892068 - Expose MCC/MNC to payment providers in mozPay() so Webpay can disable payments per region

Status: RESOLVED FIXED

(Core :: DOM: Device Interfaces, defect, P2)

Description

[Andy McKay]

At first there was an email whitelist in webpay to allow payments to work for that whitelist.

Then it was requested to do it by region. The whitelist doesn't work to well for that, so we put a region setting in marketplace. That works great for paid apps.

However in-app payments never hit the marketplace, they hit webpay directly.

We need some way to block in-app payments in a region as well if possible.

Perhaps something when we check the price tiers against the marketplace?

Comment 1

[Kumar McMillan [:kumar]]

This will require a device API change to know the region that the user is purchasing in.

nav.mozPay() will need to expose MCC info to Webpay so that we can use it like the Marketplace app does: https://github.com/mozilla/fireplace/blob/2dd55b5e7546089571113d9641d65ae8c8ec4190/hearth/media/js/mobilenetwork.js#L263

Comment 2

[Fernando Jiménez Moreno [:ferjm]]

What's the deadline for this?

Comment 3

[Fernando Jiménez Moreno [:ferjm]]

Antonio, Jonas, any objection to exposing the MCC/MNC to the payment provider?

Comment 4

[Antonio Manuel Amaya Calvo (:amac)]

Hmm... I think that's on the same boat that a broad geolocation, and as such it should probably be communicated to the user somehow (I'm ok with that being on the terms of use or something like that). Other than that, I don't have any objection.

Comment 5

[Christopher Van Wiemeersch [:cvan]]

Andy/Kumar - I'm curious: if you try to use navigator.mozMobileConnection, do you have privileged access to use it? (I think not, but it's worth trying.)

https://github.com/mozilla/fireplace/blob/master/hearth/media/js/mobilenetwork.js#L263-271

Comment 6

[Fernando Jiménez Moreno [:ferjm]]

The Mobile Connection API can only be accessed from certified apps and the payment provider flow is unprivileged web content.

Comment 7

[Christopher Van Wiemeersch [:cvan]]

The `mobilenetwork` permission though is available to privileged apps though (which is what we use on the Marketplace): http://mxr.mozilla.org/mozilla-central/source/dom/apps/src/PermissionsTable.jsm#121

Is there a way to make the payment provider flow `privileged`?

Comment 8

[Fernando Jiménez Moreno [:ferjm]]

Unfortunately, there is no way to make the payment provider flow privileged, as it is just a regular web content loaded in a somehow trusted chrome frame. All its payments "superpowers" are given by explicitly injecting the required functionality in its content. The only way to expose the MCC/MNC to the payment provider is by also injecting it in the payment flow, the same way that we did with the ICC in bug 872987.

Comment 9

[Jason Smith [:jsmith]]

Talked with Andy & in triage about this - kicking this out to koi. It's too late to take features into 1.1 at this point. We also shipped without this for 1.01.

Agreed this is important, so product should weigh in if this is a blocker for 1.2.

Comment 10

[Jonas Sicking (:sicking) No longer reading bugmail consistently]

Not from me

Comment 11

[Fernando Jiménez Moreno [:ferjm]]

Attachment: v1

This patch exposes mozPaymentProvider.mcc and mozPaymentProvider.mnc.

Comment 12

[Jason Smith [:jsmith]]

Removing needinfo on product since we've got a patch already.

Comment 13

[Fernando Jiménez Moreno [:ferjm]]

Comment on attachment 781653 [details] [diff] [review]
v1

Review of attachment 781653 [details] [diff] [review]:
-----------------------------------------------------------------

::: b2g/chrome/content/payment.js
@@ +58,5 @@
>      this._onsuccess = aSuccessCallback;
>    },
>  
>    set onerror(aErrorCallback) {
> +    _debug("ON ERROR set " + aErrorCallback);

Oops. This will be gone on the final patch.

Comment 14

[Fernando Jiménez Moreno [:ferjm]]

http://hg.mozilla.org/projects/birch/rev/776f2e0b6860

Comment 15

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/776f2e0b6860

Comment 16

[Chris Lee [:clee]]

Mozilla is unable to tell which Operator is loading the Marketplace which means we will not be able to load the right content for a given user. 

Rick has escalated this and I agree this is a product blocker for 1.1. 

Nom'ing for leo and asking all our OEM partners to pick this up if at all possible.

Comment 17

[Ryan VanderMeulen [:RyanVM]]

Needs a branch-specific patch for uplift.

Comment 18

[Ryan VanderMeulen [:RyanVM]]

Fabrice, any chance you could help since ferjm is on PTO?

Comment 19

[Fernando Jiménez Moreno [:ferjm]]

Attachment: b2g18 patch

Sorry for the delay on this, I've been on PTO for a while.

Comment 20

[Fernando Jiménez Moreno [:ferjm]]

Comment on attachment 795489 [details] [diff] [review]
b2g18 patch

Wrong patch

Comment 21

[Fernando Jiménez Moreno [:ferjm]]

Attachment: b2g18 patch

Comment 22

[Fernando Jiménez Moreno [:ferjm]]

https://hg.mozilla.org/releases/mozilla-b2g18/rev/830aa182d063

Comment 23

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-b2g18_v1_1_0_hd/rev/830aa182d063