email view is still initializing (documented next to
+     * awaitSilentSSO's `passwordPromptPolls` in browser-auth.ts); trusting one
+     * instantaneous observation can fill that decoy and click Next, leaving
+     * Entra's real password page never filled. A genuinely single-page IdP
+     * (Shibboleth portals such as USC's login.usc.edu) keeps the field on
+     * screen, so it survives the second check.
+     */
+    async hasCoVisiblePassword(page) {
+        if (!await this.anyVisible(page, PASSWORD_SELECTORS))
+            return false;
+        await page.waitForTimeout(FIELD_POLL_MS);
+        return await this.anyVisible(page, PASSWORD_SELECTORS);
+    }
     async hasPostCredentialChallenge(page) {
         return this.duoMfa.isChallenge(page) || await this.anyVisible(page, [
             NUMBER_MATCH_SELECTOR,
@@ -216,6 +259,9 @@ export class PurdueSSOFlow {
                     return;
                 }
                 await this.clickProvenKmsi(page);
+                // The federated-domain trust prompt arrives after the IdP succeeds, so
+                // it has to be caught by this loop rather than by enterCredentials.
+                await this.clickTrustPrompt(page);
                 await page.waitForTimeout(NUMBER_MATCH_POLL_MS);
             }
         }
@@ -301,6 +347,60 @@ export class PurdueSSOFlow {
             log("DEBUG", 'Clicked Yes on "Stay signed in?"');
         }
     }
+    /**
+     * Microsoft asks users of a federated domain to confirm they trust it ("Do
+     * you trust usc.edu?") before issuing the SAML assertion to Brightspace.
+     * Nothing proceeds until Continue is clicked, and a headless run has nobody
+     * to click it, so the flow parks on this page until the MFA deadline and
+     * the session is never established. This dialog is an anti-login-CSRF
+     * control, not a nuisance interstitial, so it is not enough to notice the
+     * text is present somewhere on the page (`page.getByText()` is a whole-page
+     * substring search, not a heading-scoped match) — the domain named in the
+     * prompt is parsed out and compared against the domain this login is
+     * actually signing into. A mismatch (e.g. the browser was steered to a
+     * different tenant's confirmation) is left unclicked; the existing 5-minute
+     * MFA timeout is the safe failure mode for that, same as any other
+     * unhandled prompt.
+     */
+    async clickTrustPrompt(page) {
+        if (new URL(page.url()).hostname !== "login.microsoftonline.com")
+            return;
+        const prompt = page.getByText(/Do you trust/i).first();
+        if (!await prompt.isVisible().catch(() => false))
+            return;
+        const text = await prompt.textContent().catch(() => null);
+        const promptDomain = text ? this.extractTrustDomain(text) : null;
+        const expectedDomain = this.expectedTrustDomain();
+        if (!promptDomain || !expectedDomain || promptDomain !== expectedDomain) {
+            log("WARN", `Domain-trust prompt named "${promptDomain ?? "an unknown domain"}", which does not match the configured sign-in domain; not confirming trust automatically.`);
+            return;
+        }
+        const cont = page.getByRole("button", { name: /continue/i }).first();
+        if (!await cont.isVisible().catch(() => false))
+            return;
+        await cont.click().catch(() => { });
+        log("INFO", `Clicked Continue on Microsoft's domain-trust prompt for ${promptDomain}.`);
+    }
+    /** Pulls the domain Microsoft named out of "Do you trust <domain>?" text. */
+    extractTrustDomain(text) {
+        const match = text.match(/do you trust\s+([a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)+)/i);
+        return match ? match[1].toLowerCase() : null;
+    }
+    /** The domain this login is actually signing into, to check the trust prompt against. */
+    expectedTrustDomain() {
+        if (this.config.username) {
+            const email = signInName(this.config.username, this.config.baseUrl);
+            const at = email.lastIndexOf("@");
+            if (at !== -1)
+                return email.slice(at + 1).toLowerCase();
+        }
+        // Purdue's own tenant is federated to purdue.edu regardless of what the
+        // configured username looks like.
+        if (this.config.baseUrl && new URL(this.config.baseUrl).hostname.toLowerCase() === "purdue.brightspace.com") {
+            return "purdue.edu";
+        }
+        return null;
+    }
     /** The digits on screen, or null when Entra is not showing any. */
     async readNumberMatch(page) {
         const sign = page.locator(NUMBER_MATCH_SELECTOR).first();

package/build/tools/get-calendar-events.js

@@ -4,7 +4,7 @@
  * Licensed under MIT — see LICENSE file for details.
  */
 import { GetCalendarEventsSchema } from "./schemas.js";
-import { toolResponse, sanitizeError } from "./tool-helpers.js";
+import { toolResponse, errorResponse, sanitizeError } from "./tool-helpers.js";
 import { log } from "../utils/logger.js";
 import { resolveCourses } from "./resolve-courses.js";
 import { fetchCourseCalendarEvents } from "./calendar-events.js";
@@ -23,6 +23,12 @@ export function registerGetCalendarEvents(server, apiClient, config) {
             const { courseId, from, to, includeGenerated } = GetCalendarEventsSchema.parse(args);
             const windowStart = from ? new Date(from).getTime() : Date.now();
             const windowEnd = to ? new Date(to).getTime() : windowStart + DEFAULT_WINDOW_MS;
+            // An inverted window matches nothing, and an empty list reads as "no events".
+            if (windowEnd < windowStart) {
+                return errorResponse(from
+                    ? `to (${to}) is before from (${from}). Pass a to that is on or after from.`
+                    : `to (${to}) is in the past, and from defaults to now. Pass from as well to look at past events.`);
+            }
             const courses = await resolveCourses(apiClient, config, courseId);
             const results = await Promise.allSettled(courses.map((course) => fetchCourseCalendarEvents(apiClient, config.baseUrl, course, windowStart, windowEnd)));
             const events = results

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "3.7.0",
+  "version": "3.7.2",
   "mcpName": "io.github.rohanmuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",