brightspace-mcp-server 5.1.19 → 5.1.20

package/build/api/client.js

@@ -7,7 +7,7 @@ import { DEFAULT_CACHE_TTLS } from "./types.js";
 import { TTLCache } from "./cache.js";
 import { TokenBucket } from "./rate-limiter.js";
 import { discoverVersions } from "./version-discovery.js";
-import { ApiError, RateLimitError, NetworkError } from "./errors.js";
+import { ApiError, CredentialRejectedError, RateLimitError, NetworkError } from "./errors.js";
 import { withRetry, isRetryableFailure, retryAfterMsFrom, parseRetryAfter, } from "./retry.js";
 import { log } from "../utils/logger.js";
 import { AUTH_COMMAND } from "../utils/commands.js";
@@ -475,7 +475,9 @@ export class D2LApiClient {
             }
             log("WARN", "Auto-reauthentication did not produce a valid token");
         }
-        throw new ApiError(401, path, this.authExpiredMessage ?? `Session expired. Please re-authenticate via ${AUTH_COMMAND}.`);
+        if (this.authExpiredMessage)
+            throw new CredentialRejectedError(path, this.authExpiredMessage);
+        throw new ApiError(401, path, `Session expired. Please re-authenticate via ${AUTH_COMMAND}.`);
     }
     /**
      * Make one HTTP request. Authentication recovery is shared with raw downloads.

package/build/api/errors.js

@@ -17,6 +17,19 @@ export class ApiError extends AuthError {
         this.name = "ApiError";
     }
 }
+/**
+ * A 401 for a credential pasted into the environment (D2L_ACCESS_TOKEN or
+ * D2L_SESSION_COOKIE). No browser sign-in stands behind it, so the user is
+ * told how to replace the credential rather than to run the auth command.
+ */
+export class CredentialRejectedError extends ApiError {
+    guidance;
+    constructor(endpoint, guidance) {
+        super(401, endpoint, guidance);
+        this.guidance = guidance;
+        this.name = "CredentialRejectedError";
+    }
+}
 // Generic HTTP error (non-401/429) - semantic alias for ApiError
 export class HttpError extends ApiError {
     constructor(status, endpoint, message, responseBody, cause) {

package/build/api/index.js

@@ -12,5 +12,5 @@ export { discoverVersions } from "./version-discovery.js";
 export { TTLCache } from "./cache.js";
 export { TokenBucket } from "./rate-limiter.js";
 // Errors
-export { ApiError, RateLimitError, NetworkError } from "./errors.js";
+export { ApiError, CredentialRejectedError, RateLimitError, NetworkError } from "./errors.js";
 export { DEFAULT_CACHE_TTLS } from "./types.js";

package/build/tools/get-announcements.js

@@ -6,7 +6,7 @@
 import { DEFAULT_CACHE_TTLS } from "../api/index.js";
 import { fetchAllItems } from "../api/paginate.js";
 import { GetAnnouncementsSchema, } from "./schemas.js";
-import { toolResponse, toolResponseWithNotice, sanitizeError, isAuthUnavailable, authPendingNotice } from "./tool-helpers.js";
+import { toolResponse, toolResponseWithNotice, sanitizeError, isAuthUnavailable, authPendingNotice, throwIfCredentialRejected } from "./tool-helpers.js";
 import { log } from "../utils/logger.js";
 import { applyCourseFilter } from "../utils/course-filter.js";
 import { matchesModifiedSince } from "../utils/modified-since.js";
@@ -150,6 +150,7 @@ export function registerGetAnnouncements(server, apiClient, config) {
                     // answered, so the result says so instead of reporting zero
                     // announcements as if that were a real measurement.
                     if (isAuthUnavailable(error)) {
+                        throwIfCredentialRejected(error);
                         log("DEBUG", `get_announcements: sign-in pending for course ${courseId}`, error);
                         const notice = "Sign-in to Brightspace is still in progress, so announcements for this course " +
                             `could not be fetched yet. ${authPendingNotice(error)} Call get_announcements again ` +
@@ -250,6 +251,8 @@ export function registerGetAnnouncements(server, apiClient, config) {
             // always a bare array — a shape change would break every existing
             // caller — so a pending course adds a second content block carrying
             // the notice instead of changing content[0].
+            if (pending.length > 0)
+                throwIfCredentialRejected(pending[0].authError);
             if (!modifiedSince) {
                 if (pending.length === 0)
                     return arrayPage(announcements, pagination);

package/build/tools/get-assignments.js

@@ -6,7 +6,7 @@
 import { DEFAULT_CACHE_TTLS } from "../api/index.js";
 import { fetchAllItems, fetchAllObjects } from "../api/paginate.js";
 import { GetAssignmentsSchema } from "./schemas.js";
-import { toolResponse, sanitizeError, isAuthUnavailable, authPendingNotice } from "./tool-helpers.js";
+import { toolResponse, sanitizeError, isAuthUnavailable, authPendingNotice, throwIfCredentialRejected } from "./tool-helpers.js";
 import { convertHtmlToMarkdown } from "../utils/html-converter.js";
 import { log } from "../utils/logger.js";
 import { applyCourseFilter } from "../utils/course-filter.js";
@@ -892,6 +892,7 @@ export function registerGetAssignments(server, apiClient, config) {
                     // keep working — with authPending/notice added for callers that
                     // want to tell "no assignments" apart from "couldn't check".
                     if (isAuthUnavailable(error)) {
+                        throwIfCredentialRejected(error);
                         log("DEBUG", `get_assignments: sign-in pending for course ${courseId}`, error);
                         return toolResponse({
                             courseId,
@@ -983,6 +984,7 @@ export function registerGetAssignments(server, apiClient, config) {
                 ],
             };
             if (pending.length > 0) {
+                throwIfCredentialRejected(pending[0].authError);
                 response.authPending = true;
                 response.unavailableCourseIds = pending.map((c) => c.courseId);
                 response.notice =

package/build/tools/get-calendar-events.js

@@ -4,7 +4,7 @@
  * Licensed under MIT — see LICENSE file for details.
  */
 import { GetCalendarEventsSchema } from "./schemas.js";
-import { toolResponse, toolResponseWithNotice, errorResponse, sanitizeError, isAuthUnavailable, authPendingNotice } from "./tool-helpers.js";
+import { toolResponse, toolResponseWithNotice, errorResponse, sanitizeError, isAuthUnavailable, authPendingNotice, throwIfCredentialRejected } from "./tool-helpers.js";
 import { log } from "../utils/logger.js";
 import { resolveCourses } from "./resolve-courses.js";
 import { fetchCourseCalendarEvents } from "./calendar-events.js";
@@ -67,6 +67,7 @@ export function registerGetCalendarEvents(server, apiClient, config) {
             // which names which course ids are unavailable.
             const notices = [];
             if (pendingCourseIds.length > 0) {
+                throwIfCredentialRejected(firstAuthError);
                 notices.push("Sign-in to Brightspace is still in progress, so calendar events for " +
                     `${pendingCourseIds.length} course(s) (${pendingCourseIds.join(", ")}) could not be fetched ` +
                     `yet. ${authPendingNotice(firstAuthError)} Call get_calendar_events again once sign-in finishes.`);

package/build/tools/get-my-grades.js

@@ -6,7 +6,7 @@
 import { DEFAULT_CACHE_TTLS } from "../api/index.js";
 import { fetchAllItems, fetchAllObjects } from "../api/paginate.js";
 import { GetMyGradesSchema, } from "./schemas.js";
-import { toolResponse, sanitizeError, errorResponse, isAuthUnavailable, authPendingNotice, } from "./tool-helpers.js";
+import { toolResponse, sanitizeError, errorResponse, isAuthUnavailable, authPendingNotice, throwIfCredentialRejected, } from "./tool-helpers.js";
 import { log } from "../utils/logger.js";
 import { applyCourseFilter } from "../utils/course-filter.js";
 import { gradebookUrl, quizUrl } from "../utils/deep-links.js";
@@ -115,6 +115,7 @@ export function registerGetMyGrades(server, apiClient, config) {
                     // working — with authPending/notice added for callers that want
                     // to tell "no grades" apart from "couldn't check".
                     if (isAuthUnavailable(error)) {
+                        throwIfCredentialRejected(error);
                         log("DEBUG", `get_my_grades: sign-in pending for course ${courseId}`, error);
                         return toolResponse({
                             courseId,
@@ -260,6 +261,7 @@ export function registerGetMyGrades(server, apiClient, config) {
             };
             const notices = [];
             if (pending.length > 0) {
+                throwIfCredentialRejected(pending[0].authError);
                 response.authPending = true;
                 response.unavailableCourseIds = pending.map((c) => c.courseId);
                 notices.push("Sign-in to Brightspace is still in progress, so grades for " +

package/build/tools/get-roster.js

@@ -6,7 +6,7 @@
 import { DEFAULT_CACHE_TTLS } from "../api/index.js";
 import { fetchAllObjects } from "../api/paginate.js";
 import { GetRosterSchema, } from "./schemas.js";
-import { toolResponse, sanitizeError, isAuthUnavailable, authPendingNotice } from "./tool-helpers.js";
+import { toolResponse, sanitizeError, isAuthUnavailable, authPendingNotice, throwIfCredentialRejected } from "./tool-helpers.js";
 import { log } from "../utils/logger.js";
 // Purdue-specific role IDs. These are institution-specific values.
 // If using at another institution, you may need to adjust these.
@@ -80,6 +80,8 @@ export function registerGetRoster(server, apiClient) {
                     // roster that lost its TAs to a pending sign-in should still show
                     // the instructor it already has.
                     authFailure = [instructorResult, taResult].find((r) => r.status === "rejected" && isAuthUnavailable(r.reason));
+                    if (authFailure)
+                        throwIfCredentialRejected(authFailure.reason);
                     // Merge results
                     if (instructorResult.status === "fulfilled") {
                         allUsers.push(...instructorResult.value);
@@ -169,6 +171,7 @@ export function registerGetRoster(server, apiClient) {
                 // authPending/notice added for callers that want to tell "empty
                 // roster" apart from "couldn't check".
                 if (isAuthUnavailable(error)) {
+                    throwIfCredentialRejected(error);
                     log("DEBUG", `get_roster: sign-in pending for course ${courseId}`, error);
                     return toolResponse({
                         courseId,

package/build/tools/get-upcoming-due-dates.js

@@ -6,7 +6,7 @@
 import { DEFAULT_CACHE_TTLS } from "../api/index.js";
 import { fetchAllObjects } from "../api/paginate.js";
 import { GetUpcomingDueDatesSchema, } from "./schemas.js";
-import { toolResponse, toolResponseWithNotice, sanitizeError, isAuthUnavailable, authPendingNotice } from "./tool-helpers.js";
+import { toolResponse, toolResponseWithNotice, sanitizeError, isAuthUnavailable, authPendingNotice, throwIfCredentialRejected } from "./tool-helpers.js";
 import { log } from "../utils/logger.js";
 import { quizUrl, discussionUrl } from "../utils/deep-links.js";
 import { assignmentLinkResolver } from "./assignment-links.js";
@@ -242,6 +242,7 @@ export function registerGetUpcomingDueDates(server, apiClient, config) {
             if (pendingCourseIds.length === 0) {
                 return toolResponse(upcoming);
             }
+            throwIfCredentialRejected(firstAuthError);
             return toolResponseWithNotice(upcoming, "Sign-in to Brightspace is still in progress, so upcoming due dates for " +
                 `${pendingCourseIds.length} course(s) (${pendingCourseIds.join(", ")}) could not be fetched ` +
                 `yet. ${authPendingNotice(firstAuthError)} Call get_upcoming_due_dates again once sign-in finishes.`);

package/build/tools/tool-helpers.js

@@ -5,7 +5,7 @@
  */
 import { ZodError } from "zod";
 import { ApiError, RateLimitError, NetworkError } from "../api/index.js";
-import { TokenRefreshError } from "../api/errors.js";
+import { CredentialRejectedError, TokenRefreshError } from "../api/errors.js";
 import { AuthProcessError } from "../auth/auth-runner.js";
 import { log } from "../utils/logger.js";
 import { AUTH_COMMAND } from "../utils/commands.js";
@@ -226,6 +226,16 @@ export function authPendingNotice(error) {
     return "Authentication expired. Auto-reauthentication was attempted but failed. " +
         `Please run \`${AUTH_COMMAND}\` in your terminal, then try again.`;
 }
+/**
+ * A rejected pasted credential (D2L_ACCESS_TOKEN or D2L_SESSION_COOKIE) never
+ * recovers by waiting, unlike a pending sign-in. Tools call this before
+ * reporting "sign-in is still in progress", so the whole call fails instead
+ * and sanitizeError tells the user how to replace the credential.
+ */
+export function throwIfCredentialRejected(error) {
+    if (error instanceof CredentialRejectedError)
+        throw error;
+}
 /**
  * Sanitize errors for user-friendly messages
  *
@@ -263,6 +273,9 @@ function describeError(error) {
         if (error.status === 404) {
             return errorResponse("Resource not found. The course or item may not exist, or you may not have access.");
         }
+        if (error instanceof CredentialRejectedError) {
+            return errorResponse(error.guidance);
+        }
         if (error.status === 401) {
             // A stale install is a common cause of sign-in failing, so this is the
             // one error worth attaching the update notice to.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "5.1.19",
+  "version": "5.1.20",
   "mcpName": "io.github.RohanMuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",