Firefox Total Cookie Protection: Storage Access API user-gesture requirement during third-party iframe redirect chains

Context

Firefox's Total Cookie Protection (TCP) partitions cookies and site data per top-level site. The Storage Access API (document.requestStorageAccess()) allows embedded cross-origin iframes to request access to their unpartitioned storage, but the specification requires a user gesture (transient activation) for the promise to resolve.

Unresolved behavior

When a third-party iframe initiates a server-side redirect chain (for example, an OAuth identity provider flow), it is unclear whether Firefox treats the redirect as preserving the original user gesture for the purpose of granting storage access. The current implementation appears to deny access if requestStorageAccess() is not directly triggered by a user input event, yet the specification permits user-agent discretion for transient activation via redirects. This creates a gap for identity providers that rely on redirect-based authentication inside third-party iframes.

Constraints

• TCP must be enabled (network.cookie.cookieBehavior=5 or privacy.partition.network_state=true).
• Enterprise policies or container tabs may override partitioning behavior.
• Behavior may differ across Firefox release, Beta, and Nightly channels due to ongoing experimentation.

Does Firefox consider a redirect chain initiated by a user gesture on the top-level page as sufficient transient activation for requestStorageAccess() in a third-party iframe? If not, what specific user interaction pattern satisfies the requirement without breaking legitimate federated login flows?