745319 - mozApps API should handle receipt refresh

Status: RESOLVED WONTFIX

(Core Graveyard :: DOM: Apps, defect, P2)

Description

[Michael Hanson]

The currently-planned digital receipt model is documented here:
https://wiki.mozilla.org/Apps/WebApplicationReceipt/GenerationService

In that plan, receipts may expire.  If a receipt has expired, the user agent is the only entity that has the power to refresh it.

Therefore we need the ability for the user agent to initiate a refresh of a receipt.

I propose that getSelf() checks the expiry date of the receipt, and if it is less than X days in the future and the device is online, the mozApps runtime initiates a background GET request to a "refresh" URL embedded in the receipt.

The refresh request could fail at the network or authentication levels; the UA may need to reauthenticate the user to a marketplace to complete the refresh.  This will need some user experience work - at worst, a modal dialog that blocks the user's attempt to launch the app.

Note that receipt refresh could also be done by an individual marketplace from its own content - it could inspect the list of apps it has installed on the device and quietly refresh the receipts for any that it feels the need to change.  This wouldn't need any new mozApps work but would require the UA to visit the marketplace's content.

Comment 1

[Andy McKay]

If a receipt is expiring and has correct crypto, do we still need to re-authenticate the user? We can trust the receipt that's provided. This would allow the receipt to be recreated quickly with no user interaction and could occur frequently.

In the case that we revoke a certificated and can no longer trust incoming receipts, we'll need to re-authenticate the client. This would be a very rare event.

Comment 2

[Jason Smith [:jsmith]]

Nominating for k9o - This involves receipts for web applications (e.g. paid applications)

Comment 3

[Andy McKay]

Currently receipts generated by the marketplace expire, we are just ignoring them. Security were very keen on having this to limit the possible exposure in the case of malicious signing and it was kind of promised it would happen.

Comment 4

[Anant Narayanan [:anant]]

This should block basecamp as not refreshing receipts will lead to the user unable to use an app who's receipt has expired.

Comment 5

[Jason Smith [:jsmith]]

Sounds good - looks like there's general agreement this should block. Who could work on this?

Comment 6

[Andreas Gal :gal]

Anant, can you take this one?

Comment 7

[Andreas Gal :gal]

Whats the mitigation here? I assume we can for now issue receipts with no expiration until this is fixed, so I will make this P2. Please upgrade to P1 if you disagree.

Comment 8

[Andreas Gal :gal]

Renom if you think we can't ship a v1 without this.

Comment 9

[Jason Smith [:jsmith]]

Per IRC conversations with a few other folks, I think the best course of action if there is disagreement on whether this blocks or not is to do the following:

- Move the blocking-basecamp flag to ? for re-evaluation
- Indicate a rationale for why you disagree

Comment 10

[Bill Walker [:bwalker] [@wfwalker]]

(In reply to Andreas Gal :gal from comment #7)
> Whats the mitigation here? I assume we can for now issue receipts with no
> expiration until this is fixed, so I will make this P2. Please upgrade to P1
> if you disagree.

That's right, for now we can issue receipts with very long expiration times.

The ability refresh receipts remains part of our architecture for dealing with signing key compromise, as documented at:

https://wiki.mozilla.org/Apps/WebApplicationReceipt/GenerationService

Comment 11

[Jason Smith [:jsmith]]

Per talking with Bill, this is a firm requirement needed for payments.

Comment 12

[Jason Smith [:jsmith]]

Still need more input on why this is needed for basecamp. Blocked on Bill Walker.

Comment 13

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Basecamp- kilimanjaro+ per Bill Walker.

We'll work around this in basecamp by using long-expiring receipts.

Comment 14

[Sylvestre Ledru [:Sylvestre]]

Core Graveyard / DOM: Apps is inactive. Closing all bugs in this component.