877243 - Pin was locked doesn't log the user out.

Status: VERIFIED FIXED

(Marketplace Graveyard :: Payments/Refunds, defect, P2)

Description

[krupa raj[:krupa]]

steps to reproduce:
1. Start the purchase of a paid app
2. Enter PIN incorrectly until it gets locked
3. Start the purchase flow after 5 mins
4. Notice that the 'Your Pin was locked' screen loads with 'Continue' and 'Reset Pin' screens
5. Click on the Continue button

expected behavior:
User is prompted to sign in to proceed

observed behavior:
Nothing happens on clicking the Continue button.

Comment 1

[Wraithan (Chris McDonald) [:wraithan]]

https://github.com/mozilla/webpay/commit/f8bb52a2da6f5d4f7d171d973c51a53541f41da5

Removed this page because it shouldn't have been part of the flow anymore.

Comment 2

[krupa raj[:krupa]]

This page is still accessible on dev and the Continue button doesn't work

Comment 3

[Wraithan (Chris McDonald) [:wraithan]]

Ah, I mistook what page this is. Also I have a rebuilt env so I can fix this!

Comment 4

[Wraithan (Chris McDonald) [:wraithan]]

https://github.com/mozilla/webpay/commit/53398d071fac223b088d42823c960344eb322f4e

commit has wrong bug number in it, but it is fixed. Just double and triple checked locally. There is still the bug that the enter your pin screen is shown once before showing is_locked. Investigating.

Comment 5

[Victor Carciu]

Now , the "Continue" button is working, but user is asked to Enter PIN instead of signing in with Persona.
Entering the correct locked PIN will start the payments flow.

Comment 6

[Wraithan (Chris McDonald) [:wraithan]]

I had been implementing what the ticket said, but then I looked into the mocks at: 

https://www.dropbox.com/s/am1ecw2j6o0a0ji/Marketplace_Payments_Flows_PinLockOut.pdf

It looks like once you are locked out, we are supposed to initiate a forceAuth then show the was locked page, then not have to do the forceAuth when you hit reset.

I'd like to propose that we keep what we have currently.

1) get locked out
2) wait 5 mins
3) get the was locked warning
4a) click reset and go through forceAuth like the forgot pin? flow of the normal pin entry
4b) click continue and just enter your pin like normal

Maureen, these are your mocks so it is ultimately up to you, but I'd like to hear your thoughts.

Comment 7

[Wraithan (Chris McDonald) [:wraithan]]

Bumping milestone, blocked on UX.

Comment 8

[Maureen Hanratty]

Ok, so are you proposing this:

1) User sees locked out pin error message and clicks "OK"
2) Trusted UI closes and purchase is cancelled
3) User waits 5 minutes
4) User clicks "1.99" on app
5) Show "Your pin was locked. Continue or Reset"

If "Continue"
6A) Show "Enter Pin" screen

If "Reset"
6B) Logout user and require them to sign in again

If that is your proposal it sounds good to me--actually a better flow then I proposed :)  Question: instead of requiring the user to enter their account name what if we pre-fill the account name and just require the password? Would that be ok in your opinion?

Comment 9

[Wraithan (Chris McDonald) [:wraithan]]

I'm happy you like that flow.

The name requirement isn't on our side, but rather, it is on Persona's side. ForceAuth requires the user to type their name in again. I would love if it just required them to type their password instead of typing the name as well.

QA: See steps in comment 8 for the new flow.

Comment 10

[Victor Carciu]

The flow from step 8 is working , but when I tried to reset the PIN and then cancel the reset flow, I was asked for the PIN and old pin worked.
Should I log another bug for this one?

Comment 11

[Wraithan (Chris McDonald) [:wraithan]]

If you cancel half way through the reset flow it should disregard anything you typed in the reset flow and leave your account how it was before you started resetting your pin, so that sounds like it is doing the right thing.

Comment 12

[Victor Carciu]

(In reply to Wraithan (Chris McDonald) [:wraithan] from comment #11)
> If you cancel half way through the reset flow it should disregard anything
> you typed in the reset flow and leave your account how it was before you
> started resetting your pin, so that sounds like it is doing the right thing.

Thank you , I will mark the bug as verified.