fix: handle 2FA on the Bitwarden account during API login [#442]

bw login --apikey prompts for a TOTP code when 2FA is enabled on the
BW account. The previous code didn't pass one, so it would hang or
fail. Now generates a TOTP from BW_TOTP_SECRET and passes via --code.

Changes:
- BitwardenHelper.__init__ accepts totp_secret param
- login() generates a pyotp code and passes --code when secret is set
- provision-agent.py passes BW_TOTP_SECRET from environment
- docker-compose.yml and .env.example updated for the new var
- BW_PASSWORD removed from the login env (only needed for unlock via stdin)

The BW account's own TOTP secret lives in ~/.config/bw/env alongside
the other BW access info — the one exception (can't store BW's 2FA in
BW itself).

💘 Generated with Crush

Assisted-by: Crush:glm-5.2

This commit is contained in:

TSYS Group COO

2026-08-13 12:14:16 -05:00

parent 9b4502f55d

commit 7534964c13

4 changed files with 22 additions and 4 deletions

									
										.env.example
									
		+3
		
												View File
												
				@@ -3,5 +3,8 @@ BW_CLIENTID=

				BW_CLIENTSECRET=

				BW_PASSWORD=

				# TOTP secret for the BW account's own 2FA (required if 2FA is enabled)

				BW_TOTP_SECRET=

				# Set to true for debugging (shows browser window — requires display)

				HEADFUL=false