Skip to content

Concept: Handle pushed 2FA codes when Apple omits "au" #60

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
mattaltgear wants to merge 2 commits into
base: notarized
Choose a base branch
from
+53 −12
Draft

Concept: Handle pushed 2FA codes when Apple omits "au" #60

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ab73939
Handles pushed 2FA codes when Apple omits "au"
mattaltgear Oct 14, 2026
1a6431f
Merge branch 'notarized' into matt/800concept
mattaltgear Oct 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
65 changes: 53 additions & 12 deletions AltSign/Sources/ALTAppleAPI+Authentication.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,20 @@ public extension ALTAppleAPI
anisetteData: ALTAnisetteData,
verificationHandler: ((@escaping (String?) -> Void) -> Void)?,
completionHandler: @escaping (ALTAccount?, ALTAppleAPISession?, Error?) -> Void)
{
self.authenticate(appleID: unsanitizedAppleID, password: password, anisetteData: anisetteData, hasEnteredPushedCode: false,
verificationHandler: verificationHandler, completionHandler: completionHandler)
}
}

private extension ALTAppleAPI
{
func authenticate(appleID unsanitizedAppleID: String,
password: String,
anisetteData: ALTAnisetteData,
hasEnteredPushedCode: Bool,
verificationHandler: ((@escaping (String?) -> Void) -> Void)?,
completionHandler: @escaping (ALTAccount?, ALTAppleAPISession?, Error?) -> Void)
{
// Authenticating only works with lowercase email address, even if Apple ID contains capital letters.
let sanitizedAppleID = unsanitizedAppleID.lowercased()
Expand Down Expand Up @@ -131,21 +145,30 @@ public extension ALTAppleAPI

context.dsid = dsid

let authType = statusDictionary["au"] as? String
// Apple may now respond with HTTP status 409 and no "au" field,
// in which case it has already pushed a code to trusted devices.
// Based on SideSign: https://github.com/SideStore/SideSign/pull/5
let authType = statusDictionary["au"] as? String ?? ((statusDictionary["hsc"] as? Int) == 409 ? "pushedCode" : nil)
switch authType
{
case "trustedDeviceSecondaryAuth":
case "trustedDeviceSecondaryAuth", "pushedCode":
guard let verificationHandler = verificationHandler else { throw ALTAppleAPIError(.requiresTwoFactorAuthentication) }

self.requestTrustedDeviceTwoFactorCode(dsid: dsid, idmsToken: idmsToken, anisetteData: anisetteData, verificationHandler: verificationHandler) { (result) in

let isCodeAlreadySent = (authType == "pushedCode")

// Don't prompt for a pushed code again if Apple still asks for one after we've entered it.
guard !isCodeAlreadySent || !hasEnteredPushedCode else { throw ALTAppleAPIError(.requiresTwoFactorAuthentication) }

self.requestTrustedDeviceTwoFactorCode(dsid: dsid, idmsToken: idmsToken, anisetteData: anisetteData, isCodeAlreadySent: isCodeAlreadySent, verificationHandler: verificationHandler) { (result) in
switch result
{
case .failure(let error): completionHandler(nil, nil, error)
case .success:
self.authenticate(appleID: unsanitizedAppleID, password: password, anisetteData: anisetteData, verificationHandler: verificationHandler, completionHandler: completionHandler)
self.authenticate(appleID: unsanitizedAppleID, password: password, anisetteData: anisetteData, hasEnteredPushedCode: hasEnteredPushedCode || isCodeAlreadySent,
verificationHandler: verificationHandler, completionHandler: completionHandler)
}
}

case "secondaryAuth":
guard let verificationHandler = verificationHandler else { throw ALTAppleAPIError(.requiresTwoFactorAuthentication) }

Expand All @@ -154,7 +177,8 @@ public extension ALTAppleAPI
{
case .failure(let error): completionHandler(nil, nil, error)
case .success:
self.authenticate(appleID: unsanitizedAppleID, password: password, anisetteData: anisetteData, verificationHandler: verificationHandler, completionHandler: completionHandler)
self.authenticate(appleID: unsanitizedAppleID, password: password, anisetteData: anisetteData, hasEnteredPushedCode: hasEnteredPushedCode,
verificationHandler: verificationHandler, completionHandler: completionHandler)
}
}

Expand Down Expand Up @@ -248,6 +272,7 @@ private extension ALTAppleAPI
func requestTrustedDeviceTwoFactorCode(dsid: String,
idmsToken: String,
anisetteData: ALTAnisetteData,
isCodeAlreadySent: Bool,
verificationHandler: @escaping (@escaping (String?) -> Void) -> Void,
completionHandler: @escaping (Result<Void, Error>) -> Void)
{
Expand All @@ -256,14 +281,18 @@ private extension ALTAppleAPI

let request = self.makeTwoFactorCodeRequest(url: requestURL, dsid: dsid, idmsToken: idmsToken, anisetteData: anisetteData)

self.sendGSARequest(request) { (result) in
// nil result means Apple already sent the code, so we didn't request one.
let requestCodeHandler = { (result: Result<(Data, HTTPURLResponse), Error>?) in
do
{
let (_, response) = try result.get()
guard (200 ..< 300).contains(response.statusCode) else {
throw ALTAppleAPIError.unknown(statusCode: response.statusCode, failure: NSLocalizedString("Could not request a verification code from Apple.", comment: ""))
if let result
{
let (_, response) = try result.get()
guard (200 ..< 300).contains(response.statusCode) else {
throw ALTAppleAPIError.unknown(statusCode: response.statusCode, failure: NSLocalizedString("Could not request a verification code from Apple.", comment: ""))
}
}

func responseHandler(verificationCode: String?)
{
do
Expand Down Expand Up @@ -316,6 +345,18 @@ private extension ALTAppleAPI
completionHandler(.failure(error))
}
}

if isCodeAlreadySent
{
// Apple already sent the code, so prompt for it without requesting another.
requestCodeHandler(nil)
}
else
{
self.sendGSARequest(request) { (result) in
requestCodeHandler(result)
}
}
}

func requestSMSTwoFactorCode(dsid: String,
Expand Down