gsa: fall back to a trusted-device code when SMS 2FA fails

[javiertrejoyam]

secondaryAuth can't finish logging in: GSA rejects POST /auth/verify/phone/put?mode=sms with HTTP 403 ("Could not connect to iCloud"). The JSON flavor of those endpoints (GET /auth, PUT /auth/verify/phone/) answers 401 as well.

GsService2/validate still accepts a code generated on a trusted device (Settings > Sign-In & Security > Get Verification Code), so ask for one instead of failing. Tested on WSL (Ubuntu 26.04) with an iOS 27 device.

What does this PR do?

How was it tested?

AI tool usage

How much of this PR was AI-assisted? (check one)

• 0 - No AI was used to write code
• 1 - I was assisted by AI. I reviewed the finished result.
• 2 - I set the AI going and left it to it; nobody has read the result - no review, or AI review only

Summary by CodeRabbit

• Bug Fixes
  • Two-factor authentication can now continue when an SMS request returns an HTTP response error, allowing a verification code to be validated without a phone number ID.
  • A message guides users to generate a code on a trusted device when SMS delivery is unavailable. Other SMS request errors continue to be reported.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: a7c76a96-e4ce-4f97-8777-8729b53f515e

📥 Commits

Reviewing files that changed from the base of the PR and between b50173f and c719f26.

📒 Files selected for processing: 1

• Sources/XKit/GrandSlam/Operations/GrandSlamTwoFactorAuthenticateOperation.swift

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📝 Walkthrough

When the SMS-send request returns HTTPResponseError, performSMSAuth() prints instructions to generate a code on a trusted device and validates the code without a phone number ID. Other send errors continue to propagate. Successful sends continue to SMS-specific validation.

Changes: SMS authentication fallback

Layer / File(s)	Summary
Handle SMS-send errors Sources/XKit/GrandSlam/Operations/GrandSlamTwoFactorAuthenticateOperation.swift	When the SMS-send request returns HTTPResponseError, the operation prints trusted-device instructions, validates a code without a phone number ID, and returns. Other send errors propagate. Successful sends use SMS-specific validation.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to c719f

The fallback may also be used for other HTTP send failures, but the repository does not establish that this is incorrect. No supported issue remains that prevents merging.

Pre-merge checks: 4

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: using a trusted-device code when SMS two-factor authentication fails.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}