brightspace-mcp-server 3.9.13 → 3.9.15

package/build/tools/get-assignments.js

@@ -129,8 +129,14 @@ export async function fetchCourseAssignments(apiClient, courseId, baseUrl) {
             // Skip hidden folders
             if (folder.IsHidden)
                 continue;
-            // Fetch submissions for this folder
+            // Fetch submissions for this folder. Some tenants deny students access
+            // to mysubmissions outright (403), in which case an empty list would be
+            // indistinguishable from genuinely unsubmitted work — track whether the
+            // answer is actually known so the caller never reports denied-but-real
+            // work as missing.
+            // Adapted from JoshuaMontclair/brightspace-mcp-server (MIT).
             let submissions = [];
+            let submissionsKnown = true;
             try {
                 const submissionsRaw = await apiClient.get(apiClient.le(courseId, `/dropbox/folders/${folder.Id}/submissions/mysubmissions/`), { ttl: DEFAULT_CACHE_TTLS.assignments });
                 submissions = Array.isArray(submissionsRaw) ? submissionsRaw : submissionsRaw.Objects ?? [];
@@ -138,9 +144,10 @@ export async function fetchCourseAssignments(apiClient, courseId, baseUrl) {
             catch (error) {
                 if (isAuthUnavailable(error))
                     throw error;
-                // 404 means no submissions yet - that's fine
+                // 404 is how D2L reports "nothing submitted yet" - that one is known.
                 if (error?.status !== 404) {
-                    log("DEBUG", `Failed to fetch submissions for folder ${folder.Id}`, error);
+                    submissionsKnown = false;
+                    log("DEBUG", `Could not determine submission state for folder ${folder.Id}`, error);
                 }
             }
             // Fetch feedback independently of submissions
@@ -156,6 +163,16 @@ export async function fetchCourseAssignments(apiClient, courseId, baseUrl) {
                     log("DEBUG", `Failed to fetch feedback for folder ${folder.Id}`, error);
                 }
             }
+            // Instructor-provided URL links attached to the folder. Omitted
+            // entirely (rather than an empty array) when the folder has none, to
+            // keep the common case's shape exactly as it was.
+            // Adapted from LunaParker/brightspace-mcp-server (MIT).
+            // D2L's field for the link's display text is `LinkName`; `Title` is
+            // kept as a fallback for tenants observed sending that spelling
+            // instead. Adapted from JhostinAleck/brightspace-mcp (MIT).
+            const linkAttachments = (folder.LinkAttachments ?? [])
+                .filter((l) => Boolean(l.Href))
+                .map((l) => ({ name: l.LinkName ?? l.Title ?? l.Href ?? null, url: l.Href }));
             // Build assignment object
             const assignment = {
                 type: "assignment",
@@ -169,6 +186,7 @@ export async function fetchCourseAssignments(apiClient, courseId, baseUrl) {
                 dueIn: dueIn(folder.DueDate),
                 points: folder.Assessment?.ScoreDenominator ?? null,
                 isGroup: folder.GroupTypeId !== null,
+                ...(linkAttachments.length > 0 ? { linkAttachments } : {}),
                 rubric: folder.Assessment?.Rubrics?.map((r) => ({
                     name: r.Name,
                     criteria: r.Criteria?.map((c) => ({
@@ -180,6 +198,19 @@ export async function fetchCourseAssignments(apiClient, courseId, baseUrl) {
                         })) ?? [],
                     })) ?? [],
                 })) ?? null,
+                // New, additive fields: existing "submission" stays null either way
+                // when nothing is known, but submissionStatus tells apart "nothing
+                // was submitted" (404, a known answer) from "the answer is denied"
+                // (any other error), so a caller never states real work as missing.
+                submissionStatus: !submissionsKnown
+                    ? "unknown"
+                    : submissions.length > 0
+                        ? "submitted"
+                        : "not_submitted",
+                ...(submissionsKnown ? {} : {
+                    submissionStatusNote: "Brightspace did not return this assignment's submission list, so whether it was submitted " +
+                        "is unknown. Do not report it as missing or unsubmitted - tell the user to check Brightspace directly.",
+                }),
                 submission: submissions.length > 0
                     ? {
                         submittedDate: submissions[0].SubmissionDate,
@@ -300,6 +331,16 @@ export async function fetchCourseAssignments(apiClient, courseId, baseUrl) {
             // False when the tenant refused the attempts endpoint, in which case
             // every count below is null rather than a guess of zero.
             attemptsAvailable: completedAttempts !== null,
+            // New, additive field mirroring submissionStatus above: "known" is
+            // completedAttempts !== null (the same condition attemptsAvailable
+            // already tracks), named explicitly so a caller does not have to
+            // infer "unknown" from a boolean meant for something else.
+            // Adapted from JoshuaMontclair/brightspace-mcp-server (MIT).
+            attemptStatus: completedAttempts !== null ? "known" : "unknown",
+            ...(completedAttempts !== null ? {} : {
+                attemptStatusNote: "Brightspace did not provide this quiz's attempt data, so it is unknown whether it was taken. " +
+                    "Do not report it as not attempted.",
+            }),
             attemptsUsed: completedAttempts?.length ?? null,
             attemptsRemaining,
             attemptWarning,
@@ -364,7 +405,8 @@ function gradebookHeadsUp(raw, fetched, courseId, baseUrl) {
 export function registerGetAssignments(server, apiClient, config) {
     server.registerTool("get_assignments", {
         title: "Get Assignments",
-        description: "Fetch assignments and quizzes for a specific course or all enrolled courses. Shows dropbox submissions and quizzes with due dates, status, and rubric info. Use this when the user asks about assignments, homework, what to submit, quizzes, or assignment details and rubrics.",
+        description: "Fetch assignments and quizzes for a specific course or all enrolled courses. Shows dropbox submissions and quizzes with due dates, status, and rubric info. Use this when the user asks about assignments, homework, what to submit, quizzes, or assignment details and rubrics. " +
+            "Read submissionStatus/attemptStatus, not just submission/attemptsUsed, to decide whether something was turned in: some tenants deny students access to submission or attempt data, in which case the status is \"unknown\" even though submission is null or attemptsUsed is 0. Never report an \"unknown\" item as missing, unsubmitted, or not attempted - say it could not be verified and point the user to Brightspace.",
         inputSchema: GetAssignmentsSchema,
     }, async (args) => {
         try {

package/build/tools/get-my-grades.js

@@ -6,9 +6,10 @@
 import { DEFAULT_CACHE_TTLS } from "../api/index.js";
 import { fetchAllItems } from "../api/paginate.js";
 import { GetMyGradesSchema, } from "./schemas.js";
-import { toolResponse, sanitizeError } from "./tool-helpers.js";
+import { toolResponse, sanitizeError, errorResponse } from "./tool-helpers.js";
 import { log } from "../utils/logger.js";
 import { applyCourseFilter } from "../utils/course-filter.js";
+import { gradebookUrl } from "../utils/deep-links.js";
 /**
  * Register get_my_grades tool
  */
@@ -25,9 +26,27 @@ export function registerGetMyGrades(server, apiClient, config) {
             // Single course case
             if (courseId) {
                 const path = apiClient.le(courseId, "/grades/values/myGradeValues/");
-                const gradeValues = await apiClient.get(path, {
-                    ttl: DEFAULT_CACHE_TTLS.grades,
-                });
+                let gradeValues;
+                try {
+                    gradeValues = await apiClient.get(path, {
+                        ttl: DEFAULT_CACHE_TTLS.grades,
+                    });
+                }
+                catch (error) {
+                    // A 403 here means the tenant restricts the grade API for this
+                    // course (an institutional policy, not a bug). The error shape
+                    // stays the same plain isError text result every other tool
+                    // error uses -- only the text itself changes, naming the
+                    // gradebook URL so the student can see their grade there
+                    // instead.
+                    if (error?.status === 403) {
+                        const url = gradebookUrl(config.baseUrl, courseId);
+                        log("INFO", `get_my_grades: 403 for course ${courseId} - grade API access restricted`);
+                        return errorResponse("Your institution restricts grade API access for this course. " +
+                            `View your grades directly in Brightspace: ${url}`);
+                    }
+                    throw error;
+                }
                 // Map to clean objects
                 const grades = gradeValues.map((gv) => ({
                     name: gv.GradeObjectName,
@@ -78,26 +97,43 @@ export function registerGetMyGrades(server, apiClient, config) {
                         lastModified: gv.LastModified,
                     }));
                     return {
+                        restricted: false,
                         courseId: item.OrgUnit.Id,
                         courseName: item.OrgUnit.Name,
                         grades,
                     };
                 }
                 catch (error) {
-                    // 403 means no access (past course, etc) - log and skip
+                    // A 403 means the tenant restricts the grade API for this course
+                    // (an institutional policy, not missing access like a dropped
+                    // past course). Rather than dropping the course with no trace,
+                    // it is surfaced in a separate, purely additive
+                    // `restrictedCourses` array; `courses` itself is unaffected.
                     if (error?.status === 403) {
-                        log("DEBUG", `get_my_grades: 403 Forbidden for course ${item.OrgUnit.Id} (${item.OrgUnit.Name}) - skipping`);
-                        return null;
+                        log("DEBUG", `get_my_grades: 403 Forbidden for course ${item.OrgUnit.Id} (${item.OrgUnit.Name}) - grade API access restricted`);
+                        return {
+                            restricted: true,
+                            courseId: item.OrgUnit.Id,
+                            courseName: item.OrgUnit.Name,
+                            gradeUrl: gradebookUrl(config.baseUrl, item.OrgUnit.Id),
+                        };
                     }
                     throw error; // Re-throw other errors
                 }
             });
             const results = await Promise.allSettled(gradePromises);
-            const courses = results
-                .filter((r) => r.status === "fulfilled" && r.value !== null)
+            const settled = results
+                .filter((r) => r.status === "fulfilled")
                 .map((r) => r.value);
-            log("INFO", `get_my_grades: Retrieved grades for ${courses.length} courses (out of ${enrollmentItems.length} enrolled)`);
-            return toolResponse({ courses });
+            const courses = settled
+                .filter((r) => !r.restricted)
+                .map(({ restricted: _restricted, ...rest }) => rest);
+            const restrictedCourses = settled
+                .filter((r) => r.restricted)
+                .map(({ restricted: _restricted, ...rest }) => rest);
+            log("INFO", `get_my_grades: Retrieved grades for ${courses.length} courses, ` +
+                `${restrictedCourses.length} restricted (out of ${enrollmentItems.length} enrolled)`);
+            return toolResponse({ courses, restrictedCourses });
         }
         catch (error) {
             return sanitizeError(error);

package/build/utils/config.js

@@ -7,15 +7,33 @@ import * as path from "node:path";
 import * as os from "node:os";
 import { createHash } from "node:crypto";
 import dotenv from "dotenv";
-import { configStoreExists, loadConfigStore } from "./config-store.js";
+import { configStoreExists, getConfigStorePath, loadConfigStore } from "./config-store.js";
 import { resolveStoredPassword } from "./secure-config.js";
 import { migrateLegacyState } from "../auth/legacy-state.js";
 export async function loadConfig() {
     dotenv.config({ quiet: true });
-    const store = configStoreExists() ? loadConfigStore() : null;
+    // A corrupt or permission-denied config.json must not take the whole server
+    // down at startup: env vars alone are a complete, if less convenient,
+    // configuration. The failure is still surfaced loudly (never silent) so a
+    // broken file doesn't masquerade as "no config.json was ever created".
+    // Idea from lmgveerhoek's fork (MIT).
+    let store = null;
+    let storeLoadError;
+    if (configStoreExists()) {
+        try {
+            store = loadConfigStore();
+        }
+        catch (error) {
+            storeLoadError = error;
+        }
+    }
     if (store) {
         console.error("[config] Loaded base config from ~/.brightspace-mcp/config.json");
     }
+    else if (storeLoadError) {
+        console.error(`[config] WARN: Failed to read ${getConfigStorePath()} (${storeLoadError instanceof Error ? storeLoadError.message : String(storeLoadError)}); ` +
+            "continuing with environment variables only.");
+    }
     else {
         console.error("[config] No config.json found, using environment variables");
     }

package/build/utils/file-validator.js

@@ -85,6 +85,11 @@ export const ALLOWED_MIME_TYPES = [
     // Archives
     "application/zip",
     "application/x-zip-compressed",
+    "application/x-7z-compressed",
+    "application/gzip",
+    "application/x-gzip",
+    "application/x-tar",
+    "application/x-bzip2",
     // Media
     "video/mp4",
     "audio/mpeg",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "3.9.13",
+  "version": "3.9.15",
   "mcpName": "io.github.rohanmuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",