@pnpm/network.web-auth 1101.4.3 → 1101.5.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @pnpm/network.web-auth
 
+## 1101.5.0
+
+### Minor Changes
+
+- `pnpm stage approve` now approves several staged packages at once. Run it without a stage id to pick from the staged versions interactively, or pass a list of stage ids. The whole batch is approved with a single one-time password, and pnpm asks for a new one only once the registry stops accepting it. Inside a workspace, the selected packages are approved in dependency order, and a package whose workspace dependency could not be approved is skipped instead of being published against a dependency that never reached the registry.
+
 ## 1101.4.3
 
 ### Patch Changes

package/lib/index.d.ts

@@ -3,4 +3,4 @@ export { generateQrCode } from './generateQrCode.js';
 export { pollForWebAuthToken, type PollForWebAuthTokenParams, type WebAuthContext, type WebAuthFetchOptions, type WebAuthFetchResponse, type WebAuthFetchResponseBody, type WebAuthFetchResponseBodyReader, type WebAuthFetchResponseHeaders, } from './pollForWebAuthToken.js';
 export { promptBrowserOpen, type PromptBrowserOpenContext, type PromptBrowserOpenParams, type PromptBrowserOpenReadlineInterface, } from './promptBrowserOpen.js';
 export { WebAuthTimeoutError } from './WebAuthTimeoutError.js';
-export { canonicalHttpUrl, isOtpError, type OtpContext, type OtpEnquirer, type OtpHandlingParams, OtpNonInteractiveError, type OtpProcess, OtpSecondChallengeError, SyntheticOtpError, withOtpHandling, } from './withOtpHandling.js';
+export { canonicalHttpUrl, createOtpSession, isOtpError, type OtpContext, type OtpEnquirer, type OtpHandlingParams, OtpNonInteractiveError, type OtpProcess, OtpSecondChallengeError, type OtpSession, type OtpSessionParams, SyntheticOtpError, withOtpHandling, } from './withOtpHandling.js';

package/lib/index.js

@@ -3,5 +3,5 @@ export { generateQrCode } from './generateQrCode.js';
 export { pollForWebAuthToken, } from './pollForWebAuthToken.js';
 export { promptBrowserOpen, } from './promptBrowserOpen.js';
 export { WebAuthTimeoutError } from './WebAuthTimeoutError.js';
-export { canonicalHttpUrl, isOtpError, OtpNonInteractiveError, OtpSecondChallengeError, SyntheticOtpError, withOtpHandling, } from './withOtpHandling.js';
+export { canonicalHttpUrl, createOtpSession, isOtpError, OtpNonInteractiveError, OtpSecondChallengeError, SyntheticOtpError, withOtpHandling, } from './withOtpHandling.js';
 //# sourceMappingURL=index.js.map

package/lib/withOtpHandling.d.ts

@@ -42,6 +42,33 @@ export interface OtpHandlingParams<T> {
     fetchOptions: WebAuthFetchOptions;
     operation: (otp?: string) => Promise<T>;
 }
+export interface OtpSessionParams {
+    context: OtpContext;
+    fetchOptions: WebAuthFetchOptions;
+}
+export interface OtpSession {
+    /**
+     * Runs `operation` with the one-time password this session holds, obtaining
+     * one on demand.
+     *
+     * The first operation runs without a password (the caller may still send a
+     * configured `--otp`); the password obtained from a challenge is kept and
+     * passed to every later operation, so a batch of operations costs one
+     * authentication instead of one per operation. When a kept password stops
+     * being accepted — a classic OTP expires within a minute — the challenge it
+     * triggers obtains a new one and the operation is retried with it.
+     */
+    run: <T>(operation: (otp?: string) => Promise<T>) => Promise<T>;
+}
+/**
+ * Creates an {@link OtpSession}: OTP challenge handling shared across a series
+ * of operations.
+ *
+ * @throws {@link OtpNonInteractiveError} if OTP is required but the terminal is not interactive.
+ * @throws {@link OtpSecondChallengeError} if the registry challenges an operation again right after
+ *   a freshly obtained one-time password was submitted for it.
+ */
+export declare function createOtpSession({ context, fetchOptions }: OtpSessionParams): OtpSession;
 /**
  * Wraps an operation with OTP (one-time password) challenge handling.
  *
@@ -51,6 +78,9 @@ export interface OtpHandlingParams<T> {
  * 2. Falls back to prompting the user for a classic OTP code.
  * 3. Retries the operation with the obtained OTP.
  *
+ * Use {@link createOtpSession} instead when several operations authenticate
+ * against the same registry in one run, so they share one one-time password.
+ *
  * @throws {@link OtpNonInteractiveError} if OTP is required but the terminal is not interactive.
  * @throws {@link OtpSecondChallengeError} if the registry requests OTP a second time after one was submitted.
  * @throws the original error if OTP handling is not applicable.

package/lib/withOtpHandling.js

@@ -6,6 +6,43 @@ export const isOtpError = (error) => error != null &&
     typeof error === 'object' &&
     'code' in error &&
     error.code === 'EOTP';
+/**
+ * Creates an {@link OtpSession}: OTP challenge handling shared across a series
+ * of operations.
+ *
+ * @throws {@link OtpNonInteractiveError} if OTP is required but the terminal is not interactive.
+ * @throws {@link OtpSecondChallengeError} if the registry challenges an operation again right after
+ *   a freshly obtained one-time password was submitted for it.
+ */
+export function createOtpSession({ context, fetchOptions }) {
+    let sessionOtp;
+    return {
+        async run(operation) {
+            let error;
+            try {
+                return await operation(sessionOtp);
+            }
+            catch (err) {
+                if (!isOtpError(err))
+                    throw err;
+                error = err;
+            }
+            const otp = await resolveOtpChallenge(context, fetchOptions, error);
+            if (otp == null)
+                throw error;
+            sessionOtp = otp;
+            try {
+                return await operation(otp);
+            }
+            catch (retryError) {
+                if (isOtpError(retryError)) {
+                    throw new OtpSecondChallengeError();
+                }
+                throw retryError;
+            }
+        },
+    };
+}
 /**
  * Wraps an operation with OTP (one-time password) challenge handling.
  *
@@ -15,6 +52,9 @@ export const isOtpError = (error) => error != null &&
  * 2. Falls back to prompting the user for a classic OTP code.
  * 3. Retries the operation with the obtained OTP.
  *
+ * Use {@link createOtpSession} instead when several operations authenticate
+ * against the same registry in one run, so they share one one-time password.
+ *
  * @throws {@link OtpNonInteractiveError} if OTP is required but the terminal is not interactive.
  * @throws {@link OtpSecondChallengeError} if the registry requests OTP a second time after one was submitted.
  * @throws the original error if OTP handling is not applicable.
@@ -22,60 +62,48 @@ export const isOtpError = (error) => error != null &&
  * @see https://github.com/npm/cli/blob/7d900c46/lib/utils/otplease.js for npm's implementation.
  */
 export async function withOtpHandling({ context, fetchOptions, operation, }) {
-    const { enquirer, globalInfo, globalWarn, process, } = context;
+    return createOtpSession({ context, fetchOptions }).run(operation);
+}
+/**
+ * Satisfies an OTP challenge, either through the web-based authentication flow
+ * (when the challenge carries both `authUrl` and `doneUrl`) or by prompting for
+ * a classic one-time password.
+ *
+ * @returns the one-time password, or `undefined` when the user supplied none.
+ */
+async function resolveOtpChallenge(context, fetchOptions, error) {
+    const { enquirer, globalInfo, globalWarn, process } = context;
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+        throw new OtpNonInteractiveError(error.body);
+    }
+    const authUrl = canonicalHttpUrl(error.body?.authUrl);
+    const doneUrl = canonicalHttpUrl(error.body?.doneUrl);
+    if (authUrl != null && doneUrl != null) {
+        globalInfo(formatAuthUrlMessage(authUrl, globalWarn));
+        const pollPromise = pollForWebAuthToken({
+            context,
+            doneUrl,
+            fetchOptions,
+        });
+        return promptBrowserOpen({
+            authUrl,
+            context,
+            pollPromise,
+        });
+    }
+    let otp;
     try {
-        return await operation();
+        otp = await enquirer.input({
+            message: 'This operation requires a one-time password.\nEnter OTP:',
+        });
     }
-    catch (error) {
-        if (!isOtpError(error))
-            throw error;
-        if (!process.stdin.isTTY || !process.stdout.isTTY) {
-            throw new OtpNonInteractiveError(error.body);
-        }
-        let otp;
-        const authUrl = canonicalHttpUrl(error.body?.authUrl);
-        const doneUrl = canonicalHttpUrl(error.body?.doneUrl);
-        if (authUrl != null && doneUrl != null) {
-            globalInfo(formatAuthUrlMessage(authUrl, globalWarn));
-            const pollPromise = pollForWebAuthToken({
-                context,
-                doneUrl,
-                fetchOptions,
-            });
-            otp = await promptBrowserOpen({
-                authUrl,
-                context,
-                pollPromise,
-            });
-        }
-        else {
-            let otpValue;
-            try {
-                otpValue = await enquirer.input({
-                    message: 'This operation requires a one-time password.\nEnter OTP:',
-                });
-            }
-            catch (err) {
-                if (err instanceof Error && err.name === 'ExitPromptError') {
-                    throw error;
-                }
-                throw err;
-            }
-            otp = otpValue || undefined;
-        }
-        if (otp != null) {
-            try {
-                return await operation(otp);
-            }
-            catch (retryError) {
-                if (isOtpError(retryError)) {
-                    throw new OtpSecondChallengeError();
-                }
-                throw retryError;
-            }
-        }
-        throw error;
+    catch (err) {
+        // The user aborted the prompt: re-throw the original challenge.
+        if (err instanceof Error && err.name === 'ExitPromptError')
+            return undefined;
+        throw err;
     }
+    return otp || undefined;
 }
 /**
  * Synthetic instance of {@link OtpError} meant to be thrown by the callbacks of {@link withOtpHandling}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/network.web-auth",
-  "version": "1101.4.3",
+  "version": "1101.5.0",
   "description": "Web-based authentication flow with QR code display and token polling",
   "keywords": [
     "pnpm",
@@ -34,7 +34,7 @@
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/network.web-auth": "1101.4.3",
+    "@pnpm/network.web-auth": "1101.5.0",
     "@types/qrcode-terminal": "^0.12.2"
   },
   "engines": {