Bug 1792550 - ensure the primary password is unlocked before signing in to sync. r=Mardak,sfoster

Differential Revision: https://phabricator.services.mozilla.com/D158719

browser/base/content/browser-sync.js

@@ -1142,6 +1142,9 @@ var gSync = {
   },
 
   async openSignInAgainPage(entryPoint) {
+    if (!(await FxAccounts.canConnectAccount())) {
+      return;
+    }
     const url = await FxAccounts.config.promiseForceSigninURI(entryPoint);
     switchToTabHavingURI(url, true, {
       replaceQueryString: true,
@@ -1198,6 +1201,9 @@ var gSync = {
   },
 
   async openFxAEmailFirstPage(entryPoint) {
+    if (!(await FxAccounts.canConnectAccount())) {
+      return;
+    }
     const url = await FxAccounts.config.promiseConnectAccountURI(entryPoint);
     switchToTabHavingURI(url, true, { replaceQueryString: true });
   },

browser/components/firefoxview/firefox-view-tabs-setup-manager.sys.mjs

@@ -532,6 +532,9 @@ export const TabsSetupFlowManager = new (class {
   }
 
   async openFxASignup(window) {
+    if (!(await lazy.fxAccounts.constructor.canConnectAccount())) {
+      return;
+    }
     const url = await lazy.fxAccounts.constructor.config.promiseConnectAccountURI(
       "firefoxview"
     );

browser/components/preferences/main.js

@@ -897,6 +897,9 @@ var gMainPane = {
       win.openTrustedLinkIn("about:preferences#sync", "current");
       return;
     }
+    if (!(await FxAccounts.canConnectAccount())) {
+      return;
+    }
     let url = await FxAccounts.config.promiseConnectAccountURI(
       "dev-edition-setup"
     );

browser/components/preferences/sync.js

@@ -445,6 +445,9 @@ var gSyncPane = {
   },
 
   async signIn() {
+    if (!(await FxAccounts.canConnectAccount())) {
+      return;
+    }
     const url = await FxAccounts.config.promiseConnectAccountURI(
       this._getEntryPoint()
     );
@@ -456,6 +459,10 @@ var gSyncPane = {
     // lost the FxA account data - in which case we'll not get a URL as the re-auth
     // URL embeds account info and the server endpoint complains if we don't
     // supply it - So we just use the regular "sign in" URL in that case.
+    if (!(await FxAccounts.canConnectAccount())) {
+      return;
+    }
+
     let entryPoint = this._getEntryPoint();
     const url =
       (await FxAccounts.config.promiseForceSigninURI(entryPoint)) ||

browser/components/uitour/UITour.jsm

@@ -457,6 +457,13 @@ var UITour = {
       case "showFirefoxAccounts": {
         Promise.resolve()
           .then(() => {
+            return lazy.FxAccounts.canConnectAccount();
+          })
+          .then(canConnect => {
+            if (!canConnect) {
+              lazy.log.warn("showFirefoxAccounts: can't currently connect");
+              return null;
+            }
             return data.email
               ? lazy.FxAccounts.config.promiseEmailURI(
                   data.email,
@@ -467,6 +474,9 @@ var UITour = {
                 );
           })
           .then(uri => {
+            if (!uri) {
+              return;
+            }
             const url = new URL(uri);
             // Call our helper to validate extraURLParams and populate URLSearchParams
             if (!this._populateURLParams(url, data.extraURLParams)) {

services/fxaccounts/FxAccounts.jsm

@@ -89,6 +89,15 @@ ChromeUtils.defineModuleGetter(
   "resource://gre/modules/FxAccountsTelemetry.jsm"
 );
 
+XPCOMUtils.defineLazyGetter(lazy, "mpLocked", () => {
+  return ChromeUtils.import("resource://services-sync/util.js").Utils.mpLocked;
+});
+
+XPCOMUtils.defineLazyGetter(lazy, "ensureMPUnlocked", () => {
+  return ChromeUtils.import("resource://services-sync/util.js").Utils
+    .ensureMPUnlocked;
+});
+
 XPCOMUtils.defineLazyModuleGetters(lazy, {
   Preferences: "resource://gre/modules/Preferences.jsm",
 });
@@ -629,6 +638,23 @@ class FxAccounts {
     });
   }
 
+  /** Returns a promise that resolves to true if we can currently connect (ie,
+   *  sign in, or re-connect after a password change) to a Firefox Account.
+   *  If this returns false, the caller can assume that some UI was shown
+   *  which tells the user why we could not connect.
+   *
+   *  Currently, the primary password being locked is the only reason why
+   *  this returns false, and in this scenario, the primary password unlock
+   *  dialog will have been shown.
+   *
+   *  This currently doesn't need to return a promise, but does so that
+   *  future enhancements, such as other explanatory UI which requires
+   *  async can work without modification of the call-sites.
+   */
+  static canConnectAccount() {
+    return Promise.resolve(!lazy.mpLocked() || lazy.ensureMPUnlocked());
+  }
+
   /**
    * Send a message to a set of devices in the same account
    *

toolkit/components/messaging-system/lib/SpecialMessageActions.jsm

@@ -307,6 +307,9 @@ const SpecialMessageActions = {
         });
         break;
       case "SHOW_FIREFOX_ACCOUNTS":
+        if (!(await lazy.FxAccounts.canConnectAccount())) {
+          break;
+        }
         const data = action.data;
         const url = await lazy.FxAccounts.config.promiseConnectAccountURI(
           (data && data.entrypoint) || "snippets",