brightspace-mcp-server 3.8.10 → 3.8.12

package/build/auth/purdue-sso.js

@@ -24,6 +24,9 @@ const FIELD_POLL_MS = 250;
 const NUMBER_MATCH_SELECTOR = "#idRichContext_DisplaySign";
 const MFA_CODE_SELECTORS = ["#idTxtBx_SAOTCC_OTC", 'input[name="otc"]'];
 const MFA_CODE_SUBMIT_SELECTORS = ["#idSubmit_SAOTCC_Continue", "#idSIButton9"];
+// Entra rejects a wrong code in place: the field stays and this message appears.
+const MFA_CODE_ERROR_SELECTOR = "#idSpan_SAOTCC_Error_OTC";
+const MAX_MFA_CODE_ATTEMPTS = 3;
 /**
  * Entra's "Don't ask again for N days" checkbox: the number-match page's id
  * first, then the verification-code page's, then the label text for a tenant
@@ -95,8 +98,15 @@ function signInName(username, baseUrl) {
 export class PurdueSSOFlow {
     config;
     accountHintSubmitted = false;
-    /** One authenticator code per login. See submitMfaCode. */
-    mfaCodeSubmitted = false;
+    /** Authenticator codes asked for during this login. See submitMfaCode. */
+    mfaCodeAttempts = 0;
+    /**
+     * True for exactly one poll after a code is resubmitted in response to a
+     * rejection. Entra's rejection span can still be in the DOM on that very
+     * next poll - it hasn't re-rendered yet, so what's on screen is still the
+     * PREVIOUS attempt's verdict, not this one's. See submitMfaCode.
+     */
+    awaitingMfaCodeSettle = false;
     /** Set once per login, the first time Entra's MFA page is handled. */
     rememberMfa;
     duoMfa;
@@ -446,18 +456,37 @@ export class PurdueSSOFlow {
             return false;
         if (this.config.headless === false)
             return false;
-        // Ask once per login. This runs on every two-second poll, and Microsoft
-        // commonly leaves the field on screen while it validates, so without this
-        // a correct code gets a second prompt on the next tick. That prompt blocks
-        // on stdin, and the deadline is only checked between iterations, so the
-        // five-minute budget can never fire while parked there.
-        if (this.mfaCodeSubmitted)
-            return false;
+        // Ask again only after Entra's rejection message. This runs on every
+        // two-second poll, and Microsoft commonly leaves the field on screen while
+        // it validates, so a lingering field alone would give a correct code a
+        // second prompt on the next tick. That prompt blocks on stdin, and the
+        // deadline is only checked between iterations, so the five-minute budget
+        // can never fire while parked there.
+        const isRetry = this.mfaCodeAttempts > 0;
+        if (isRetry) {
+            // The rejection span can still be the stale one from the attempt we
+            // just resubmitted in reaction to - Entra hasn't re-rendered yet, so
+            // this poll can't tell that span apart from a genuine rejection of the
+            // new attempt. Give it exactly one more poll (like cuny-sso.ts requiring
+            // the URL to change before trusting its own error state) before trusting
+            // the span again.
+            if (this.awaitingMfaCodeSettle) {
+                this.awaitingMfaCodeSettle = false;
+                return false;
+            }
+            if (!await page.locator(MFA_CODE_ERROR_SELECTOR).first().isVisible().catch(() => false))
+                return false;
+            if (this.mfaCodeAttempts >= MAX_MFA_CODE_ATTEMPTS) {
+                throw new BrowserAuthError(`Microsoft rejected ${this.mfaCodeAttempts} authenticator codes. Run \`${AUTH_COMMAND}\` to try again.`, "mfa_code");
+            }
+            log("WARN", "Microsoft rejected that code. Enter the current one from your authenticator app.");
+        }
         if (!this.config.requestMfaCode) {
             throw new UnsupportedAuthenticationError(`This MFA method requires a code. Run \`${AUTH_COMMAND}\` in a terminal to enter it.`);
         }
         await this.rememberMfaDevice(page);
-        this.mfaCodeSubmitted = true;
+        this.mfaCodeAttempts += 1;
+        this.awaitingMfaCodeSettle = isRetry;
         const code = await this.config.requestMfaCode();
         if (!/^\d{6,8}$/.test(code))
             throw new UnsupportedAuthenticationError("The MFA code must contain 6-8 digits.");

package/build/setup.js

@@ -80,6 +80,34 @@ function ask(rl, question) {
         rl.question(question, (answer) => resolve(answer.trim()));
     });
 }
+/**
+ * Apply one raw-mode stdin chunk to the password typed so far. A paste
+ * arrives as a single chunk, possibly wrapped in bracketed-paste markers and
+ * ending in a copied newline, so the chunk is read one character at a time
+ * and escape sequences (paste markers, arrow keys) never reach the password.
+ */
+export function readPasswordInput(password, chunk) {
+    let echo = "";
+    const text = chunk.replace(/\x1b\[[0-9;?]*[ -/]*[@-~]/g, "");
+    for (const ch of text) {
+        if (ch === "\x03")
+            return { password, echo, outcome: "cancel" };
+        if (ch === "\r" || ch === "\n")
+            return { password, echo, outcome: "submit" };
+        if (ch === "\x7f" || ch === "\b") {
+            if (password.length > 0) {
+                password = [...password].slice(0, -1).join("");
+                echo += "\b \b";
+            }
+            continue;
+        }
+        if (ch < " ")
+            continue;
+        password += ch;
+        echo += "*";
+    }
+    return { password, echo, outcome: "pending" };
+}
 /**
  * Prompt for a password without echoing characters to the terminal.
  * We swap stdout.write to suppress the default echo, then print
@@ -114,37 +142,22 @@ function askPassword(prompt) {
         process.stdin.setRawMode?.(true);
         process.stdin.resume();
         const onData = (key) => {
-            const ch = key.toString("utf-8");
-            // Ctrl+C
-            if (ch === "\x03") {
-                process.stdout.write = origWrite;
-                process.stdin.setRawMode?.(false);
-                process.stdin.removeListener("data", onData);
-                rl.close();
+            const input = readPasswordInput(password, key.toString("utf-8"));
+            if (input.echo)
+                origWrite(input.echo);
+            password = input.password;
+            if (input.outcome === "pending")
+                return;
+            process.stdout.write = origWrite;
+            process.stdin.setRawMode?.(false);
+            process.stdin.removeListener("data", onData);
+            rl.close();
+            if (input.outcome === "cancel") {
                 console.log("");
                 process.exit(0);
             }
-            // Enter
-            if (ch === "\r" || ch === "\n") {
-                process.stdout.write = origWrite;
-                process.stdin.setRawMode?.(false);
-                process.stdin.removeListener("data", onData);
-                rl.close();
-                origWrite("\n");
-                resolve(password);
-                return;
-            }
-            // Backspace
-            if (ch === "\x7f" || ch === "\b") {
-                if (password.length > 0) {
-                    password = password.slice(0, -1);
-                    origWrite("\b \b");
-                }
-                return;
-            }
-            // Normal character
-            password += ch;
-            origWrite("*");
+            origWrite("\n");
+            resolve(password);
         };
         process.stdin.on("data", onData);
     });
@@ -406,7 +419,7 @@ async function main() {
     // Close the rl temporarily since askPassword manages its own
     rl.close();
     const passwordPrompt = preset
-        ? `What is your ${preset.usernameLabel.replace("username", "password")}? `
+        ? `What is your ${preset.name} password? `
         : "What is your Brightspace password? ";
     let password = "";
     while (!password) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "3.8.10",
+  "version": "3.8.12",
   "mcpName": "io.github.rohanmuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",