Should I get signed out of Notes when I sign out of Sync?

[rfk]

(sorry if there's a mailing list I should ask this on instead, I couldn't find one in my notes)

I'm trying to make sure I have my head around the relationship between being logged in to Firefox Sync, and being logged in to the Notes webextension. IIUC the intention is for these to be two separate and independent login states despite co-existing in the same browser, right?

If I'm signed in to sync, and I go to sign in to the Notes webextension, then I get a nice experience where it already knows who I am and I just have to re-enter my password to enable Notes to start syncing. I think that feels pretty solid.

But what happens if I then sign out of sync in my browser? Will the Notes webextension stay signed in and keep syncing? Is the user going to find that surprising? They may not have a good mental model of the two things being distinct.

[vladikoff]

No mailing list :)

[ryanfeeley]

@rfk @vladikoff As this is a Test Pilot experiment, and the user is signing in to "Firefox Notes", I'd say they are not coupled in any way. Signing out of one will not affect the other.

However if a user deletes their account, we should delete it (eventually if not immediately).

[Natim]

if a user deletes their account, we should delete it (eventually if not immediately).

Do we have a way to know that from Kinto? Like a webhook we can register somewhere or something?

[ryanfeeley]

Maybe? @vladikoff?

[rfk]

However if a user deletes their account, we should delete it (eventually if not immediately).

For other services such as Sync, we've set up a backchannel SQS queue from which you can get account lifecycle events such as deletions. Will that be workable here?

(A webhook would be neat going forward, but more engineering work in the short term)

[Natim]

The plan is to stick with web-extensions compatibility. I don't think WebExtension would have access to that SQS queue.

Is it possible to guess this by not being able to access the Kinto server with the current token and as a consequence disconnect the user?

[vladikoff]

@ryanfeeley says " Don't worry about singing out users when Firefox Sync signs out"

[ryanfeeley]

🎤👨‍🎤

[rfk]

However if a user deletes their account, we should delete it (eventually if not immediately).

Do we need a separate issue for this account-deletion part?

[ryanfeeley]

@rfk I wouldn't make that a high priority for a test pilot release. Hell, I don't think our mobile clients even handle it properly with sync yet. But if we develop this further I would definitely revert the user to unauthenticated state and fire a desktop notification like this one we use for sync (but with Notes wording)