Conversation
Because: * The auth-server removed POST /totp/destroy in January 2026, so Session.totp_delete has returned 404 since then. * POST /totp/create is being retired now that traffic has moved to /mfa/totp/create (FXA-14626); PyFxA was its last first-party caller. This commit: * Adds Session.mfa_request_otp and mfa_verify_otp to obtain the MFA JWT that guards the /mfa/* routes. * Points totp_create and totp_delete at /mfa/totp/create and /mfa/totp/destroy; both now take the MFA token. * Adds totp_setup_verify and totp_setup_complete for the setup flow. * Rewrites the live TOTP test around the MFA flow and adds a mocked test pinning the plain Bearer header on the MFA call site.
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
MFA JWTs can be transmitted over plaintext HTTP, and most new call paths lack default-CI coverage.
Get a fresh assessment by requesting another Copilot review.
Review effort: Balanced
Findings: 1
Open (2)
What changed in this PR
Moves TOTP lifecycle management to MFA JWT-protected routes.
Changes:
- Adds MFA OTP request and verification helpers.
- Migrates TOTP creation, setup, and deletion to
/mfa/totp/*. - Updates live and mocked tests plus release notes.
| File | Description |
|---|---|
fxa/core.py |
Implements MFA-token TOTP APIs. |
fxa/tests/test_core.py |
Updates live flow and adds bearer-header coverage. |
CHANGES.txt |
Documents the breaking API migration. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| from fxa.errors import ClientError | ||
| from fxa._utils import ( | ||
| APIClient, | ||
| BearerTokenAuth, |
Comment on lines
+465
to
+466
| @responses.activate | ||
| def test_totp_setup_sends_plain_bearer_mfa_token(self): |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The auth-server's pre-MFA TOTP routes are going away.
POST /totp/destroywas removed in January 2026 (mozilla/fxa985f565dc9), soSession.totp_deletehas been returning 404 since then, andPOST /totp/createis being retired under FXA-14626. PyFxA was the last first-party caller of/totp/create.This moves TOTP management onto the
/mfa/totp/*routes, which are guarded by a short-lived MFA JWT instead of the session token.Changes
Session.mfa_request_otp(action)andSession.mfa_verify_otp(code, action): request the emailed one-time code and exchange it for the MFA token.Session.totp_create(mfa_token)andSession.totp_delete(mfa_token)now call/mfa/totp/createand/mfa/totp/destroy. Breaking: both take the MFA token.Session.totp_setup_verify(mfa_token, code)andSession.totp_setup_complete(mfa_token)cover the setup flow; nothing is stored on the account until complete succeeds.test_totprewritten around the MFA flow. The code arrives in theX-Account-Change-Verify-Codeemail header.Bearertoken, not the prefixed session token.CHANGES.txtentry under 0.9.0 (unreleased); no version bump here.Notes
totp_existsandtotp_verifyare unchanged;/totp/existsand/session/verify/totpare not being retired.FXA_RUN_LIVE_TESTS=1, stage, and restmail). Mocked suite: 6 passed, 30 skipped.Related: FXA-14626, FXA-12699.