Skip to content

fix(settings): reject pairing sends on a torn-down channel - #21159

Open
dschom wants to merge 2 commits into
mainfrom
fxa-14484
Open

fix(settings): reject pairing sends on a torn-down channel#21159
dschom wants to merge 2 commits into
mainfrom
fxa-14484

Conversation

@dschom

@dschom dschom commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

Because

  • When the channel-server socket dies mid-pairing, fxa-pairing-channel dispatches error rather than close, so the wrapper keeps using a channel the library has already discarded.
  • Sending on that channel reported a raw TypeError with no errno instead of a pairing error the flow could act on.
  • The authority sends an OAuth code/state immediately after minting it, so the send should refuse a dead socket before handing anything over.

This pull request

  • Throws CONNECTION_CLOSED (errno 1006) from PairingChannelClient.send() when the underlying channel reports itself closed.
  • Adds unit coverage for send after teardown.

Issue that this pull request solves

Closes: FXA-14484

Checklist

Put an x in the boxes that apply

  • My commit is GPG signed.
  • If applicable, I have modified or added tests which pass locally.
  • I have added necessary documentation (if appropriate).
  • I have verified that my changes render correctly in RTL (if appropriate).
  • I have manually reviewed all AI generated code.

How to review (Optional)

  • Key files/areas to focus on: the send() guard in packages/fxa-settings/src/lib/channels/pairing-channel.ts.
  • Suggested review order: the guard, then the new test. Skip the 9 deleted lines — lint-staged prettier churn (semicolons, quote style, scope:string), not the fix.
  • Risky or complex parts: the guard reads the closed getter from fxa-pairing-channel 1.0.2 (!this._socket || readyState === 3). Verified by removing the guard and confirming the new test fails.

Screenshots (Optional)

Please attach the screenshots of the changes made in case of change in user interface.

Other information (Optional)

Because:
  - fxa-pairing-channel reports an unexpected socket close as an `error`,
    not a `close`, so the wrapper keeps a channel it has already discarded
  - sending on that channel threw a raw `TypeError` from the library, which
    reached Sentry and the integrations' `fail()` handlers with no errno

This commit:
  - throws `CONNECTION_CLOSED` from `PairingChannelClient.send()` when the
    underlying channel reports itself closed
  - covers the torn-down send path in the unit tests

Closes: FXA-14484
_channelId?: string;
_channelKey?: Uint8Array;
/**
* True once fxa-pairing-channel has torn the WebSocket down. In 1.0.2 this

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just say 'True once fxa-pairing-channel has torn the WebSocket down.'

@dschom
dschom marked this pull request as ready for review September 4, 2026 23:59
@dschom
dschom requested a review from a team as a code owner September 4, 2026 23:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant