brightspace-mcp-server 5.1.18 → 5.1.19

package/build/auth/token-manager.js

@@ -5,6 +5,7 @@
  */
 import { SessionStore } from "./session-store.js";
 import { mintAccessToken } from "./token-mint.js";
+import { fetchXsrfToken } from "./xsrf-fetch.js";
 import { log } from "../utils/logger.js";
 import { TokenRefreshError } from "../api/errors.js";
 import { devActivity } from "../utils/dev-activity.js";
@@ -15,6 +16,8 @@ import { devActivity } from "../utils/dev-activity.js";
 const REFRESH_BUFFER_MS = 5 * 60 * 1000; // 5 minutes
 /** Matches the tokenTtl default in the app config. */
 const DEFAULT_TOKEN_TTL_SECONDS = 3600;
+/** How long a D2L_SESSION_COOKIE mint that failed in transit waits before trying again. */
+const ENV_MINT_RETRY_MS = 60 * 1000;
 /**
  * TokenManager manages token lifecycle with in-memory caching and disk persistence.
  * Handles expiry detection with a configurable refresh buffer.
@@ -25,8 +28,18 @@ export class TokenManager {
     baseUrl;
     tokenTtl;
     mint;
+    fetchXsrf;
     envAccessToken;
     envSessionCookie;
+    mintEnvCookie;
+    /** The Bearer JWT minted from envSessionCookie, memory only. */
+    envMinted = null;
+    /** The XSRF token that last minted successfully, reused for the hourly re-mint. */
+    envCsrfToken;
+    /** Set once the env cookie is known not to mint, so later calls skip straight to the passthrough. */
+    envMintDisabled = false;
+    envMintRetryAt = 0;
+    envMintInFlight = null;
     /** Single in-flight mint, so concurrent callers share one request. */
     mintInFlight = null;
     rejectedAccessToken = null;
@@ -53,8 +66,10 @@ export class TokenManager {
         this.baseUrl = options.baseUrl ? new URL(options.baseUrl).origin : undefined;
         this.tokenTtl = options.tokenTtl ?? DEFAULT_TOKEN_TTL_SECONDS;
         this.mint = options.mint ?? mintAccessToken;
+        this.fetchXsrf = options.fetchXsrf ?? fetchXsrfToken;
         this.envAccessToken = options.envAccessToken;
         this.envSessionCookie = options.envSessionCookie;
+        this.mintEnvCookie = options.mintEnvCookie ?? false;
     }
     /**
      * Get the current token if valid, otherwise null.
@@ -72,6 +87,11 @@ export class TokenManager {
         // value again. (See D2LApiClient.tryAutoReauth / authExpiredMessage for
         // the user-facing "paste a fresh one" error this produces.)
         if (this.envAccessToken || this.envSessionCookie) {
+            if (!this.envAccessToken && this.mintEnvCookie && this.baseUrl) {
+                const minted = await this.envCookieBearer(rejectedAccessToken);
+                if (minted)
+                    return minted;
+            }
             const token = this.buildEnvToken();
             if (rejectedAccessToken && token.accessToken === rejectedAccessToken) {
                 log("DEBUG", "The env-provided credential was rejected; no replacement is available");
@@ -255,6 +275,75 @@ export class TokenManager {
             cookieHeader: this.envSessionCookie,
         };
     }
+    /**
+     * The Bearer JWT minted from envSessionCookie, minting one when there is
+     * none or it expired or was just rejected. Null means use the cookie
+     * passthrough instead, which also keeps the existing "paste a fresh one"
+     * error for a dead cookie.
+     */
+    async envCookieBearer(rejectedAccessToken) {
+        if (this.envMinted && rejectedAccessToken === this.envMinted.accessToken) {
+            log("DEBUG", "The JWT minted from D2L_SESSION_COOKIE was rejected; minting again");
+            this.envMinted = null;
+        }
+        if (this.envMinted && this.isValid(this.envMinted))
+            return this.envMinted;
+        if (this.envMintDisabled || Date.now() < this.envMintRetryAt)
+            return null;
+        this.envMintInFlight ??= this.runEnvMint().finally(() => {
+            this.envMintInFlight = null;
+        });
+        return this.envMintInFlight;
+    }
+    async runEnvMint() {
+        const baseUrl = this.baseUrl;
+        const cookieHeader = this.envSessionCookie;
+        let csrfToken = this.envCsrfToken;
+        if (!csrfToken) {
+            const xsrf = await this.fetchXsrf({ baseUrl, cookieHeader });
+            if (!xsrf.ok)
+                return this.envMintFailed(xsrf.reason, xsrf.detail);
+            csrfToken = xsrf.csrfToken;
+        }
+        let result;
+        try {
+            result = await this.mint({ baseUrl, cookieHeader, csrfToken });
+        }
+        catch (error) {
+            return this.envMintFailed("transport", error instanceof Error ? error.message : String(error));
+        }
+        if (!result.ok) {
+            // A stale XSRF token is one cause of a refused mint; read a fresh one next time.
+            this.envCsrfToken = undefined;
+            return this.envMintFailed(result.reason, result.detail);
+        }
+        const now = Date.now();
+        this.envCsrfToken = csrfToken;
+        this.envMinted = {
+            accessToken: result.accessToken,
+            tenantOrigin: this.baseUrl,
+            capturedAt: now,
+            expiresAt: now + this.tokenTtl * 1000,
+            source: "env",
+            cookieHeader,
+        };
+        log("INFO", "Minted a Bearer token from D2L_SESSION_COOKIE without a browser");
+        return this.envMinted;
+    }
+    /**
+     * A dead cookie or a page with no XSRF token will not mint later either, so
+     * stop trying; a transport failure is retried after ENV_MINT_RETRY_MS.
+     */
+    envMintFailed(reason, detail) {
+        if (reason === "transport") {
+            this.envMintRetryAt = Date.now() + ENV_MINT_RETRY_MS;
+        }
+        else {
+            this.envMintDisabled = true;
+        }
+        log("DEBUG", `Could not mint from D2L_SESSION_COOKIE (${reason}${detail ? `: ${detail}` : ""}); using the cookie as-is`);
+        return null;
+    }
     /**
      * Only use persisted session material, including updates from other processes.
      */

package/build/auth/xsrf-fetch.js

@@ -0,0 +1,76 @@
+/**
+ * Brightspace MCP Server
+ * Copyright (c) 2026 Rohan Muppa. All rights reserved.
+ * Licensed under MIT: see LICENSE file for details.
+ */
+import { log } from "../utils/logger.js";
+/** Same marker token-mint.ts keys on: a dead session gets a 200 redirect stub. */
+const EXPIRED_MARKER = "/d2l/login?sessionExpired=1";
+/** Same identity the API client sends, see buildAuthHeaders in api/client.ts. */
+const USER_AGENT = "BrightspaceMCP/1.0 (Rohan Muppa; github.com/rohanmuppa/brightspace-mcp-server)";
+const DEFAULT_TIMEOUT_MS = 15000;
+/**
+ * Where a Brightspace page carries its XSRF token, most specific first.
+ *
+ * The browser path reads D2L.LP.Web.Authentication.Xsrf.GetXsrfToken(), whose
+ * value is the one the page also writes to localStorage as "XSRF.Token"
+ * (the same 32 characters). Measured against purdue.brightspace.com: the
+ * cookie-only HTML carries it in an inline
+ * `localStorage.setItem('XSRF.Token','...')`, so that is the first place to
+ * look; the meta tag is the browser path's own fallback.
+ */
+const XSRF_PATTERNS = [
+    /XSRF\.Token\\?["']\s*,\s*\\?["']([A-Za-z0-9_-]{16,})\\?["']/,
+    /<meta[^>]*name=["']d2l-xsrf-token["'][^>]*content=["']([A-Za-z0-9_-]{16,})["']/i,
+    /<meta[^>]*content=["']([A-Za-z0-9_-]{16,})["'][^>]*name=["']d2l-xsrf-token["']/i,
+];
+/** Pull the XSRF token out of a Brightspace page's HTML, or null when absent. */
+export function parseXsrfToken(html) {
+    for (const pattern of XSRF_PATTERNS) {
+        const match = pattern.exec(html);
+        if (match)
+            return match[1];
+    }
+    return null;
+}
+/**
+ * Read the XSRF token the token mint needs from /d2l/home over plain HTTP,
+ * using only the session cookies. This is what lets a pasted
+ * D2L_SESSION_COOKIE be traded for a Bearer JWT without a browser.
+ */
+export async function fetchXsrfToken({ baseUrl, cookieHeader, fetchImpl = fetch, timeoutMs = DEFAULT_TIMEOUT_MS, }) {
+    const url = `${baseUrl.replace(/\/+$/, "")}/d2l/home`;
+    let status;
+    let body;
+    let location;
+    try {
+        const response = await fetchImpl(url, {
+            method: "GET",
+            headers: { cookie: cookieHeader, "User-Agent": USER_AGENT, accept: "text/html" },
+            signal: AbortSignal.timeout(timeoutMs),
+            redirect: "manual",
+        });
+        status = response.status;
+        body = await response.text();
+        location = response.headers?.get("location") ?? null;
+    }
+    catch (error) {
+        return { ok: false, reason: "transport", detail: error instanceof Error ? error.message : String(error) };
+    }
+    if (status >= 500 || status === 429)
+        return { ok: false, reason: "transport", detail: `HTTP ${status}` };
+    // A dead session either redirects to the login page or answers 200 with the
+    // redirect stub. Either way the cookie is no good for minting.
+    if (status === 401 || body.includes(EXPIRED_MARKER) || (status >= 300 && status < 400 && location?.includes("/d2l/login"))) {
+        log("DEBUG", "The home page answered as a signed-out session");
+        return { ok: false, reason: "sessionExpired" };
+    }
+    if (status < 200 || status >= 300)
+        return { ok: false, reason: "transport", detail: `HTTP ${status}` };
+    const csrfToken = parseXsrfToken(body);
+    if (!csrfToken) {
+        log("DEBUG", "No XSRF token found in the home page HTML");
+        return { ok: false, reason: "notFound" };
+    }
+    return { ok: true, csrfToken };
+}

package/build/server.js

@@ -30,6 +30,7 @@ export function createRuntime(config, version) {
         tokenTtl: config.tokenTtl,
         envAccessToken: config.envAccessToken,
         envSessionCookie: config.envSessionCookie,
+        mintEnvCookie: true,
     });
     // D2L_ACCESS_TOKEN / D2L_SESSION_COOKIE are opt-in browser-free sign-in
     // escape hatches (Docker, headless Linux, WSL, hardware-key MFA

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "5.1.18",
+  "version": "5.1.19",
   "mcpName": "io.github.RohanMuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",