fix: make the 2FA take-over universal — tailor guidance to what the page asks for - #3520
Merged
Conversation
Vendors like GitHub default the 2FA step to a passkey / security-key prompt (github.com/sessions/two-factor/webauthn) — which we can't use and which has no 6-digit field, so the panel said 'enter the code' while the page showed no place to type it. After sign-in, best-effort switch to the authenticator-app option (More options -> Use authenticator app / Enter a code) so the code field is actually shown — for us to fill a stored code, or for the user to type one during take-over. +test.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 2 files
Reply with feedback, questions, or to request a fix.
Fix all with cubic | Re-trigger cubic
Make the two-factor take-over universal instead of assuming an authenticator code: - Classify the verification page into how it wants the user to verify (a code, a passkey that can be switched away from, a passkey-only login, or another challenge) and return it from the sign-in result. - When Comp AI has a stored code, auto-switch off a passkey so the code field appears, then fill it. When a human is taking over, don't pick a method for them — just reveal the vendor's other options so they choose the one they can complete. - Show exact guidance in the take-over panel from that classification: enter the code, switch off the passkey, or a plain notice that a passkey-only login can't be automated (with the confirm button hidden, since there's nothing to complete). No vendor names are hard-coded. Adds unit coverage for the classifier, the take-over vs stored-code login behavior, and the panel copy for each method state.
tofikwest
changed the title
Contributor
There was a problem hiding this comment.
All reported issues were addressed across 7 files (changes from recent commits).
Reply with feedback, questions, or to request a fix.
Fix all with cubic | Re-trigger cubic
- Split the passkey→code switch into two single-action steps (reveal the other options, then choose the authenticator/code method). act() performs one action per call, so a combined 'click More options, then Use authenticator app' could stop after the first click and never reach the code field. - Trust an explicit method classification when routing the take-over panel: an 'other' verification (device approval, CAPTCHA, link) now uses the generic finish panel instead of code-entry guidance, even when the outcome is needs_2fa. Falls back to the failure code only when no method was detected. - Extract the page classifiers (classifyLoginOutcome, classifyTwoFactorMethod, safeOriginAndPath) into a focused browser-login-classifier module, bringing the login file back under the 300-line limit. Tests moved/updated alongside; 186 browserbase tests green, typecheck clean.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Makes the two-factor take-over work for any vendor instead of assuming an authenticator code. Three parts:
Classify how the page wants the user to verify. After a blocked sign-in, we read the verification page into one of:
code(a code can be entered),passkey(a passkey/security key is shown, but another method can be chosen),passkey_only(passkey is the only option), orother(device approval / CAPTCHA / link). Returned on the sign-in result. No vendor names are hard-coded — the model recognizes the prompt and the "use another method" control itself.Right agent behavior per situation.
Exact take-over guidance in the panel, driven by the classification:
code→ "Enter the code in the page."passkey→ "Switch to a code method" (click More options → authenticator / SMS / email).passkey_only→ plain notice that it can't be automated, confirm button hidden (nothing to complete), with what to do instead.Why
Follows the two live-view fixes merged in #3516 (live view follows to the 2FA tab; session stays alive during take-over). Those got the user to the right page; this makes the panel stop telling everyone to "enter the code" when the page is really showing a passkey — and says so honestly when a login can't be automated at all.
Scope
browser-credential-login.ts(per-situation passkey handling +classifyTwoFactorMethod),browser-credential-signin.service.ts(returntwoFactorMethodon take-over).ConnectLiveSignin.tsx(method-tailored copy),ConnectVendorLoginFlow.tsx(thread the method through).Tests
other, throw →other); stored-code login switches off a passkey; take-over reveals options without picking one; service returns the classified method. 186 browserbase tests green, typecheck clean on the touched files.Note
The passkey→code switch and "reveal options" are best-effort model steps, and during take-over the live view is interactive — if the model misses the control, the user can click it themselves. Needs one live check on stage against a vendor that defaults 2FA to a passkey (can't be reproduced locally).