Add Step-up rechallenge implementation by rinatkhaziev · Pull Request #2869 · Automattic/vip-cli

rinatkhaziev · 2026-06-04T20:59:25Z

Description

This pull request implements step-up rechallenge support end-to-end for elevated-permission operations, and wires it into the shipped CLI experience.

Shipped behavior

Adds a rechallenge flow in the GraphQL request path so protected mutations can trigger step-up verification and then retry automatically with elevated authorization.
Adds operation-scoped elevated-token caching with keychain-backed persistence (scoped by API host), so repeated protected operations can reuse a valid elevation window.
Clears elevated-token cache on both login and logout so cached elevation cannot carry across user identity changes.
Introduces the vip defensive-mode command group with enable, disable, and configure subcommands.
Adds production safety guards for defensive-mode mutations, including explicit confirmation requirements in non-interactive contexts.
Adds non-interactive rechallenge fail-fast behavior by default, with explicit opt-in wait support via --rechallenge-wait / VIP_RECHALLENGE_WAIT=1.
Extracts API host constants into a dedicated module to support rechallenge integration without circular dependency regressions.

Test coverage included

Adds unit tests for rechallenge client, flow orchestration, Apollo link integration, token cache behavior, defensive-mode API and commands, API-chain retries, and logout/login cache clearing paths.

Changelog Description

Added

Added new vip defensive-mode commands to enable, disable, and configure defensive mode for an environment.
Added step-up verification support for protected actions, including automatic retry after verification succeeds.

Changed

Non-interactive runs now fail fast when step-up verification is required, unless you explicitly opt in to wait with --rechallenge-wait or VIP_RECHALLENGE_WAIT=1.
Production defensive-mode mutations in non-interactive workflows now require explicit confirmation bypass via --skip-confirmation.

Fixed

Login and logout now clear cached elevated permissions to prevent reuse across account switches on the same machine.

Pull request checklist

Update SETUP.md with any new environmental variables.
Update the documentation.
Manually test the relevant changes.
Follow the pull request checklist
Add/update automated tests as needed.

New release checklist

Automated tests pass.
The Preparing for release checklist is completed.

Steps to Test

Outline the steps to test and verify the PR here.

Example:

Check out PR.
Run npm run build
Run ./dist/bin/vip-cookies.js nom
Verify cookies are delicious.

github-actions · 2026-06-04T20:59:45Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

Copilot

Pull request overview

This PR introduces a new “step-up / rechallenge” elevated-permissions flow that integrates with the existing Apollo GraphQL client (via a custom ApolloLink), adds an elevated-token cache, and wires the flow into logout. It also adds a new vip defensive-mode CLI command group backed by new defensive-mode GraphQL mutations, along with a broad suite of unit tests around these behaviors.

Changes:

Add rechallenge (step-up) client, flow orchestration, ApolloLink integration, error types, and elevated-token keychain cache.
Add defensive-mode GraphQL mutation helpers and new CLI commands (vip defensive-mode enable|disable|configure).
Add unit tests for rechallenge components, defensive-mode API, logout behavior, and defensive-mode command behavior.

Reviewed changes

Copilot reviewed 22 out of 30 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
src/lib/token.ts	Switches API host/constants import to avoid pulling full `api.ts` graph.
src/lib/rechallenge/types.ts	Defines rechallenge protocol/types and constants.
src/lib/rechallenge/token-cache.ts	Implements keychain-backed elevated-token cache keyed by scope.
src/lib/rechallenge/open-browser.ts	Adds wrapper around ESM-only `open` for browser launching.
src/lib/rechallenge/link.ts	Adds ApolloLink that pre-attaches cached elevated token and runs rechallenge on elevated-permission errors.
src/lib/rechallenge/index.ts	Exposes rechallenge module exports.
src/lib/rechallenge/flow.ts	Implements rechallenge orchestration (session create → poll → exchange → cache).
src/lib/rechallenge/errors.ts	Adds typed rechallenge error classes.
src/lib/rechallenge/client.ts	Adds HTTP client for rechallenge session/status/exchange endpoints.
src/lib/logout.ts	Clears elevated-token cache on logout in addition to primary token purge.
src/lib/defensive-mode/api.ts	Adds GraphQL mutations/helpers to update defensive-mode status/config.
src/lib/api/http.ts	Switches `API_HOST` import to new constants module (reduces circular deps).
src/lib/api/feature-flags.ts	Lazy-initializes Apollo client to break a circular dependency chain.
src/lib/api/constants.ts	Introduces shared API host/URL constants (re-exported by `api.ts`).
src/lib/api.ts	Re-exports constants and injects rechallenge link via lazy `require()` to avoid Jest mock timing issues.
src/bin/vip.js	Registers the new `defensive-mode` top-level CLI command.
src/bin/vip-defensive-mode.js	Adds `vip defensive-mode` parent command and subcommand wiring.
src/bin/vip-defensive-mode-enable.js	Adds `vip defensive-mode enable` command implementation.
src/bin/vip-defensive-mode-disable.js	Adds `vip defensive-mode disable` command implementation.
src/bin/vip-defensive-mode-configure.js	Adds `vip defensive-mode configure` command implementation with flag validation/prompting.
package.json	Adds new `vip-defensive-mode*` bin entries for distribution.
tests/lib/rechallenge/token-cache.test.ts	Unit tests for elevated-token cache behavior and corruption handling.
tests/lib/rechallenge/link.test.ts	Unit tests for rechallenge ApolloLink preflight, retry, and error propagation.
tests/lib/rechallenge/flow.test.ts	Unit tests for rechallenge flow polling/exchange/caching and interactivity detection.
tests/lib/rechallenge/client.test.ts	Unit tests for rechallenge HTTP client request shapes and non-2xx error handling.
tests/lib/logout.test.ts	Verifies logout clears both primary token and elevated-token cache + telemetry.
tests/lib/defensive-mode/api.test.ts	Verifies defensive-mode mutation input formatting and optional field omission.
tests/bin/vip-defensive-mode-enable.js	Tests command registration and enable behavior (including non-interactive production safety).
tests/bin/vip-defensive-mode-disable.js	Tests command registration and disable behavior (including non-interactive production safety).
tests/bin/vip-defensive-mode-configure.js	Tests configure flag validation, non-interactive behavior, logging, and telemetry.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…n errors

Also extracts API_HOST/API_URL/PRODUCTION_API_HOST into a leaf constants module and lazy-requires the rechallenge link inside API() to break a circular-dependency cycle that caused Jest mocks to misfire in the rechallenge test suite.

…ions

Implements `vip defensive-mode configure` with full flag validation, interactive prompting for missing required flags, and non-interactive hard-error mode.

Copilot

Pull request overview

Copilot reviewed 26 out of 35 changed files in this pull request and generated 3 comments.

Copilot

Pull request overview

Copilot reviewed 26 out of 35 changed files in this pull request and generated 2 comments.

sjinks · 2026-07-01T21:57:09Z

+		super(
+			`Step-up verification is required for ${ scope }, but this is a non-interactive session. ` +
+				'Re-run the command interactively, or pass --rechallenge-wait (or set VIP_RECHALLENGE_WAIT=1) ' +
+				'to print the verification URL and wait for you to complete it on another device.',
+			scope


I am not sure what to do with this one. This is the third reviewer who flags this issue.

I have verified that no other command triggers rechallenge, but I understand why reviews flag this issue.

@rinatkhaziev, what do you think?

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Copilot reviewed 26 out of 35 changed files in this pull request and generated 4 comments.

sjinks · 2026-07-01T22:09:25Z

+		super(
+			`Step-up verification is required for ${ scope }, but this is a non-interactive session. ` +
+				'Re-run the command interactively, or pass --rechallenge-wait (or set VIP_RECHALLENGE_WAIT=1) ' +
+				'to print the verification URL and wait for you to complete it on another device.',
+			scope
+		);


Same as #2869 (comment)

Copilot

Pull request overview

Copilot reviewed 27 out of 36 changed files in this pull request and generated 3 comments.

Copilot

Pull request overview

Copilot reviewed 27 out of 36 changed files in this pull request and generated 4 comments.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

sonarqubecloud · 2026-07-01T23:19:42Z

Quality Gate passed

Issues
8 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
1.4% Duplication on New Code

See analysis details on SonarQube Cloud

Copilot

Pull request overview

Copilot reviewed 27 out of 36 changed files in this pull request and generated 1 comment.

rinatkhaziev requested a review from Copilot June 4, 2026 21:01

Copilot started reviewing on behalf of rinatkhaziev June 4, 2026 21:02 View session

Copilot AI reviewed Jun 4, 2026

View reviewed changes

Comment thread src/lib/defensive-mode/api.ts

Comment thread src/lib/defensive-mode/api.ts

Comment thread src/lib/rechallenge/errors.ts

Comment thread src/lib/rechallenge/link.ts

Comment thread __tests__/lib/rechallenge/client.test.ts

rinatkhaziev added the [Status] Needs Review label Jun 9, 2026

sjinks reviewed Jun 9, 2026

View reviewed changes

Comment thread src/bin/vip-defensive-mode-configure.js Outdated

sjinks reviewed Jun 9, 2026

View reviewed changes

Comment thread src/lib/logout.ts Outdated

sjinks reviewed Jun 9, 2026

View reviewed changes

Comment thread package.json

sjinks reviewed Jun 9, 2026

View reviewed changes

Comment thread src/lib/rechallenge/flow.ts Outdated

sjinks reviewed Jun 9, 2026

View reviewed changes

Comment thread src/bin/vip-defensive-mode-configure.js Outdated

sjinks reviewed Jun 18, 2026

View reviewed changes

Comment thread src/bin/vip-defensive-mode-configure.js Outdated

sjinks reviewed Jun 18, 2026

View reviewed changes

Comment thread src/lib/rechallenge/link.ts

sjinks reviewed Jun 18, 2026

View reviewed changes

Comment thread src/lib/rechallenge/flow.ts Outdated

sjinks reviewed Jun 18, 2026

View reviewed changes

Comment thread src/lib/rechallenge/flow.ts

sjinks reviewed Jun 18, 2026

View reviewed changes

Comment thread __tests__/bin/vip-defensive-mode-configure.js

rebeccahum reviewed Jun 30, 2026

View reviewed changes

Comment thread src/lib/rechallenge/flow.ts Outdated

rinatkhaziev and others added 6 commits July 1, 2026 18:10

feat(rechallenge): add types and error classes

479ffae

feat(rechallenge): add keychain-backed per-scope elevated-token cache

586b7af

feat(rechallenge): add REST client for Parker v2 session endpoints

cd414f0

fix(rechallenge): satisfy tsc check-types in test files

5b0fab9

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

feat(rechallenge): orchestrate session create, poll, exchange

49e5a49

feat(rechallenge): add Apollo link that intercepts elevated-permissio…

6b938df

…n errors

sjinks force-pushed the feat/rechallenge-v2-defensive-mode branch from 36c8952 to 291ed25 Compare July 1, 2026 15:17

github-advanced-security AI found potential problems Jul 1, 2026

View reviewed changes

Comment thread __tests__/lib/rechallenge/token-cache.test.ts Fixed

Comment thread __tests__/lib/rechallenge/token-cache.test.ts Fixed

Comment thread __tests__/lib/rechallenge/token-cache.test.ts Fixed

rinatkhaziev added 6 commits July 1, 2026 18:32

feat(api): insert rechallenge link into Apollo chain

96161a9

Also extracts API_HOST/API_URL/PRODUCTION_API_HOST into a leaf constants module and lazy-requires the rechallenge link inside API() to break a circular-dependency cycle that caused Jest mocks to misfire in the rechallenge test suite.

feat(defensive-mode): add GraphQL helpers for status and config mutat…

da63adf

…ions

feat(cli): add vip defensive-mode parent command

3566bbf

feat(cli): add vip defensive-mode enable subcommand

b6a676d

feat(cli): add vip defensive-mode disable subcommand

b800278

feat(cli): add vip defensive-mode configure subcommand

a90d285

Implements `vip defensive-mode configure` with full flag validation, interactive prompting for missing required flags, and non-interactive hard-error mode.

sjinks requested a review from Copilot July 1, 2026 21:16

Copilot started reviewing on behalf of sjinks July 1, 2026 21:16 View session