@pnpm/network.web-auth 1101.5.0 → 1101.6.0

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @pnpm/network.web-auth
 
+## 1101.6.0
+
+### Minor Changes
+
+- `pnpm unpublish` now completes the two-factor authentication a registry asks for instead of failing with `ERR_PNPM_UNAUTHORIZED` while logged in. A 401 that is an OTP challenge starts the web-based authentication flow, or prompts for a classic one-time password. The obtained password is reused by every request of the run [#14464](https://github.com/pnpm/pnpm/issues/14464).
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/error@1100.1.4
+
 ## 1101.5.0
 
 ### Minor Changes

package/lib/withOtpHandling.d.ts

@@ -96,6 +96,13 @@ export declare class SyntheticOtpError extends Error implements OtpError {
     readonly code = "EOTP";
     readonly body?: OtpErrorBody;
     constructor(body: OtpErrorBody | undefined);
+    /**
+     * The challenge a `401` response body carries, or `undefined` when the body
+     * is a plain authentication failure. A JSON body with both `authUrl` and
+     * `doneUrl` is the web-based flow; a body mentioning `one-time pass` (npm's
+     * classic wording) is a classic OTP challenge.
+     */
+    static fromUnauthorizedBody(body: string): SyntheticOtpError | undefined;
     static fromUnknownBody(globalWarn: OtpContext['globalWarn'], body: unknown): SyntheticOtpError;
 }
 export declare class OtpNonInteractiveError extends PnpmError {

package/lib/withOtpHandling.js

@@ -116,6 +116,25 @@ export class SyntheticOtpError extends Error {
         super('This error was meant to be caught by `withOtpHandling`, not to propagate to other parts of the code');
         this.body = body;
     }
+    /**
+     * The challenge a `401` response body carries, or `undefined` when the body
+     * is a plain authentication failure. A JSON body with both `authUrl` and
+     * `doneUrl` is the web-based flow; a body mentioning `one-time pass` (npm's
+     * classic wording) is a classic OTP challenge.
+     */
+    static fromUnauthorizedBody(body) {
+        const parsed = tryParseJson(body);
+        if (parsed != null && typeof parsed === 'object' && 'authUrl' in parsed && 'doneUrl' in parsed) {
+            return new SyntheticOtpError({
+                authUrl: typeof parsed.authUrl === 'string' ? parsed.authUrl : undefined,
+                doneUrl: typeof parsed.doneUrl === 'string' ? parsed.doneUrl : undefined,
+            });
+        }
+        if (body.toLowerCase().includes('one-time pass')) {
+            return new SyntheticOtpError(undefined);
+        }
+        return undefined;
+    }
     static fromUnknownBody(globalWarn, body) {
         if (body == null || typeof body !== 'object') {
             return new SyntheticOtpError(undefined);
@@ -141,6 +160,14 @@ export class SyntheticOtpError extends Error {
         return new SyntheticOtpError({ authUrl, doneUrl });
     }
 }
+function tryParseJson(body) {
+    try {
+        return JSON.parse(body);
+    }
+    catch {
+        return undefined;
+    }
+}
 export class OtpNonInteractiveError extends PnpmError {
     authUrl;
     doneUrl;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/network.web-auth",
-  "version": "1101.5.0",
+  "version": "1101.6.0",
   "description": "Web-based authentication flow with QR code display and token polling",
   "keywords": [
     "pnpm",
@@ -28,13 +28,13 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/error": "1100.1.3",
-    "open": "^11.0.1",
+    "@pnpm/error": "1100.1.4",
+    "open": "^11.0.2",
     "qrcode-terminal": "^0.12.0"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/network.web-auth": "1101.5.0",
+    "@pnpm/network.web-auth": "1101.6.0",
     "@types/qrcode-terminal": "^0.12.2"
   },
   "engines": {