1101131 - Disable navigator.mozId.logout() for RPs once they have called watch() with FxAccounts

Status: RESOLVED WONTFIX

(Firefox OS Graveyard :: FxA, defect)

Description

[Sam Penrose]

navigator.mozId.logout() is properly exposed for use with Persona. It should not be used with Firefox Accounts, which has a single state on device controlled via the Settings UX and Gecko state, not RP prompts. Once an RP has passed {wantIssuer: 'firefox-accounts'} to watch(), B2G should not allow logout() to sign the user out of FxA on device.

Comment 1

[Jared Hirsch [:jhirsch] (he/him) (Needinfo please)]

Ah, the joys of reusing an unversioned API with totally different semantics :-P

Any RPs that support FxOS < 2.2 will still need to avoid calling mozId.logout(), since it's way too late to backport this fix.

Comment 2

[Sam Penrose]

(In reply to Jared Hirsch [:_6a68] [NEEDINFO pls] from comment #1)
> Ah, the joys of reusing an unversioned API with totally different semantics
> :-P
> 
> Any RPs that support FxOS < 2.2 will still need to avoid calling
> mozId.logout(), since it's way too late to backport this fix.

I don't think it's that bad. No 2.0- or 2.1-bundled RP code should land that invokes logout(). Later code that targets those versions we should be able to intercept or update.

Comment 3

[(not reading bugmail) Nick Desaulniers [:\n]]

All docs need to be updated in the event that logout should not be called.

Comment 4

[BMO Automation]

Firefox OS is not being worked on