Problem / motivation
Traeger.login() (traeger_client.py) only implements the USER_PASSWORD_AUTH Cognito flow. Accounts with MFA enabled on the Traeger app account fail at the initial login with no clear path forward — refresh()/reauth() already handle long-running renewal fine, but there's no way to complete a first login that requires an MFA challenge response.
Proposed solution
- Detect a Cognito challenge response (e.g.
ChallengeName in the InitiateAuth response, such as SMS_MFA or SOFTWARE_TOKEN_MFA) instead of assuming AuthenticationResult is always present.
- Prompt interactively for the code (CLI
input(), matching the project's terminal-native style — no new UI surface) and complete the flow via Cognito's RespondToAuthChallenge API.
- Keep this opt-in/graceful: accounts without MFA must see zero behavior change.
Alternatives considered
Documenting MFA as unsupported (current state, in SECURITY.md's "Known limitations") — acceptable as a stopgap, but excludes anyone who (reasonably) has MFA on their Traeger account.
Problem / motivation
Traeger.login()(traeger_client.py) only implements theUSER_PASSWORD_AUTHCognito flow. Accounts with MFA enabled on the Traeger app account fail at the initial login with no clear path forward —refresh()/reauth()already handle long-running renewal fine, but there's no way to complete a first login that requires an MFA challenge response.Proposed solution
ChallengeNamein theInitiateAuthresponse, such asSMS_MFAorSOFTWARE_TOKEN_MFA) instead of assumingAuthenticationResultis always present.input(), matching the project's terminal-native style — no new UI surface) and complete the flow via Cognito'sRespondToAuthChallengeAPI.Alternatives considered
Documenting MFA as unsupported (current state, in SECURITY.md's "Known limitations") — acceptable as a stopgap, but excludes anyone who (reasonably) has MFA on their Traeger account.