fix(oauth): fail prompt=none step-up instead of challenging

[StaberindeZA]

Because

• RFC 9470 section 5 requires the authorization request to fail with unmet_authentication_requirements when the requested authentication level cannot be reached. FxA had no such path.
• A prompt=none step-up request routed the user to an interactive 2FA page, which the parameter forbids, and the RP was never told its request failed.

This pull request

• Adds UNMET_AUTHENTICATION_REQUIREMENTS to OAUTH_ERRORS, carrying response_error_code: 'unmet_authentication_requirements'.
• Fails prompt=none step-up requests in getOAuthNavigationTarget instead of routing to an interactive challenge, on errno 170 only.
• Gates that on a new isPromptNoneRequest navigation option set only by the Authorization container, the one caller that relays a returned error to the RP.
• Documents errno 170 and the step-up parameters on POST /oauth/authorization.
• Pins that the id_token acr claim reflects the achieved AAL.

Issue that this pull request solves

Closes: FXA-12860

Checklist

Put an x in the boxes that apply

• My commit is GPG signed.
• If applicable, I have modified or added tests which pass locally.
• I have added necessary documentation (if appropriate).
• I have verified that my changes render correctly in RTL (if appropriate).
• I have manually reviewed all AI generated code.

How to review (Optional)

• Key files/areas to focus on: the prompt=none short-circuit in packages/fxa-settings/src/pages/Signin/utils.ts, and where isPromptNoneRequest is set in packages/fxa-settings/src/pages/Authorization/container.tsx.
• Suggested review order: Signin/utils.ts → Authorization/container.tsx → tests.
• Risky or complex parts: the gate is on the caller's flag rather than integration.wantsPromptNone(), because prompt=none can outlive the authorization route in the query string. Every other handleNavigation caller renders errors in-FxA, so returning one to them would dead-end the user instead of completing enrolment.

Screenshots (Optional)

Please attach the screenshots of the changes made in case of change in user interface.

Other information (Optional)

Scoped to prompt=none. The ticket also describes returning this error when a user declines to enrol a second factor, which is not in this PR:

• Inline TOTP setup is handled upstream — refactor(settings): scope inline TOTP MFA guard to enrolment step #21097 rescoped its MFA guard to the enrolment step, so dismissing it returns to the intro screen rather than leaving the flow. That is an in-flow back action, not a decline.
• Recovery setup was implemented and then removed. MfaGuardCore only renders its modal when the mfa:2fa JWT is absent, and that JWT is already minted during TOTP setup — so onDismiss there is reachable only via a stale-JWT re-prompt mid-enrolment, where treating it as a decline would discard a confirmed phone number and generated backup codes.
• Abandoning an interactive 2FA challenge (/signin_totp_code, /signin_token_code) still dead-ends without notifying the RP. Those surfaces have no decline control and none was added.

The decline half wants its own ticket with UX input. FXA-14408 covers the adjacent prompt=none gap for unverified sessions, where interaction_required is the correct code rather than unmet_authentication_requirements.

[Copilot]

Pull request overview

Adds RFC 9470-compliant handling for prompt=none OAuth step-up failures.

Changes:

• Maps errno 170 to unmet_authentication_requirements.
• Redirects eligible failures to the RP.
• Adds documentation and unit/functional coverage.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
Signin/utils.ts	Maps step-up failures to the OAuth error.
Signin/utils.test.ts	Tests prompt-none navigation behavior.
Signin/interfaces.ts	Adds the prompt-none navigation flag.
Authorization/container.tsx	Supplies the flag and relays errors.
Authorization/container.test.tsx	Tests RP error redirection.
oauth-web-integration.test.ts	Tests error URL and state handling.
oauth-errors.ts	Defines the new OAuth error.
grant.spec.ts	Verifies achieved AAL claims.
oauth-api.ts	Documents step-up behavior and errno 170.
stepUpAuth.spec.ts	Adds end-to-end prompt-none coverage.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.