Skip to content

Support web otp #1773

@bluwy

Description

@bluwy

Changesets currently only support token-based otp (aka classic otp):

// The first case is no 2fa provided, the second is when the 2fa is wrong (timeout or wrong words)
if (
(json.error.code === "EOTP" ||
(json.error.code === "E401" &&
json.error.detail.includes("--otp=<code>"))) &&
!isCI
) {
if (twoFactorState.token !== null) {
// the current otp code must be invalid since it errored
twoFactorState.token = null;
}
// just in case this isn't already true
twoFactorState.isRequired = Promise.resolve(true);
return internalPublish(packageJson, opts, twoFactorState);
}

Web-based otp, which opens the browser to login is not supported, which is required for newer 2fa types like webauthn and passkeys, which is being pushed by npm and at the same time sunsetting TOTP (which I think is stupid).

Anyways, we probably need to copy npm's flow:

https://github.com/npm/cli/blob/7f7223833b9f655ea82039cf389ed8d03fb3b212/lib/utils/auth.js#L6-L33
https://github.com/npm/npm-profile/blob/92b3c147b18d2122b5eee5880d2848625068bd8c/lib/index.js#L80


Alternatively, we should figure a flow that doesn't require us to manually implement them, something for next perhaps.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions