mfa

func CheckMFACompletion ¶ added in v1.3.0

func CheckMFACompletion(ac *client.AlpaconClient) (bool, error)

func GetMFALink ¶

func GetMFALink(ac *client.AlpaconClient, serverID string, workspaceName string) (string, error)

func GetMFALinkForSudo ¶ added in v1.4.0

func GetMFALinkForSudo(ac *client.AlpaconClient, serverName string) (string, error)

GetMFALinkForSudo resolves the server name and returns a CLI MFA URL. Used by the sudo MFA listener where only the server name is available.

func GetWorkspaceSecurityMFALink ¶ added in v1.4.2

func GetWorkspaceSecurityMFALink(ac *client.AlpaconClient, workspaceName string) (string, error)

GetWorkspaceSecurityMFALink returns an MFA URL for workspace security settings. Uses location "cli" so the mfa-success page notifies the backend, enabling CheckMFACompletion polling to detect when MFA is done.

func HandleMFAError ¶

func HandleMFAError(ac *client.AlpaconClient, serverName string) error

func StepUpForSudo ¶ added in v1.7.2

func StepUpForSudo(ac *client.AlpaconClient, serverName string) error

StepUpForSudo runs an interactive MFA step-up for an exec-sudo presence denial (SUDO_PRESENCE_REQUIRED). It prints the verification link, opens the browser when the user presses Enter, and polls until the server records the MFA completion. It returns nil once presence is fresh, or an error on timeout.

The Enter prompt opens the browser as a convenience but never gates progress: the poll runs regardless, so a user who opens the link manually still completes, and an absent human or a misconfigured agent always terminates at the bounded timeout rather than wedging the command. Callers should still gate this on an interactive terminal, since scripts, CI, and AI agents never receive a presence denial in the first place.