brightspace-mcp-server 3.8.12 → 3.8.14

package/README.md

@@ -6,7 +6,7 @@ Talk to your Brightspace courses with AI. Ask about grades, due dates, quizzes,
 
 This is an [MCP (Model Context Protocol)](https://modelcontextprotocol.io) server that connects your AI to D2L Brightspace so it can pull your grades, assignments, syllabus, and course content on demand.
 
-Connects to D2L Brightspace. Automatic login supports Purdue's Microsoft Entra flow, SUNY campus selection, Western University, TU Delft NetID via SURFconext, and CUNY Login. Other schools need a compatible automated sign-in flow; unsupported login pages return an actionable error.
+Connects to D2L Brightspace. Automatic login supports Purdue's Microsoft Entra flow, SUNY campus selection, Western University, TU Delft NetID via SURFconext, CUNY Login, and Leiden University via SURFconext and Microsoft Entra. Other schools need a compatible automated sign-in flow; unsupported login pages return an actionable error.
 
 <p align="center">
   <img src="https://raw.githubusercontent.com/RohanMuppa/brightspace-mcp-server/main/docs/how-it-works.svg" alt="Architecture diagram" width="100%">
@@ -28,7 +28,7 @@ Paste this into Claude Code, Cursor, Windsurf, Copilot, Codex, or any AI coding
 ```
 Install brightspace-mcp-server for me by following
 https://github.com/RohanMuppa/brightspace-mcp-server/blob/main/LLMs.md
-(use --purdue at Purdue, --suny at SUNY, --tudelft at TU Delft, or --cuny at CUNY).
+(use --purdue at Purdue, --suny at SUNY, --tudelft at TU Delft, --cuny at CUNY, or --leiden at Leiden).
 ```
 
 **Option 2: Run it yourself**
@@ -68,6 +68,14 @@ every full sign-in, so when your Brightspace session ends, run
 npx -y brightspace-mcp-server@latest setup --cuny
 ```
 
+Leiden University students can use `--leiden`:
+
+```bash
+npx -y brightspace-mcp-server@latest setup --leiden
+```
+
+Sign in with your full Microsoft address (for example `s1234567@vuw.leidenuniv.nl`). The flow picks Leiden University (Entra) on SURFconext's account page, then uses the same Microsoft sign-in as Purdue. Leiden normally asks for a code from your authenticator app, which `auth` prompts for in the terminal.
+
 The wizard saves your password in the native credential store and asks how you'll complete MFA: wait for approval or number matching, enter a terminal code from Google Authenticator or another app, or use a visible browser for other interactive methods. It can also configure Claude Desktop, Cursor, Codex Desktop and CLI, and Claude Code when installed — restart your AI client when it finishes.
 
 Any other D2L school: run `setup` without a flag and paste your Brightspace URL (for example `https://yourschool.brightspace.com`).
@@ -143,5 +151,6 @@ Run it from your home folder — macOS blocks `npx` from Documents, Desktop, or
 
 When a content-file download returns 403 or 404, `download_file` checks topic metadata and the course table of contents. Confirmed restrictions return `{ success: false, available: false, reason, message, startDate, endDate }` so the assistant can explain when content opens or why it has closed. Unexplained 404s and server/network failures retain their original errors.
 
+When course content or announcements are converted to markdown, `javascript:`/`data:` links are rendered as plain text (the link itself is dropped, not followed) and D2L's per-session query parameters (`d2lSessionVal`, `d2lSecureSessionVal`, and the cache-busting `_`) are stripped from any remaining links and images before they reach the assistant.
 
 Licensed under the MIT License.

package/build/api/paginate.js

@@ -78,16 +78,47 @@ export async function fetchAllObjects(apiClient, firstPath, options) {
     }
     return objects;
 }
-/** A Next value resolved to a request path. */
+/**
+ * A Next value resolved to a request path, or null when it should not be
+ * followed.
+ *
+ * Adapted from JhostinAleck/brightspace-mcp (MIT): beyond dropping an
+ * absolute Next's host (the client always prefixes its own configured base
+ * URL, so a hostile/garbled Next cannot redirect requests elsewhere), anything
+ * -- absolute or server-relative -- whose path falls outside `/d2l/api/` is
+ * rejected rather than followed, since that is the only space these paginated
+ * endpoints legitimately point back into.
+ */
 function nextPath(firstPath, next) {
     if (/^https?:\/\//i.test(next)) {
         const url = new URL(next);
+        if (!isApiPath(url.pathname)) {
+            log("INFO", "Pagination stopped: Next link left the D2L API", {
+                firstPath,
+                nextPath: url.pathname,
+            });
+            return null;
+        }
         return `${url.pathname}${url.search}`;
     }
     // A Next that begins with a slash is already a path, not a bookmark.
     // Appending it as one would ask for a page that does not exist.
     if (next.startsWith("/")) {
+        const nextPathOnly = next.split("?")[0] ?? next;
+        if (!isApiPath(nextPathOnly)) {
+            log("INFO", "Pagination stopped: Next link left the D2L API", {
+                firstPath,
+                // Log only the path, not the query string: a rejected server-relative
+                // Next can carry a `d2lSessionVal=` token in its query.
+                nextPath: nextPathOnly,
+            });
+            return null;
+        }
         return next;
     }
     return withBookmark(firstPath, next);
 }
+/** Whether a Next path stays inside the D2L API namespace these endpoints page through. */
+function isApiPath(pathname) {
+    return pathname.startsWith("/d2l/api/");
+}

package/build/auth/browser-auth.js

@@ -512,8 +512,10 @@ export class BrowserAuth {
             }
             return;
         }
-        if (!url.includes("login.microsoftonline.com"))
+        if (!url.includes("login.microsoftonline.com")) {
+            await this.ssoFlow.selectIdentityProvider?.(page);
             return;
+        }
         // The page must PROVE it is the "Stay signed in?" page before this click:
         // #idSIButton9 is Microsoft's id for the primary button on EVERY sign-in
         // page, "Next" on account name and "Sign in" on password, so clicking it

package/build/auth/index.js

@@ -8,6 +8,7 @@ export { PurdueSSOFlow } from "./purdue-sso.js";
 export { SunySSOFlow, isSunyBrightspace } from "./suny-sso.js";
 export { TUDelftSSOFlow, isTUDelftBrightspace } from "./tudelft-sso.js";
 export { CunySSOFlow, isCunyBrightspace } from "./cuny-sso.js";
+export { LeidenSSOFlow, isLeidenBrightspace } from "./leiden-sso.js";
 export { createSSOFlow } from "./sso-flow.js";
 export { TokenManager } from "./token-manager.js";
 export { SessionStore } from "./session-store.js";

package/build/auth/leiden-sso.js

@@ -0,0 +1,100 @@
+/** Leiden University login via SURFconext and Microsoft Entra. Licensed under MIT; see LICENSE. */
+import { PurdueSSOFlow } from "./purdue-sso.js";
+import { UnsupportedAuthenticationError } from "./sso-flow.js";
+import { log } from "../utils/logger.js";
+const LEIDEN_HOST = "brightspace.universiteitleiden.nl";
+const SURFCONEXT_HOST = "engine.surfconext.nl";
+const ENTRA_HOST = "login.microsoftonline.com";
+// SURFconext lists eduID first and LUMC next to Leiden, so the account is
+// picked by entity ID rather than by position or a "Leiden" text match.
+export const LEIDEN_ENTRA_ENTITY_ID = "https://sts.windows.net/ca2a7f76-dbd7-4ec0-9108-6b3d524fb7c8/";
+// The list wrapper never reports as visible, so the search box marks the picker.
+const WAYF_SEARCH = "#wayf_search";
+const LEIDEN_WAYF_ENTRY = `.wayf__idp[data-entityid="${LEIDEN_ENTRA_ENTITY_ID}"]`;
+// SURFconext's picker can take a poll or two to render the account list
+// (the search box itself appears first), so a miss is not treated as
+// authoritative until it has survived a few polls in a row.
+const MAX_WAYF_ENTRY_MISSES = 3;
+export function isLeidenBrightspace(baseUrl) {
+    try {
+        return new URL(baseUrl).hostname.toLowerCase() === LEIDEN_HOST;
+    }
+    catch {
+        return false;
+    }
+}
+function isSurfconext(rawUrl) {
+    try {
+        const url = new URL(rawUrl);
+        return url.protocol === "https:" && url.hostname.toLowerCase() === SURFCONEXT_HOST;
+    }
+    catch {
+        return false;
+    }
+}
+function isMicrosoftEntra(rawUrl) {
+    try {
+        const url = new URL(rawUrl);
+        return url.protocol === "https:" && url.hostname.toLowerCase() === ENTRA_HOST;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Brightspace sends Leiden users straight to SURFconext's account picker.
+ * Choosing the Entra entry there is the only Leiden-specific step; the
+ * Microsoft sign-in after it is the shared flow.
+ */
+export class LeidenSSOFlow {
+    common;
+    wayfEntryMisses = 0;
+    constructor(config) {
+        this.common = new PurdueSSOFlow(config);
+    }
+    hasCredentials() {
+        return this.common.hasCredentials();
+    }
+    rememberMfaResult() {
+        return this.common.rememberMfaResult();
+    }
+    async selectIdentityProvider(page) {
+        await this.chooseLeidenAccount(page);
+    }
+    async identifyAccount(page) {
+        return this.common.identifyAccount(page);
+    }
+    async login(page) {
+        await this.chooseLeidenAccount(page);
+        // The Microsoft sign-in flow below is shared with Purdue and fills
+        // whatever email/password fields it finds without checking where it is.
+        // Refuse to hand it the page at all unless SURFconext actually landed on
+        // Microsoft Entra: a redirect to a lookalike host must never reach the
+        // point where credentials get typed.
+        if (!isMicrosoftEntra(page.url())) {
+            throw new UnsupportedAuthenticationError("Leiden sign-in reached an unsupported identity-provider page. No credentials were entered there.");
+        }
+        return this.common.login(page);
+    }
+    async chooseLeidenAccount(page) {
+        if (!isSurfconext(page.url()))
+            return;
+        // The redirect back to Brightspace also passes through SURFconext.
+        if (!await page.locator(WAYF_SEARCH).first().isVisible().catch(() => false))
+            return;
+        const entry = page.locator(LEIDEN_WAYF_ENTRY).first();
+        if (!await entry.isVisible().catch(() => false)) {
+            this.wayfEntryMisses++;
+            // A lazily rendered account list can miss the first poll or two on a
+            // working account; only a miss that survives several polls means
+            // SURFconext genuinely stopped offering the Leiden entry.
+            if (this.wayfEntryMisses > MAX_WAYF_ENTRY_MISSES) {
+                throw new UnsupportedAuthenticationError("SURFconext no longer offers the Leiden University (Entra) account. Sign in with D2L_HEADLESS=false and pick the account manually.");
+            }
+            return;
+        }
+        this.wayfEntryMisses = 0;
+        log("INFO", "Choosing Leiden University (Entra) on SURFconext");
+        await entry.click();
+    }
+}

package/build/auth/sso-flow.js

@@ -8,6 +8,7 @@ import { SunySSOFlow, isSunyBrightspace } from "./suny-sso.js";
 import { WesternSSOFlow, isWesternBrightspace } from "./western-sso.js";
 import { TUDelftSSOFlow, isTUDelftBrightspace } from "./tudelft-sso.js";
 import { CunySSOFlow, isCunyBrightspace } from "./cuny-sso.js";
+import { LeidenSSOFlow, isLeidenBrightspace } from "./leiden-sso.js";
 import { BrowserAuthError } from "../utils/errors.js";
 import { AUTH_COMMAND } from "../utils/commands.js";
 export class UnsupportedAuthenticationError extends BrowserAuthError {
@@ -50,6 +51,9 @@ export function createSSOFlow(config, requestMfaCode, onMfaChallenge) {
     if (isTUDelftBrightspace(config.baseUrl)) {
         return new TUDelftSSOFlow(credentials);
     }
+    if (isLeidenBrightspace(config.baseUrl)) {
+        return new LeidenSSOFlow(credentials);
+    }
     if (isSunyBrightspace(config.baseUrl)) {
         return new SunySSOFlow({ ...credentials, campus: config.campus });
     }

package/build/setup.js

@@ -31,6 +31,13 @@ export const SCHOOL_PRESETS = {
         mfaNote: "NetID sign-in normally runs headlessly without MFA.",
         usernameHint: "Use your NetID, not your student email address.",
     },
+    leiden: {
+        name: "Leiden University",
+        baseUrl: "https://brightspace.universiteitleiden.nl",
+        usernameLabel: "Leiden University username",
+        mfaNote: "Leiden usually asks for a code from your authenticator app, which you can type here.",
+        usernameHint: "Use the full address you sign in to Microsoft with, e.g. s1234567@vuw.leidenuniv.nl.",
+    },
     purdue: {
         name: "Purdue University",
         baseUrl: "https://purdue.brightspace.com",

package/build/utils/html-converter.js

@@ -60,9 +60,70 @@ function getTurndownService() {
                 return body ? `\n\n${body}\n\n` : "";
             },
         });
+        // D2L appends per-session query params (d2lSessionVal, d2lSecureSessionVal,
+        // a `_` cache-buster) to in-content hrefs. Left alone, the markdown we hand
+        // the model echoes a live session token into the chat transcript. These
+        // two rules are unshifted ahead of Turndown's built-in link/image rules
+        // (addRule always inserts at the front of the rule list), so they run
+        // first and the defaults never see the raw attribute.
+        turndownService.addRule("linkSessionTokens", {
+            filter: (node) => node.nodeName === "A" && !!node.getAttribute("href"),
+            replacement: (content, node) => {
+                const href = node.getAttribute("href") ?? "";
+                // javascript:/data: hrefs aren't content links; drop the link but
+                // keep whatever text was inside it.
+                if (isUnsafeHref(href))
+                    return content;
+                const cleaned = stripSessionParams(href).replace(/([()])/g, "\\$1");
+                const title = node.getAttribute("title");
+                const titlePart = title ? ` "${title.replace(/"/g, '\\"')}"` : "";
+                return `[${content}](${cleaned}${titlePart})`;
+            },
+        });
+        turndownService.addRule("imageSessionTokens", {
+            filter: "img",
+            replacement: (_content, node) => {
+                const el = node;
+                const alt = el.getAttribute("alt") ?? "";
+                const src = stripSessionParams(el.getAttribute("src") ?? "");
+                const title = el.getAttribute("title");
+                const titlePart = title ? ` "${title}"` : "";
+                return src ? `![${alt}](${src}${titlePart})` : "";
+            },
+        });
     }
     return turndownService;
 }
+const SESSION_QUERY_PARAMS = new Set(["d2lsessionval", "d2lsecuresessionval", "_"]);
+/**
+ * Strip D2L's per-session query params (`d2lSessionVal`, `d2lSecureSessionVal`,
+ * and the `_` cache-buster) from a URL. Everything else about the URL --
+ * scheme, path, other params -- is left untouched, including a relative href,
+ * which is returned as-is apart from this filtering.
+ */
+function stripSessionParams(url) {
+    const queryStart = url.indexOf("?");
+    if (queryStart < 0)
+        return url;
+    const earlyHash = url.indexOf("#");
+    if (earlyHash >= 0 && earlyHash < queryStart) {
+        // The "?" falls inside the fragment (e.g. "#frag?x=1"), not a real query
+        // string -- nothing to strip, and treating it as one would mangle the
+        // fragment.
+        return url;
+    }
+    const hashStart = url.indexOf("#", queryStart);
+    const query = url.slice(queryStart + 1, hashStart < 0 ? undefined : hashStart);
+    const hash = hashStart < 0 ? "" : url.slice(hashStart);
+    const kept = query
+        .split("&")
+        .filter((param) => param !== "" && !SESSION_QUERY_PARAMS.has(param.split("=")[0].toLowerCase()));
+    return url.slice(0, queryStart) + (kept.length > 0 ? `?${kept.join("&")}` : "") + hash;
+}
+/** True for `javascript:`/`data:` hrefs -- never a legitimate content link. */
+function isUnsafeHref(href) {
+    return /^\s*(javascript|data):/i.test(href);
+}
 /** A cell's text, flattened so one table cell stays one table cell. */
 function cellText(content) {
     return content

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "3.8.12",
+  "version": "3.8.14",
   "mcpName": "io.github.rohanmuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",