Bugzilla

It's possible this is better as a separate ticket as I see mention of `fxa_client` above, but dropping this comment as a continuation of where this piece first came up in this Android spike doc/thread: https://docs.google.com/document/d/1nJGmQmz-3CtvWmYjWqGsOQgHVrZ9RCGozdFtOm2x6ao/edit?disco=AAACFuVaLGQ

Per option 3 in ADR 0049 (https://github.com/mozilla/fxa/blob/main/docs/adr/0049-service-driven-scope-resolution.md) and reaffirmed in later discussions, you can drop the `scope` parameter here in favor of just sending us `service`. FxA will determine whether or not Sync will be granted as well (always send us `keys_jwk` as a query param so we can grab the sync key if the user enters a password), and we will send you back what scopes were granted in the `fxa_oauth_login` web channel message.

In the discussions that happened later (WIP ADR 0052), Dan, Mark, and I are aligned that we'd like "scope mapping" sent to FxA over the `fxa_status` web channel message, under `capabilities`. Send us what the browser supports (Desktop will be sending us a 'smartwindow' service):

```
...
keys_optional: true,
services: {
  sync:  { scope: ['https://identity.mozilla.com/apps/oldsync', 'profile'] },
  relay: { scope: ['https://identity.mozilla.com/apps/relay', 'profile'] },
  vpn:   { scope: ['https://identity.mozilla.com/apps/vpn', 'profile'] }
}
```

For the re-auth piece mentioned by Mark above, you can send the scopes you determine the user should have without `service`, and we will grant those.

Timing: we'd like this in place before Android sync decoupling reaches production so we can delete our own mapping rather than maintaining it for one or two Firefox versions. We have the FxA piece to remove our mapping and read from the web channel message tracked in https://mozilla-hub.atlassian.net/browse/FXA-14509.

It's possible this is better as a separate ticket as I see mention of `fxa_client` above, but dropping this comment as a continuation of where this piece first came up in [this Android spike doc/thread](https://docs.google.com/document/d/1nJGmQmz-3CtvWmYjWqGsOQgHVrZ9RCGozdFtOm2x6ao/edit?disco=AAACFuVaLGQ).

Per option 3 in [ADR 0049](https://github.com/mozilla/fxa/blob/main/docs/adr/0049-service-driven-scope-resolution.md) and reaffirmed in later discussions, you can drop the `scope` parameter here in favor of just sending us `service`. FxA will determine whether or not Sync will be granted as well (always send us `keys_jwk` as a query param so we can grab the sync key if the user enters a password), and we will send you back what scopes were granted in the `fxa_oauth_login` web channel message.

In the discussions that happened later (WIP ADR 0052), Dan, Mark, and I are aligned that we'd like "scope mapping" sent to FxA over the `fxa_status` web channel message, under `capabilities`. Send us what the browser supports (Desktop will be sending us a 'smartwindow' service):

```
...
keys_optional: true,
services: {
  sync:  { scope: ['https://identity.mozilla.com/apps/oldsync', 'profile'] },
  relay: { scope: ['https://identity.mozilla.com/apps/relay', 'profile'] },
  vpn:   { scope: ['https://identity.mozilla.com/apps/vpn', 'profile'] }
}
```

For the re-auth piece mentioned by Mark above, you can send the scopes you determine the user should have without `service`, and we will grant those.

Timing: we'd like this in place before Android sync decoupling reaches production so we can delete our own mapping rather than maintaining it for one or two Firefox versions. We have the FxA piece to remove our mapping and read from the web channel message tracked in https://mozilla-hub.atlassian.net/browse/FXA-14509.