What's the best way to minimize 2fa queries for snapcraft ?

[Vincent Ladeuil]

Working on 'snapcraft login' I ran into the following issue:

- login to SSO with 2FA (as that's the default mode for snapcraft),

- get the root macaroon from sca

- get the discharge_macarron from sso
=> fails with ssoclient.v2.errors.TwoFactorRequired: 401: TWOFACTOR_REQUIRED

- get the discharge macaroon from sso with the otp used for login
=> fails with
ssoclient.v2.errors.TwoFactorFailure: 403: TWOFACTOR_FAILURE

- get the discharge macaroon with an auth based on the login session and the
  login otp

=> fails with ssoclient.v2.errors.TwoFactorRequired: 401: TWOFACTOR_REQUIRED

- get the discharge macaroon from sso with a *new* otp without auth
=> works

So I'm not sure I'm using the API correctly but if getting a discharge
macaroon /always/ require 2fA for any operation (discharge macaroons
refreshes have been mentioned recently), the user experience will
be... painful :-/

Advice welcome.

[Vincent Ladeuil (vila)]

Ideally I should be able to get a discharge macaroon while being auth'ed with the first otp and without having to use a second one.

[Vincent Ladeuil (vila)]

Thanks to Facundo for clarifying, the bit I missed was that a discharge macaroon can be refreshed without requiring a new 2FA otp (as long the the user is still valid, didn't change his password, etc).