fix(cli): retry 2FA preflight then warn-and-continue on network errors

[riderx]

Summary (AI generated)

• Retry the reject_access_due_to_2fa_for_app / reject_access_due_to_2fa_for_org preflight RPC up to three times on transient network errors.
• After retries are exhausted, log a warning and continue the command instead of aborting (fail-open for the preflight probe only).
• Still abort when the RPC succeeds and returns shouldReject === true (real 2FA enforcement).
• Still abort on non-network RPC failures (e.g. permission errors).
• Report remaining preflight network failures to PostHog via TwoFactorComplianceNetworkError without wrapping them in CliUserError.

Motivation (AI generated)

check2FAComplianceForApp is a UX preflight on success-path commands like bundle upload and channel add. When the probe hits a transient fetch failed, the CLI aborts even though the backend still enforces 2FA on the actual mutation. That blocks valid uploads on flaky connectivity.

PR #3180 only reclassified the failure as TwoFactorComplianceNetworkError while staying fail-closed — the command still stopped. This change keeps telemetry visibility but lets the success path continue after retries.

Business Impact (AI generated)

• Reduces false-negative upload/channel failures caused by transient network blips during the 2FA preflight.
• Preserves security: orgs that require 2FA are still blocked when the probe succeeds, and the backend remains authoritative on the mutation.
• Keeps operational visibility for unreachable preflight probes via PostHog exception capture.

Test Plan (AI generated)

• bun run test:2fa-compliance-network — persistent network errors warn-and-continue after 3 attempts; retry succeeds on 2nd attempt; shouldReject still throws; non-network RPC errors still throw.
• bun run test:posthog-exception — TwoFactorComplianceNetworkError remains PostHog-eligible.
• bun run lint (CLI)
• bun run build (CLI)

Generated with AI

  

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• Bug Fixes
  • Improved two-factor compliance checks to automatically retry temporary network failures.
  • Network-related failures now display a warning and allow the check to continue when appropriate.
  • Persistent and non-network errors continue to be reported normally.
• Tests
  • Expanded coverage for successful checks, retry behavior, persistent failures, and network error handling.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 204632f7-2d42-4b93-8c66-67ff96a8f862

📥 Commits

Reviewing files that changed from the base of the PR and between 5b9fb45 and 5d74e8b.

📒 Files selected for processing (2)

• cli/src/shared/two-factor-compliance.ts
• cli/test/test-2fa-compliance-network.mjs

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• Cap-go/capacitor-updater (manual)

Included review availability: 0 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 2 reviews per hour.

---

📝 Walkthrough

Walkthrough

2FA compliance RPC checks now retry transient network failures up to three attempts. Persistent network failures emit warnings and telemetry without throwing. Non-transient errors retain existing logging and rejection behavior. Tests cover app and organization flows.

Changes

2FA compliance network resilience

Layer / File(s)	Summary
Retry and fail-open warning flow cli/src/shared/two-factor-compliance.ts	Adds retry configuration, transient RPC retry handling, user warnings, and optional PostHog error capture.
App and organization check integration cli/src/api/app.ts, cli/src/utils.ts	Routes both compliance checks through the retry helper and continues after persistent transient network failures.
Network retry behavior validation cli/test/test-2fa-compliance-network.mjs	Tests retry limits, successful retries, persistent failures, rejection behavior, and network error properties.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to 5d74e

The retry and warning behavior is localized and preserves the intended enforcement and telemetry paths; no actionable merge-blocking risk remains after normal checks and review.

Sequence Diagram(s)

sequenceDiagram
  participant check2FAComplianceForApp
  participant callTwoFactorComplianceRpcWithRetry
  participant SupabaseRPC
  participant warnAndContinueTwoFactorPreflightNetworkFailure
  check2FAComplianceForApp->>callTwoFactorComplianceRpcWithRetry: invoke 2FA compliance RPC
  callTwoFactorComplianceRpcWithRetry->>SupabaseRPC: attempt request
  SupabaseRPC-->>callTwoFactorComplianceRpcWithRetry: transient network failure
  callTwoFactorComplianceRpcWithRetry->>SupabaseRPC: retry up to three attempts
  SupabaseRPC-->>callTwoFactorComplianceRpcWithRetry: result or persistent failure
  callTwoFactorComplianceRpcWithRetry-->>check2FAComplianceForApp: return RPC result
  check2FAComplianceForApp->>warnAndContinueTwoFactorPreflightNetworkFailure: warn and capture persistent network failure

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 12 functions across 4 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: retrying the 2FA preflight and continuing after network errors.
Description check	✅ Passed	The description explains the motivation, behavior, business impact, and test plan. It covers the required summary and testing information. The repository checklist and screenshots section are not incl…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description explains the motivation, behavior, business impact, and test plan. It covers the required summary and testing information. The repository checklist and screenshots section are not included, but these omissions are non-critical because the description is otherwise complete and relevant.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands.}

[codspeed-hq]

Merging this PR will not alter performance

✅ 43 untouched benchmarks
⏩ 2 skipped benchmarks¹

---

_{Comparing cursor/cli-2fa-preflight-retry-warn-881f (5d74e8b) with main (dc57849)}

Footnotes

1. 2 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[cubic-dev-ai]

No issues found across 4 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[cursor]

@coderabbitai review

[Copilot]

Pull request overview

This PR adjusts the Capgo CLI’s 2FA compliance preflight (RPCs reject_access_due_to_2fa_for_app / reject_access_due_to_2fa_for_org) to be more resilient to transient network failures by retrying and then warn-and-continue (fail-open) when the probe remains unreachable, while still enforcing 2FA when the probe succeeds and indicates rejection.

Changes:

• Added a shared retry helper for the 2FA preflight RPC and a warn+telemetry “continue” path after retries are exhausted.
• Updated the app/org 2FA preflight call sites to use the retry helper and to fail-open only on transient network errors.
• Updated the 2FA network tests to match the new behavior (retry + continue instead of throwing on network failures).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
cli/src/shared/two-factor-compliance.ts	Introduces retry wrapper + warn-and-continue path and telemetry capture for preflight network failures.
cli/src/api/app.ts	Routes app-scoped 2FA preflight through the retry helper and fail-open handler for transient network errors.
cli/src/utils.ts	Routes org-scoped 2FA preflight through the retry helper and fail-open handler for transient network errors.
cli/test/test-2fa-compliance-network.mjs	Updates tests to assert retry counts and warn-and-continue behavior on persistent network errors.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[cursor]

@coderabbitai full review

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud