brightspace-mcp-server 3.8.1 → 3.8.2

package/README.md

@@ -99,7 +99,7 @@ There's no login step — asking a question signs you in.
 
 **Normal days:** tokens renew over HTTPS, and a background browser silently replays your saved Microsoft session (silent SSO) if it lapses.
 
-**When MFA is asked:** the number to approve shows up right in the tool's response, and sign-in finishes in the background — approve it, call the tool again, and use the newest number if one goes stale. TOTP apps (Google Authenticator, etc.) get prompted via the terminal; visible-browser mode opens a window instead, though automatic recovery during a tool call still runs headless unless you set `D2L_HEADLESS=false`. On Duo, sign-in auto-answers "Is this your device?" with **yes**, since a headless run has nobody to click it — this also makes Duo remember the device, so skip it on shared machines. Set `D2L_DUO_PASSCODE` to swap the push for a typed passcode. On Microsoft's MFA page the server ticks "Don't ask again" when your school offers it, so later sign-ins can skip the second factor; how long that lasts is the school's setting, not the server's (`D2L_REMEMBER_MFA=false` turns this off, and `get_server_info` shows whether it was offered).
+**When MFA is asked:** the number to approve shows up right in the tool's response, and sign-in finishes in the background — approve it, call the tool again, and use the newest number if one goes stale. TOTP apps (Google Authenticator, etc.) get prompted via the terminal; visible-browser mode opens a window instead, though automatic recovery during a tool call still runs headless unless you set `D2L_HEADLESS=false`. On Duo, sign-in auto-answers "Is this your device?" with **yes**, since a headless run has nobody to click it — this also makes Duo remember the device, so skip it on shared machines. Set `D2L_DUO_PASSCODE` to swap the push for a typed passcode. On Microsoft's MFA page, setting `D2L_REMEMBER_MFA=true` makes the server tick "Don't ask again" when your school offers it, so later sign-ins can skip the second factor; how long that lasts is the school's setting, not the server's. It is off by default — leave it off on a shared machine — and `get_server_info` shows whether the box was ticked, offered, or left alone.
 
 **If it gets stuck:** a missed MFA approval pauses automatic sign-in for 5 minutes. This retries immediately, takes over a stuck sign-in, or asks for a code:
 
@@ -123,7 +123,7 @@ Run it from your home folder — macOS blocks `npx` from Documents, Desktop, or
 | Roster | "Who are the TAs for ECE 264?" · "Get me my instructor's email" |
 | Discussions | "What are people saying in the final project thread?" · "Summarize the latest discussion posts" |
 | Video transcripts | "What did the professor say about pinch-off in Tuesday's lecture recording?" · "Summarize last week's BoilerCast video" — works for Kaltura and YouTube embeds; other platforms report that they aren't supported yet |
-| Troubleshooting | "Which version of the Brightspace server am I running?" · "Where is my Brightspace config file?" — `get_server_info` reports the version, Node runtime, platform, config and session paths, school URL, whether a credential is stored, and what Microsoft remembered (`microsoftSession`: stay-signed-in and its expiry, plus whether "Don't ask again" was ticked, already on, or not offered), without contacting Brightspace or revealing secrets |
+| Troubleshooting | "Which version of the Brightspace server am I running?" · "Where is my Brightspace config file?" — `get_server_info` reports the version, Node runtime, platform, config and session paths, school URL, whether a credential is stored, and what Microsoft remembered (`microsoftSession`: stay-signed-in and its expiry, plus whether "Don't ask again" was ticked, already on, not offered, or left off because `D2L_REMEMBER_MFA` isn't set), without contacting Brightspace or revealing secrets |
 | Calendar | "When is my midterm?" · "What's on my calendar this week?" · "Is lab cancelled on Thursday?" — reads exams, labs, review sessions, and deadlines instructors put only on the course calendar |
 | Planning | "Build me a study schedule based on my upcoming due dates" · "Which class needs the most attention right now?" — pulls from assignments, quizzes, graded discussion topics (any topic with a due date), and course calendar events such as exams and labs |
 

package/build/auth/microsoft-session.js

@@ -10,7 +10,7 @@ import { BROWSER_STATE_FILE } from "./browser-state-store.js";
 const SUMMARY_FILE = "microsoft-session.json";
 const ENTRA_HOST = "login.microsoftonline.com";
 const ENTRA_COOKIES = new Set(["ESTSAUTH", "ESTSAUTHPERSISTENT", "ESTSAUTHLIGHT"]);
-const OUTCOMES = ["ticked", "already", "absent", "unknown"];
+const OUTCOMES = ["ticked", "already", "absent", "unknown", "off"];
 /** Latest expiry of each Entra sign-in cookie in a jar. */
 function entraExpiries(state) {
     const expiries = new Map();

package/build/auth/purdue-sso.js

@@ -39,6 +39,7 @@ const REMEMBER_MFA_LOG = {
     already: "already checked",
     absent: "not offered by tenant",
     unknown: "could not be ticked",
+    off: "off (set D2L_REMEMBER_MFA=true to tick it)",
 };
 /** How often to look for the number while waiting on MFA. */
 const NUMBER_MATCH_POLL_MS = 2000;
@@ -469,11 +470,18 @@ export class PurdueSSOFlow {
     }
     /**
      * Tick Entra's "Don't ask again" box, once per login and never in a loop.
+     * Opt-in: without an explicit true the box is left alone and the outcome
+     * is recorded as "off", so get_server_info can say why nothing was ticked.
      * An already-checked box is left alone so this can never untick it.
      */
     async rememberMfaDevice(page) {
-        if (this.rememberMfa || this.config.rememberMfa === false)
+        if (this.rememberMfa)
             return;
+        if (this.config.rememberMfa !== true) {
+            this.rememberMfa = { outcome: "off", at: new Date().toISOString() };
+            log("INFO", `Entra remember-MFA checkbox: ${REMEMBER_MFA_LOG.off}`);
+            return;
+        }
         if (new URL(page.url()).hostname !== "login.microsoftonline.com")
             return;
         // A nicety, never a reason to fail sign-in: any surprise is "unknown".

package/build/utils/config.js

@@ -29,8 +29,10 @@ export async function loadConfig() {
     const headless = envBoolean(process.env.D2L_HEADLESS, "D2L_HEADLESS")
         ?? store?.headless
         ?? true;
-    // Ask Microsoft to skip the second factor for its "Don't ask again" window.
-    const rememberMfa = envBoolean(process.env.D2L_REMEMBER_MFA, "D2L_REMEMBER_MFA") ?? true;
+    // Opt-in: ask Microsoft to skip the second factor for its "Don't ask again"
+    // window. Off unless D2L_REMEMBER_MFA=true, so a shared machine never
+    // remembers MFA without the user choosing it.
+    const rememberMfa = envBoolean(process.env.D2L_REMEMBER_MFA, "D2L_REMEMBER_MFA") ?? false;
     // Resolve tokenTtl: env > store > default (3600)
     const tokenTtl = positiveSeconds(process.env.D2L_TOKEN_TTL, "D2L_TOKEN_TTL")
         ?? positiveSeconds(store?.tokenTtl, "tokenTtl in config.json")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "3.8.1",
+  "version": "3.8.2",
   "mcpName": "io.github.rohanmuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",