brightspace-mcp-server 3.8.11 → 3.8.12

package/build/auth/purdue-sso.js

@@ -24,6 +24,9 @@ const FIELD_POLL_MS = 250;
 const NUMBER_MATCH_SELECTOR = "#idRichContext_DisplaySign";
 const MFA_CODE_SELECTORS = ["#idTxtBx_SAOTCC_OTC", 'input[name="otc"]'];
 const MFA_CODE_SUBMIT_SELECTORS = ["#idSubmit_SAOTCC_Continue", "#idSIButton9"];
+// Entra rejects a wrong code in place: the field stays and this message appears.
+const MFA_CODE_ERROR_SELECTOR = "#idSpan_SAOTCC_Error_OTC";
+const MAX_MFA_CODE_ATTEMPTS = 3;
 /**
  * Entra's "Don't ask again for N days" checkbox: the number-match page's id
  * first, then the verification-code page's, then the label text for a tenant
@@ -95,8 +98,15 @@ function signInName(username, baseUrl) {
 export class PurdueSSOFlow {
     config;
     accountHintSubmitted = false;
-    /** One authenticator code per login. See submitMfaCode. */
-    mfaCodeSubmitted = false;
+    /** Authenticator codes asked for during this login. See submitMfaCode. */
+    mfaCodeAttempts = 0;
+    /**
+     * True for exactly one poll after a code is resubmitted in response to a
+     * rejection. Entra's rejection span can still be in the DOM on that very
+     * next poll - it hasn't re-rendered yet, so what's on screen is still the
+     * PREVIOUS attempt's verdict, not this one's. See submitMfaCode.
+     */
+    awaitingMfaCodeSettle = false;
     /** Set once per login, the first time Entra's MFA page is handled. */
     rememberMfa;
     duoMfa;
@@ -446,18 +456,37 @@ export class PurdueSSOFlow {
             return false;
         if (this.config.headless === false)
             return false;
-        // Ask once per login. This runs on every two-second poll, and Microsoft
-        // commonly leaves the field on screen while it validates, so without this
-        // a correct code gets a second prompt on the next tick. That prompt blocks
-        // on stdin, and the deadline is only checked between iterations, so the
-        // five-minute budget can never fire while parked there.
-        if (this.mfaCodeSubmitted)
-            return false;
+        // Ask again only after Entra's rejection message. This runs on every
+        // two-second poll, and Microsoft commonly leaves the field on screen while
+        // it validates, so a lingering field alone would give a correct code a
+        // second prompt on the next tick. That prompt blocks on stdin, and the
+        // deadline is only checked between iterations, so the five-minute budget
+        // can never fire while parked there.
+        const isRetry = this.mfaCodeAttempts > 0;
+        if (isRetry) {
+            // The rejection span can still be the stale one from the attempt we
+            // just resubmitted in reaction to - Entra hasn't re-rendered yet, so
+            // this poll can't tell that span apart from a genuine rejection of the
+            // new attempt. Give it exactly one more poll (like cuny-sso.ts requiring
+            // the URL to change before trusting its own error state) before trusting
+            // the span again.
+            if (this.awaitingMfaCodeSettle) {
+                this.awaitingMfaCodeSettle = false;
+                return false;
+            }
+            if (!await page.locator(MFA_CODE_ERROR_SELECTOR).first().isVisible().catch(() => false))
+                return false;
+            if (this.mfaCodeAttempts >= MAX_MFA_CODE_ATTEMPTS) {
+                throw new BrowserAuthError(`Microsoft rejected ${this.mfaCodeAttempts} authenticator codes. Run \`${AUTH_COMMAND}\` to try again.`, "mfa_code");
+            }
+            log("WARN", "Microsoft rejected that code. Enter the current one from your authenticator app.");
+        }
         if (!this.config.requestMfaCode) {
             throw new UnsupportedAuthenticationError(`This MFA method requires a code. Run \`${AUTH_COMMAND}\` in a terminal to enter it.`);
         }
         await this.rememberMfaDevice(page);
-        this.mfaCodeSubmitted = true;
+        this.mfaCodeAttempts += 1;
+        this.awaitingMfaCodeSettle = isRetry;
         const code = await this.config.requestMfaCode();
         if (!/^\d{6,8}$/.test(code))
             throw new UnsupportedAuthenticationError("The MFA code must contain 6-8 digits.");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "3.8.11",
+  "version": "3.8.12",
   "mcpName": "io.github.rohanmuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",