@pnpm/network.web-auth 1101.4.3 → 1101.6.0

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @pnpm/network.web-auth
 
+## 1101.6.0
+
+### Minor Changes
+
+- `pnpm unpublish` now completes the two-factor authentication a registry asks for instead of failing with `ERR_PNPM_UNAUTHORIZED` while logged in. A 401 that is an OTP challenge starts the web-based authentication flow, or prompts for a classic one-time password. The obtained password is reused by every request of the run [#14464](https://github.com/pnpm/pnpm/issues/14464).
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/error@1100.1.4
+
+## 1101.5.0
+
+### Minor Changes
+
+- `pnpm stage approve` now approves several staged packages at once. Run it without a stage id to pick from the staged versions interactively, or pass a list of stage ids. The whole batch is approved with a single one-time password, and pnpm asks for a new one only once the registry stops accepting it. Inside a workspace, the selected packages are approved in dependency order, and a package whose workspace dependency could not be approved is skipped instead of being published against a dependency that never reached the registry.
+
 ## 1101.4.3
 
 ### Patch Changes

package/lib/index.d.ts

@@ -3,4 +3,4 @@ export { generateQrCode } from './generateQrCode.js';
 export { pollForWebAuthToken, type PollForWebAuthTokenParams, type WebAuthContext, type WebAuthFetchOptions, type WebAuthFetchResponse, type WebAuthFetchResponseBody, type WebAuthFetchResponseBodyReader, type WebAuthFetchResponseHeaders, } from './pollForWebAuthToken.js';
 export { promptBrowserOpen, type PromptBrowserOpenContext, type PromptBrowserOpenParams, type PromptBrowserOpenReadlineInterface, } from './promptBrowserOpen.js';
 export { WebAuthTimeoutError } from './WebAuthTimeoutError.js';
-export { canonicalHttpUrl, isOtpError, type OtpContext, type OtpEnquirer, type OtpHandlingParams, OtpNonInteractiveError, type OtpProcess, OtpSecondChallengeError, SyntheticOtpError, withOtpHandling, } from './withOtpHandling.js';
+export { canonicalHttpUrl, createOtpSession, isOtpError, type OtpContext, type OtpEnquirer, type OtpHandlingParams, OtpNonInteractiveError, type OtpProcess, OtpSecondChallengeError, type OtpSession, type OtpSessionParams, SyntheticOtpError, withOtpHandling, } from './withOtpHandling.js';

package/lib/index.js

@@ -3,5 +3,5 @@ export { generateQrCode } from './generateQrCode.js';
 export { pollForWebAuthToken, } from './pollForWebAuthToken.js';
 export { promptBrowserOpen, } from './promptBrowserOpen.js';
 export { WebAuthTimeoutError } from './WebAuthTimeoutError.js';
-export { canonicalHttpUrl, isOtpError, OtpNonInteractiveError, OtpSecondChallengeError, SyntheticOtpError, withOtpHandling, } from './withOtpHandling.js';
+export { canonicalHttpUrl, createOtpSession, isOtpError, OtpNonInteractiveError, OtpSecondChallengeError, SyntheticOtpError, withOtpHandling, } from './withOtpHandling.js';
 //# sourceMappingURL=index.js.map

package/lib/withOtpHandling.d.ts

@@ -42,6 +42,33 @@ export interface OtpHandlingParams<T> {
     fetchOptions: WebAuthFetchOptions;
     operation: (otp?: string) => Promise<T>;
 }
+export interface OtpSessionParams {
+    context: OtpContext;
+    fetchOptions: WebAuthFetchOptions;
+}
+export interface OtpSession {
+    /**
+     * Runs `operation` with the one-time password this session holds, obtaining
+     * one on demand.
+     *
+     * The first operation runs without a password (the caller may still send a
+     * configured `--otp`); the password obtained from a challenge is kept and
+     * passed to every later operation, so a batch of operations costs one
+     * authentication instead of one per operation. When a kept password stops
+     * being accepted — a classic OTP expires within a minute — the challenge it
+     * triggers obtains a new one and the operation is retried with it.
+     */
+    run: <T>(operation: (otp?: string) => Promise<T>) => Promise<T>;
+}
+/**
+ * Creates an {@link OtpSession}: OTP challenge handling shared across a series
+ * of operations.
+ *
+ * @throws {@link OtpNonInteractiveError} if OTP is required but the terminal is not interactive.
+ * @throws {@link OtpSecondChallengeError} if the registry challenges an operation again right after
+ *   a freshly obtained one-time password was submitted for it.
+ */
+export declare function createOtpSession({ context, fetchOptions }: OtpSessionParams): OtpSession;
 /**
  * Wraps an operation with OTP (one-time password) challenge handling.
  *
@@ -51,6 +78,9 @@ export interface OtpHandlingParams<T> {
  * 2. Falls back to prompting the user for a classic OTP code.
  * 3. Retries the operation with the obtained OTP.
  *
+ * Use {@link createOtpSession} instead when several operations authenticate
+ * against the same registry in one run, so they share one one-time password.
+ *
  * @throws {@link OtpNonInteractiveError} if OTP is required but the terminal is not interactive.
  * @throws {@link OtpSecondChallengeError} if the registry requests OTP a second time after one was submitted.
  * @throws the original error if OTP handling is not applicable.
@@ -66,6 +96,13 @@ export declare class SyntheticOtpError extends Error implements OtpError {
     readonly code = "EOTP";
     readonly body?: OtpErrorBody;
     constructor(body: OtpErrorBody | undefined);
+    /**
+     * The challenge a `401` response body carries, or `undefined` when the body
+     * is a plain authentication failure. A JSON body with both `authUrl` and
+     * `doneUrl` is the web-based flow; a body mentioning `one-time pass` (npm's
+     * classic wording) is a classic OTP challenge.
+     */
+    static fromUnauthorizedBody(body: string): SyntheticOtpError | undefined;
     static fromUnknownBody(globalWarn: OtpContext['globalWarn'], body: unknown): SyntheticOtpError;
 }
 export declare class OtpNonInteractiveError extends PnpmError {

package/lib/withOtpHandling.js

@@ -6,6 +6,43 @@ export const isOtpError = (error) => error != null &&
     typeof error === 'object' &&
     'code' in error &&
     error.code === 'EOTP';
+/**
+ * Creates an {@link OtpSession}: OTP challenge handling shared across a series
+ * of operations.
+ *
+ * @throws {@link OtpNonInteractiveError} if OTP is required but the terminal is not interactive.
+ * @throws {@link OtpSecondChallengeError} if the registry challenges an operation again right after
+ *   a freshly obtained one-time password was submitted for it.
+ */
+export function createOtpSession({ context, fetchOptions }) {
+    let sessionOtp;
+    return {
+        async run(operation) {
+            let error;
+            try {
+                return await operation(sessionOtp);
+            }
+            catch (err) {
+                if (!isOtpError(err))
+                    throw err;
+                error = err;
+            }
+            const otp = await resolveOtpChallenge(context, fetchOptions, error);
+            if (otp == null)
+                throw error;
+            sessionOtp = otp;
+            try {
+                return await operation(otp);
+            }
+            catch (retryError) {
+                if (isOtpError(retryError)) {
+                    throw new OtpSecondChallengeError();
+                }
+                throw retryError;
+            }
+        },
+    };
+}
 /**
  * Wraps an operation with OTP (one-time password) challenge handling.
  *
@@ -15,6 +52,9 @@ export const isOtpError = (error) => error != null &&
  * 2. Falls back to prompting the user for a classic OTP code.
  * 3. Retries the operation with the obtained OTP.
  *
+ * Use {@link createOtpSession} instead when several operations authenticate
+ * against the same registry in one run, so they share one one-time password.
+ *
  * @throws {@link OtpNonInteractiveError} if OTP is required but the terminal is not interactive.
  * @throws {@link OtpSecondChallengeError} if the registry requests OTP a second time after one was submitted.
  * @throws the original error if OTP handling is not applicable.
@@ -22,60 +62,48 @@ export const isOtpError = (error) => error != null &&
  * @see https://github.com/npm/cli/blob/7d900c46/lib/utils/otplease.js for npm's implementation.
  */
 export async function withOtpHandling({ context, fetchOptions, operation, }) {
-    const { enquirer, globalInfo, globalWarn, process, } = context;
+    return createOtpSession({ context, fetchOptions }).run(operation);
+}
+/**
+ * Satisfies an OTP challenge, either through the web-based authentication flow
+ * (when the challenge carries both `authUrl` and `doneUrl`) or by prompting for
+ * a classic one-time password.
+ *
+ * @returns the one-time password, or `undefined` when the user supplied none.
+ */
+async function resolveOtpChallenge(context, fetchOptions, error) {
+    const { enquirer, globalInfo, globalWarn, process } = context;
+    if (!process.stdin.isTTY || !process.stdout.isTTY) {
+        throw new OtpNonInteractiveError(error.body);
+    }
+    const authUrl = canonicalHttpUrl(error.body?.authUrl);
+    const doneUrl = canonicalHttpUrl(error.body?.doneUrl);
+    if (authUrl != null && doneUrl != null) {
+        globalInfo(formatAuthUrlMessage(authUrl, globalWarn));
+        const pollPromise = pollForWebAuthToken({
+            context,
+            doneUrl,
+            fetchOptions,
+        });
+        return promptBrowserOpen({
+            authUrl,
+            context,
+            pollPromise,
+        });
+    }
+    let otp;
     try {
-        return await operation();
+        otp = await enquirer.input({
+            message: 'This operation requires a one-time password.\nEnter OTP:',
+        });
     }
-    catch (error) {
-        if (!isOtpError(error))
-            throw error;
-        if (!process.stdin.isTTY || !process.stdout.isTTY) {
-            throw new OtpNonInteractiveError(error.body);
-        }
-        let otp;
-        const authUrl = canonicalHttpUrl(error.body?.authUrl);
-        const doneUrl = canonicalHttpUrl(error.body?.doneUrl);
-        if (authUrl != null && doneUrl != null) {
-            globalInfo(formatAuthUrlMessage(authUrl, globalWarn));
-            const pollPromise = pollForWebAuthToken({
-                context,
-                doneUrl,
-                fetchOptions,
-            });
-            otp = await promptBrowserOpen({
-                authUrl,
-                context,
-                pollPromise,
-            });
-        }
-        else {
-            let otpValue;
-            try {
-                otpValue = await enquirer.input({
-                    message: 'This operation requires a one-time password.\nEnter OTP:',
-                });
-            }
-            catch (err) {
-                if (err instanceof Error && err.name === 'ExitPromptError') {
-                    throw error;
-                }
-                throw err;
-            }
-            otp = otpValue || undefined;
-        }
-        if (otp != null) {
-            try {
-                return await operation(otp);
-            }
-            catch (retryError) {
-                if (isOtpError(retryError)) {
-                    throw new OtpSecondChallengeError();
-                }
-                throw retryError;
-            }
-        }
-        throw error;
+    catch (err) {
+        // The user aborted the prompt: re-throw the original challenge.
+        if (err instanceof Error && err.name === 'ExitPromptError')
+            return undefined;
+        throw err;
     }
+    return otp || undefined;
 }
 /**
  * Synthetic instance of {@link OtpError} meant to be thrown by the callbacks of {@link withOtpHandling}
@@ -88,6 +116,25 @@ export class SyntheticOtpError extends Error {
         super('This error was meant to be caught by `withOtpHandling`, not to propagate to other parts of the code');
         this.body = body;
     }
+    /**
+     * The challenge a `401` response body carries, or `undefined` when the body
+     * is a plain authentication failure. A JSON body with both `authUrl` and
+     * `doneUrl` is the web-based flow; a body mentioning `one-time pass` (npm's
+     * classic wording) is a classic OTP challenge.
+     */
+    static fromUnauthorizedBody(body) {
+        const parsed = tryParseJson(body);
+        if (parsed != null && typeof parsed === 'object' && 'authUrl' in parsed && 'doneUrl' in parsed) {
+            return new SyntheticOtpError({
+                authUrl: typeof parsed.authUrl === 'string' ? parsed.authUrl : undefined,
+                doneUrl: typeof parsed.doneUrl === 'string' ? parsed.doneUrl : undefined,
+            });
+        }
+        if (body.toLowerCase().includes('one-time pass')) {
+            return new SyntheticOtpError(undefined);
+        }
+        return undefined;
+    }
     static fromUnknownBody(globalWarn, body) {
         if (body == null || typeof body !== 'object') {
             return new SyntheticOtpError(undefined);
@@ -113,6 +160,14 @@ export class SyntheticOtpError extends Error {
         return new SyntheticOtpError({ authUrl, doneUrl });
     }
 }
+function tryParseJson(body) {
+    try {
+        return JSON.parse(body);
+    }
+    catch {
+        return undefined;
+    }
+}
 export class OtpNonInteractiveError extends PnpmError {
     authUrl;
     doneUrl;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/network.web-auth",
-  "version": "1101.4.3",
+  "version": "1101.6.0",
   "description": "Web-based authentication flow with QR code display and token polling",
   "keywords": [
     "pnpm",
@@ -28,13 +28,13 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/error": "1100.1.3",
-    "open": "^11.0.1",
+    "@pnpm/error": "1100.1.4",
+    "open": "^11.0.2",
     "qrcode-terminal": "^0.12.0"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/network.web-auth": "1101.4.3",
+    "@pnpm/network.web-auth": "1101.6.0",
     "@types/qrcode-terminal": "^0.12.2"
   },
   "engines": {