2074136 - fxa-client should not include scopes in the auth url params when we are authenticating in a "decoupled" state

Status: RESOLVED FIXED

(Application Services :: Fxa Client, enhancement)

Description

[Segun Famisa [:segun]]

As mentioned in Bug 2066516, to implement and fulfil fxa's ADR 0049, when authenticating in a "decoupled state", the auth URL returned by fxa-client as a result of BeginOAuthFlow or BeginPairingFlow events, must not contain the scope query param.

Currently, when an empty list is passed to the state machine through BeginOAuthFlow and BeginPairingFlow events from Android, the auth url returned looks like this:

https://accounts.firefox.com/authorization?...&service=sync&...&scope=&state...

and that breaks the auth web page with an error message that says:

Model Validation errors Encountered! Fields: An instance of kr has failed the validation: 
- property scope has failed the following constraints: isNotEmpty

Not sure if this is all that might be required, but I believe that fxa-client needs to somehow know not to include scopes in the auth url it generates here - maybe we just send an empty list, or we might need a flag to tell fxa-client that we are authenticating in a decoupled world.

Comment 1

[Mark Hammond [:markh] [:mhammond]]

yeah - it looks like the server does get upset even with an empty scope list. It does seem like omitting it entirely when empty might solve it. It looks like we should probably refactor things a little - eg, begin_oauth_flow takes both service and scope params, with service stitched in before oauth_flow sees it - the component should probably be directly aware of the "rules" around service and scopes.

Comment 2

[Segun Famisa [:segun]]

(In reply to Mark Hammond [:markh] [:mhammond] from comment #1)

yeah - it looks like the server does get upset even with an empty scope list. It does seem like omitting it entirely when empty might solve it. It looks like we should probably refactor things a little - eg, begin_oauth_flow takes both service and scope params, with service stitched in before oauth_flow sees it - the component should probably be directly aware of the "rules" around service and scopes.

That is my impression as well. Although, I think we already handle it for service, we don't add it if it's empty - in begin_oauth_flow.

If you like, I can send a draft PR for your review/evaluation.

Comment 3

[Segun Famisa [:segun]]

Attachment: GitHub Pull Request

Comment 4

[BMO Github Automation]

Authored by https://github.com/segunfamisa
https://github.com/mozilla/application-services/commit/5779a959e19d7e1251e369f8fc7ce12aeb18ebf2
[main] Bug 2074136 - Do not include scope query param in auth url when no scopes are specified (#7639)

(via GitHub webhook, authenticated as shared-secret)