2025534 - Move refresh/reauth logic to Felt

Status: RESOLVED FIXED

(Enterprise Products :: Firefox, enhancement)

Description

[Andi Pieper]

Felt should be the responsible party to handle signin/signout/refresh/re-auth logic, Firefox should hand off any responsibility to Felt.

• Only Felt holds the refresh token and sends access token and expiry to Firefox.
• If Firefox feels the need to refresh the token, either by getting 401 responses from the backend or hitting the expiry time, It sends a RefreshTokens IPC message to Felt to refresh the token:
  • In the happy case, Felt refreshes the token and sends a AccessToken((<token>, <expires_at>)) IPC message back to Firefox. Firefox stores those in memory and normal work continues.
  • If for any reason, the refresh fails (user has been deactivated, refresh token timed out, …), Felt deletes all tokens it possesses, sets itself visible and to the foreground and displays the sign in screen - essentially a fresh start. Once the auth flow succeeds, Firefox is passed the new token and brought to the foreground.

This limits the IPC messages to these:

Ask for a token refresh
Firefox -> RefreshTokens -> Felt

Set a new access token in Firefox
Felt -> AccessToken((<token>, <expires_at>)) -> Firefox

Sign Out
Firefox -> LogoutShutdown -> Felt

Comment 1

[Gian-Carlo Pascutto [:gcp]]

This limits the IPC messages to these

The user can also explicitly log out in Firefox, which will signal to Felt to get rid of the tokens.

Comment 2

[Andi Pieper]

(In reply to Gian-Carlo Pascutto [:gcp] from comment #1)

This limits the IPC messages to these

The user can also explicitly log out in Firefox, which will signal to Felt to get rid of the tokens.

Ah yes, correct. That would actually be the existing LogoutShutdown message from Firefox -> Felt. I have changed the description accordingly.

As far as I can see, a user exiting either from Felt or Firefox does not need any changes in the mechanics, but correct me if I am wrong. All tokens are in-memory and should be gone with the processes, no need for explicitely deleting them before exit.

Comment 3

[:gerard-majax]

Attachment: GitHub Pull Request

Comment 4

[BMO Github Automation]

Authored by https://github.com/argl
https://github.com/mozilla/enterprise-firefox/commit/e882afc756aa74fb85e706b779832ee47042cbc6
[enterprise-main] Bug 2025534 - Token refresh via felt (#588)