brightspace-mcp-server 3.7.6 → 3.7.10

package/README.md

@@ -6,7 +6,7 @@ Talk to your Brightspace courses with AI. Ask about grades, due dates, quizzes,
 
 This is an [MCP (Model Context Protocol)](https://modelcontextprotocol.io) server that connects your AI to D2L Brightspace so it can pull your grades, assignments, syllabus, and course content on demand.
 
-Connects to D2L Brightspace. Automatic login supports Purdue's Microsoft Entra flow and SUNY campus selection. Other schools need a compatible automated sign-in flow; unsupported login pages return an actionable error.
+Connects to D2L Brightspace. Automatic login supports Purdue's Microsoft Entra flow, SUNY campus selection, Western University, and TU Delft NetID via SURFconext. Other schools need a compatible automated sign-in flow; unsupported login pages return an actionable error.
 
 <p align="center">
   <img src="https://raw.githubusercontent.com/RohanMuppa/brightspace-mcp-server/main/docs/how-it-works.svg" alt="Architecture diagram" width="100%">
@@ -28,7 +28,7 @@ Paste this into Claude Code, Cursor, Windsurf, Copilot, Codex, or any AI coding
 ```
 Install brightspace-mcp-server for me by following
 https://github.com/RohanMuppa/brightspace-mcp-server/blob/main/LLMs.md
-(use --purdue if I'm at Purdue, or --suny if I'm at a SUNY campus).
+(use --purdue at Purdue, --suny at SUNY, or --tudelft at TU Delft).
 ```
 
 **Option 2: Run it yourself**
@@ -50,6 +50,14 @@ you're at and skips SUNY's campus picker when you sign in:
 npx -y brightspace-mcp-server@latest setup --suny
 ```
 
+TU Delft students can use `--tudelft` to select the Brightspace URL and NetID login:
+
+```bash
+npx -y brightspace-mcp-server@latest setup --tudelft
+```
+
+Use your NetID rather than your student email address. The TU Delft flow is headless NetID username and password sign-in only, including automatic re-authentication when the saved session expires; it does not support MFA or any other interactive step. If your account requires one, [open an issue](https://github.com/RohanMuppa/brightspace-mcp-server/issues) — that tenant isn't supported yet.
+
 The wizard saves your password in the native credential store and asks how you complete MFA. Authentication can wait for approval or number matching, prompt in the terminal for a code from Google Authenticator or another app, or open a visible browser for other interactive methods. The wizard can configure Claude Desktop, Cursor, Codex Desktop and CLI, and Claude Code when they are installed. Restart your AI client when it finishes.
 
 Any other D2L school: run `setup` without a flag and paste your Brightspace URL (for example `https://yourschool.brightspace.com`).

package/build/auth/index.js

@@ -6,6 +6,7 @@
 export { BrowserAuth } from "./browser-auth.js";
 export { PurdueSSOFlow } from "./purdue-sso.js";
 export { SunySSOFlow, isSunyBrightspace } from "./suny-sso.js";
+export { TUDelftSSOFlow, isTUDelftBrightspace } from "./tudelft-sso.js";
 export { createSSOFlow } from "./sso-flow.js";
 export { TokenManager } from "./token-manager.js";
 export { SessionStore } from "./session-store.js";

package/build/auth/sso-flow.js

@@ -6,6 +6,7 @@
 import { PurdueSSOFlow } from "./purdue-sso.js";
 import { SunySSOFlow, isSunyBrightspace } from "./suny-sso.js";
 import { WesternSSOFlow, isWesternBrightspace } from "./western-sso.js";
+import { TUDelftSSOFlow, isTUDelftBrightspace } from "./tudelft-sso.js";
 import { BrowserAuthError } from "../utils/errors.js";
 import { AUTH_COMMAND } from "../utils/commands.js";
 export class UnsupportedAuthenticationError extends BrowserAuthError {
@@ -44,6 +45,9 @@ export function createSSOFlow(config, requestMfaCode, onMfaChallenge) {
         requestMfaCode,
         onMfaChallenge,
     };
+    if (isTUDelftBrightspace(config.baseUrl)) {
+        return new TUDelftSSOFlow(credentials);
+    }
     if (isSunyBrightspace(config.baseUrl)) {
         return new SunySSOFlow({ ...credentials, campus: config.campus });
     }

package/build/auth/tudelft-sso.js

@@ -0,0 +1,144 @@
+/** TU Delft NetID login via SURFconext. Licensed under MIT; see LICENSE. */
+import { UnsupportedAuthenticationError } from "./sso-flow.js";
+import { BrowserAuthError } from "../utils/errors.js";
+import { log } from "../utils/logger.js";
+const BRIGHTSPACE_HOST = "brightspace.tudelft.nl";
+const NETID_HOST = "login.tudelft.nl";
+const SURFCONEXT_HOST = "engine.surfconext.nl";
+const LOGIN_TIMEOUT_MS = 60_000;
+// Give the login page time to settle after submission before trusting any
+// alert banner as a rejection: a 1 second margin, or two polls, whichever a
+// given test/runtime environment can observe.
+const REJECTION_SETTLE_MS = 1_000;
+const REJECTION_SETTLE_POLLS = 2;
+const REJECTION_TEXT_PATTERN = /invalid|incorrect|rejected|wrong|failed|onjuist|ongeldig/i;
+export function isTUDelftBrightspace(baseUrl) {
+    try {
+        return new URL(baseUrl).hostname.toLowerCase() === BRIGHTSPACE_HOST;
+    }
+    catch {
+        return false;
+    }
+}
+async function firstVisible(page, selectors) {
+    for (const selector of selectors) {
+        const locator = page.locator(selector).first();
+        if (await locator.isVisible().catch(() => false))
+            return locator;
+    }
+    return null;
+}
+function isNetID(url) {
+    return url.protocol === "https:" && url.hostname.toLowerCase() === NETID_HOST;
+}
+/**
+ * Only a specific error container counts as a rejection on its own. A bare
+ * `[role="alert"]` is also common for benign, standing banners (maintenance
+ * notices, cookie prompts) that have nothing to do with the credentials just
+ * submitted, so it only counts when its text reads like a rejection.
+ */
+async function findRejectionAlert(page) {
+    const specific = await firstVisible(page, ['.form-error', '.login-error', '.alert-danger', '#error', '[role="alert"].error']);
+    if (specific)
+        return specific;
+    const generic = await firstVisible(page, ['[role="alert"]']);
+    if (generic) {
+        const text = (await generic.textContent().catch(() => null)) ?? "";
+        if (REJECTION_TEXT_PATTERN.test(text))
+            return generic;
+    }
+    return null;
+}
+/** NetID uses a simultaneous username/password form and normally requires no MFA. */
+export class TUDelftSSOFlow {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    hasCredentials() {
+        return Boolean(this.config.username && this.config.password);
+    }
+    async login(page) {
+        if (!this.hasCredentials())
+            return false;
+        log("INFO", "Starting TU Delft NetID sign-in");
+        let submitted = false;
+        let submittedAt = null;
+        let pollsSinceSubmit = 0;
+        let consentSubmitted = false;
+        const deadline = Date.now() + LOGIN_TIMEOUT_MS;
+        try {
+            do {
+                let current;
+                try {
+                    current = new URL(page.url());
+                }
+                catch {
+                    // Not a parseable URL (e.g. a transient navigation state). Give it
+                    // another poll instead of treating it as a fatal unknown host.
+                    await page.waitForTimeout(250);
+                    continue;
+                }
+                if (current.protocol !== "https:" && current.protocol !== "http:") {
+                    // about:blank and similar interstitial pages show up between
+                    // navigations; they're not an identity-provider page to evaluate.
+                    await page.waitForTimeout(250);
+                    continue;
+                }
+                if (current.origin === `https://${BRIGHTSPACE_HOST}` && /^\/d2l\/home(?:\/|$)/.test(current.pathname)) {
+                    return true;
+                }
+                if (isNetID(current)) {
+                    if (!submitted) {
+                        const username = await firstVisible(page, ['input#username', 'input[name="username"]', 'input[name="j_username"]']);
+                        const password = await firstVisible(page, ['input#password', 'input[name="password"]', 'input[name="j_password"]']);
+                        const submit = await firstVisible(page, ['#submit_button', 'button[name="_eventId_proceed"]', 'button[type="submit"]', 'input[type="submit"]']);
+                        if (username && password && submit) {
+                            await username.fill(this.config.username);
+                            // Recheck after the account field: a navigation must never send
+                            // the password to a different origin using a stale locator.
+                            if (!isNetID(new URL(page.url()))) {
+                                throw new UnsupportedAuthenticationError("TU Delft sign-in left the trusted NetID page before password entry.");
+                            }
+                            await password.fill(this.config.password);
+                            await submit.click();
+                            submitted = true;
+                            submittedAt = Date.now();
+                        }
+                    }
+                    else {
+                        pollsSinceSubmit++;
+                        const settled = pollsSinceSubmit >= REJECTION_SETTLE_POLLS
+                            || (submittedAt !== null && Date.now() - submittedAt >= REJECTION_SETTLE_MS);
+                        // Recheck the host: the alert lookup is async and must not act on
+                        // a page that has since navigated away from NetID.
+                        if (settled && isNetID(new URL(page.url())) && await findRejectionAlert(page)) {
+                            throw new UnsupportedAuthenticationError("TU Delft NetID sign-in was rejected. Check the saved NetID and password.");
+                        }
+                    }
+                }
+                else if (current.protocol === "https:" && current.hostname.toLowerCase() === SURFCONEXT_HOST) {
+                    // A user's first visit may require consent to share information with
+                    // Brightspace. No credentials are entered on SURFconext itself.
+                    if (!consentSubmitted) {
+                        const consent = await firstVisible(page, ['#consent_accept', 'button[name="confirm"]', 'input[name="confirm"]', 'input[name="yes"]']);
+                        if (consent) {
+                            await consent.click();
+                            consentSubmitted = true;
+                        }
+                    }
+                }
+                else if (current.origin !== `https://${BRIGHTSPACE_HOST}`) {
+                    throw new UnsupportedAuthenticationError("TU Delft sign-in reached an unsupported identity-provider page. No credentials were entered there.");
+                }
+                await page.waitForTimeout(250);
+            } while (Date.now() < deadline);
+            throw new UnsupportedAuthenticationError("TU Delft NetID sign-in did not reach Brightspace within 60 seconds. Check the saved credentials or retry with D2L_HEADLESS=false for an interactive sign-in.");
+        }
+        catch (error) {
+            if (error instanceof BrowserAuthError)
+                throw error;
+            throw new UnsupportedAuthenticationError("TU Delft NetID sign-in could not complete automatically.", error);
+        }
+    }
+}

package/build/setup.js

@@ -24,6 +24,13 @@ const dim = (s) => `\x1b[2m${s}\x1b[0m`;
 const yellow = (s) => `\x1b[33m${s}\x1b[0m`;
 const thisDir = path.dirname(fileURLToPath(import.meta.url));
 export const SCHOOL_PRESETS = {
+    tudelft: {
+        name: "TU Delft",
+        baseUrl: "https://brightspace.tudelft.nl",
+        usernameLabel: "TU Delft NetID",
+        mfaNote: "NetID sign-in normally runs headlessly without MFA.",
+        usernameHint: "Use your NetID, not your student email address.",
+    },
     purdue: {
         name: "Purdue University",
         baseUrl: "https://purdue.brightspace.com",

package/build/utils/self-update.js

@@ -18,6 +18,10 @@
  * from inside a live process, which is the thing this package deliberately
  * does not do.
  *
+ * Automatic sign-in (`--automatic`, spawned by the server's AuthRunner) never
+ * re-execs: it must run the auth CLI shipped alongside that server, not
+ * whatever npm calls latest. Only a user-run `auth` self-updates.
+ *
  * Opt out with D2L_NO_UPDATE_CHECK.
  */
 import { spawn } from "node:child_process";
@@ -61,10 +65,12 @@ export async function reexecLatestIfStale(deps = {}) {
     const { env = process.env, argv = process.argv, installedVersion, fetchImpl = fetch, runningFromNpxCache = ownNpxCacheDir() !== null, platform = process.platform, spawnImpl = spawn, } = deps;
     if (installedVersion === undefined)
         return null;
-    // Cheap local checks first, so an opted-out or npx-launched run never even
-    // touches the network.
+    // Cheap local checks first, so an opted-out, npx-launched, or automatic run
+    // never even touches the network.
     if (env[REEXEC_SENTINEL] || env.D2L_NO_UPDATE_CHECK || runningFromNpxCache)
         return null;
+    if (argv.includes("--automatic"))
+        return null; // stay on the server's sibling version
     const latest = await fetchLatestVersion(fetchImpl);
     if (!shouldReexec({ env, latest, installedVersion, runningFromNpxCache }))
         return null;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "3.7.6",
+  "version": "3.7.10",
   "mcpName": "io.github.rohanmuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",