brightspace-mcp-server 3.8.12 → 3.8.13

package/README.md

@@ -6,7 +6,7 @@ Talk to your Brightspace courses with AI. Ask about grades, due dates, quizzes,
 
 This is an [MCP (Model Context Protocol)](https://modelcontextprotocol.io) server that connects your AI to D2L Brightspace so it can pull your grades, assignments, syllabus, and course content on demand.
 
-Connects to D2L Brightspace. Automatic login supports Purdue's Microsoft Entra flow, SUNY campus selection, Western University, TU Delft NetID via SURFconext, and CUNY Login. Other schools need a compatible automated sign-in flow; unsupported login pages return an actionable error.
+Connects to D2L Brightspace. Automatic login supports Purdue's Microsoft Entra flow, SUNY campus selection, Western University, TU Delft NetID via SURFconext, CUNY Login, and Leiden University via SURFconext and Microsoft Entra. Other schools need a compatible automated sign-in flow; unsupported login pages return an actionable error.
 
 <p align="center">
   <img src="https://raw.githubusercontent.com/RohanMuppa/brightspace-mcp-server/main/docs/how-it-works.svg" alt="Architecture diagram" width="100%">
@@ -28,7 +28,7 @@ Paste this into Claude Code, Cursor, Windsurf, Copilot, Codex, or any AI coding
 ```
 Install brightspace-mcp-server for me by following
 https://github.com/RohanMuppa/brightspace-mcp-server/blob/main/LLMs.md
-(use --purdue at Purdue, --suny at SUNY, --tudelft at TU Delft, or --cuny at CUNY).
+(use --purdue at Purdue, --suny at SUNY, --tudelft at TU Delft, --cuny at CUNY, or --leiden at Leiden).
 ```
 
 **Option 2: Run it yourself**
@@ -68,6 +68,14 @@ every full sign-in, so when your Brightspace session ends, run
 npx -y brightspace-mcp-server@latest setup --cuny
 ```
 
+Leiden University students can use `--leiden`:
+
+```bash
+npx -y brightspace-mcp-server@latest setup --leiden
+```
+
+Sign in with your full Microsoft address (for example `s1234567@vuw.leidenuniv.nl`). The flow picks Leiden University (Entra) on SURFconext's account page, then uses the same Microsoft sign-in as Purdue. Leiden normally asks for a code from your authenticator app, which `auth` prompts for in the terminal.
+
 The wizard saves your password in the native credential store and asks how you'll complete MFA: wait for approval or number matching, enter a terminal code from Google Authenticator or another app, or use a visible browser for other interactive methods. It can also configure Claude Desktop, Cursor, Codex Desktop and CLI, and Claude Code when installed — restart your AI client when it finishes.
 
 Any other D2L school: run `setup` without a flag and paste your Brightspace URL (for example `https://yourschool.brightspace.com`).

package/build/auth/browser-auth.js

@@ -512,8 +512,10 @@ export class BrowserAuth {
             }
             return;
         }
-        if (!url.includes("login.microsoftonline.com"))
+        if (!url.includes("login.microsoftonline.com")) {
+            await this.ssoFlow.selectIdentityProvider?.(page);
             return;
+        }
         // The page must PROVE it is the "Stay signed in?" page before this click:
         // #idSIButton9 is Microsoft's id for the primary button on EVERY sign-in
         // page, "Next" on account name and "Sign in" on password, so clicking it

package/build/auth/index.js

@@ -8,6 +8,7 @@ export { PurdueSSOFlow } from "./purdue-sso.js";
 export { SunySSOFlow, isSunyBrightspace } from "./suny-sso.js";
 export { TUDelftSSOFlow, isTUDelftBrightspace } from "./tudelft-sso.js";
 export { CunySSOFlow, isCunyBrightspace } from "./cuny-sso.js";
+export { LeidenSSOFlow, isLeidenBrightspace } from "./leiden-sso.js";
 export { createSSOFlow } from "./sso-flow.js";
 export { TokenManager } from "./token-manager.js";
 export { SessionStore } from "./session-store.js";

package/build/auth/leiden-sso.js

@@ -0,0 +1,100 @@
+/** Leiden University login via SURFconext and Microsoft Entra. Licensed under MIT; see LICENSE. */
+import { PurdueSSOFlow } from "./purdue-sso.js";
+import { UnsupportedAuthenticationError } from "./sso-flow.js";
+import { log } from "../utils/logger.js";
+const LEIDEN_HOST = "brightspace.universiteitleiden.nl";
+const SURFCONEXT_HOST = "engine.surfconext.nl";
+const ENTRA_HOST = "login.microsoftonline.com";
+// SURFconext lists eduID first and LUMC next to Leiden, so the account is
+// picked by entity ID rather than by position or a "Leiden" text match.
+export const LEIDEN_ENTRA_ENTITY_ID = "https://sts.windows.net/ca2a7f76-dbd7-4ec0-9108-6b3d524fb7c8/";
+// The list wrapper never reports as visible, so the search box marks the picker.
+const WAYF_SEARCH = "#wayf_search";
+const LEIDEN_WAYF_ENTRY = `.wayf__idp[data-entityid="${LEIDEN_ENTRA_ENTITY_ID}"]`;
+// SURFconext's picker can take a poll or two to render the account list
+// (the search box itself appears first), so a miss is not treated as
+// authoritative until it has survived a few polls in a row.
+const MAX_WAYF_ENTRY_MISSES = 3;
+export function isLeidenBrightspace(baseUrl) {
+    try {
+        return new URL(baseUrl).hostname.toLowerCase() === LEIDEN_HOST;
+    }
+    catch {
+        return false;
+    }
+}
+function isSurfconext(rawUrl) {
+    try {
+        const url = new URL(rawUrl);
+        return url.protocol === "https:" && url.hostname.toLowerCase() === SURFCONEXT_HOST;
+    }
+    catch {
+        return false;
+    }
+}
+function isMicrosoftEntra(rawUrl) {
+    try {
+        const url = new URL(rawUrl);
+        return url.protocol === "https:" && url.hostname.toLowerCase() === ENTRA_HOST;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Brightspace sends Leiden users straight to SURFconext's account picker.
+ * Choosing the Entra entry there is the only Leiden-specific step; the
+ * Microsoft sign-in after it is the shared flow.
+ */
+export class LeidenSSOFlow {
+    common;
+    wayfEntryMisses = 0;
+    constructor(config) {
+        this.common = new PurdueSSOFlow(config);
+    }
+    hasCredentials() {
+        return this.common.hasCredentials();
+    }
+    rememberMfaResult() {
+        return this.common.rememberMfaResult();
+    }
+    async selectIdentityProvider(page) {
+        await this.chooseLeidenAccount(page);
+    }
+    async identifyAccount(page) {
+        return this.common.identifyAccount(page);
+    }
+    async login(page) {
+        await this.chooseLeidenAccount(page);
+        // The Microsoft sign-in flow below is shared with Purdue and fills
+        // whatever email/password fields it finds without checking where it is.
+        // Refuse to hand it the page at all unless SURFconext actually landed on
+        // Microsoft Entra: a redirect to a lookalike host must never reach the
+        // point where credentials get typed.
+        if (!isMicrosoftEntra(page.url())) {
+            throw new UnsupportedAuthenticationError("Leiden sign-in reached an unsupported identity-provider page. No credentials were entered there.");
+        }
+        return this.common.login(page);
+    }
+    async chooseLeidenAccount(page) {
+        if (!isSurfconext(page.url()))
+            return;
+        // The redirect back to Brightspace also passes through SURFconext.
+        if (!await page.locator(WAYF_SEARCH).first().isVisible().catch(() => false))
+            return;
+        const entry = page.locator(LEIDEN_WAYF_ENTRY).first();
+        if (!await entry.isVisible().catch(() => false)) {
+            this.wayfEntryMisses++;
+            // A lazily rendered account list can miss the first poll or two on a
+            // working account; only a miss that survives several polls means
+            // SURFconext genuinely stopped offering the Leiden entry.
+            if (this.wayfEntryMisses > MAX_WAYF_ENTRY_MISSES) {
+                throw new UnsupportedAuthenticationError("SURFconext no longer offers the Leiden University (Entra) account. Sign in with D2L_HEADLESS=false and pick the account manually.");
+            }
+            return;
+        }
+        this.wayfEntryMisses = 0;
+        log("INFO", "Choosing Leiden University (Entra) on SURFconext");
+        await entry.click();
+    }
+}

package/build/auth/sso-flow.js

@@ -8,6 +8,7 @@ import { SunySSOFlow, isSunyBrightspace } from "./suny-sso.js";
 import { WesternSSOFlow, isWesternBrightspace } from "./western-sso.js";
 import { TUDelftSSOFlow, isTUDelftBrightspace } from "./tudelft-sso.js";
 import { CunySSOFlow, isCunyBrightspace } from "./cuny-sso.js";
+import { LeidenSSOFlow, isLeidenBrightspace } from "./leiden-sso.js";
 import { BrowserAuthError } from "../utils/errors.js";
 import { AUTH_COMMAND } from "../utils/commands.js";
 export class UnsupportedAuthenticationError extends BrowserAuthError {
@@ -50,6 +51,9 @@ export function createSSOFlow(config, requestMfaCode, onMfaChallenge) {
     if (isTUDelftBrightspace(config.baseUrl)) {
         return new TUDelftSSOFlow(credentials);
     }
+    if (isLeidenBrightspace(config.baseUrl)) {
+        return new LeidenSSOFlow(credentials);
+    }
     if (isSunyBrightspace(config.baseUrl)) {
         return new SunySSOFlow({ ...credentials, campus: config.campus });
     }

package/build/setup.js

@@ -31,6 +31,13 @@ export const SCHOOL_PRESETS = {
         mfaNote: "NetID sign-in normally runs headlessly without MFA.",
         usernameHint: "Use your NetID, not your student email address.",
     },
+    leiden: {
+        name: "Leiden University",
+        baseUrl: "https://brightspace.universiteitleiden.nl",
+        usernameLabel: "Leiden University username",
+        mfaNote: "Leiden usually asks for a code from your authenticator app, which you can type here.",
+        usernameHint: "Use the full address you sign in to Microsoft with, e.g. s1234567@vuw.leidenuniv.nl.",
+    },
     purdue: {
         name: "Purdue University",
         baseUrl: "https://purdue.brightspace.com",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "3.8.12",
+  "version": "3.8.13",
   "mcpName": "io.github.rohanmuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",