703093 - Allow apps to request key/secret to make in-app payments

Status: RESOLVED FIXED

(addons.mozilla.org Graveyard :: Developer Pages, defect, P1)

Description

[Kumar McMillan [:kumar]]

If an app operator wants to make in-app payments they need a page on devhub where they can request an application key and secret.

They will keep the secret safe on the server and use it to encode JWT requests to the AMO market.  All requests will contain the application key so that AMO knows what secret to use when decoding JWTs.

More info: https://github.com/mozilla/apps-payment-server/blob/master/DESIGN.md

The secret needs to be very strong.  We will need to quickly revoke application keys if a secret gets compromised.

Comment 1

[Andy McKay]

This page should be logging with prejudice. And maybe send an email to the developer.

Comment 2

[Kumar McMillan [:kumar]]

We also need them to register their postback URL (bug 703083) and chargeback URL (bug 703084)

Comment 3

[Kumar McMillan [:kumar]]

Brian Warner gave me the Python code for generating a strong key and he provided the best way with os.urandom() so that it is a truly random key.

andym, I didn't add any logging because I realized everything is time-stamped in the database. We are not [yet] regenerating keys so it's only DB inserts. If and when we regenerate keys we should log that.

To see the new page in devhub, turn on the in-app-payments switch.

Fixed in https://github.com/mozilla/zamboni/commit/218b379