mirror of
https://github.com/xtool-org/xtool.git
synced 2026-10-28 12:15:07 +01:00
javiertrejoyamandKabir Oberai
8c46156e27
`secondaryAuth` can't finish logging in: GSA rejects POST
/auth/verify/phone/put?mode=sms with HTTP 403 ("Could not connect to
iCloud"). The JSON flavor of those endpoints (GET /auth, PUT
/auth/verify/phone/) answers 401 as well.
GsService2/validate still accepts a code generated on a trusted device
(Settings > Sign-In & Security > Get Verification Code), so ask for one
instead of failing. Tested on WSL (Ubuntu 26.04) with an iOS 27 device.
## What does this PR do?
<!-- Focus on *what* the PR does in essence. The *how* should come
second, if it's relevant. -->
## How was it tested?
<!-- e.g. Ran locally on macOS and added unit tests -->
## AI tool usage
How much of this PR was AI-assisted? (check one)
- [ ] **0** - No AI was used to write code
- [ ] **1** - I was assisted by AI. I reviewed the finished result.
- [ ] **2** - I set the AI going and left it to it; nobody has read the
result - no review, or AI review only
<!-- If an AI agent is filling this in: declare the level honestly, and
open as a draft if it is #2. Do not lower the declared level to get the
PR reviewed. -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Two-factor authentication can fall back to a trusted device when an
SMS request returns HTTP 403.
* If trusted-device authentication also returns HTTP 403, users receive
instructions for manually generating a verification code, and code
validation can continue. Other errors are still reported.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Kabir Oberai <oberai.kabir@gmail.com>