brightspace-mcp-server 3.9.12 → 3.9.14

package/build/auth/purdue-sso.js

@@ -295,11 +295,18 @@ export class PurdueSSOFlow {
         return await this.hasCoVisiblePassword(page) && !await this.anyVisible(page, EMAIL_SELECTORS);
     }
     async hasPostCredentialChallenge(page) {
+        // Entra can land directly on its bare verification-code form - no
+        // number-match digits, no #idDiv_SAOTCAS_Title/#idDiv_SAOTCC_Title
+        // heading - when resuming a restored session. Without MFA_CODE_SELECTORS
+        // here, login() concluded no challenge was present and re-ran
+        // enterCredentials against a page with no username/password field.
+        // Idea from ElliotDrel/brightspace-mcp (branch codex/purdue-totp).
         return this.duoMfa.isChallenge(page) || await this.anyVisible(page, [
             NUMBER_MATCH_SELECTOR,
             "#idDiv_SAOTCAS_Title",
             "#idDiv_SAOTCC_Title",
             "#KmsiCheckboxField",
+            ...MFA_CODE_SELECTORS,
         ]);
     }
     /** Brightspace Bar's bounded number/auth/KMSI polling loop. */

package/build/tools/get-assignments.js

@@ -156,6 +156,16 @@ export async function fetchCourseAssignments(apiClient, courseId, baseUrl) {
                     log("DEBUG", `Failed to fetch feedback for folder ${folder.Id}`, error);
                 }
             }
+            // Instructor-provided URL links attached to the folder. Omitted
+            // entirely (rather than an empty array) when the folder has none, to
+            // keep the common case's shape exactly as it was.
+            // Adapted from LunaParker/brightspace-mcp-server (MIT).
+            // D2L's field for the link's display text is `LinkName`; `Title` is
+            // kept as a fallback for tenants observed sending that spelling
+            // instead. Adapted from JhostinAleck/brightspace-mcp (MIT).
+            const linkAttachments = (folder.LinkAttachments ?? [])
+                .filter((l) => Boolean(l.Href))
+                .map((l) => ({ name: l.LinkName ?? l.Title ?? l.Href ?? null, url: l.Href }));
             // Build assignment object
             const assignment = {
                 type: "assignment",
@@ -169,6 +179,7 @@ export async function fetchCourseAssignments(apiClient, courseId, baseUrl) {
                 dueIn: dueIn(folder.DueDate),
                 points: folder.Assessment?.ScoreDenominator ?? null,
                 isGroup: folder.GroupTypeId !== null,
+                ...(linkAttachments.length > 0 ? { linkAttachments } : {}),
                 rubric: folder.Assessment?.Rubrics?.map((r) => ({
                     name: r.Name,
                     criteria: r.Criteria?.map((c) => ({

package/build/tools/get-my-grades.js

@@ -6,9 +6,10 @@
 import { DEFAULT_CACHE_TTLS } from "../api/index.js";
 import { fetchAllItems } from "../api/paginate.js";
 import { GetMyGradesSchema, } from "./schemas.js";
-import { toolResponse, sanitizeError } from "./tool-helpers.js";
+import { toolResponse, sanitizeError, errorResponse } from "./tool-helpers.js";
 import { log } from "../utils/logger.js";
 import { applyCourseFilter } from "../utils/course-filter.js";
+import { gradebookUrl } from "../utils/deep-links.js";
 /**
  * Register get_my_grades tool
  */
@@ -25,9 +26,27 @@ export function registerGetMyGrades(server, apiClient, config) {
             // Single course case
             if (courseId) {
                 const path = apiClient.le(courseId, "/grades/values/myGradeValues/");
-                const gradeValues = await apiClient.get(path, {
-                    ttl: DEFAULT_CACHE_TTLS.grades,
-                });
+                let gradeValues;
+                try {
+                    gradeValues = await apiClient.get(path, {
+                        ttl: DEFAULT_CACHE_TTLS.grades,
+                    });
+                }
+                catch (error) {
+                    // A 403 here means the tenant restricts the grade API for this
+                    // course (an institutional policy, not a bug). The error shape
+                    // stays the same plain isError text result every other tool
+                    // error uses -- only the text itself changes, naming the
+                    // gradebook URL so the student can see their grade there
+                    // instead.
+                    if (error?.status === 403) {
+                        const url = gradebookUrl(config.baseUrl, courseId);
+                        log("INFO", `get_my_grades: 403 for course ${courseId} - grade API access restricted`);
+                        return errorResponse("Your institution restricts grade API access for this course. " +
+                            `View your grades directly in Brightspace: ${url}`);
+                    }
+                    throw error;
+                }
                 // Map to clean objects
                 const grades = gradeValues.map((gv) => ({
                     name: gv.GradeObjectName,
@@ -78,26 +97,43 @@ export function registerGetMyGrades(server, apiClient, config) {
                         lastModified: gv.LastModified,
                     }));
                     return {
+                        restricted: false,
                         courseId: item.OrgUnit.Id,
                         courseName: item.OrgUnit.Name,
                         grades,
                     };
                 }
                 catch (error) {
-                    // 403 means no access (past course, etc) - log and skip
+                    // A 403 means the tenant restricts the grade API for this course
+                    // (an institutional policy, not missing access like a dropped
+                    // past course). Rather than dropping the course with no trace,
+                    // it is surfaced in a separate, purely additive
+                    // `restrictedCourses` array; `courses` itself is unaffected.
                     if (error?.status === 403) {
-                        log("DEBUG", `get_my_grades: 403 Forbidden for course ${item.OrgUnit.Id} (${item.OrgUnit.Name}) - skipping`);
-                        return null;
+                        log("DEBUG", `get_my_grades: 403 Forbidden for course ${item.OrgUnit.Id} (${item.OrgUnit.Name}) - grade API access restricted`);
+                        return {
+                            restricted: true,
+                            courseId: item.OrgUnit.Id,
+                            courseName: item.OrgUnit.Name,
+                            gradeUrl: gradebookUrl(config.baseUrl, item.OrgUnit.Id),
+                        };
                     }
                     throw error; // Re-throw other errors
                 }
             });
             const results = await Promise.allSettled(gradePromises);
-            const courses = results
-                .filter((r) => r.status === "fulfilled" && r.value !== null)
+            const settled = results
+                .filter((r) => r.status === "fulfilled")
                 .map((r) => r.value);
-            log("INFO", `get_my_grades: Retrieved grades for ${courses.length} courses (out of ${enrollmentItems.length} enrolled)`);
-            return toolResponse({ courses });
+            const courses = settled
+                .filter((r) => !r.restricted)
+                .map(({ restricted: _restricted, ...rest }) => rest);
+            const restrictedCourses = settled
+                .filter((r) => r.restricted)
+                .map(({ restricted: _restricted, ...rest }) => rest);
+            log("INFO", `get_my_grades: Retrieved grades for ${courses.length} courses, ` +
+                `${restrictedCourses.length} restricted (out of ${enrollmentItems.length} enrolled)`);
+            return toolResponse({ courses, restrictedCourses });
         }
         catch (error) {
             return sanitizeError(error);

package/build/utils/file-validator.js

@@ -85,6 +85,11 @@ export const ALLOWED_MIME_TYPES = [
     // Archives
     "application/zip",
     "application/x-zip-compressed",
+    "application/x-7z-compressed",
+    "application/gzip",
+    "application/x-gzip",
+    "application/x-tar",
+    "application/x-bzip2",
     // Media
     "video/mp4",
     "audio/mpeg",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "3.9.12",
+  "version": "3.9.14",
   "mcpName": "io.github.rohanmuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",