brightspace-mcp-server 3.7.12 → 3.7.13

package/build/auth/browser-auth.js

@@ -30,6 +30,11 @@ const SILENT_SSO = {
     kmsiCheckbox: "#KmsiCheckboxField",
     kmsiTitle: "Stay signed in?",
     kmsiSubmit: "#idSIButton9",
+    // Microsoft's passwordless approval view ("Approve sign in request", or
+    // "Request wasn't sent" once a push fails) offers the password instead. The
+    // text fallback covers a tenant that renames the id.
+    passwordSwitch: "#idA_PWD_SwitchToPassword",
+    passwordSwitchText: "Use your password instead",
 };
 export class BrowserAuthTransportError extends Error {
     code = "AUTH_TRANSPORT";
@@ -338,6 +343,7 @@ export class BrowserAuth {
         const deadline = Date.now() + SILENT_SSO_TIMEOUT_MS;
         let accountHintAttempted = false;
         let passwordPromptPolls = 0;
+        let passwordSwitchAttempted = false;
         do {
             if (await this.hasLiveSession(page))
                 return true;
@@ -359,6 +365,22 @@ export class BrowserAuth {
                 log("INFO", "The identity provider requires a login challenge");
                 return false;
             }
+            const passwordSwitch = await this.passwordSignInOption(page);
+            if (passwordSwitch) {
+                // The approval view has no field or MFA title this poll recognizes, so
+                // without leaving it the poll would wait out its whole budget. Switch
+                // once when a password is saved; the password page then settles the
+                // poll like any other credential prompt.
+                if (!passwordSwitchAttempted && this.ssoFlow.hasCredentials()) {
+                    passwordSwitchAttempted = true;
+                    await passwordSwitch.click().catch(() => { });
+                    log("DEBUG", "Chose the password sign-in option over passwordless approval");
+                    await page.waitForTimeout(SILENT_SSO_POLL_MS);
+                    continue;
+                }
+                log("INFO", "The identity provider requires a password sign-in");
+                return false;
+            }
             if (await this.isAnyOnScreen(page, SILENT_SSO.credentialFields)) {
                 passwordPromptPolls += 1;
                 // Entra can briefly expose a password-shaped control while its email
@@ -390,6 +412,13 @@ export class BrowserAuth {
         return await this.isAnyOnScreen(page, SILENT_SSO.emailFields) ||
             await this.isAnyOnScreen(page, SILENT_SSO.credentialFields);
     }
+    /** The visible "Use your password instead" control, when Microsoft offers one. */
+    async passwordSignInOption(page) {
+        if (await this.isOnScreen(page, SILENT_SSO.passwordSwitch))
+            return page.locator(SILENT_SSO.passwordSwitch).first();
+        const byText = page.getByText(SILENT_SSO.passwordSwitchText).first();
+        return await byText.isVisible().catch(() => false) ? byText : null;
+    }
     /** One definition of the MFA pages the shared authentication loop supports. */
     async hasMfaChallenge(page) {
         return isDuoPrompt(page) || await this.isAnyOnScreen(page, SILENT_SSO.mfaChallenges);

package/build/auth/purdue-sso.js

@@ -174,7 +174,11 @@ export class PurdueSSOFlow {
         // and then blames a missing password field.
         const hintAccepted = this.accountHintSubmitted && !await this.anyVisible(page, EMAIL_SELECTORS);
         this.accountHintSubmitted = false;
-        if (!hintAccepted) {
+        // Microsoft can also know the account without a hint from this login: a
+        // remembered account's passwordless approval view, once awaitSilentSSO
+        // takes "Use your password instead", leads to a password page with no
+        // username field at all.
+        if (!hintAccepted && !await this.isPasswordOnlyPage(page)) {
             const email = signInName(this.config.username, this.config.baseUrl);
             if (!await this.fillWhenReady(page, EMAIL_SELECTORS, email)) {
                 throw new UnsupportedAuthenticationError("The identity provider's username field did not appear. Automatic sign-in cannot continue.");
@@ -253,6 +257,10 @@ export class PurdueSSOFlow {
         await page.waitForTimeout(FIELD_POLL_MS);
         return await this.anyVisible(page, PASSWORD_SELECTORS);
     }
+    /** A stable password field with no username field beside it. */
+    async isPasswordOnlyPage(page) {
+        return await this.hasCoVisiblePassword(page) && !await this.anyVisible(page, EMAIL_SELECTORS);
+    }
     async hasPostCredentialChallenge(page) {
         return this.duoMfa.isChallenge(page) || await this.anyVisible(page, [
             NUMBER_MATCH_SELECTOR,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "3.7.12",
+  "version": "3.7.13",
   "mcpName": "io.github.rohanmuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",