Last Comment Bug 793811 - Skip pay provider selector in navigator.mozPay() when only 1 JWT
: Skip pay provider selector in navigator.mozPay() when only 1 JWT
Status: RESOLVED WONTFIX
:
Product: Core
Classification: Components
Component: DOM: Device Interfaces (show other bugs)
: Trunk
: All All
: -- normal (vote)
: ---
Assigned To: Fernando Jiménez Moreno [:ferjm]
:
:
Mentors:
Depends on:
Blocks: 767818
  Show dependency treegraph
 
Reported: 2012-09-24 12:24 PDT by Kumar McMillan [:kumar] (needinfo all the things)
Modified: 2012-10-03 02:38 PDT (History)
9 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
v1 (7.71 KB, patch)
2012-09-25 02:19 PDT, Fernando Jiménez Moreno [:ferjm]
no flags Details | Diff | Splinter Review
Pointer to Github pull request: https://github.com/mozilla-b2g/gaia/pull/5235 (355 bytes, text/html)
2012-10-03 02:24 PDT, Fernando Jiménez Moreno [:ferjm]
no flags Details

Description Kumar McMillan [:kumar] (needinfo all the things) 2012-09-24 12:24:40 PDT
navigator.mozPay() (bug 767818) shows an initial selection screen to handle cases where merchants send multiple JWTs for each supported payment provider. In the case where there is only one provider (JWT array length of 1), skip that screen.

This change has been approved by Jonas over email. There are privacy implications here because navigator.mozPay() may not have been triggered by a user action. After this change, triggering that API will result in a GET request to the payment provider.

The privacy team should be aware of it but after discussion we felt the risks were mitigated by these facts:

1) The whitelist of payment provider URLs is controlled by Mozilla and thus we can restrict who might receive the GET request

2) The GET request only includes the JWT (an encoded JSON object with product details) provided by the merchant, it does not include personally identifiable information.

3) Mozilla has the chance to not only review but enforce privacy policies of any whitelisted payment provider. The recommendations are here: https://wiki.mozilla.org/WebAPI/WebPaymentProvider#Privacy

4) For our initial launch there will only be one supported payment provider and it will be hosted by a Mozilla server. We can enforce the privacy policy for collected data.

5) Triggering navigator.mozPay() without user interaction and having it result in a GET request is not much different than triggering window.location = 'http://...'
Comment 1 Kumar McMillan [:kumar] (needinfo all the things) 2012-09-24 12:29:21 PDT
Tom, let me know if you want me to follow up with any details here.
Comment 2 Fernando Jiménez Moreno [:ferjm] 2012-09-25 00:55:00 PDT
Should this be a P1 blocker?
Comment 3 Fernando Jiménez Moreno [:ferjm] 2012-09-25 02:19:38 PDT
Created attachment 664402 [details] [diff] [review]
v1

This patch skips the old payment provider confirmation (now selection) screen unless the payment request contains more than one JWT (with different 'typ' values). In that case, the platform allows the user to choose the payment provider that she prefers.

The only significant change is in dom/payment/Payment.jsm, where the condition has been added. The other changes are for renaming 'confirmation' to 'selection'.

Once this lands, the Gaia side will also require some modifications.
Comment 4 Kumar McMillan [:kumar] (needinfo all the things) 2012-09-25 12:05:59 PDT
(In reply to Fernando Jiménez Moreno [:ferjm] from comment #2)
> Should this be a P1 blocker?

I say yes because it is required by UX for launching payments for basecamp. Maria S (mushi) can provide details about the UX requirement.
Comment 5 [:fabrice] Fabrice Desré 2012-09-25 15:55:48 PDT
So, I'm not a big fan of having this skipping functionality in the back-end. Is there anything that prevents the content side (eg Gaia) to return the only choice available if there's only one?
Comment 6 Fernando Jiménez Moreno [:ferjm] 2012-09-26 00:22:58 PDT
(In reply to Fabrice Desré [:fabrice] from comment #5)
> So, I'm not a big fan of having this skipping functionality in the back-end.
> Is there anything that prevents the content side (eg Gaia) to return the
> only choice available if there's only one?

Yes, we could do that on the content side, but I would like to understand your reasons to prefer this option before :)

IMHO it would be better to avoid any mozChromeEvent <-> mozContentEvent dance if possible.

If your concern is about doing this in the common part (dom/payment/Payment.jsm) we can still do it in the B2G glue, so the check is only done in B2G (just in case we finally implement mozPay for other platforms).

Thanks Fabrice!
Comment 7 [:fabrice] Fabrice Desré 2012-09-26 08:05:49 PDT
My main reason is that this is a UX decision, so I'd rather have the code as close to UI as possible. This is what we do for web activities, and for install/updates API we also had to let the UI drive the process because of complex UX requirements. In general, keep the backend dumb and secure, and let the front-end drive it.

I'm not sure moving that in the b2g glue is good enough either. mozChromeEvents are not *that* bad anyway...
Comment 8 Fernando Jiménez Moreno [:ferjm] 2012-09-26 09:26:58 PDT
(In reply to Fabrice Desré [:fabrice] from comment #7)
> My main reason is that this is a UX decision, so I'd rather have the code as
> close to UI as possible. This is what we do for web activities, and for
> install/updates API we also had to let the UI drive the process because of
> complex UX requirements. In general, keep the backend dumb and secure, and
> let the front-end drive it.
> 
> I'm not sure moving that in the b2g glue is good enough either.
> mozChromeEvents are not *that* bad anyway...

Ok. I still think that saving any extra event flow is worth the platform modification :). Anyway, I've just sent this PR https://github.com/mozilla-b2g/gaia/pull/5235 with the required modification.

Should I close this as WONTFIX?
Comment 9 Fernando Jiménez Moreno [:ferjm] 2012-09-28 06:37:28 PDT
Fabrice, could you take a look at the Gaia PR, please :)? I am not sure if you notice the github notifications.
Comment 10 Fernando Jiménez Moreno [:ferjm] 2012-10-03 02:24:22 PDT
Created attachment 667396 [details]
Pointer to Github pull request: https://github.com/mozilla-b2g/gaia/pull/5235

Pointer to Github pull-request

Note You need to log in before you can comment on or make changes to this bug.