Changesets currently only support token-based otp (aka classic otp):
|
// The first case is no 2fa provided, the second is when the 2fa is wrong (timeout or wrong words) |
|
if ( |
|
(json.error.code === "EOTP" || |
|
(json.error.code === "E401" && |
|
json.error.detail.includes("--otp=<code>"))) && |
|
!isCI |
|
) { |
|
if (twoFactorState.token !== null) { |
|
// the current otp code must be invalid since it errored |
|
twoFactorState.token = null; |
|
} |
|
// just in case this isn't already true |
|
twoFactorState.isRequired = Promise.resolve(true); |
|
return internalPublish(packageJson, opts, twoFactorState); |
|
} |
Web-based otp, which opens the browser to login is not supported, which is required for newer 2fa types like webauthn and passkeys, which is being pushed by npm and at the same time sunsetting TOTP (which I think is stupid).
Anyways, we probably need to copy npm's flow:
https://github.com/npm/cli/blob/7f7223833b9f655ea82039cf389ed8d03fb3b212/lib/utils/auth.js#L6-L33
https://github.com/npm/npm-profile/blob/92b3c147b18d2122b5eee5880d2848625068bd8c/lib/index.js#L80
Alternatively, we should figure a flow that doesn't require us to manually implement them, something for next perhaps.
Changesets currently only support token-based otp (aka classic otp):
changesets/packages/cli/src/commands/publish/npm-utils.ts
Lines 238 to 252 in 097afd9
Web-based otp, which opens the browser to login is not supported, which is required for newer 2fa types like webauthn and passkeys, which is being pushed by npm and at the same time sunsetting TOTP (which I think is stupid).
Anyways, we probably need to copy npm's flow:
https://github.com/npm/cli/blob/7f7223833b9f655ea82039cf389ed8d03fb3b212/lib/utils/auth.js#L6-L33
https://github.com/npm/npm-profile/blob/92b3c147b18d2122b5eee5880d2848625068bd8c/lib/index.js#L80
Alternatively, we should figure a flow that doesn't require us to manually implement them, something for
nextperhaps.