2052820 - fxa-client error handling might cause auth errors

Status: NEW

(Application Services :: Fxa Client, defect)

Description

[Mark Hammond [:markh] [:mhammond]]

claude noticed, and I think it's correct. Last 2 aren't exactly error handling, but close.

1. Transient failures drop a still-valid refresh token. For the Connected
   transitions CheckAuthorizationStatus, CallGetProfile, and
   WebChannelPasswordChange, transitions.rs maps any non-logic error to
   S::AuthIssues via .to_state_machine_err(|| S::AuthIssues)?. So after network
   retries are exhausted, a network outage — or an AuthCircuitBreakerError
   (which is FxaError::Other, not Authentication, so it isn't even the "auth"
   case) — lands the user in AuthIssues and on_auth_issues() deletes the refresh
   token even though the server never rejected it. Full re-auth then required.

2. Auth circuit breaker + check = forced logout. check_authorization_status
   calls auth_circuit_breaker.check() first (capacity 5, refill 3/min,
   oauth.rs:536). Once tripped it returns AuthCircuitBreakerError; in the
   CheckAuthorizationStatus arm that becomes AuthIssues → token dropped. A tight
   loop of auth checks thus self-inflicts a logout.

3. Device capabilities silently not re-registered after recovery. Initialize
   from Connected: if ensure_capabilities hits an auth error and
   check_authorization_status says "active", we return to Connected without
   re-running ensure_capabilities (explicit FIXME, transitions.rs:32, bug
   1868418). The device record on the server can be missing capabilities / push
   subscription while the client believes it is fully Connected.

4. Orphaned device id after on_auth_issues. on_auth_issues keeps
   current_device_id but drops the refresh token. The server destroys a device
   record when its refresh token dies, so the retained id can be stale until the next
   complete_oauth_flow re-registers.

Comment 1

[Mark Hammond [:markh] [:mhammond]]

Points 1 and 2 are handled by 2060539. We should look at 4 a little more - it's not clear retaining the device ID actually hurts anything. Point 3 does remain though and worth digging in to.

Comment 2

[Mark Hammond [:markh] [:mhammond]]

Actually looks like (3) was fixed in https://github.com/mozilla/application-services/pull/7457