Skip to content

feat(settings): thread service through oauth_flow_begin webchannel - #21099

Open
vbudhram wants to merge 1 commit into
mainfrom
fxa-14371
Open

feat(settings): thread service through oauth_flow_begin webchannel#21099
vbudhram wants to merge 1 commit into
mainfrom
fxa-14371

Conversation

@vbudhram

@vbudhram vbudhram commented Aug 24, 2026

Copy link
Copy Markdown
Contributor

Because

  • fxaccounts:oauth_flow_begin carries no service in either direction. FxA sends only scopes and then rebuilds the sign-in URL with service=sync hardcoded, so a future non-Sync caller would silently start a Sync sign-in.
  • Every caller today is a Sync flow, so this is hardening, not a bug fix.
  • The branch conflicted with main's pairing and QR work in the same two files, so it could not merge.

This pull request

  • Adds a service argument to fxaOAuthFlowBegin and sends it with the scopes. The key is omitted when the caller passes none.
  • Adds an optional service field to FxAOAuthFlowBeginResponse for a browser echo, and a WebChannelService type derived from WebChannelServices so the two lists cannot drift.
  • Renames buildSyncOAuthSearch to buildOAuthSearch(oauthParams, service?). It takes the service from the caller, then the echo, then sync. An unrecognized echo falls back to sync.
  • Passes sync explicitly from Pair/Index and ConnectAnotherDevice, so both still produce service=sync.
  • Drops the reformatting hunks that collided with main. What is left is the service work and nothing else.

Issue that this pull request solves

Closes: https://mozilla-hub.atlassian.net/browse/FXA-14371

Checklist

Put an x in the boxes that apply

  • My commit is GPG signed.
  • If applicable, I have modified or added tests which pass locally.
  • I have added necessary documentation (if appropriate).
  • I have verified that my changes render correctly in RTL (if appropriate).
  • I have manually reviewed all AI generated code.

How to review (Optional)

  • Key files/areas to focus on: firefox.ts, specifically the service resolution in buildOAuthSearch and the send payload in fxaOAuthFlowBegin.
  • Suggested review order: firefox.ts, then firefox.test.ts, then the two callers.
  • Risky or complex parts: nothing at runtime. Check the merge instead. Every file now merges with no conflict except one import line in firefox.test.ts, where main adds DEFAULT_SEND_TIMEOUT_LENGTH_MS next to the renamed import. Keep both names.

Screenshots (Optional)

Please attach the screenshots of the changes made in case of change in user interface.

Other information (Optional)

Local runs: fxa-settings unit tests for channels/firefox, Pair/Index, ConnectAnotherDevice and useOAuthFlowRecovery: 106 passed, 0 failed.
nx lint fxa-settings: 0 errors. tsc --noEmit on fxa-settings: clean.

Two notes for the reviewer:

  • The browser does not echo the service back yet, so that path is unreachable today. The browser side needs a Bugzilla bug for oauthBegin, beginOAuthFlow and the COMMAND_OAUTH_FLOW_BEGIN handler. The FxA half lands safely without it.
  • packages/functional-tests/lib/channels.ts is untouched. Its mocked response type imports FxAOAuthFlowBeginResponse, so it picks up the new field on its own.

Copilot AI balanced review requested due to automatic review settings August 24, 2026 22:05
@vbudhram
vbudhram requested a review from a team as a code owner August 24, 2026 22:05
@vbudhram vbudhram added the auto label Aug 24, 2026
@vbudhram vbudhram self-assigned this Aug 24, 2026

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Threads OAuth service identity through Firefox WebChannel flow startup while preserving Sync defaults and validating browser echoes.

Changes:

  • Adds typed service payloads and validated precedence handling.
  • Updates Pair and Connect Another Device to pass sync.
  • Expands unit and navigation coverage.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file
File Description
pages/Pair/Index/index.tsx Passes Sync service through pairing bootstrap.
pages/Pair/Index/index.test.tsx Verifies the service argument.
pages/ConnectAnotherDevice/index.tsx Preserves Sync service during sign-in.
pages/ConnectAnotherDevice/index.test.tsx Tests the generated Sync URL.
lib/channels/firefox.ts Adds service typing, validation, and WebChannel payload support.
lib/channels/firefox.test.ts Tests service precedence, validation, and payload omission.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 Changes recommended

The service must be supplied independently to two APIs, allowing future non-Sync flows to silently diverge or fall back to Sync.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details
  • Files reviewed: 6/6 changed files
  • Comments generated: 1
  • Review effort level: Balanced

Comment on lines +242 to +244
export function buildOAuthSearch(
oauthParams: FxAOAuthFlowBeginResponse,
service?: WebChannelService
## Because

- `fxaccounts:oauth_flow_begin` carries no service in either direction. FxA sends only scopes and then rebuilds the sign-in URL with `service=sync` hardcoded, so a future non-Sync caller would silently start a Sync sign-in.
- Every caller today is a Sync flow, so this is hardening, not a bug fix.
- The branch conflicted with main's pairing and QR work in the same two files, so it could not merge.

## This pull request

- Adds a `service` argument to `fxaOAuthFlowBegin` and sends it with the scopes. The key is omitted when the caller passes none.
- Adds an optional `service` field to `FxAOAuthFlowBeginResponse` for a browser echo, and a `WebChannelService` type derived from `WebChannelServices` so the two lists cannot drift.
- Renames `buildSyncOAuthSearch` to `buildOAuthSearch(oauthParams, service?)`. It takes the service from the caller, then the echo, then `sync`. An unrecognized echo falls back to `sync`.
- Passes `sync` explicitly from `Pair/Index` and `ConnectAnotherDevice`, so both still produce `service=sync`.
- Drops the reformatting hunks that collided with main. What is left is the service work and nothing else.

## Issue that this pull request solves

Closes: https://mozilla-hub.atlassian.net/browse/FXA-14371
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants