Conversation
This was referenced Sep 9, 2026
ericmj
commented
Sep 10, 2026
| HEXPM_OTP: OTP-28.5 | ||
| HEXPM_ELIXIR: v1.19.5 | ||
| HEXPM_BRANCH: main | ||
| HEXPM_BRANCH: organization-tfa-enforcement |
Member
Author
There was a problem hiding this comment.
This needs reverting back to main before merging.
ericmj
marked this pull request as ready for review
September 10, 2026 02:28
The server no longer tracks per-session 2FA verification, so the "tfa" requirement means the account has to enable two-factor authentication. Label it that way in the reauthorization prompt, start the integration server with organization 2FA policies enabled, and cover both an unenrolled member seeing the requirement and an enrolled member keeping organization access when a policy starts.
The server decides whether a browser request was completed, so the client no longer skips the refresh when the verification URL's expiry has passed by the time the user presses Enter. Re-vendor hex_core from 68d8345 for the improper requirement list fix.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When private dependencies need organization authentication, Hex names the affected organizations and displays separate 2FA enrollment and SSO requirements. The shared browser flow completes outstanding requirements before the client refreshes scopes and resumes fetching, and outstanding requirements are kept when the flow is cancelled, expires, or receives EOF.
Vendor the corresponding hex_core protocol changes and add integration coverage against Hexpm for organization scope filtering, verification requests, and an enrolled member keeping access when a policy starts. The integration harness starts the server with organization 2FA policies enabled. The full Hex suite against the changed server passed 662 tests with one existing skip; formatting passed.
Depends on hexpm/hex_core#222, vendored from hexpm/hex_core@68d8345.
Related: hexpm/hexpm#1913, hexpm/hex_core#222.
Draft CI runs against the
organization-tfa-enforcementserver branch from hexpm/hexpm#1913. RestoreHEXPM_BRANCH: mainafter that server change merges and before merging this PR.