feat(publish): handle OTP and web-based authentication flows#11019
Merged
Conversation
Add OTP handling to `pnpm publish` with support for: - Classic OTP prompt (manual code entry) - Web-based authentication flow with QR code display and doneUrl polling - `npm-auth-type: web` header to signal web auth support to the registry Extract OTP logic into a dedicated `otp.ts` module with dependency injection for testability. Consolidate shared context for OIDC and OTP. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Pull request overview
Adds OTP challenge handling to pnpm publish (both classic OTP prompt and modern web-based auth with QR + doneUrl polling), consolidating publish/OIDC/OTP dependencies into a shared DI context and updating publish options to advertise web auth support to registries.
Changes:
- Introduce
publishWithOtpHandling()with classic OTP retry + web auth polling flow and dedicated error types. - Add DI-driven
SHARED_CONTEXTfor OIDC + OTP dependencies (fetch/enquirer/publish/process/Date/setTimeout) and update OIDC modules to use it. - Update
publishPackedPkgto call the OTP wrapper and to sendnpm-auth-type: web/npm-command: publishheaders plusauthType/npmCommandoptions.
Reviewed changes
Copilot reviewed 12 out of 13 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| releasing/commands/src/publish/otp.ts | New OTP/web-auth handling module with DI + error types. |
| releasing/commands/src/publish/utils/shared-context.ts | New consolidated shared DI context for OIDC + OTP flows. |
| releasing/commands/src/publish/publishPackedPkg.ts | Route publishing through OTP handler; add web-auth signaling options/headers. |
| releasing/commands/src/publish/oidc/authToken.ts | Update shared-context import path. |
| releasing/commands/src/publish/oidc/idToken.ts | Update shared-context import path. |
| releasing/commands/src/publish/oidc/provenance.ts | Update shared-context import path. |
| releasing/commands/src/publish/oidc/utils/shared-context.ts | Remove old OIDC-only shared context module. |
| releasing/commands/test/publish/otp.test.ts | Add unit tests covering OTP and web-auth flows (polling/timeout/retry-after/etc). |
| releasing/commands/package.json | Add qrcode-terminal and @types/qrcode-terminal deps. |
| pnpm-workspace.yaml | Add catalog entries for qrcode-terminal and its types. |
| pnpm-lock.yaml | Lockfile updates for new dependencies. |
| cspell.json | Add OTP/webauth-related words. |
| .changeset/tangy-pans-pull.md | Document new OTP prompt and QR-based web auth behavior. |
Files not reviewed (1)
- pnpm-lock.yaml: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You can also share your feedback on Copilot code review. Take the survey.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Rebased version of #10834 on current main (which now includes the "stop reading settings from pnpm field" change).
pnpm publishwith support for classic OTP prompts and web-based authentication (QR code + doneUrl polling)otp.tsmodule with dependency injection for testabilityutils/shared-context.tsnpm-auth-type: webandnpm-command: publishheaders to signal web auth support to the registryTest plan
Supersedes #10834.
🤖 Generated with Claude Code