fix #360: FXA_ENABLED flag and default to false

.env-dist

@@ -28,6 +28,8 @@ BASKET_API_KEY=
 BASKET_NEWSLETTER=mozilla-and-you
 
 # Firefox Accounts OAuth
+# leave FXA_ENABLED empty to disable FXA
+FXA_ENABLED=
 OAUTH_CLIENT_ID=cb1bef9d06bb9bc9
 OAUTH_CLIENT_SECRET=f5fb99de6e0af18ab17e013ac1d439903179a97a1c510fc10bc3bd50bbce089b
 OAUTH_AUTHORIZATION_URI="https://oauth-stable.dev.lcip.org/v1/authorization"

README.md

@@ -98,6 +98,9 @@ export SMTP_PASSWORD=<your-password>
 
 #### Firefox Accounts
 
+Subscribe with a Firefox Account is controlled via the `FXA_ENABLED`
+environment variable. (See `.env-dist`)
+
 The repo comes with a development FxA oauth app pre-configured in `.env`, which
 should work fine running the app on http://localhost:6060
 

app-constants.js

@@ -18,6 +18,7 @@ const kEnvironmentVariables = [
   "BASKET_URL",
   "BASKET_API_KEY",
   "BASKET_NEWSLETTER",
+  "FXA_ENABLED",
   "OAUTH_AUTHORIZATION_URI",
   "OAUTH_TOKEN_URI",
   "OAUTH_PROFILE_URI",

server.js

@@ -83,6 +83,7 @@ if (app.get("env") === "dev") {
   app.set("trust proxy", true);
 }
 
+app.locals.FXA_ENABLED = AppConstants.FXA_ENABLED;
 app.locals.SERVER_URL = AppConstants.SERVER_URL;
 app.locals.UTM_SOURCE = url.parse(AppConstants.SERVER_URL).hostname;
 
@@ -99,7 +100,9 @@ if (!AppConstants.DISABLE_DOCKERFLOW) {
   app.use("/", DockerflowRoutes);
 }
 app.use("/hibp", HibpRoutes);
-app.use("/oauth", OAuthRoutes);
+if (AppConstants.FXA_ENABLED) {
+  app.use("/oauth", OAuthRoutes);
+}
 app.use("/scan", ScanRoutes);
 app.use("/ses", SesRoutes);
 app.use("/user", UserRoutes);

views/partials/subscribe_modal/subscribe_to_ffxm.hbs

@@ -1,7 +1,9 @@
 <div id="subscribe-to-ffxm" class="modal-content">
   <h3 class="section-headline">Subscribe to Firefox Monitor</h3>
   <p>Sign up for your full report, alerts when new breaches happen, and safety tips from Firefox Monitor. </p>
+  {{#if FXA_ENABLED }}
   <button id="subscribe-fxa-btn" class="button">Subscribe with Firefox Account</button>
+  {{/if}}
   <form action="/user/add" id="subscribe-form" class="form-group" method="post" novalidate data-no-csrf>
     <div class="input-group">
       <input id="subscribe-email-input" class="input-group-field" type="email" name="email" placeholder="Subscribe with Email Account" minlength="1" aria-label="Enter Email Address" tabindex="0" autocomplete="off" />