Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Threads OAuth service identity through Firefox WebChannel flow startup while preserving Sync defaults and validating browser echoes.
Changes:
- Adds typed service payloads and validated precedence handling.
- Updates Pair and Connect Another Device to pass
sync. - Expands unit and navigation coverage.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
pages/Pair/Index/index.tsx |
Passes Sync service through pairing bootstrap. |
pages/Pair/Index/index.test.tsx |
Verifies the service argument. |
pages/ConnectAnotherDevice/index.tsx |
Preserves Sync service during sign-in. |
pages/ConnectAnotherDevice/index.test.tsx |
Tests the generated Sync URL. |
lib/channels/firefox.ts |
Adds service typing, validation, and WebChannel payload support. |
lib/channels/firefox.test.ts |
Tests service precedence, validation, and payload omission. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The service must be supplied independently to two APIs, allowing future non-Sync flows to silently diverge or fall back to Sync.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 6/6 changed files
- Comments generated: 1
- Review effort level: Balanced
Comment on lines
+242
to
+244
| export function buildOAuthSearch( | ||
| oauthParams: FxAOAuthFlowBeginResponse, | ||
| service?: WebChannelService |
## Because - `fxaccounts:oauth_flow_begin` carries no service in either direction. FxA sends only scopes and then rebuilds the sign-in URL with `service=sync` hardcoded, so a future non-Sync caller would silently start a Sync sign-in. - Every caller today is a Sync flow, so this is hardening, not a bug fix. - The branch conflicted with main's pairing and QR work in the same two files, so it could not merge. ## This pull request - Adds a `service` argument to `fxaOAuthFlowBegin` and sends it with the scopes. The key is omitted when the caller passes none. - Adds an optional `service` field to `FxAOAuthFlowBeginResponse` for a browser echo, and a `WebChannelService` type derived from `WebChannelServices` so the two lists cannot drift. - Renames `buildSyncOAuthSearch` to `buildOAuthSearch(oauthParams, service?)`. It takes the service from the caller, then the echo, then `sync`. An unrecognized echo falls back to `sync`. - Passes `sync` explicitly from `Pair/Index` and `ConnectAnotherDevice`, so both still produce `service=sync`. - Drops the reformatting hunks that collided with main. What is left is the service work and nothing else. ## Issue that this pull request solves Closes: https://mozilla-hub.atlassian.net/browse/FXA-14371
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Because
fxaccounts:oauth_flow_begincarries no service in either direction. FxA sends only scopes and then rebuilds the sign-in URL withservice=synchardcoded, so a future non-Sync caller would silently start a Sync sign-in.This pull request
serviceargument tofxaOAuthFlowBeginand sends it with the scopes. The key is omitted when the caller passes none.servicefield toFxAOAuthFlowBeginResponsefor a browser echo, and aWebChannelServicetype derived fromWebChannelServicesso the two lists cannot drift.buildSyncOAuthSearchtobuildOAuthSearch(oauthParams, service?). It takes the service from the caller, then the echo, thensync. An unrecognized echo falls back tosync.syncexplicitly fromPair/IndexandConnectAnotherDevice, so both still produceservice=sync.Issue that this pull request solves
Closes: https://mozilla-hub.atlassian.net/browse/FXA-14371
Checklist
Put an
xin the boxes that applyHow to review (Optional)
firefox.ts, specifically the service resolution inbuildOAuthSearchand the send payload infxaOAuthFlowBegin.firefox.ts, thenfirefox.test.ts, then the two callers.firefox.test.ts, where main addsDEFAULT_SEND_TIMEOUT_LENGTH_MSnext to the renamed import. Keep both names.Screenshots (Optional)
Please attach the screenshots of the changes made in case of change in user interface.
Other information (Optional)
Local runs:
fxa-settingsunit tests forchannels/firefox,Pair/Index,ConnectAnotherDeviceanduseOAuthFlowRecovery: 106 passed, 0 failed.nx lint fxa-settings: 0 errors.tsc --noEmitonfxa-settings: clean.Two notes for the reviewer:
oauthBegin,beginOAuthFlowand theCOMMAND_OAUTH_FLOW_BEGINhandler. The FxA half lands safely without it.packages/functional-tests/lib/channels.tsis untouched. Its mocked response type importsFxAOAuthFlowBeginResponse, so it picks up the new field on its own.