From 567ddca9e696c389cae49ae3f3643d72fe341de3 Mon Sep 17 00:00:00 2001
From: NiceAesth <nice@aesth.dev>
Date: Tue, 13 Oct 2026 15:52:58 -0300
Subject: [PATCH 1/2] retry 2fa on status code 409

---
 Sources/DeveloperPortal/Authentication.swift | 49 ++++++++++++--------
 1 file changed, 30 insertions(+), 19 deletions(-)

diff --git a/Sources/DeveloperPortal/Authentication.swift b/Sources/DeveloperPortal/Authentication.swift
index f60d4c6..a4047d6 100644
--- a/Sources/DeveloperPortal/Authentication.swift
+++ b/Sources/DeveloperPortal/Authentication.swift
@@ -9,6 +9,10 @@
 import Foundation
 import GSACryptoKit
 
+private enum PushedCodeState {
+    @TaskLocal static var handled = false
+}
+
 public extension DeveloperPortal {
 
     func authenticate(appleID unsanitizedAppleID: String,
@@ -190,6 +194,7 @@ public extension DeveloperPortal {
         let statusDictionary = completeResponseDictionary["Status"] as? [String: any Sendable]
         let authType = (statusDictionary?["au"] as? String)
            ?? (completeResponseDictionary["au"] as? String)
+           ?? ((statusDictionary?["hsc"] as? Int) == 409 && anisetteData.clientInfo.contains("<Android;") ? "pushedCode" : nil)
         verboseLog("[SideSign] Authentication status type: \(authType ?? "nil")")
 
         let twoFactorAuthContext = TwoFactorAuthContext(
@@ -200,25 +205,31 @@ public extension DeveloperPortal {
         )
 
         switch authType {
-            case "trustedDeviceSecondaryAuth", "trustedDevice", "secondaryAuth", "sms", "voice", "phone":
-                let isTrustedDevice = (authType == "trustedDeviceSecondaryAuth" || authType == "trustedDevice")
+            case "trustedDeviceSecondaryAuth", "trustedDevice", "secondaryAuth", "sms", "voice", "phone", "pushedCode":
+                let pushedCode = authType == "pushedCode"
+                guard !pushedCode || !PushedCodeState.handled else {
+                    throw DeveloperPortalError.requiresTwoFactorAuthentication
+                }
+                let isTrustedDevice = pushedCode || authType == "trustedDeviceSecondaryAuth" || authType == "trustedDevice"
                 try await handle2FARequest(
                     isTrustedDevice: isTrustedDevice,
                     completeResponseDictionary: completeResponseDictionary,
                     statusDictionary: statusDictionary,
                     context: twoFactorAuthContext,
-                    verificationHandler: verificationHandler
-                )
-                // recur coz we just solved 2FA above and this invocation shouldn't come to this case
-                return try await authenticate(
-                    appleID: unsanitizedAppleID, 
-                    password: password, 
-                    anisetteData: anisetteData, 
-                    xcodeVersion: xcodeVersion, 
-                    machinePassword: machinePassword, 
-                    accountRepairHandler: accountRepairHandler, 
-                    verificationHandler: verificationHandler
+                    verificationHandler: verificationHandler,
+                    codeAlreadySent: pushedCode
                 )
+                return try await PushedCodeState.$handled.withValue(PushedCodeState.handled || pushedCode) {
+                    try await authenticate(
+                        appleID: unsanitizedAppleID,
+                        password: password,
+                        anisetteData: anisetteData,
+                        xcodeVersion: xcodeVersion,
+                        machinePassword: machinePassword,
+                        accountRepairHandler: accountRepairHandler,
+                        verificationHandler: verificationHandler
+                    )
+                }
 
             case "repair":
                 let directRepairURL = completeResponseDictionary["repairUrl"] as? String
@@ -572,7 +583,8 @@ public extension DeveloperPortal {
                             completeResponseDictionary: [String: any Sendable],
                             statusDictionary: [String: any Sendable]?,
                             context: TwoFactorAuthContext,
-                            verificationHandler: VerificationHandler?) async throws 
+                            verificationHandler: VerificationHandler?,
+                            codeAlreadySent: Bool = false) async throws
     {
         guard let verificationHandler else {
             debugLog("[SideSign] 2FA required but no verificationHandler provided")
@@ -586,11 +598,10 @@ public extension DeveloperPortal {
 
         let preferredMode: TwoFactorDeliveryMode = isTrustedDevice ? .trustedDevice : .sms
 
-        var currentRequest: TwoFactorRequest = .selectDeliveryMethod(
-            preferredMode: preferredMode,
-            phoneNumbers: phoneNumbers
-        )
-        var activeChannel: TwoFactorAuthChannel? = nil
+        var currentRequest: TwoFactorRequest = codeAlreadySent
+            ? .trustedDevice(error: nil)
+            : .selectDeliveryMethod(preferredMode: preferredMode, phoneNumbers: phoneNumbers)
+        var activeChannel: TwoFactorAuthChannel? = codeAlreadySent ? .trustedDevice : nil
 
         while true {
             debugLog("[SideSign] Prompting user with 2FA request (\(currentRequest))...")

From 7a18c89e491600d78a84a889eebb20fd5cfdfe5e Mon Sep 17 00:00:00 2001
From: NiceAesth <nice@aesth.dev>
Date: Tue, 13 Oct 2026 15:54:52 -0300
Subject: [PATCH 2/2] well windows was doing this too so

---
 Sources/DeveloperPortal/Authentication.swift | 22 ++++++++++----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/Sources/DeveloperPortal/Authentication.swift b/Sources/DeveloperPortal/Authentication.swift
index a4047d6..0b8e0f2 100644
--- a/Sources/DeveloperPortal/Authentication.swift
+++ b/Sources/DeveloperPortal/Authentication.swift
@@ -189,18 +189,18 @@ public extension DeveloperPortal {
         }
 
         verboseLog("[SideSign] Parse complete. dsid: \(dsid), token: \(idmsToken)")
-        
+
         // 2FA auth type
         let statusDictionary = completeResponseDictionary["Status"] as? [String: any Sendable]
         let authType = (statusDictionary?["au"] as? String)
            ?? (completeResponseDictionary["au"] as? String)
-           ?? ((statusDictionary?["hsc"] as? Int) == 409 && anisetteData.clientInfo.contains("<Android;") ? "pushedCode" : nil)
+           ?? ((statusDictionary?["hsc"] as? Int) == 409 ? "pushedCode" : nil)
         verboseLog("[SideSign] Authentication status type: \(authType ?? "nil")")
 
         let twoFactorAuthContext = TwoFactorAuthContext(
-            dsid: dsid, 
-            idmsToken: idmsToken, 
-            anisetteData: anisetteData, 
+            dsid: dsid,
+            idmsToken: idmsToken,
+            anisetteData: anisetteData,
             xcodeVersion: xcodeVersion
         )
 
@@ -731,9 +731,9 @@ public extension DeveloperPortal {
         let errorMsg = (responseDict?["em"] as? String)
                    ?? ((responseDict?["Status"] as? [String: any Sendable])?["em"] as? String)
 
-        if errorCode == GrandSlamAuthErrorCodes.tooManyAttempts 
-            || errorCode == GrandSlamAuthErrorCodes.tooManyCodesRequested 
-            || errorCode == GrandSlamAuthErrorCodes.rateLimited 
+        if errorCode == GrandSlamAuthErrorCodes.tooManyAttempts
+            || errorCode == GrandSlamAuthErrorCodes.tooManyCodesRequested
+            || errorCode == GrandSlamAuthErrorCodes.rateLimited
             || statusCode == HTTPStatusCodes.tooManyRequests
         {
             let msg = errorMsg ?? "Verification codes cannot be sent to this phone number at this time. Please try again later."
@@ -850,9 +850,9 @@ public extension DeveloperPortal {
                     ?? xmluiMessage
                     ?? xmluiTitle
 
-        if errorCode == GrandSlamAuthErrorCodes.tooManyAttempts 
-            || errorCode == GrandSlamAuthErrorCodes.tooManyCodesRequested 
-            || errorCode == GrandSlamAuthErrorCodes.rateLimited 
+        if errorCode == GrandSlamAuthErrorCodes.tooManyAttempts
+            || errorCode == GrandSlamAuthErrorCodes.tooManyCodesRequested
+            || errorCode == GrandSlamAuthErrorCodes.rateLimited
             || statusCode == HTTPStatusCodes.tooManyRequests
         {
             let msg = errorMsg ?? "Too many verification code attempts. Please try again later."