Merge pull request #20302 from mozilla/fxa-13379

fix(settings): cached passwordless Sync signin on mobile stuck on sigin page

Author: vbudhram

packages/fxa-settings/src/pages/Signin/index.test.tsx

@@ -1182,6 +1182,41 @@ describe('Signin component', () => {
           handleNavigationSpy.mockRestore();
         });
 
+        it('allows navigation for cached Sync passwordless user on mobile', async () => {
+          const ensureCanLinkSpy = jest.spyOn(
+            SigninUtils,
+            'ensureCanLinkAcountOrRedirect'
+          ).mockResolvedValue(true);
+          const handleNavigationSpy = jest.spyOn(
+            SigninUtils,
+            'handleNavigation'
+          );
+          const cachedSigninHandler = jest
+            .fn()
+            .mockReturnValueOnce(CACHED_SIGNIN_HANDLER_RESPONSE);
+          const integration = createMockSigninOAuthNativeSyncIntegration({
+            isMobile: true,
+          });
+          render({
+            integration,
+            sessionToken: MOCK_SESSION_TOKEN,
+            hasPassword: false,
+            hasLinkedAccount: false,
+            cachedSigninHandler,
+          });
+
+          await submit();
+          await waitFor(() => {
+            expect(handleNavigationSpy).toHaveBeenCalledWith(
+              expect.objectContaining({
+                performNavigation: true,
+              })
+            );
+          });
+          ensureCanLinkSpy.mockRestore();
+          handleNavigationSpy.mockRestore();
+        });
+
         it('shows merge warning for cached Sync passwordless signin when user accepts', async () => {
           const ensureCanLinkSpy = jest.spyOn(
             SigninUtils,

packages/fxa-settings/src/pages/Signin/index.tsx

@@ -199,9 +199,13 @@ const Signin = ({
               : '',
           finishOAuthFlowHandler,
           queryParams: location.search,
-          performNavigation: !integration.isFirefoxMobileClient(),
+          // Passwordless Sync accounts (OTP or third-party auth) need to navigate
+          // to set_password within the webview, even on mobile clients. No webchannel
+          // messages are sent (deferred until after password creation), so the webview
+          // must handle navigation internally.
+          performNavigation: (isSync && !hasPassword) || !integration.isFirefoxMobileClient(),
           isServiceWithEmailVerification,
-          // Sync users in the cached path are passwordless (third-party auth);
+          // Sync users in the cached path are passwordless (third-party auth or OTP);
           // defer web channel messages until after password creation.
           handleFxaLogin: !isSync,
           handleFxaOAuthLogin: !isSync,