Bug 2048644 - Resolve the enterprise console address from AutoConfig, falling back to distribution.ini

[mkaply]

Description

Bugzilla: Bug-2048644

The enterprise console address (enterprise.console.address) is migrating from distribution.ini to AutoConfig (firefox.cfg). Teach both the browser and the crash reporter client to prefer AutoConfig while keeping distribution.ini working, so existing deployments are unaffected during the migration.

Browser (nsAppRunner): once AutoConfig has been evaluated, if enterprise.console.address is locked (i.e. set via lockPref in firefox.cfg), derive the crash submission and update URLs from it and register the crash ServerURL, overriding any value read earlier from distribution.ini. The early distribution.ini read is left intact as the fallback, and the lock check means non-AutoConfig (distribution.ini) deployments keep their existing behavior.

Crash reporter client: resolve the console base URL in priority order:

1. the ServerURL crash annotation recorded by the browser,
2. the AutoConfig file (firefox.cfg, byte-shift decoded), then
3. distribution.ini (legacy, retained for migration). This feeds both the crash submission URL and the Glean telemetry endpoint. The distribution.ini reader is preserved as the final fallback rather than removed.

This is just the enabling code. Actually putting the firefox.cfg in the build will be a separate patch.

[mkaply]

Background

The enterprise console address (enterprise.console.address) is moving from distribution.ini to AutoConfig (firefox.cfg). Today the browser reads it from distribution.ini very early in startup (XRE_mainInit, before prefs/JS exist) to build the crash-submission and update URLs, and the crash reporter client reads distribution.ini directly for its Glean telemetry endpoint. AutoConfig isn't evaluated until much later (XRE_mainRun → FinishInitializingUserPrefs), so it can't feed that early code path.

This patch makes both the browser and the crash reporter client prefer AutoConfig while keeping distribution.ini fully working, so deployments can migrate incrementally without breaking.

Browser (toolkit/xre/nsAppRunner.cpp)

After AutoConfig has been evaluated, if enterprise.console.address is locked — i.e. set via lockPref in firefox.cfg — derive the crash-submission and update URLs from it via XRE_ParseEnterpriseServerURL and register the crash ServerURL, overriding anything read earlier from distribution.ini.

• The lock state is the discriminator for "this came from AutoConfig": lockPref locks the pref, whereas distribution.ini-applied prefs and test prefs do not. This is what lets AutoConfig take precedence without disturbing distribution.ini deployments.
• The existing early distribution.ini read in XRE_mainInit is left untouched as the fallback.
• The phase-3 block replaces the previous test-only (enterprise.felt_tests.read_update_url_from_prefs) path. Because the new gate is IsLocked(...) || readUpdateUrlFromPref, and the pref is never locked in the selenium harness, the existing update-URL tests (test_felt_updates_basic, test_felt_updates_distIni) keep their current behavior.

Crash reporter client (toolkit/crashreporter/client/app)

New autoconfig module (#[cfg(feature = "enterprise")]) resolves the console base URL in priority order:

1. the ServerURL crash annotation already recorded by the browser,
2. the AutoConfig file (firefox.cfg) — bytes are un-shifted by general.config.obscure_value (tries the default 13, then plaintext) and scanned for the lockPref/defaultPref/pref setting,
3. distribution.ini (the original reader, relocated here and kept as the legacy fallback).

This single resolver now feeds both consumers:

• Submit URL (config.rs): previously only the ServerURL annotation; now, when that annotation is absent or a domain-less placeholder (/submit?..., which is what the empty built-in crash URL produces for enterprise), it falls back through the chain above.
• Telemetry URL (glean.rs): previously read distribution.ini directly; now goes through the same resolver.

Supporting changes: a bytes-returning fs::read helper; generalized prefs_parser so it can match lockPref/defaultPref/pref (not just user_pref). These two are generic and intentionally not feature-gated.

What is explicitly preserved

distribution.ini reading is retained, not removed, in both the browser (early read, still the fallback) and the crash client (final step of the resolver). Non-AutoConfig deployments behave exactly as before.

Testing

• New Rust unit tests cover all three resolution paths (annotation, AutoConfig-encoded file, distribution.ini) plus the lockPref parser case.
• rustfmt and clang-format clean.
• [Fill in] try run / mach rusttests for the crash client, and the felt update selenium tests.

[jonathanmendez]

Looks good, I just have a few cleanup requests.