WebUI not showing MFA prompt maybe causing crash loop of PyiCloudAPIResponseException and rate limit

[tanookiben]

Overview

My notification script started going off several times (5+) in a row when my auth expired and when I looked at the logs I saw repeated PyiCloudAPIResponseException errors that caused crashes and restarts:

PyiCloudAPIResponseException('Service Temporarily Unavailable (503)'))

I know there are other bugs with this exception but I don't think any of them cover what I think is the bug where the web UI does not show a prompt for the MFA code in this state because the exception causes a crash and eventually iCloud enforces the rate limit (but the error code/message isn't correct) because on every container restart it will try to re-auth

Steps to Reproduce

Here is my docker-compose:

  icloudpd:
    image: icloudpd/icloudpd:1.28.1@sha256:1967ddaf24c8b65313d7abdee5bfaa50fda210877fa1c216f6f24ed60843dbb0
    container_name: icloudpd
    command: icloudpd --directory /data --mfa-provider webui --password-provider keyring --password-provider webui --username <USERNAME> --notification-script /scripts/notification-script.sh --auto-delete --watch-with-interval 21600
    environment:
      - TZ=America/Los_Angeles
    volumes:
      - ./icloudpd/.local:/root/.local
      - ./icloudpd/.pyicloud:/root/.pyicloud
      - ./icloudpd/data:/data
      - ./icloudpd/scripts:/scripts:ro
    ports:
      - 8080:8080
    restart: unless-stopped

After I first got spammed with alerts from my script, I tried clearing out .local and .pyicloud and even though I could enter my password successfully, it would still get stuck on MFA without showing me the form in the web UI because it kept crashing

Expected Behavior

• The web UI shows the form for the MFA code
• The container should not crash (maybe?) when waiting for a MFA code

Actual Behavior

• The web UI showed the form for my password after I cleared out .local and .pyicloud but would not let me put in a MFA code
• The container kept crashing due to the exception (from the iCloud API?)

Context

The workaround in this case was to use --auth-only to get everything set up after the rate limit was lifted (in this flow the web UI properly showed me a prompt for the MFA code)

[AndreyNikiforov]

Does your config cause consistent error? It was hard to repro 503s reported, so all attempts to fix were kinda shooting in the dark.

[AndreyNikiforov]

also notification actions terminate icloudpd - there is a big filed for that. it may have triggered overloading and causing 503...

[tanookiben]

Does your config cause consistent error? It was hard to repro 503s reported, so all attempts to fix were kinda shooting in the dark.

Hard to say because this was the first time my token expired

also notification actions terminate icloudpd - there is a big filed for that. it may have triggered overloading and causing 503...

This makes a lot of sense to me, maybe I'll disable the notification script for now. IS #898 the bug you're talking about?

[AndreyNikiforov]

see if 1.29.1 works better

[AndreyNikiforov]

1.29.4 has improvements as well