NEWS

---

brightspaceR 0.1.0.9000

Differential Merge Fixes

• Course Access / Course Access Log schemas added. These datasets are keyed on a date/timestamp (DayAccessed, Timestamp) in addition to OrgUnitId/UserId. Without a registered schema, bs_apply_diffs() guessed merge keys from _id columns only and silently collapsed every day's rows into one — so merged (full + differential) results were missing rows that the differential extracts contained. Their UserId columns are also now pseudonymised by the privacy layer.
• bs_apply_diffs() no longer loses rows silently. When a differential extract shares no key column with the accumulated result it now errors instead of skipping the diff; when it is missing some key columns it merges on the shared subset and warns. Guessing keys from _id columns (no dataset_name or no registered schema) now emits a warning.

Privacy Layer Fixes

• bs_pseudonymise_df() and bs_apply_field_policy() now work on real data. Both matched their PascalCase registry/policy field names (e.g. UserId) against the snake_case columns that bs_get_dataset() actually returns (user_id), so on live data pseudonymisation was a silent no-op and allow-mode field policies dropped every column. Matching is now snake_case-normalised on both sides. The MCP server (which delegates to these functions) is fixed as a result. Regression tests now exercise the real snake_case column names.

Exported Privacy Functions

• Exported bs_pseudonymise_id(), bs_pseudonymise_df(), and bs_apply_field_policy() so regular R scripts can apply the same privacy protections as the MCP server. These are opt-in tools for use in dplyr pipelines — they do not wrap or change existing functions like bs_get_dataset(). The MCP server now calls the package functions instead of maintaining its own copies.

MCP Server Security (Phase 2)

• ID pseudonymisation: All person-referencing ID columns (UserId, SubmitterId, LastModifiedBy, etc.) are hashed with a session-scoped HMAC-SHA256 key. The AI model sees deterministic pseudonyms like usr_a3f2b1c8 instead of raw integers. Consistent within a session (joins and grouping work), unrecoverable across sessions. Combined with Phase 1's field policy (which drops names and emails), this achieves full pseudonymisation.
• Privacy compliance vignette: New vignette("privacy-compliance") documents alignment with ENISA, NIST SP 800-188, NIST IR 8053, ISO 25237:2017, GDPR/EDPB Guidelines 01/2025, FERPA, and HIPAA Safe Harbor. Includes compliance summary table with degree of compliance and organisational gaps. Provides complete worked examples for applying the same protections in regular R scripts outside the MCP server.

MCP Server Security (Phase 1)

• AST code inspection: execute_r now parses submitted R code and rejects dangerous constructs before execution. Blocked categories include direct package access (brightspaceR::, httr::, curl::, etc.), metaprogramming (eval, do.call, get), shell commands (system, system2), file I/O (readLines, writeLines, readRDS, etc.), and network functions (download.file, url). Safe code (dplyr pipelines, ggplot2, arithmetic) passes through unchanged.
• write_chart() helper: New safe alternative to writeLines() for Chart.js HTML output. Writes only .html files to the configured output directory. Server instructions updated to reference write_chart().
• PII field policy: YAML-driven column allowlists per BDS dataset (inst/mcp/field_policy.yml). Datasets containing PII (Users, Grade Results, Assignment Submissions, Quiz User Answers) are filtered to exclude sensitive columns (names, emails, comments) before data reaches the AI model. Policy supports allow, redact, and all modes. Custom policies can be provided via the BRIGHTSPACER_FIELD_POLICY environment variable.
• Audit logging: Every tool call is logged as append-only JSONL to mcp_audit.jsonl in the output directory. Entries include timestamp, tool name, arguments (code truncated to 500 chars), response size, blocked status, and error flag. Session start/end events are also recorded.
• 35 new tests in inst/mcp/test_server.R: 18 for AST inspection, 9 for field policy, 3 for audit logging, plus supporting infrastructure. All 68 tests pass.

brightspaceR 0.1.0 (2026-03-12)

• Initial CRAN release.
• OAuth2 authentication with D2L Brightspace (bs_auth()).
• Download all Brightspace Data Sets (BDS) as tidy data frames (bs_get_dataset()).
• Download Advanced Data Sets (ADS) with automatic pagination (bs_get_ads()).
• Convenience join functions that know foreign-key relationships (bs_join()).
• Composable analytics helpers for engagement, performance, and retention.
• MCP server for LLM-assisted data exploration (inst/mcp/).