Fix MFA option resolution priority by match type first

cursoragent · cursoragent · commit b3607bf5ed1b · 2026-03-02T15:08:58.000Z
diff --git a/cmd/auth_connections.go b/cmd/auth_connections.go
@@ -460,24 +460,43 @@ func (c AuthConnectionCmd) Submit(ctx context.Context, in AuthConnectionSubmitIn
 			return util.CleanedUpSdkError{Err: fmt.Errorf("failed to fetch connection for MFA option resolution: %w", err)}
 		}
 		if len(conn.MfaOptions) > 0 {
-			resolved := false
+			resolvedType := ""
+			inputOption := in.MfaOptionID
+
+			// Match by type first across all options, then label, then display string.
+			// This ensures an exact type match is never shadowed by an earlier label match.
 			for _, opt := range conn.MfaOptions {
-				displayName := fmt.Sprintf("%s (%s)", opt.Label, opt.Type)
-				if strings.EqualFold(in.MfaOptionID, opt.Type) ||
-					strings.EqualFold(in.MfaOptionID, opt.Label) ||
-					strings.EqualFold(in.MfaOptionID, displayName) {
-					in.MfaOptionID = opt.Type
-					resolved = true
+				if strings.EqualFold(inputOption, opt.Type) {
+					resolvedType = opt.Type
 					break
 				}
 			}
-			if !resolved {
+			if resolvedType == "" {
+				for _, opt := range conn.MfaOptions {
+					if strings.EqualFold(inputOption, opt.Label) {
+						resolvedType = opt.Type
+						break
+					}
+				}
+			}
+			if resolvedType == "" {
+				for _, opt := range conn.MfaOptions {
+					displayName := fmt.Sprintf("%s (%s)", opt.Label, opt.Type)
+					if strings.EqualFold(inputOption, displayName) {
+						resolvedType = opt.Type
+						break
+					}
+				}
+			}
+			if resolvedType == "" {
 				available := make([]string, 0, len(conn.MfaOptions))
 				for _, opt := range conn.MfaOptions {
 					available = append(available, fmt.Sprintf("%s (%s)", opt.Label, opt.Type))
 				}
 				return fmt.Errorf("unknown MFA option %q; available: %s", in.MfaOptionID, strings.Join(available, ", "))
 			}
+
+			in.MfaOptionID = resolvedType
 		}
 	}
 
diff --git a/cmd/auth_connections_test.go b/cmd/auth_connections_test.go
@@ -233,6 +233,28 @@ func TestSubmit_MfaOptionResolvesType(t *testing.T) {
 	assert.Equal(t, "sms", submittedID)
 }
 
+func TestSubmit_MfaOptionResolvesTypeBeforeEarlierLabel(t *testing.T) {
+	fake := newFakeWithMfaOptions([]kernel.ManagedAuthMfaOption{
+		{Label: "call", Type: "phone"},
+		{Label: "Get a text", Type: "call"},
+	})
+
+	var submittedID string
+	fake.SubmitFunc = func(ctx context.Context, id string, body kernel.AuthConnectionSubmitParams, opts ...option.RequestOption) (*kernel.SubmitFieldsResponse, error) {
+		submittedID = body.SubmitFieldsRequest.MfaOptionID.Value
+		return &kernel.SubmitFieldsResponse{Accepted: true}, nil
+	}
+
+	c := AuthConnectionCmd{svc: fake}
+	err := c.Submit(context.Background(), AuthConnectionSubmitInput{
+		ID:          "conn-1",
+		MfaOptionID: "call",
+		Output:      "json",
+	})
+	require.NoError(t, err)
+	assert.Equal(t, "call", submittedID)
+}
+
 func TestSubmit_MfaOptionResolvesLabel(t *testing.T) {
 	fake := newFakeWithMfaOptions([]kernel.ManagedAuthMfaOption{
 		{Label: "Get a text", Type: "sms"},
