feat(auth): enable otp by clientid and service

[StaberindeZA]

Because

• Allow Passwordless OTP to be enabled for a clientId and then only specific services of that clientId or all services.

This pull request

• Adds a new env var, PASSWORDLESS_ALLOWED_CLIENT_SERVICES, to configure which client and service are allowed to use the passwordless OTP feature.
• Removes env var, PASSWORDLESS_ALLOWED_CLIENTIDS env var.
• Updates metricsContext to include service

Issue that this pull request solves

Closes: # FXA-13178

Checklist

Put an x in the boxes that apply

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).

[vbudhram]

@StaberindeZA What are your thoughts about having a test to do the signup flow through a browser service? We have a test for signin, but for this feature seems useful.

fxa/packages/functional-tests/tests/passwordless/signinPasswordless.spec.ts

Line 1042 in 1d12977

test.describe('Passwordless authentication - Browser Service (Relay)', () => {

fxa/packages/functional-tests/tests/passwordless/signinPasswordless.spec.ts

Line 12 in 1d12977

test('passwordless signup - new account', async ({

It would be roughly combining those two tests.

[Copilot]

Pull request overview

Enables passwordless OTP eligibility to be controlled by OAuth clientId + service, instead of a flat clientId allowlist, by propagating service through metrics context and /account/status calls.

Changes:

• Replace allowedClientIds with allowedClientServices (clientId → allowed services, with * wildcard) for passwordless OTP gating.
• Plumb service through settings → auth-client → auth-server (/account/status) and into server-side metrics context.
• Update passwordless route logic and local/unit tests to enforce client+service allowlisting.

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
packages/fxa-settings/src/pages/Signin/container.tsx	Passes service to accountStatusByEmail requests.
packages/fxa-settings/src/pages/Index/container.tsx	Passes service to accountStatusByEmail requests.
packages/fxa-auth-server/test/local/routes/passwordless.js	Updates local route tests to use allowedClientServices config shape.
packages/fxa-auth-server/test/local/routes/account.js	Updates local account route tests to use allowedClientServices.
packages/fxa-auth-server/lib/routes/utils/passwordless.ts	Implements clientId+service allowlist check with wildcard support.
packages/fxa-auth-server/lib/routes/utils/passwordless.spec.ts	Adds unit coverage for the new allowlist behavior.
packages/fxa-auth-server/lib/routes/passwordless.ts	Enforces allowlist using metricsContext.service for passwordless endpoints.
packages/fxa-auth-server/lib/routes/account.ts	Accepts service on /account/status and uses it for passwordless support checks.
packages/fxa-auth-server/lib/metrics/context.js	Extends metrics context schema to include service.
packages/fxa-auth-server/config/index.ts	Introduces PASSWORDLESS_ALLOWED_CLIENT_SERVICES and removes the old allowlist config field.
packages/fxa-auth-server/config/dev.json	Updates dev config example to the new allowlist structure.
packages/fxa-auth-client/lib/client.ts	Extends accountStatusByEmail options to include service.
libs/shared/metrics/glean/src/lib/metrics.context.ts	Adds service to shared MetricsContext and parses it from query params.
.circleci/config.yml	Adds PASSWORDLESS_ALLOWED_CLIENT_SERVICES to CI environment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[vbudhram]

@StaberindeZA Tested this locally

• Smartwindow signup (email code) ✅
• Sync signup (prompts for password) ✅
• Settings signup (email code) ✅

Once an account has email code enabled, they will always get it. I also tested the enable sync and set password flows and they worked,