fix(2fa): request a push notification when re-auth is required - #486
Open
epheterson wants to merge 3 commits into
Open
fix(2fa): request a push notification when re-auth is required#486epheterson wants to merge 3 commits into
epheterson wants to merge 3 commits into
Conversation
The headless sync loop detected "2FA required", notified the user, and retried -- but never called trigger_2fa_push_notification, so Apple was never asked to push a code. The user's trusted devices stayed silent and there was no code to enter. Wire the trigger into _handle_2fa_required (best-effort; a failure is logged and never breaks the retry loop). Fire once per re-auth episode, latched on SyncState.two_fa_triggered and reset on the next successful auth, so we don't re-push every retry cycle (default 600s) and trip Apple's rate limits. No new config; behaviour is automatic. This is the mechanism-agnostic core fix underneath the Telegram (mandarons#470) and web-UI (mandarons#464) re-auth flows, split out per maintainer request on mandarons#470. Co-Authored-By: Claude <noreply@anthropic.com>
epheterson
force-pushed
the
fix/2fa-trigger-push
branch
from
July 21, 2026 07:49
f7c29db to
e4dad94
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Split out from #470 per your request — the mechanism-agnostic core bug fix, with the Telegram convenience layer to rebase on top.
The headless sync loop detected "2FA required", notified the user, and retried — but never called
trigger_2fa_push_notification, so Apple was never asked to push a code. The user's trusted devices stayed silent and there was nothing to enter. (#471 bumped icloudpy so the trigger works; nothing in icloud-docker actually called it.)Change
_handle_2fa_requirednow requests the push, best-effort — a failure is logged and never breaks the retry loop.SyncState.two_fa_triggeredand reset on the next successful auth, so we don't re-push every retry cycle (default 600s) and trip Apple's rate limits.Tests
Full suite green, 100% coverage. Adds direct coverage for: push requested once per episode, not re-requested on subsequent retries within the same episode, and a failing trigger being swallowed without breaking the loop.