brightspace-mcp-server 5.1.26 → 5.1.28

package/build/tools/get-upcoming-due-dates.js

@@ -13,6 +13,15 @@ import { assignmentLinkResolver } from "./assignment-links.js";
 import { dueIn } from "../utils/due-in.js";
 import { resolveCourses } from "./resolve-courses.js";
 import { fetchCourseCalendarEvents, eventEndsAt } from "./calendar-events.js";
+/**
+ * Whether a failed source must be reported rather than skipped. A 403 means
+ * the tool is restricted or switched off in that course (a past course, a
+ * course with no quizzes): nothing was missed. Anything else (a 404, a 5xx, a
+ * dropped connection) leaves a hole the caller would read as "nothing due".
+ */
+function isReportableFailure(error) {
+    return error?.status !== 403;
+}
 /** D2L list endpoints return either a paged { Objects: [...] } or a flat array. */
 function unwrapList(raw) {
     return Array.isArray(raw) ? raw : (raw?.Objects ?? []);
@@ -24,11 +33,13 @@ function unwrapList(raw) {
  * hides everything inside it, however visible its topics claim to be, so it is
  * skipped without asking for its topics at all. A forum whose topics fail to
  * load (e.g. no access) is skipped rather than failing the whole course,
- * matching `getForumsOverview` in get-discussions.ts.
+ * matching `getForumsOverview` in get-discussions.ts; `incomplete` marks a
+ * skip that was not a 403, so the caller can say topics may be missing.
  */
 async function fetchDiscussionDueTopics(apiClient, courseId) {
     const forums = await apiClient.get(apiClient.le(courseId, "/discussions/forums/"), { ttl: DEFAULT_CACHE_TTLS.assignments });
     const topics = [];
+    let incomplete = false;
     for (const forum of unwrapList(forums)) {
         if (forum.IsHidden === true)
             continue;
@@ -39,10 +50,12 @@ async function fetchDiscussionDueTopics(apiClient, courseId) {
         catch (error) {
             if (isAuthUnavailable(error))
                 throw error;
+            if (isReportableFailure(error))
+                incomplete = true;
             log("DEBUG", `get_upcoming_due_dates: failed to fetch topics for forum ${forum.ForumId} in course ${courseId}`, error);
         }
     }
-    return topics;
+    return { topics, incomplete };
 }
 /**
  * Calendar events as upcoming items, minus the ones Brightspace generated from
@@ -94,6 +107,7 @@ async function fetchCourseDueItems(apiClient, baseUrl, course, from, to) {
             throw result.reason;
     }
     const items = [];
+    const unavailable = [];
     const assignmentLink = assignmentLinkResolver(apiClient, baseUrl, course.id);
     if (dropboxResult.status === "fulfilled") {
         for (const folder of unwrapList(dropboxResult.value)) {
@@ -125,6 +139,8 @@ async function fetchCourseDueItems(apiClient, baseUrl, course, from, to) {
     }
     else {
         // 403 for past courses and similar: log and keep the other courses.
+        if (isReportableFailure(dropboxResult.reason))
+            unavailable.push("assignments");
         log("DEBUG", `get_upcoming_due_dates: failed to fetch dropbox folders for course ${course.id}`, dropboxResult.reason);
     }
     if (quizResult.status === "fulfilled") {
@@ -150,10 +166,14 @@ async function fetchCourseDueItems(apiClient, baseUrl, course, from, to) {
         }
     }
     else {
+        if (isReportableFailure(quizResult.reason))
+            unavailable.push("quizzes");
         log("DEBUG", `get_upcoming_due_dates: failed to fetch quizzes for course ${course.id}`, quizResult.reason);
     }
     if (discussionResult.status === "fulfilled") {
-        for (const topic of discussionResult.value) {
+        if (discussionResult.value.incomplete)
+            unavailable.push("discussions");
+        for (const topic of discussionResult.value.topics) {
             if (topic.IsHidden === true)
                 continue;
             if (!topic.DueDate)
@@ -173,15 +193,19 @@ async function fetchCourseDueItems(apiClient, baseUrl, course, from, to) {
         }
     }
     else {
+        if (isReportableFailure(discussionResult.reason))
+            unavailable.push("discussions");
         log("DEBUG", `get_upcoming_due_dates: failed to fetch discussions for course ${course.id}`, discussionResult.reason);
     }
     if (calendarResult.status === "fulfilled") {
         items.push(...calendarItems(calendarResult.value, items));
     }
     else {
+        if (isReportableFailure(calendarResult.reason))
+            unavailable.push("calendar");
         log("DEBUG", `get_upcoming_due_dates: failed to fetch calendar events for course ${course.id}`, calendarResult.reason);
     }
-    return items;
+    return { items, unavailable };
 }
 /**
  * Register get_upcoming_due_dates tool
@@ -209,16 +233,28 @@ export function registerGetUpcomingDueDates(server, apiClient, config) {
             // have gone out independently. Collect it rather than failing the
             // whole call and losing every course that *did* answer.
             const pendingCourseIds = [];
+            // Anything else that failed still must not make items vanish: an
+            // assignment missing from a list that looks complete reads as
+            // "nothing due" (#383).
+            const failedCourses = [];
             let firstAuthError = null;
             const items = results.flatMap((result, i) => {
-                if (result.status === "fulfilled")
-                    return result.value;
+                if (result.status === "fulfilled") {
+                    if (result.value.unavailable.length > 0) {
+                        failedCourses.push({ courseId: courses[i].id, sources: result.value.unavailable });
+                    }
+                    return result.value.items;
+                }
                 if (isAuthUnavailable(result.reason)) {
                     pendingCourseIds.push(courses[i].id);
                     firstAuthError ??= result.reason;
                     log("DEBUG", `get_upcoming_due_dates: sign-in pending for course ${courses[i].id}`, result.reason);
                     return [];
                 }
+                failedCourses.push({
+                    courseId: courses[i].id,
+                    sources: ["assignments", "quizzes", "discussions", "calendar"],
+                });
                 log("DEBUG", "get_upcoming_due_dates: skipping course after fetch failure", result.reason);
                 return [];
             });
@@ -234,18 +270,30 @@ export function registerGetUpcomingDueDates(server, apiClient, config) {
             })
                 .sort((a, b) => new Date(a.dueDate).getTime() - new Date(b.dueDate).getTime());
             log("INFO", `get_upcoming_due_dates: Retrieved ${upcoming.length} items across ${courses.length} courses` +
-                (pendingCourseIds.length > 0 ? ` (${pendingCourseIds.length} pending sign-in)` : ""));
+                (pendingCourseIds.length > 0 ? ` (${pendingCourseIds.length} pending sign-in)` : "") +
+                (failedCourses.length > 0 ? ` (${failedCourses.length} incomplete)` : ""));
             // The response is always a bare array, pending sign-in or not — a
-            // shape change would break every existing caller. A pending course
-            // instead adds a second content block carrying the notice, which
-            // names which course ids are unavailable.
-            if (pendingCourseIds.length === 0) {
+            // shape change would break every existing caller. A pending or
+            // incomplete course instead adds a second content block carrying the
+            // notice, which names which course ids are unavailable.
+            const notices = [];
+            if (pendingCourseIds.length > 0) {
+                throwIfCredentialRejected(firstAuthError);
+                notices.push("Sign-in to Brightspace is still in progress, so upcoming due dates for " +
+                    `${pendingCourseIds.length} course(s) (${pendingCourseIds.join(", ")}) could not be fetched ` +
+                    `yet. ${authPendingNotice(firstAuthError)} Call get_upcoming_due_dates again once sign-in finishes.`);
+            }
+            if (failedCourses.length > 0) {
+                const listed = failedCourses
+                    .map(({ courseId, sources }) => `${courseId} (${sources.join(", ")})`)
+                    .join("; ");
+                notices.push(`Some upcoming items could not be read from Brightspace, so they may be missing from this list: ${listed}. ` +
+                    "Do not report these as having nothing due: call get_upcoming_due_dates again with that courseId.");
+            }
+            if (notices.length === 0) {
                 return toolResponse(upcoming);
             }
-            throwIfCredentialRejected(firstAuthError);
-            return toolResponseWithNotice(upcoming, "Sign-in to Brightspace is still in progress, so upcoming due dates for " +
-                `${pendingCourseIds.length} course(s) (${pendingCourseIds.join(", ")}) could not be fetched ` +
-                `yet. ${authPendingNotice(firstAuthError)} Call get_upcoming_due_dates again once sign-in finishes.`);
+            return toolResponseWithNotice(upcoming, notices.join(" "));
         }
         catch (error) {
             return sanitizeError(error);

package/build/utils/zip-extract.js

@@ -16,8 +16,9 @@ import { inflateRawSync } from "node:zlib";
  * parsing a header that does not exist.
  *
  * Nothing here throws. A truncated download, an unsupported compression
- * method, or a ZIP64 archive all return null, because the caller's fallback
- * is simply to report the file without its text.
+ * method, a ZIP64 archive, or an entry that inflates past the size budget all
+ * return null, because the caller's fallback is simply to report the file
+ * without its text.
  */
 const EOCD_SIGNATURE = 0x06054b50;
 const CENTRAL_FILE_SIGNATURE = 0x02014b50;
@@ -26,6 +27,13 @@ const EOCD_MAX_COMMENT = 0xffff;
 const ZIP64_MARKER = 0xffffffff;
 const METHOD_STORED = 0;
 const METHOD_DEFLATE = 8;
+/**
+ * Most bytes one document may inflate to, across every entry read from it.
+ * DEFLATE reaches ~1000:1, so a 50 MB download could otherwise inflate to
+ * tens of gigabytes and take the server down (issue #380). Real Office XML
+ * sits far below this.
+ */
+export const MAX_INFLATED_BYTES = 64 * 1024 * 1024;
 /** Find the End of Central Directory record by scanning backwards. */
 function findEocd(buffer) {
     const earliest = Math.max(0, buffer.length - EOCD_MIN_SIZE - EOCD_MAX_COMMENT);
@@ -70,7 +78,13 @@ function readCentralDirectory(buffer) {
     }
     return entries;
 }
-function readEntryData(buffer, entry) {
+/**
+ * An entry's bytes, or null when it would exceed `limit`. The declared size
+ * is checked first, but a header can lie, so inflation is capped as well.
+ */
+function readEntryData(buffer, entry, limit) {
+    if (entry.uncompressedSize > limit)
+        return null;
     const header = entry.localHeaderOffset;
     if (header + 30 > buffer.length)
         return null;
@@ -84,18 +98,19 @@ function readEntryData(buffer, entry) {
         return null;
     const raw = buffer.subarray(start, end);
     if (entry.method === METHOD_STORED)
-        return Buffer.from(raw);
+        return raw.length > limit ? null : Buffer.from(raw);
     if (entry.method !== METHOD_DEFLATE)
         return null;
     try {
-        return inflateRawSync(raw);
+        // Throws a RangeError past maxOutputLength.
+        return inflateRawSync(raw, { maxOutputLength: Math.max(1, limit) });
     }
     catch {
         return null;
     }
 }
 /** One entry from a ZIP archive by exact name, or null. Never throws. */
-export function extractZipEntry(buffer, entryName) {
+export function extractZipEntry(buffer, entryName, limit = MAX_INFLATED_BYTES) {
     try {
         const entries = readCentralDirectory(buffer);
         if (!entries)
@@ -103,7 +118,7 @@ export function extractZipEntry(buffer, entryName) {
         const entry = entries.find((e) => e.name === entryName);
         if (!entry)
             return null;
-        return readEntryData(buffer, entry);
+        return readEntryData(buffer, entry, limit);
     }
     catch {
         return null;
@@ -145,7 +160,22 @@ export function officeDocumentText(buffer) {
     const names = listZipEntries(buffer);
     if (!names)
         return null;
-    const read = (name) => xmlToText(extractZipEntry(buffer, name)?.toString("utf-8") ?? "");
+    // One budget for the whole document, so a PPTX can't spread a zip bomb
+    // across many slides that each fit on their own. An entry that fails to
+    // read (oversize included) ends the walk: retrying the rest would re-inflate
+    // up to the budget once per entry.
+    let budget = MAX_INFLATED_BYTES;
+    const read = (name) => {
+        if (budget <= 0)
+            return "";
+        const data = extractZipEntry(buffer, name, budget);
+        if (!data) {
+            budget = 0;
+            return "";
+        }
+        budget -= data.length;
+        return xmlToText(data.toString("utf-8"));
+    };
     let text = "";
     if (names.includes("word/document.xml")) {
         text = read("word/document.xml");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "5.1.26",
+  "version": "5.1.28",
   "mcpName": "io.github.RohanMuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",