The workaround that I found was to go to a different JS page, reauth there, and come back to change the content model.

Looks like a side effect of Iae4182f. I think using RIGOR_FULL in checkPermissions() (so the form loads) and handling getReauthOperation() in onSubmit() (redirect to login when reauth is needed) might fix this.

In T431236#12088688, @neriah wrote:

Although there is a workaround (re-auth on another page), most users are unaware of it.

There's a reauth link right at the bottom of the error page.

In T431236#12089516, @Tgr wrote:

There's a reauth link right at the bottom of the error page.

And when I use it, I'm redirected to the main page and have to navigate back to the special page again...

In T431236#12089800, @neriah wrote:

And when I use it, I'm redirected to the main page and have to navigate back to the special page again...

Hm yeah we should fix that. Filed as T431290: Reauthentication link in permission errors does not use returnto

I think the "You do not have permission" message is a bit misleading here since the user actually has the right but only needs to reauthenticate.

What actually needs to be handled in these cases is why, instead of displaying the second step for user, these errors are outright making you not able to do the action. This is not only an issue with 2FA-based checks, I encountered it today with just a regular captcha:

The entire assumptions here need to change. MediaWiki should be able to handle the confirmation step without leaving the form. The current way of doing this for 2FA is misleading, since it ends up displaying a message that I have no permissions to edit the page when I do have them.

Maybe we could make PermissionError behave similar to UserNotLoggedIn when it's created with a PermissionStatus that only contains reauth-related errors, and then make sure everything that creates a PermissionError uses a status. We can't support redirect-on-submit behavior that way, but for special pages that might be fine.

Change #1307853 had a related patch set uploaded (by Neriah; author: Neriah):

[mediawiki/core@master] Prompt for reauthentication after submitting content model changes

https://gerrit.wikimedia.org/r/1307853

I uploaded a patch for the specific case of Special:ChangeContentModel, following @HakanIST's original suggestion. On submit, if authorizeChange() returns a reauth operation, the user is redirected to reauthentication while preserving the form data, and after authentication the action continues automatically.
This also keeps the behavior consistent with editing site JS. In the future we should add a lock icon here, but I think that can be left as a todo.

Change #1307853 merged by jenkins-bot:

[mediawiki/core@master] Prompt for reauthentication after submitting content model changes

https://gerrit.wikimedia.org/r/1307853