1 /* This Source Code Form is subject to the terms of the Mozilla Public
2 * License, v. 2.0. If a copy of the MPL was not distributed with this
3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
6 * Firefox Accounts Web Channel.
8 * Uses the WebChannel component to receive messages
9 * about account state changes.
12 import { XPCOMUtils } from "resource://gre/modules/XPCOMUtils.sys.mjs";
15 COMMAND_PROFILE_CHANGE,
20 COMMAND_CAN_LINK_ACCOUNT,
21 COMMAND_SYNC_PREFERENCES,
22 COMMAND_CHANGE_PASSWORD,
24 COMMAND_PAIR_HEARTBEAT,
25 COMMAND_PAIR_SUPP_METADATA,
26 COMMAND_PAIR_AUTHORIZE,
28 COMMAND_PAIR_COMPLETE,
29 COMMAND_PAIR_PREFERENCES,
32 ON_PROFILE_CHANGE_NOTIFICATION,
37 } from "resource://gre/modules/FxAccountsCommon.sys.mjs";
41 ChromeUtils.defineESModuleGetters(lazy, {
42 CryptoUtils: "resource://services-crypto/utils.sys.mjs",
43 FxAccountsPairingFlow: "resource://gre/modules/FxAccountsPairing.sys.mjs",
44 FxAccountsStorageManagerCanStoreField:
45 "resource://gre/modules/FxAccountsStorage.sys.mjs",
46 PrivateBrowsingUtils: "resource://gre/modules/PrivateBrowsingUtils.sys.mjs",
47 Weave: "resource://services-sync/main.sys.mjs",
48 WebChannel: "resource://gre/modules/WebChannel.sys.mjs",
50 ChromeUtils.defineLazyGetter(lazy, "fxAccounts", () => {
51 return ChromeUtils.importESModule(
52 "resource://gre/modules/FxAccounts.sys.mjs"
53 ).getFxAccountsSingleton();
55 XPCOMUtils.defineLazyPreferenceGetter(
58 "identity.fxaccounts.pairing.enabled"
60 XPCOMUtils.defineLazyPreferenceGetter(
62 "separatePrivilegedMozillaWebContentProcess",
63 "browser.tabs.remote.separatePrivilegedMozillaWebContentProcess",
66 XPCOMUtils.defineLazyPreferenceGetter(
68 "separatedMozillaDomains",
69 "browser.tabs.remote.separatedMozillaDomains",
74 XPCOMUtils.defineLazyPreferenceGetter(
77 "identity.fxaccounts.remote.root",
80 val => Services.io.newURI(val)
83 // These engines were added years after Sync had been introduced, they need
84 // special handling since they are system add-ons and are un-available on
85 // older versions of Firefox.
86 const EXTRA_ENGINES = ["addresses", "creditcards"];
88 // These engines will be displayed to the user to pick which they would like to
90 const CHOOSE_WHAT_TO_SYNC = [
102 * A helper function that extracts the message and stack from an error object.
103 * Returns a `{ message, stack }` tuple. `stack` will be null if the error
104 * doesn't have a stack trace.
106 function getErrorDetails(error) {
107 // Replace anything that looks like it might be a filepath on Windows or Unix
108 let cleanMessage = String(error)
109 .replace(/\\.*\\/gm, "[REDACTED]")
110 .replace(/\/.*\//gm, "[REDACTED]");
111 let details = { message: cleanMessage, stack: null };
113 // Adapted from Console.sys.mjs.
116 for (let frame = error.stack; frame; frame = frame.caller) {
117 frames.push(String(frame).padStart(4));
119 details.stack = frames.join("\n");
126 * Create a new FxAccountsWebChannel to listen for account updates
128 * @param {Object} options Options
129 * @param {Object} options
130 * @param {String} options.content_uri
131 * The FxA Content server uri
132 * @param {String} options.channel_id
133 * The ID of the WebChannel
134 * @param {String} options.helpers
135 * Helpers functions. Should only be passed in for testing.
138 export function FxAccountsWebChannel(options) {
140 throw new Error("Missing configuration options");
142 if (!options.content_uri) {
143 throw new Error("Missing 'content_uri' option");
145 this._contentUri = options.content_uri;
147 if (!options.channel_id) {
148 throw new Error("Missing 'channel_id' option");
150 this._webChannelId = options.channel_id;
152 // options.helpers is only specified by tests.
153 ChromeUtils.defineLazyGetter(this, "_helpers", () => {
154 return options.helpers || new FxAccountsWebChannelHelpers(options);
157 this._setupChannel();
160 FxAccountsWebChannel.prototype = {
162 * WebChannel that is used to communicate with content page
167 * Helpers interface that does the heavy lifting.
176 * WebChannel origin, used to validate origin of messages
178 _webChannelOrigin: null,
181 * Release all resources that are in use.
184 this._channel.stopListening();
185 this._channel = null;
186 this._channelCallback = null;
190 * Configures and registers a new WebChannel
195 // if this.contentUri is present but not a valid URI, then this will throw an error.
197 this._webChannelOrigin = Services.io.newURI(this._contentUri);
198 this._registerChannel();
205 _receiveMessage(message, sendingContext) {
206 const { command, data } = message;
207 let shouldCheckRemoteType =
208 lazy.separatePrivilegedMozillaWebContentProcess &&
209 lazy.separatedMozillaDomains.some(function (val) {
211 lazy.accountServer.asciiHost == val ||
212 lazy.accountServer.asciiHost.endsWith("." + val)
215 let { currentRemoteType } = sendingContext.browsingContext;
216 if (shouldCheckRemoteType && currentRemoteType != "privilegedmozilla") {
218 `Rejected FxA webchannel message from remoteType = ${currentRemoteType}`
223 let browser = sendingContext.browsingContext.top.embedderElement;
225 case COMMAND_PROFILE_CHANGE:
226 Services.obs.notifyObservers(
228 ON_PROFILE_CHANGE_NOTIFICATION,
235 .catch(error => this._sendError(error, message, sendingContext));
240 .catch(error => this._sendError(error, message, sendingContext));
246 .catch(error => this._sendError(error, message, sendingContext));
248 case COMMAND_CAN_LINK_ACCOUNT:
249 let canLinkAccount = this._helpers.shouldAllowRelink(data.email);
253 messageId: message.messageId,
254 data: { ok: canLinkAccount },
257 log.debug("FxAccountsWebChannel response", response);
258 this._channel.send(response, sendingContext);
260 case COMMAND_SYNC_PREFERENCES:
261 this._helpers.openSyncPreferences(browser, data.entryPoint);
263 case COMMAND_PAIR_PREFERENCES:
264 if (lazy.pairingEnabled) {
265 let window = browser.ownerGlobal;
266 // We should close the FxA tab after we open our pref page
267 let selectedTab = window.gBrowser.selectedTab;
268 window.switchToTabHavingURI(
269 "about:preferences?action=pair#sync",
272 ignoreQueryString: true,
273 replaceQueryString: true,
274 adoptIntoActiveWindow: true,
275 ignoreFragment: "whenComparing",
277 Services.scriptSecurityManager.getSystemPrincipal(),
281 window.gBrowser.removeTab(selectedTab);
284 case COMMAND_FIREFOX_VIEW:
285 this._helpers.openFirefoxView(browser, data.entryPoint);
287 case COMMAND_CHANGE_PASSWORD:
289 .changePassword(data)
290 .catch(error => this._sendError(error, message, sendingContext));
292 case COMMAND_FXA_STATUS:
293 log.debug("fxa_status received");
295 const service = data && data.service;
296 const isPairing = data && data.isPairing;
297 const context = data && data.context;
299 .getFxaStatus(service, sendingContext, isPairing, context)
303 messageId: message.messageId,
306 this._channel.send(response, sendingContext);
308 .catch(error => this._sendError(error, message, sendingContext));
310 case COMMAND_PAIR_HEARTBEAT:
311 case COMMAND_PAIR_SUPP_METADATA:
312 case COMMAND_PAIR_AUTHORIZE:
313 case COMMAND_PAIR_DECLINE:
314 case COMMAND_PAIR_COMPLETE:
315 log.debug(`Pairing command ${command} received`);
316 const { channel_id: channelId } = data;
317 delete data.channel_id;
318 const flow = lazy.FxAccountsPairingFlow.get(channelId);
320 log.warn(`Could not find a pairing flow for ${channelId}`);
323 flow.onWebChannelMessage(command, data).then(replyData => {
327 messageId: message.messageId,
335 log.warn("Unrecognized FxAccountsWebChannel command", command);
336 // As a safety measure we also terminate any pending FxA pairing flow.
337 lazy.FxAccountsPairingFlow.finalizeAll();
342 _sendError(error, incomingMessage, sendingContext) {
343 log.error("Failed to handle FxAccountsWebChannel message", error);
346 command: incomingMessage.command,
347 messageId: incomingMessage.messageId,
349 error: getErrorDetails(error),
357 * Create a new channel with the WebChannelBroker, setup a callback listener
362 * Processes messages that are called back from the FxAccountsChannel
364 * @param webChannelId {String}
365 * Command webChannelId
366 * @param message {Object}
368 * @param sendingContext {Object}
369 * Message sending context.
370 * @param sendingContext.browsingContext {BrowsingContext}
371 * The browsingcontext from which the
372 * WebChannelMessageToChrome was sent.
373 * @param sendingContext.eventTarget {EventTarget}
374 * The <EventTarget> where the message was sent.
375 * @param sendingContext.principal {Principal}
376 * The <Principal> of the EventTarget where the message was sent.
380 let listener = (webChannelId, message, sendingContext) => {
382 log.debug("FxAccountsWebChannel message received", message.command);
384 log.debug("FxAccountsWebChannel message details", message);
387 this._receiveMessage(message, sendingContext);
389 this._sendError(error, message, sendingContext);
394 this._channelCallback = listener;
395 this._channel = new lazy.WebChannel(
397 this._webChannelOrigin
399 this._channel.listen(listener);
401 "FxAccountsWebChannel registered: " +
404 this._webChannelOrigin.prePath
409 export function FxAccountsWebChannelHelpers(options) {
410 options = options || {};
412 this._fxAccounts = options.fxAccounts || lazy.fxAccounts;
413 this._weaveXPCOM = options.weaveXPCOM || null;
414 this._privateBrowsingUtils =
415 options.privateBrowsingUtils || lazy.PrivateBrowsingUtils;
418 FxAccountsWebChannelHelpers.prototype = {
419 // If the last fxa account used for sync isn't this account, we display
420 // a modal dialog checking they really really want to do this...
421 // (This is sync-specific, so ideally would be in sync's identity module,
422 // but it's a little more seamless to do here, and sync is currently the
423 // only fxa consumer, so...
424 shouldAllowRelink(acctName) {
426 !this._needRelinkWarning(acctName) || this._promptForRelink(acctName)
430 async _initializeSync() {
431 // A sync-specific hack - we want to ensure sync has been initialized
432 // before we set the signed-in user.
433 // XXX - probably not true any more, especially now we have observerPreloads
434 // in FxAccounts.sys.mjs?
437 Cc["@mozilla.org/weave/service;1"].getService(Ci.nsISupports)
439 await xps.whenLoaded();
443 _setEnabledEngines(offeredEngines, declinedEngines) {
444 if (offeredEngines && declinedEngines) {
445 EXTRA_ENGINES.forEach(engine => {
447 offeredEngines.includes(engine) &&
448 !declinedEngines.includes(engine)
450 // These extra engines are disabled by default.
451 Services.prefs.setBoolPref(`services.sync.engine.${engine}`, true);
454 log.debug("Received declined engines", declinedEngines);
455 lazy.Weave.Service.engineManager.setDeclined(declinedEngines);
456 declinedEngines.forEach(engine => {
457 Services.prefs.setBoolPref(`services.sync.engine.${engine}`, false);
462 * stores sync login info it in the fxaccounts service
464 * @param accountData the user's account data and credentials
466 async login(accountData) {
467 // We don't act on customizeSync anymore, it used to open a dialog inside
468 // the browser to selecte the engines to sync but we do it on the web now.
469 log.debug("Webchannel is logging a user in.");
470 delete accountData.customizeSync;
472 // Save requested services for later.
473 const requestedServices = accountData.services;
474 delete accountData.services;
476 // the user has already been shown the "can link account"
477 // screen. No need to keep this data around.
478 delete accountData.verifiedCanLinkAccount;
480 // Remember who it was so we can log out next time.
481 if (accountData.verified) {
482 this.setPreviousAccountNameHashPref(accountData.email);
485 await this._fxAccounts.telemetry.recordConnection(
486 Object.keys(requestedServices || {}),
490 const xps = await this._initializeSync();
491 await this._fxAccounts._internal.setSignedInUser(accountData);
493 if (requestedServices) {
494 // User has enabled Sync.
495 if (requestedServices.sync) {
496 const { offeredEngines, declinedEngines } = requestedServices.sync;
497 this._setEnabledEngines(offeredEngines, declinedEngines);
498 log.debug("Webchannel is enabling sync");
499 await xps.Weave.Service.configure();
505 * Logins in to sync by completing an OAuth flow
506 * @param { Object } oauthData: The oauth code and state as returned by the server */
507 async oauthLogin(oauthData) {
508 log.debug("Webchannel is completing the oauth flow");
509 const xps = await this._initializeSync();
510 const { code, state, declinedSyncEngines, offeredSyncEngines } = oauthData;
511 const { sessionToken } =
512 await this._fxAccounts._internal.getUserAccountData(["sessionToken"]);
513 // First we finish the ongoing oauth flow
514 const { scopedKeys, refreshToken } =
515 await this._fxAccounts._internal.completeOAuthFlow(
521 // We don't currently use the refresh token in Firefox Desktop, lets be good citizens and revoke it.
522 await this._fxAccounts._internal.destroyOAuthToken({ token: refreshToken });
524 // Then, we persist the sync keys
525 await this._fxAccounts._internal.setScopedKeys(scopedKeys);
527 // Now that we have the scoped keys, we set our status to verified
528 await this._fxAccounts._internal.setUserVerified();
529 this._setEnabledEngines(offeredSyncEngines, declinedSyncEngines);
530 log.debug("Webchannel is enabling sync");
531 xps.Weave.Service.configure();
535 * logout the fxaccounts service
537 * @param the uid of the account which have been logged out
540 let fxa = this._fxAccounts;
541 let userData = await fxa._internal.getUserAccountData(["uid"]);
542 if (userData && userData.uid === uid) {
543 await fxa.telemetry.recordDisconnection(null, "webchannel");
544 // true argument is `localOnly`, because server-side stuff
545 // has already been taken care of by the content server
546 await fxa.signOut(true);
551 * Check if `sendingContext` is in private browsing mode.
553 isPrivateBrowsingMode(sendingContext) {
554 if (!sendingContext) {
555 log.error("Unable to check for private browsing mode, assuming true");
559 let browser = sendingContext.browsingContext.top.embedderElement;
560 const isPrivateBrowsing =
561 this._privateBrowsingUtils.isBrowserPrivate(browser);
562 log.debug("is private browsing", isPrivateBrowsing);
563 return isPrivateBrowsing;
567 * Check whether sending fxa_status data should be allowed.
569 shouldAllowFxaStatus(service, sendingContext, isPairing, context) {
570 // Return user data for any service in non-PB mode. In PB mode,
571 // only return user data if service==="sync" or is in pairing mode
572 // (as service will be equal to the OAuth client ID and not "sync").
574 // This behaviour allows users to click the "Manage Account"
575 // link from about:preferences#sync while in PB mode and things
576 // "just work". While in non-PB mode, users can sign into
577 // Pocket w/o entering their password a 2nd time, while in PB
578 // mode they *will* have to enter their email/password again.
580 // The difference in behaviour is to try to match user
581 // expectations as to what is and what isn't part of the browser.
582 // Sync is viewed as an integral part of the browser, interacting
583 // with FxA as part of a Sync flow should work all the time. If
584 // Sync is broken in PB mode, users will think Firefox is broken.
585 // See https://bugzilla.mozilla.org/show_bug.cgi?id=1323853
586 log.debug("service", service);
588 !this.isPrivateBrowsingMode(sendingContext) ||
589 service === "sync" ||
590 context === "fx_desktop_v3" ||
596 * Get fxa_status information. Resolves to { signedInUser: <user_data> }.
597 * If returning status information is not allowed or no user is signed into
598 * Sync, `user_data` will be null.
600 async getFxaStatus(service, sendingContext, isPairing, context) {
601 let signedInUser = null;
604 this.shouldAllowFxaStatus(service, sendingContext, isPairing, context)
606 const userData = await this._fxAccounts._internal.getUserAccountData([
614 email: userData.email,
615 sessionToken: userData.sessionToken,
617 verified: userData.verified,
622 const capabilities = this._getCapabilities();
626 clientId: FX_OAUTH_CLIENT_ID,
632 Services.prefs.getBoolPref("identity.fxaccounts.oauth.enabled", false)
636 pairing: lazy.pairingEnabled,
637 choose_what_to_sync: true,
638 engines: CHOOSE_WHAT_TO_SYNC,
643 pairing: lazy.pairingEnabled,
644 engines: this._getAvailableExtraEngines(),
648 _getAvailableExtraEngines() {
649 return EXTRA_ENGINES.filter(engineName => {
651 return Services.prefs.getBoolPref(
652 `services.sync.engine.${engineName}.available`
660 async changePassword(credentials) {
661 // If |credentials| has fields that aren't handled by accounts storage,
662 // updateUserAccountData will throw - mainly to prevent errors in code
663 // that hard-codes field names.
664 // However, in this case the field names aren't really in our control.
665 // We *could* still insist the server know what fields names are valid,
666 // but that makes life difficult for the server when Firefox adds new
667 // features (ie, new fields) - forcing the server to track a map of
668 // versions to supported field names doesn't buy us much.
669 // So we just remove field names we know aren't handled.
670 let newCredentials = {
671 device: null, // Force a brand new device registration.
672 // We force the re-encryption of the send tab keys using the new sync key after the password change
673 encryptedSendTabKeys: null,
675 for (let name of Object.keys(credentials)) {
679 lazy.FxAccountsStorageManagerCanStoreField(name)
681 newCredentials[name] = credentials[name];
683 log.info("changePassword ignoring unsupported field", name);
686 await this._fxAccounts._internal.updateUserAccountData(newCredentials);
687 await this._fxAccounts._internal.updateDeviceRegistration();
691 * Get the hash of account name of the previously signed in account
693 getPreviousAccountNameHashPref() {
695 return Services.prefs.getStringPref(PREF_LAST_FXA_USER);
702 * Given an account name, set the hash of the previously signed in account
704 * @param acctName the account name of the user's account.
706 setPreviousAccountNameHashPref(acctName) {
707 Services.prefs.setStringPref(
709 lazy.CryptoUtils.sha256Base64(acctName)
714 * Open Sync Preferences in the current tab of the browser
716 * @param {Object} browser the browser in which to open preferences
717 * @param {String} [entryPoint] entryPoint to use for logging
719 openSyncPreferences(browser, entryPoint) {
720 let uri = "about:preferences";
722 uri += "?entrypoint=" + encodeURIComponent(entryPoint);
726 browser.loadURI(Services.io.newURI(uri), {
727 triggeringPrincipal: Services.scriptSecurityManager.getSystemPrincipal(),
732 * Open Firefox View in the browser's window
734 * @param {Object} browser the browser in whose window we'll open Firefox View
736 openFirefoxView(browser) {
737 browser.ownerGlobal.FirefoxViewHandler.openTab("syncedtabs");
741 * If a user signs in using a different account, the data from the
742 * previous account and the new account will be merged. Ask the user
743 * if they want to continue.
747 _needRelinkWarning(acctName) {
748 let prevAcctHash = this.getPreviousAccountNameHashPref();
750 prevAcctHash && prevAcctHash != lazy.CryptoUtils.sha256Base64(acctName)
755 * Show the user a warning dialog that the data from the previous account
756 * and the new account will be merged.
760 _promptForRelink(acctName) {
761 let sb = Services.strings.createBundle(
762 "chrome://browser/locale/syncSetup.properties"
764 let continueLabel = sb.GetStringFromName("continue.label");
765 let title = sb.GetStringFromName("relinkVerify.title");
766 let description = sb.formatStringFromName("relinkVerify.description", [
770 sb.GetStringFromName("relinkVerify.heading") + "\n\n" + description;
771 let ps = Services.prompt;
773 ps.BUTTON_POS_0 * ps.BUTTON_TITLE_IS_STRING +
774 ps.BUTTON_POS_1 * ps.BUTTON_TITLE_CANCEL +
775 ps.BUTTON_POS_1_DEFAULT;
777 // If running in context of the browser chrome, window does not exist.
778 let pressed = Services.prompt.confirmEx(
789 return pressed === 0; // 0 is the "continue" button
795 // The entry-point for this module, which ensures only one of our channels is
796 // ever created - we require this because the WebChannel is global in scope
797 // (eg, it uses the observer service to tell interested parties of interesting
798 // things) and allowing multiple channels would cause such notifications to be
799 // sent multiple times.
800 export var EnsureFxAccountsWebChannel = () => {
801 let contentUri = Services.urlFormatter.formatURLPref(
802 "identity.fxaccounts.remote.root"
804 if (singleton && singleton._contentUri !== contentUri) {
805 singleton.tearDown();
811 // The FxAccountsWebChannel listens for events and updates
812 // the state machine accordingly.
813 singleton = new FxAccountsWebChannel({
814 content_uri: contentUri,
815 channel_id: WEBCHANNEL_ID,
818 log.warn("FxA WebChannel functionaly is disabled due to no URI pref.");
821 log.error("Failed to create FxA WebChannel", ex);