779275 - Get the bluevia developer secret into solitude

Status: RESOLVED WONTFIX

(Marketplace Graveyard :: Payments/Refunds, defect, P1)

Description

[Andy McKay]

We've got basic bluevia support to generate and verify the JWT. However this doesn't currently use the shared the developer secret between BlueVia and the Marketplace.

This bug is to a) add in the encrypted model field for the developer secret and b) get the developer secret populated.

I'm unclear how b) will happen. Is it by pinging bluevia or is it going to be passed through from the marketplace?

Comment 1

[Andy McKay]

This is clearer in https://etherpad.mozilla.org/mkt-bluevia-devhub-flow.

Basically we just need an api that allows the storing and setting of secrets. Marketplace will be doing the BlueVia communication at this point.

Comment 2

[Kumar McMillan [:kumar]]

the developer secret will be passed through marketplace to Solitude. It will work something like this on the marketplace side:
- a seller registers, mkt gets a developer ID and sends it to Solitude (bug 776642)
- a seller specifies an app to sell, mkt creates the app using the BlueVia API which returns a developer secret
- mkt sends the developer secret to solitude for safe keeping

Comment 3

[Kumar McMillan [:kumar]]

Let's hold off on this for now. I'm working with BlueVia devs and rforbes to possibly change the spec where we don't need to handle developer secrets at all.

Comment 4

[Wil Clouser [:clouserw]]

(In reply to Kumar McMillan [:kumar] from comment #3)
> Let's hold off on this for now. I'm working with BlueVia devs and rforbes to
> possibly change the spec where we don't need to handle developer secrets at
> all.

Any changes to this bug?

Comment 5

[Andy McKay]

This is bluevia secret which is no more. We'll have a JWT secret though, but we should re-file that under the new payments when we get to it.