Merge pull request #19538 from mozilla/FXA-12631

bug(settings): Make sure session is verified before starting key stretching upgrade

Author: dschom

packages/fxa-settings/src/pages/Signin/SigninTotpCode/container.test.tsx

@@ -20,7 +20,11 @@ import { renderWithLocalizationProvider } from 'fxa-react/lib/test-utils/localiz
 import SigninTotpCodeContainer from './container';
 import { MozServices } from '../../../lib/types';
 import { createMockWebIntegration } from '../SigninTokenCode/mocks';
-import { Integration, useSensitiveDataClient } from '../../../models';
+import {
+  Integration,
+  useSensitiveDataClient,
+  useSession,
+} from '../../../models';
 import { mockSensitiveDataClient as createMockSensitiveDataClient } from '../../../models/mocks';
 
 import {
@@ -72,6 +76,7 @@ jest.mock('../../../models', () => {
     ...jest.requireActual('../../../models'),
     useAuthClient: jest.fn(),
     useSensitiveDataClient: jest.fn(),
+    useSession: jest.fn(),
   };
 });
 
@@ -146,6 +151,16 @@ function resetMockSensitiveDataClient() {
   );
 }
 
+function mockSession() {
+  (useSession as jest.Mock).mockImplementation(() => {
+    return {
+      isSessionVerified: () => {
+        return Promise.resolve(true);
+      },
+    };
+  });
+}
+
 function applyDefaultMocks() {
   jest.resetAllMocks();
   jest.restoreAllMocks();
@@ -158,6 +173,7 @@ function applyDefaultMocks() {
   mockVerifyTotp();
   mockWebIntegration();
   resetMockSensitiveDataClient();
+  mockSession();
 }
 
 describe('signin totp code container', () => {

packages/fxa-settings/src/pages/Signin/SigninTotpCode/container.tsx

@@ -23,6 +23,7 @@ import {
   isWebIntegration,
   useAuthClient,
   useSensitiveDataClient,
+  useSession,
 } from '../../../models';
 import {
   useFinishOAuthFlowHandler,
@@ -54,6 +55,8 @@ export const SigninTotpCodeContainer = ({
   serviceName,
 }: SigninTotpCodeContainerProps & RouteComponentProps) => {
   const authClient = useAuthClient();
+  const session = useSession();
+
   const { finishOAuthFlowHandler, oAuthDataError } = useFinishOAuthFlowHandler(
     authClient,
     integration
@@ -133,7 +136,7 @@ export const SigninTotpCodeContainer = ({
       // can only be finished after the account has been verified on accounts that
       // require totp.
       const sessionToken = signinState?.sessionToken;
-      if (sessionToken) {
+      if (sessionToken && (await session.isSessionVerified())) {
         await tryFinalizeUpgrade(
           sessionToken,
           sensitiveDataClient,