brightspace-mcp-server 5.1.43 → 5.1.44

package/build/auth/auth-runner.js

@@ -13,17 +13,19 @@ import { AUTH_COMMAND } from "../utils/commands.js";
 import { dependencyRepairHint, PLAYWRIGHT_INSTALL_HINT } from "../utils/browser-install.js";
 import { devActivity, newRecoveryId, RECOVERY_ID_ENV } from "../utils/dev-activity.js";
 import { parsePhaseMarker } from "./auth-phases.js";
-import { AUTOMATIC_PENDING_MARKER, MFA_HELD_MARKER, RELAYED_CHALLENGE_MARKER, RELAYED_STARTING_MARKER, authLockPath, challengeRelayedAt, relayChallenge } from "./mfa-challenge.js";
+import { AUTOMATIC_PENDING_MARKER, MFA_HELD_MARKER, MFA_MAX_WAIT_MS, RELAYED_CHALLENGE_MARKER, RELAYED_STARTING_MARKER, authLockPath, challengeRelayedAt, relayChallenge } from "./mfa-challenge.js";
 import { inspectLockOwner, liveAutomaticOwner } from "./auth-lock.js";
 /**
  * Timeout for the auth process. It has to outlast the child's own MFA wait,
- * which is five minutes: a person has to find their phone, unlock it, and read
- * a number off the screen. A shorter parent budget would kill the child in the
- * middle of a sign-in the user was still completing. run() itself usually
+ * which is up to MFA_MAX_WAIT_MS (15 minutes: five for the first number and five
+ * more for each of the two resent ones, see purdue-sso.ts) plus the browser
+ * launch and sign-in pages before MFA starts. A shorter parent budget would
+ * kill the child in the middle of a sign-in the user was still completing
+ * (the 8-minute budget cut a resent number's window short). run() itself usually
  * returns long before this fires — the moment the child reports an MFA
  * challenge — but this timer keeps bounding the background child regardless.
  */
-const AUTH_TIMEOUT_MS = 8 * 60 * 1000;
+const AUTH_TIMEOUT_MS = MFA_MAX_WAIT_MS + 3 * 60 * 1000;
 const KILL_GRACE_MS = 5000;
 /**
  * How long a caller keeps waiting for the background sign-in once the
@@ -65,8 +67,8 @@ const ABANDON_MS = MFA_POLL_MS;
 const RELAY_POLL_MS = 1000;
 /**
  * How long a relayed challenge stays "already told to a caller" for the rule
- * that only a RETRY waits on another process's sign-in. The MFA window is five
- * minutes, so a number reported longer ago than that belongs to a sign-in that
+ * that only a RETRY waits on another process's sign-in. One number's MFA window is five
+ * minutes (a resent number is a new number with a new window), so a number reported longer ago than that belongs to a sign-in that
  * is over; the same digits showing up again are a new challenge.
  */
 const RELAY_TOLD_MS = 5 * 60 * 1000;

package/build/auth/mfa-challenge.js

@@ -16,6 +16,21 @@ import * as fs from "node:fs/promises";
 import { statSync } from "node:fs";
 import * as path from "node:path";
 import { CHALLENGE_FILE } from "./auth-lock.js";
+/**
+ * How long one Microsoft number-match request stays approvable: a person has
+ * to find their phone, unlock it and read a prompt, and Microsoft expires the
+ * request itself at about this mark.
+ */
+export const MFA_APPROVAL_WINDOW_MS = 5 * 60 * 1000;
+/** Times a sign-in may ask Microsoft for a fresh number after one expires or is denied. */
+export const MFA_MAX_RESENDS = 2;
+/**
+ * The longest a sign-in waits on MFA: the first number's window plus a full
+ * window for each resent number (each resend restarts the clock, see
+ * purdue-sso.ts handleMFA). 15 minutes. Anything that bounds the sign-in
+ * from outside has to outlast this.
+ */
+export const MFA_MAX_WAIT_MS = MFA_APPROVAL_WINDOW_MS * (1 + MFA_MAX_RESENDS);
 /** Same bound the auth child's stdout marker enforces: 1-3 digits and nothing else. */
 const NUMBER_MATCH = /^\d{1,3}$/;
 export function authLockPath(sessionDir) {

package/build/auth/purdue-sso.js

@@ -9,6 +9,7 @@ import { devActivity } from "../utils/dev-activity.js";
 import { AutomaticCodeAuthenticationError, MfaApprovalError, UnsupportedAuthenticationError } from "./sso-flow.js";
 import { DuoMfaHandler } from "./duo-mfa.js";
 import { AUTH_COMMAND } from "../utils/commands.js";
+import { MFA_APPROVAL_WINDOW_MS, MFA_MAX_RESENDS } from "./mfa-challenge.js";
 import { generateTotp, secondsUntilFreshCode } from "./totp.js";
 // Entra names its username field type=email/loginfmt; Shibboleth portals (USC's
 // login.usc.edu among them) use the protocol's j_username.
@@ -66,16 +67,20 @@ const REMEMBER_MFA_LOG = {
 /** How often to look for the number while waiting on MFA. */
 const NUMBER_MATCH_POLL_MS = 2000;
 /** A person has to find their phone, unlock it, and read a prompt. */
-const MFA_TIMEOUT_MS = 5 * 60 * 1000;
+const MFA_TIMEOUT_MS = MFA_APPROVAL_WINDOW_MS;
 /**
- * Entra's number-match request itself expires (typically ~1-2 minutes) well
- * before the 5-minute MFA_TIMEOUT_MS this flow allows overall, or the user
- * can tap Deny. Either way Entra stops showing the number and offers a way to
- * send another request; without asking for one this flow just polls a dead
- * request until MFA_TIMEOUT_MS. Bounded so a tenant that never clears this
- * screen still hits the ordinary timeout instead of resending forever.
+ * Entra's number-match request itself expires (observed live at about the
+ * same 5 minutes as MFA_TIMEOUT_MS, 2026-11-08; earlier tenants showed 1-2
+ * minutes), or the user can tap Deny. Either way Entra stops showing the
+ * number and offers a way to send another request; without asking for one
+ * this flow just polls a dead request until the deadline. Each resend gives
+ * the new number its own full MFA_TIMEOUT_MS (the deadline moves to
+ * resend time + MFA_TIMEOUT_MS), because a resend made at the 5-minute mark
+ * left the new number about four seconds. Bounded, so the total is at most
+ * (1 + MAX_RESENDS) * MFA_TIMEOUT_MS (MFA_MAX_WAIT_MS, 15 minutes) and a
+ * tenant that never clears this screen still ends instead of resending forever.
  */
-const MAX_RESENDS = 2;
+const MAX_RESENDS = MFA_MAX_RESENDS;
 /**
  * EXPECTED, not verified against a live tenant from here: Entra's "Send
  * another request" control on the number-match timeout/denied view.
@@ -412,7 +417,7 @@ export class PurdueSSOFlow {
             throw new UnsupportedAuthenticationError("A school URL is required to verify authentication.");
         }
         const startedAt = Date.now();
-        const deadline = startedAt + MFA_TIMEOUT_MS;
+        let deadline = startedAt + MFA_TIMEOUT_MS;
         let challenged = false;
         /** True once onMfaHeld has reported this login. */
         let heldReported = false;
@@ -565,9 +570,9 @@ export class PurdueSSOFlow {
                     resendNotFoundWarned = false;
                 }
                 // Fix 2: Entra's number-match request itself times out (or the user
-                // taps Deny) well before the 5-minute budget above. Once that has
+                // taps Deny), at the latest about when the budget above runs out. Once that has
                 // happened, ask Entra for another one instead of polling a dead
-                // request until MFA_TIMEOUT_MS; readNumberMatch on the next poll
+                // request until the deadline; readNumberMatch on the next poll
                 // picks up the fresh number, and the re-announce logic above tells
                 // the caller about it.
                 if (manualRequired && sawNumber && number === null && new URL(page.url()).hostname === "login.microsoftonline.com") {
@@ -581,6 +586,8 @@ export class PurdueSSOFlow {
                         onResend: (clickedAt) => {
                             resendCount += 1;
                             resendLastClickAt = clickedAt;
+                            // The new number gets its own full approval window; never shorten.
+                            deadline = Math.max(deadline, clickedAt + MFA_TIMEOUT_MS);
                         },
                     });
                 }
@@ -637,7 +644,7 @@ export class PurdueSSOFlow {
         }
         const clickedAt = Date.now();
         state.onResend(clickedAt);
-        log("WARN", `Number-match request expired; sent another request (${state.resendCount + 1} of ${MAX_RESENDS}).`);
+        log("WARN", `Number-match request expired; sent another request (${state.resendCount + 1} of ${MAX_RESENDS}). The new number gets its own ${MFA_TIMEOUT_MS / 60000} minutes.`);
         await control.click().catch(() => { });
         return state.resendNotFoundWarned;
     }

package/build/auth/sso-flow.js

@@ -39,7 +39,7 @@ export class MfaApprovalError extends BrowserAuthError {
      */
     numberMatch;
     constructor(cause, numberMatch) {
-        super(`MFA approval failed or timed out after 5 minutes. Run ${AUTH_COMMAND} to retry.`, "mfa_approval", cause);
+        super(`MFA approval failed or timed out: no approval within 5 minutes of the last number shown. Run ${AUTH_COMMAND} to retry.`, "mfa_approval", cause);
         this.name = "MfaApprovalError";
         this.numberMatch = numberMatch;
     }

package/build/tools/tool-helpers.js

@@ -114,7 +114,8 @@ const MFA_SAME_PROMPT = "Calling again doesn't send a new prompt, and neither do
     "keeps waiting, for up to 5 minutes, on the prompt already sent.";
 /** Entra number match only: purdue-sso.ts asks for another request when one expires or is denied. */
 const MFA_NEW_NUMBER = "If Microsoft's number expires or is denied, the sign-in asks Microsoft for a new one by itself " +
-    "and the next answer shows it; always give the user the latest number.";
+    "and the next answer shows it, with its own 5 minutes to approve (at most twice, so a sign-in can run up " +
+    "to 15 minutes in all); always give the user the latest number.";
 /**
  * Why a missed prompt cannot be skipped. Microsoft keeps a prompt open for up
  * to 5 minutes and refuses another for the same account until then

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "brightspace-mcp-server",
-  "version": "5.1.43",
+  "version": "5.1.44",
   "mcpName": "io.github.RohanMuppa/brightspace",
   "description": "MCP server for Brightspace (D2L). Check grades, due dates, assignments, announcements, syllabus, rosters and more via Claude, ChatGPT, Cursor, Windsurf, or any MCP client.",
   "type": "module",