brightspace-mcp-server 3.8.11 → 3.8.13

package/README.md

@@ -6,7 +6,7 @@ Talk to your Brightspace courses with AI. Ask about grades, due dates, quizzes,
 
 This is an [MCP (Model Context Protocol)](https://modelcontextprotocol.io) server that connects your AI to D2L Brightspace so it can pull your grades, assignments, syllabus, and course content on demand.
 
-Connects to D2L Brightspace. Automatic login supports Purdue's Microsoft Entra flow, SUNY campus selection, Western University, TU Delft NetID via SURFconext, and CUNY Login. Other schools need a compatible automated sign-in flow; unsupported login pages return an actionable error.
+Connects to D2L Brightspace. Automatic login supports Purdue's Microsoft Entra flow, SUNY campus selection, Western University, TU Delft NetID via SURFconext, CUNY Login, and Leiden University via SURFconext and Microsoft Entra. Other schools need a compatible automated sign-in flow; unsupported login pages return an actionable error.
 
 <p align="center">
   <img src="https://raw.githubusercontent.com/RohanMuppa/brightspace-mcp-server/main/docs/how-it-works.svg" alt="Architecture diagram" width="100%">
@@ -28,7 +28,7 @@ Paste this into Claude Code, Cursor, Windsurf, Copilot, Codex, or any AI coding
 ```
 Install brightspace-mcp-server for me by following
 https://github.com/RohanMuppa/brightspace-mcp-server/blob/main/LLMs.md
-(use --purdue at Purdue, --suny at SUNY, --tudelft at TU Delft, or --cuny at CUNY).
+(use --purdue at Purdue, --suny at SUNY, --tudelft at TU Delft, --cuny at CUNY, or --leiden at Leiden).
 ```
 
 **Option 2: Run it yourself**
@@ -68,6 +68,14 @@ every full sign-in, so when your Brightspace session ends, run
 npx -y brightspace-mcp-server@latest setup --cuny
 ```
 
+Leiden University students can use `--leiden`:
+
+```bash
+npx -y brightspace-mcp-server@latest setup --leiden
+```
+
+Sign in with your full Microsoft address (for example `s1234567@vuw.leidenuniv.nl`). The flow picks Leiden University (Entra) on SURFconext's account page, then uses the same Microsoft sign-in as Purdue. Leiden normally asks for a code from your authenticator app, which `auth` prompts for in the terminal.
+
 The wizard saves your password in the native credential store and asks how you'll complete MFA: wait for approval or number matching, enter a terminal code from Google Authenticator or another app, or use a visible browser for other interactive methods. It can also configure Claude Desktop, Cursor, Codex Desktop and CLI, and Claude Code when installed — restart your AI client when it finishes.
 
 Any other D2L school: run `setup` without a flag and paste your Brightspace URL (for example `https://yourschool.brightspace.com`).

package/build/auth/browser-auth.js

@@ -512,8 +512,10 @@ export class BrowserAuth {
             }
             return;
         }
-        if (!url.includes("login.microsoftonline.com"))
+        if (!url.includes("login.microsoftonline.com")) {
+            await this.ssoFlow.selectIdentityProvider?.(page);
             return;
+        }
         // The page must PROVE it is the "Stay signed in?" page before this click:
         // #idSIButton9 is Microsoft's id for the primary button on EVERY sign-in
         // page, "Next" on account name and "Sign in" on password, so clicking it

package/build/auth/index.js

@@ -8,6 +8,7 @@ export { PurdueSSOFlow } from "./purdue-sso.js";
 export { SunySSOFlow, isSunyBrightspace } from "./suny-sso.js";
 export { TUDelftSSOFlow, isTUDelftBrightspace } from "./tudelft-sso.js";
 export { CunySSOFlow, isCunyBrightspace } from "./cuny-sso.js";
+export { LeidenSSOFlow, isLeidenBrightspace } from "./leiden-sso.js";
 export { createSSOFlow } from "./sso-flow.js";
 export { TokenManager } from "./token-manager.js";
 export { SessionStore } from "./session-store.js";

package/build/auth/leiden-sso.js

@@ -0,0 +1,100 @@
+/** Leiden University login via SURFconext and Microsoft Entra. Licensed under MIT; see LICENSE. */
+import { PurdueSSOFlow } from "./purdue-sso.js";
+import { UnsupportedAuthenticationError } from "./sso-flow.js";
+import { log } from "../utils/logger.js";
+const LEIDEN_HOST = "brightspace.universiteitleiden.nl";
+const SURFCONEXT_HOST = "engine.surfconext.nl";
+const ENTRA_HOST = "login.microsoftonline.com";
+// SURFconext lists eduID first and LUMC next to Leiden, so the account is
+// picked by entity ID rather than by position or a "Leiden" text match.
+export const LEIDEN_ENTRA_ENTITY_ID = "https://sts.windows.net/ca2a7f76-dbd7-4ec0-9108-6b3d524fb7c8/";
+// The list wrapper never reports as visible, so the search box marks the picker.
+const WAYF_SEARCH = "#wayf_search";
+const LEIDEN_WAYF_ENTRY = `.wayf__idp[data-entityid="${LEIDEN_ENTRA_ENTITY_ID}"]`;
+// SURFconext's picker can take a poll or two to render the account list
+// (the search box itself appears first), so a miss is not treated as
+// authoritative until it has survived a few polls in a row.
+const MAX_WAYF_ENTRY_MISSES = 3;
+export function isLeidenBrightspace(baseUrl) {
+    try {
+        return new URL(baseUrl).hostname.toLowerCase() === LEIDEN_HOST;
+    }
+    catch {
+        return false;
+    }
+}
+function isSurfconext(rawUrl) {
+    try {
+        const url = new URL(rawUrl);
+        return url.protocol === "https:" && url.hostname.toLowerCase() === SURFCONEXT_HOST;
+    }
+    catch {
+        return false;
+    }
+}
+function isMicrosoftEntra(rawUrl) {
+    try {
+        const url = new URL(rawUrl);
+        return url.protocol === "https:" && url.hostname.toLowerCase() === ENTRA_HOST;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Brightspace sends Leiden users straight to SURFconext's account picker.
+ * Choosing the Entra entry there is the only Leiden-specific step; the
+ * Microsoft sign-in after it is the shared flow.
+ */
+export class LeidenSSOFlow {
+    common;
+    wayfEntryMisses = 0;
+    constructor(config) {
+        this.common = new PurdueSSOFlow(config);
+    }
+    hasCredentials() {
+        return this.common.hasCredentials();
+    }
+    rememberMfaResult() {
+        return this.common.rememberMfaResult();
+    }
+    async selectIdentityProvider(page) {
+        await this.chooseLeidenAccount(page);
+    }
+    async identifyAccount(page) {
+        return this.common.identifyAccount(page);
+    }
+    async login(page) {
+        await this.chooseLeidenAccount(page);
+        // The Microsoft sign-in flow below is shared with Purdue and fills
+        // whatever email/password fields it finds without checking where it is.
+        // Refuse to hand it the page at all unless SURFconext actually landed on
+        // Microsoft Entra: a redirect to a lookalike host must never reach the
+        // point where credentials get typed.
+        if (!isMicrosoftEntra(page.url())) {
+            throw new UnsupportedAuthenticationError("Leiden sign-in reached an unsupported identity-provider page. No credentials were entered there.");
+        }
+        return this.common.login(page);
+    }
+    async chooseLeidenAccount(page) {
+        if (!isSurfconext(page.url()))
+            return;
+        // The redirect back to Brightspace also passes through SURFconext.
+        if (!await page.locator(WAYF_SEARCH).first().isVisible().catch(() => false))
+            return;
+        const entry = page.locator(LEIDEN_WAYF_ENTRY).first();
+        if (!await entry.isVisible().catch(() => false)) {
+            this.wayfEntryMisses++;
+            // A lazily rendered account list can miss the first poll or two on a
+            // working account; only a miss that survives several polls means
+            // SURFconext genuinely stopped offering the Leiden entry.
+            if (this.wayfEntryMisses > MAX_WAYF_ENTRY_MISSES) {
+                throw new UnsupportedAuthenticationError("SURFconext no longer offers the Leiden University (Entra) account. Sign in with D2L_HEADLESS=false and pick the account manually.");
+            }
+            return;
+        }
+        this.wayfEntryMisses = 0;
+        log("INFO", "Choosing Leiden University (Entra) on SURFconext");
+        await entry.click();
+    }
+}

package/build/auth/purdue-sso.js

@@ -24,6 +24,9 @@ const FIELD_POLL_MS = 250;
 const NUMBER_MATCH_SELECTOR = "#idRichContext_DisplaySign";
 const MFA_CODE_SELECTORS = ["#idTxtBx_SAOTCC_OTC", 'input[name="otc"]'];
 const MFA_CODE_SUBMIT_SELECTORS = ["#idSubmit_SAOTCC_Continue", "#idSIButton9"];
+// Entra rejects a wrong code in place: the field stays and this message appears.
+const MFA_CODE_ERROR_SELECTOR = "#idSpan_SAOTCC_Error_OTC";
+const MAX_MFA_CODE_ATTEMPTS = 3;
 /**
  * Entra's "Don't ask again for N days" checkbox: the number-match page's id
  * first, then the verification-code page's, then the label text for a tenant
@@ -95,8 +98,15 @@ function signInName(username, baseUrl) {
 export class PurdueSSOFlow {
     config;
     accountHintSubmitted = false;
-    /** One authenticator code per login. See submitMfaCode. */
-    mfaCodeSubmitted = false;
+    /** Authenticator codes asked for during this login. See submitMfaCode. */
+    mfaCodeAttempts = 0;
+    /**
+     * True for exactly one poll after a code is resubmitted in response to a
+     * rejection. Entra's rejection span can still be in the DOM on that very
+     * next poll - it hasn't re-rendered yet, so what's on screen is still the
+     * PREVIOUS attempt's verdict, not this one's. See submitMfaCode.
+     */
+    awaitingMfaCodeSettle = false;
     /** Set once per login, the first time Entra's MFA page is handled. */
     rememberMfa;
     duoMfa;
@@ -446,18 +456,37 @@ export class PurdueSSOFlow {
             return false;
         if (this.config.headless === false)
             return false;
-        // Ask once per login. This runs on every two-second poll, and Microsoft
-        // commonly leaves the field on screen while it validates, so without this
-        // a correct code gets a second prompt on the next tick. That prompt blocks
-        // on stdin, and the deadline is only checked between iterations, so the
-        // five-minute budget can never fire while parked there.
-        if (this.mfaCodeSubmitted)
-            return false;
+        // Ask again only after Entra's rejection message. This runs on every
+        // two-second poll, and Microsoft commonly leaves the field on screen while
+        // it validates, so a lingering field alone would give a correct code a
+        // second prompt on the next tick. That prompt blocks on stdin, and the
+        // deadline is only checked between iterations, so the five-minute budget
+        // can never fire while parked there.
+        const isRetry = this.mfaCodeAttempts > 0;
+        if (isRetry) {
+            // The rejection span can still be the stale one from the attempt we
+            // just resubmitted in reaction to - Entra hasn't re-rendered yet, so
+            // this poll can't tell that span apart from a genuine rejection of the
+            // new attempt. Give it exactly one more poll (like cuny-sso.ts requiring
+            // the URL to change before trusting its own error state) before trusting
+            // the span again.
+            if (this.awaitingMfaCodeSettle) {
+                this.awaitingMfaCodeSettle = false;
+                return false;
+            }
+            if (!await page.locator(MFA_CODE_ERROR_SELECTOR).first().isVisible().catch(() => false))
+                return false;
+            if (this.mfaCodeAttempts >= MAX_MFA_CODE_ATTEMPTS) {
+                throw new BrowserAuthError(`Microsoft rejected ${this.mfaCodeAttempts} authenticator codes. Run \`${AUTH_COMMAND}\` to try again.`, "mfa_code");
+            }
+            log("WARN", "Microsoft rejected that code. Enter the current one from your authenticator app.");
+        }
         if (!this.config.requestMfaCode) {
             throw new UnsupportedAuthenticationError(`This MFA method requires a code. Run \`${AUTH_COMMAND}\` in a terminal to enter it.`);
         }
         await this.rememberMfaDevice(page);
-        this.mfaCodeSubmitted = true;
+        this.mfaCodeAttempts += 1;
+        this.awaitingMfaCodeSettle = isRetry;
         const code = await this.config.requestMfaCode();
         if (!/^\d{6,8}$/.test(code))
             throw new UnsupportedAuthenticationError("The MFA code must contain 6-8 digits.");

package/build/auth/sso-flow.js

@@ -8,6 +8,7 @@ import { SunySSOFlow, isSunyBrightspace } from "./suny-sso.js";
 import { WesternSSOFlow, isWesternBrightspace } from "./western-sso.js";
 import { TUDelftSSOFlow, isTUDelftBrightspace } from "./tudelft-sso.js";
 import { CunySSOFlow, isCunyBrightspace } from "./cuny-sso.js";
+import { LeidenSSOFlow, isLeidenBrightspace } from "./leiden-sso.js";
 import { BrowserAuthError } from "../utils/errors.js";
 import { AUTH_COMMAND } from "../utils/commands.js";
 export class UnsupportedAuthenticationError extends BrowserAuthError {
@@ -50,6 +51,9 @@ export function createSSOFlow(config, requestMfaCode, onMfaChallenge) {
     if (isTUDelftBrightspace(config.baseUrl)) {
         return new TUDelftSSOFlow(credentials);
     }
+    if (isLeidenBrightspace(config.baseUrl)) {
+        return new LeidenSSOFlow(credentials);
+    }
     if (isSunyBrightspace(config.baseUrl)) {
         return new SunySSOFlow({ ...credentials, campus: config.campus });
     }

package/build/setup.js

@@ -31,6 +31,13 @@ export const SCHOOL_PRESETS = {
         mfaNote: "NetID sign-in normally runs headlessly without MFA.",
         usernameHint: "Use your NetID, not your student email address.",
     },
+    leiden: {
+        name: "Leiden University",
+        baseUrl: "https://brightspace.universiteitleiden.nl",
+        usernameLabel: "Leiden University username",
+        mfaNote: "Leiden usually asks for a code from your authenticator app, which you can type here.",
+        usernameHint: "Use the full address you sign in to Microsoft with, e.g. s1234567@vuw.leidenuniv.nl.",
+    },
     purdue: {
         name: "Purdue University",
         baseUrl: "https://purdue.brightspace.com",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "3.8.11",
+  "version": "3.8.13",
   "mcpName": "io.github.rohanmuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",