1633641 - Provide a method to fetch an OAuth token and its key in a single operation

Status: RESOLVED FIXED

(Firefox :: Firefox Accounts, enhancement)

Description

[Ryan Kelly [:rfkelly]]

Over in Bug 1631830, we're refactoring the Sync client code to use OAuth tokens rather than BrowserID assertions. The code there needs to obtain an OAuth access with with "oldsync" scope as well as the FxA scoped key for the same scope, and it currently has to jump through a few awkward API hoops in order to do so.

By contrast, our FxA rust component and its bindings offer a nice getAccessToken method call that can return the OAuth token and its corresponding key in a single operation. I think the code from Bug 1631830 would be both cleaner and more performant if we added a similar method to the desktop codebase.

My strawman proposal would be to exactly mirror the API offered by the rust component:

fxa.getAccessToken(scope, ttl) => {
  scope, // the scope you requested
  token, // the access token for including in `Authorization` header
  key, // the corresponding JWK for that scope, if any
  expiresAt, // how long the token is good for, in seconds
}

Under the hood, this API would need to call fxa.keys.getScopedKeys in order to obtain the JWK for the requested scope, and would probably need to do a bit of caching in order to avoid hitting the network for /account/scoped-key-data on every call. But we should be able to hide that complexity from API consumers.

Comment 1

[Vlad Filippov (:vladikoff)]

Thank you for filing this follow up bug!

Comment 2

[Ryan Kelly [:rfkelly]]

Sketch of what I think we should do here:

• Add a new field to signedInUser.json named, say, "scopedKeyData". Use it for caching the result of calling /account/scoped-key-data with the "oldsync" scope and our own client_id.
• Add the new getAccessToken or equivalent bikeshedded method, so that it:
  • Have it share the same cache as the exising getOAuthToken method
  • If called with the "oldsync" scope, have it fetch (or populate) the "scopedKeyData" field from storage, and synthesize the appropriate scoped-key JWK.

Comment 3

[Vlad Filippov (:vladikoff)]

Attachment: Bug 1633641 - Provide a method to fetch an OAuth token and its key in a single operation. r=rfkelly

Comment 4

[Vlad Filippov (:vladikoff)]

Try build in https://treeherder.mozilla.org/#/jobs?repo=try&revision=cf4fbc5a16236363458b0e16f44912a53f79dc3a

Comment 5

[Vlad Filippov (:vladikoff)]

Updated try in https://treeherder.mozilla.org/#/jobs?repo=try&revision=3656b5fdc8c27105f6dbb552e31f9ff8c675fcec

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/4dca574b5a53
Provide a method to fetch an OAuth token and its key in a single operation. r=rfkelly

Comment 7

[Narcis Beleuzu [:NarcisB]]

https://hg.mozilla.org/mozilla-central/rev/4dca574b5a53