{"record":{"id":"1ed652947d28c480","repo":"eyaltoledano/claude-task-master","slug":"mfa-required-1ed652","errorCode":"MFA_REQUIRED","errorMessage":"'MFA verification required. Please provide your authentication code.'","messagePattern":"'MFA verification required\\. Please provide your authentication code\\.'","errorType":"exception","errorClass":"AuthenticationError","httpStatus":null,"severity":"warning","filePath":"packages/tm-core/src/modules/auth/services/session-manager.ts","lineNumber":255,"sourceCode":"\t\t\t\t);\n\t\t\t}\n\n\t\t\t// Get user information\n\t\t\tconst user = await this.supabaseClient.getUser();\n\n\t\t\tif (!user) {\n\t\t\t\tthrow new AuthenticationError(\n\t\t\t\t\t'Failed to get user information',\n\t\t\t\t\t'INVALID_RESPONSE'\n\t\t\t\t);\n\t\t\t}\n\n\t\t\t// Check if MFA is required for this user\n\t\t\tconst mfaCheck = await this.supabaseClient.checkMFARequired();\n\n\t\t\tif (mfaCheck.required && mfaCheck.factorId && mfaCheck.factorType) {\n\t\t\t\t// MFA is required - throw an error with the MFA challenge information\n\t\t\t\tthrow new AuthenticationError(\n\t\t\t\t\t'MFA verification required. Please provide your authentication code.',\n\t\t\t\t\t'MFA_REQUIRED',\n\t\t\t\t\tundefined,\n\t\t\t\t\t{\n\t\t\t\t\t\tfactorId: mfaCheck.factorId,\n\t\t\t\t\t\tfactorType: mfaCheck.factorType\n\t\t\t\t\t}\n\t\t\t\t);\n\t\t\t}\n\n\t\t\t// Store user context\n\t\t\tthis.contextStore.saveContext({\n\t\t\t\tuserId: user.id,\n\t\t\t\temail: user.email\n\t\t\t});\n\n\t\t\t// Build credentials response\n\t\t\tconst context = this.contextStore.getUserContext();","sourceCodeStart":237,"sourceCodeEnd":273,"githubUrl":"https://github.com/eyaltoledano/claude-task-master/blob/c0c98d367c55296bfe69e65680625b6db437af02/packages/tm-core/src/modules/auth/services/session-manager.ts#L237-L273","documentation":"AuthenticationError with code MFA_REQUIRED thrown by authenticateWithCode when checkMFARequired() reports the user has MFA enabled (required=true with factorId and factorType). This is an expected control-flow signal, not a malfunction: the one-time code authenticated the user, but a second factor must be verified via verifyMFA(factorId, code) before credentials are issued.","triggerScenarios":"Calling authenticateWithCode(token) for any user who has enrolled an MFA factor in Supabase; factorId/factorType are attached to the error so callers can immediately prompt for the verification code and call verifyMFA.","commonSituations":"Users with TOTP or other MFA factors enrolled running headless/SSH CLI login; scripts written before MFA was enabled on the account suddenly hitting this; automation that never handles the MFA step.","solutions":["Catch this error, prompt the user for their MFA code, and call sessionManager.verifyMFA(err.details.factorId, code)","Factor the factorType (e.g. totp) into the prompt shown to the user","For non-interactive automation, use a service account without MFA or an alternate auth path","Document in your tooling that MFA-enabled accounts require the two-step token + MFA flow"],"exampleFix":"// before: assuming single-step auth\nawait sessionManager.authenticateWithCode(token);\n// after: handle MFA step\ntry {\n  await sessionManager.authenticateWithCode(token);\n} catch (e) {\n  if (e instanceof AuthenticationError && e.code === 'MFA_REQUIRED') {\n    const code = await prompt('Enter MFA code:');\n    await sessionManager.verifyMFA(e.details.factorId, code);\n  }\n}","handlingStrategy":"try-catch","validationCode":"// no local pre-check possible: MFA enrollment is server-side.\n// Design callers to expect MFA_REQUIRED whenever user accounts may have factors.","typeGuard":"function isMfaRequired(e: unknown): e is AuthenticationError & { details: { factorId: string; factorType: string } } {\n  return e instanceof AuthenticationError && e.code === 'MFA_REQUIRED' &&\n    !!e.details?.factorId;\n}","tryCatchPattern":"try {\n  await sessionManager.authenticateWithCode(token);\n} catch (e) {\n  if (isMfaRequired(e)) {\n    const code = await prompt(`Enter ${e.details.factorType} code:`);\n    await sessionManager.verifyMFA(e.details.factorId, code);\n  } else throw e;\n}","preventionTips":["Always implement the MFA branch in auth flows — any user may enroll MFA","Surface factorType in prompts (totp vs other)","For headless automation, use accounts without MFA or a supported non-interactive path","Treat MFA_REQUIRED as control flow, not an error condition to crash on"],"tags":["auth","mfa","two-factor","cli"],"backgroundTag":"mfa-required","analyzedSha":"c0c98d367c55296bfe69e65680625b6db437af02","analyzedAt":"2026-08-29T02:56:26.071Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}