Skip to content

fix(pair): route in-app camera v2 scans to the v2 supplicant screens - #21156

Draft
dschom wants to merge 1 commit into
mainfrom
worktree-FXA-14427
Draft

fix(pair): route in-app camera v2 scans to the v2 supplicant screens#21156
dschom wants to merge 1 commit into
mainfrom
worktree-FXA-14427

Conversation

@dschom

@dschom dschom commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

Because

  • Scanning a v2 QR with a mobile Firefox's own camera completed pairing, but walked the user through the legacy v1 screens.
  • Both Android and iOS reach pairing through this entry point, so neither got the v2 flow.

This pull request

  • Hands /pair/supp off to /pair/supplicant/connect_this_device only when the authority's fragment, the browser's fxa_status and pairing.version all report v2
  • Waits on fxa_status before choosing a flow, and only for a v=2 fragment — v1 URLs are unaffected
  • Sends the v2 post-OAuth reload to /pair/supplicant/sync_success rather than the v1 /oauth/success/:clientId
  • Reuses the OAuth request already in the URL for v2, asking the browser via pair_oauth_start only when the URL carries none
  • Adds unit coverage for the version gate and the param source

Issue that this pull request solves

Closes: FXA-14427

Checklist

Put an x in the boxes that apply

  • My commit is GPG signed.
  • If applicable, I have modified or added tests which pass locally.
  • I have added necessary documentation (if appropriate).
  • I have verified that my changes render correctly in RTL (if appropriate).
  • I have manually reviewed all AI generated code.

How to review (Optional)

  • Key files/areas to focus on: the version gate in pages/Pair/Supp/index.tsx, and getOAuthParams in pairing-supplicant-integration.ts
  • Suggested review order: the Pair/Supp gate first, then the param-source change it depends on
  • Risky or complex parts: an in-app camera scan reaches FxA through app-services, which rewrites the path to the v1 /pair/supp and copies the authority's fragment over verbatim — hence a v=2 marker on a v1 route. Reusing that URL's OAuth request is load-bearing: app-services holds the PKCE verifier for the code it expects back, so a second pair_oauth_start flow would strand it.

Screenshots (Optional)

Please attach the screenshots of the changes made in case of change in user interface.

Other information (Optional)

  • No functional coverage added: every v2 pairing spec is gated behind an emulator or Nightly and skips in CI. AndroidSupplicant.beginPairing() drives this exact path if a real-device regression guard is wanted.
  • Behaviour is unchanged wherever pairing.version is not 2, or where the supplicant does not report v2 pairing support.

Because:

- A v2 QR scanned with a mobile Firefox's own camera opens /pair/supp, the
  v1 supplicant entry, so pairing completed on the legacy screens.
- app-services holds the PKCE verifier for the code it expects back, so the
  page must not begin a second OAuth flow.

This commit:

- Hands /pair/supp off to /pair/supplicant/connect_this_device only when the
  authority's fragment, the browser's fxa_status and pairing.version all say v2
- Waits on fxa_status before choosing a flow, and only for a v=2 fragment
- Sends the v2 post-OAuth reload to /pair/supplicant/sync_success instead of
  /oauth/success/:clientId
- Reads the OAuth request from the URL in v2 when it carries one, asking the
  browser only when it does not
- Adds unit coverage for the version gate and the param source

Closes #FXA-14427
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant