Download web payment manifests.

chrome/android/java/src/org/chromium/chrome/browser/payments/AndroidPaymentAppFactory.java

 // Copyright 2017 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 package org.chromium.chrome.browser.payments;
 
-import android.content.Context;
 import android.content.Intent;
 import android.content.pm.PackageManager;
 import android.content.pm.ResolveInfo;
 import android.graphics.drawable.Drawable;
 import android.net.Uri;
 import android.util.Pair;
 
 import org.chromium.base.ContextUtils;
-import org.chromium.chrome.browser.ChromeActivity;
 import org.chromium.chrome.browser.UrlConstants;
 import org.chromium.chrome.browser.payments.PaymentAppFactory.PaymentAppCreatedCallback;
 import org.chromium.chrome.browser.payments.PaymentAppFactory.PaymentAppFactoryAddition;
+import org.chromium.chrome.browser.payments.PaymentManifestVerifier.ManifestVerifyCallback;
 import org.chromium.content_public.browser.WebContents;
 
+import java.net.URI;
+import java.net.URISyntaxException;
+import java.util.ArrayList;
 import java.util.HashMap;
+import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
 
 /** Builds instances of payment apps based on installed third party Android payment apps. */
 public class AndroidPaymentAppFactory implements PaymentAppFactoryAddition {
-    private static final String ACTION_IS_READY_TO_PAY =
-            "org.chromium.intent.action.IS_READY_TO_PAY";
-
-    /** The action name for the Pay Basic-card Intent. */
-    private static final String ACTION_PAY_BASIC_CARD = "org.chromium.intent.action.PAY_BASIC_CARD";
+    @Override
+    public void create(
+            WebContents webContents, Set<String> methods, PaymentAppCreatedCallback callback) {
+        new PaymentAppFinder(webContents, methods, callback).find();

[Ted C, 2017/03/03 17:44:45]

A slightly nicer pattern IMO would just be to have a static method find in
PaymentAppFinder that internally constructs an object.  newing something to just
throw it away looks odd to me.

[please use gerrit instead, 2017/03/09 18:05:33]

Done.

+    }
 
     /**
-     * The basic-card payment method name used by merchant and defined by W3C:
-     * https://w3c.github.io/webpayments-methods-card/#method-id
+     * Finds installed native Android payment apps and verifies their signatures according to the
+     * payment method manifests. The manifests are located based on the payment method name, which
+     * is a URI that starts with "https://". The "basic-card" payment method is an exception: it's a
+     * common payment method that does not have a manifest and can be used by any payment app.
      */
-    private static final String BASIC_CARD_PAYMENT_METHOD = "basic-card";
-
-    @Override
-    public void create(WebContents webContents, Set<String> methods,
-            PaymentAppCreatedCallback callback) {
-        Context context = ChromeActivity.fromWebContents(webContents);
-        if (context == null) {
-            callback.onAllPaymentAppsCreated();
-            return;
-        }
-
-        Map<String, AndroidPaymentApp> installedApps = new HashMap<>();
-        PackageManager pm = context.getPackageManager();
-        Intent payIntent = new Intent();
-
-        for (String methodName : methods) {
-            if (methodName.startsWith(UrlConstants.HTTPS_URL_PREFIX)) {
-                payIntent.setAction(AndroidPaymentApp.ACTION_PAY);
-                payIntent.setData(Uri.parse(methodName));
-            } else if (methodName.equals(BASIC_CARD_PAYMENT_METHOD)) {
+    private static class PaymentAppFinder implements ManifestVerifyCallback {

[Ted C, 2017/03/03 17:44:45]

I'd pull this out to a separate class (package protected) just for the sake of
brevity of this file.

[please use gerrit instead, 2017/03/09 18:05:33]

Done.

+        /** The name of the intent for the service to check whether an app is ready to pay. */
+        private static final String ACTION_IS_READY_TO_PAY =
+                "org.chromium.intent.action.IS_READY_TO_PAY";
+
+        /** The name of the intent for the action of paying using "basic-card" method. */
+        private static final String ACTION_PAY_BASIC_CARD =
+                "org.chromium.intent.action.PAY_BASIC_CARD";
+
+        /**
+         * The basic-card payment method name used by merchant and defined by W3C:
+         * https://w3c.github.io/webpayments-methods-card/#method-id
+         */
+        private static final String BASIC_CARD_PAYMENT_METHOD = "basic-card";
+
+        /** The maximum number of payment method manifests to download. */
+        private static final int MAX_NUMBER_OF_MANIFESTS = 10;
+
+        private final WebContents mWebContents;
+        private final PaymentAppCreatedCallback mCallback;
+
+        /** Whether "basic-card" supporting payment apps should be queried. */
+        private final boolean mQueryBasicCard;
+
+        /**
+         * A map of payment method names to the list of unverified (yet) Android apps that claim to

[Ted C, 2017/03/03 17:44:45]

nit of nits, I would put the (yet) before unverified

[please use gerrit instead, 2017/03/09 18:05:32]

Done.

+         * handle these methods. Example payment method names in this data structure:
+         * "https://bobpay.com", "https://android.com/pay". Basic card is excluded.
+         */
+        private final Map<URI, Set<ResolveInfo>> mPendingApps;
+
+        /** A map of Android package name to the payment app. */
+        private final Map<String, AndroidPaymentApp> mResult;
+
+        private final Set<URI> mPaymentMethods;
+
+        private PaymentManifestParser mParser;
+
+        /**
+         * Builds a native Android payment app finder.
+         *
+         * @param webContents The web contents that invoked the web payments API.
+         * @param methods     The list of payment methods requested by the merchant. For example,
+         *                    "https://bobpay.com", "https://android.com/pay", "basic-card".
+         * @param callback    The asynchronous callback to be invoked (on the UI thread) when all
+         *                    Android payment apps have been found.
+         */
+        public PaymentAppFinder(
+                WebContents webContents, Set<String> methods, PaymentAppCreatedCallback callback) {
+            mWebContents = webContents;
+            mCallback = callback;
+            mQueryBasicCard = methods.contains(BASIC_CARD_PAYMENT_METHOD);
+            mPendingApps = new HashMap<>();
+            mResult = new HashMap<>();
+
+            mPaymentMethods = new HashSet<>();
+            for (String method : methods) {
+                assert method != null;
+                if (method.startsWith(UrlConstants.HTTPS_URL_PREFIX)) {

[Ted C, 2017/03/03 17:44:45]

I would do

if (!method.startsWith...) continue;

Then reduce intent.

[please use gerrit instead, 2017/03/09 18:05:33]

Done.

+                    URI uri;
+                    try {
+                        // Don't use java.net.URL, because it performs a synchronous DNS lookup in
+                        // the constructor.
+                        uri = new URI(method);
+                    } catch (URISyntaxException e) {
+                        continue;
+                    }
+                    if (uri.isAbsolute() && UrlConstants.HTTPS_SCHEME.equals(uri.getScheme())) {
+                        mPaymentMethods.add(uri);
+                    }
+                }
+            }
+        }
+
+        /** Looks for native Android payment apps. */
+        public void find() {
+            PackageManager pm = ContextUtils.getApplicationContext().getPackageManager();
+            Intent payIntent = new Intent();
+            payIntent.setAction(AndroidPaymentApp.ACTION_PAY);
+
+            List<PaymentManifestVerifier> verifiers = new ArrayList<>();
+            for (URI methodName : mPaymentMethods) {
+                payIntent.setData(Uri.parse(methodName.toString()));
+                List<ResolveInfo> apps = pm.queryIntentActivities(payIntent, 0);

[Ted C, 2017/03/03 17:44:45]

you might need a strictmode exemption for this (crbug.com/613977), see
ExternalNavigationDelegateImpl#queryIntentActivities

[please use gerrit instead, 2017/03/09 18:05:32]

Moved to async task.

[please use gerrit instead, 2017/03/09 18:13:15]

Eh, I did not, actually. Going to add an exemption in patch 12.

+                if (apps.isEmpty()) continue;
+
+                if (mParser == null) {
+                    mParser = new PaymentManifestParser();
+                    mParser.startUtilityProcess();

[Ted C, 2017/03/03 17:44:45]

might be covered later, but do you do anything to handle when the utility
process is killed?  I suspect it has the likelihood to be killed like a
background renderer, but I'm not sure.

Just want to make sure this won't hang in that case or anything.

[please use gerrit instead, 2017/03/09 18:05:32]

Yep, dead parser process causes all consequent requests to parse data to invoke
the onParseFailure() callback, which is properly handled in the
PaymentManifestVerifier.

+                }
+
+                verifiers.add(
+                        new PaymentManifestVerifier(mWebContents, methodName, apps, mParser, this));
+                mPendingApps.put(methodName, new HashSet<>(apps));
+                if (verifiers.size() == MAX_NUMBER_OF_MANIFESTS) break;

[Ted C, 2017/03/03 17:44:45]

maybe log something here that we've exceeded our max allowed.

[please use gerrit instead, 2017/03/09 18:05:33]

Done.

+            }
+
+            if (mQueryBasicCard) {
                 payIntent.setAction(ACTION_PAY_BASIC_CARD);
                 payIntent.setData(null);
-            } else {
-                continue;
-            }
-
-            List<ResolveInfo> matches = pm.queryIntentActivities(payIntent, 0);
-            for (int i = 0; i < matches.size(); i++) {
-                ResolveInfo match = matches.get(i);
-                String packageName = match.activityInfo.packageName;
-                // Do not recommend disabled apps.
-                if (!PaymentPreferencesUtil.isAndroidPaymentAppEnabled(packageName)) continue;
-                AndroidPaymentApp installedApp = installedApps.get(packageName);
-                if (installedApp == null) {
-                    CharSequence label = match.loadLabel(pm);
-                    installedApp =
-                            new AndroidPaymentApp(webContents, packageName, match.activityInfo.name,
-                                    label == null ? "" : label.toString(), match.loadIcon(pm));
-                    callback.onPaymentAppCreated(installedApp);
-                    installedApps.put(packageName, installedApp);
+                List<ResolveInfo> apps = pm.queryIntentActivities(payIntent, 0);
+                for (int i = 0; i < apps.size(); i++) {
+                    onValidPaymentApp(BASIC_CARD_PAYMENT_METHOD, apps.get(i));
                 }
-                installedApp.addMethodName(methodName);
-            }
-        }
-
-        List<ResolveInfo> matches = pm.queryIntentServices(new Intent(ACTION_IS_READY_TO_PAY), 0);
-        for (int i = 0; i < matches.size(); i++) {
-            ResolveInfo match = matches.get(i);
-            String packageName = match.serviceInfo.packageName;
-            AndroidPaymentApp installedApp = installedApps.get(packageName);
-            if (installedApp != null) installedApp.setIsReadyToPayAction(match.serviceInfo.name);
-        }
-
-        callback.onAllPaymentAppsCreated();
+            }
+
+            if (verifiers.isEmpty()) {
+                onSearchFinished();
+                return;
+            }
+
+            for (int i = 0; i < verifiers.size(); i++) {
+                verifiers.get(i).verify();
+            }
+        }
+
+        @Override
+        public void onValidPaymentApp(URI methodName, ResolveInfo resolveInfo) {
+            onValidPaymentApp(methodName.toString(), resolveInfo);
+            removePendingApp(methodName, resolveInfo);
+        }
+
+        /** Same as above, but also works for non-URI method names, e.g., "basic-card". */
+        private void onValidPaymentApp(String methodName, ResolveInfo resolveInfo) {
+            PackageManager pm = ContextUtils.getApplicationContext().getPackageManager();
+            String packageName = resolveInfo.activityInfo.packageName;
+            AndroidPaymentApp app = mResult.get(packageName);
+            if (app == null) {
+                CharSequence label = resolveInfo.loadLabel(pm);

[Ted C, 2017/03/03 17:44:45]

any reason we don't force people to have a valid label?

[please use gerrit instead, 2017/03/09 18:05:32]

Forcing now.

+                app = new AndroidPaymentApp(mWebContents, packageName,
+                        resolveInfo.activityInfo.name, label == null ? "" : label.toString(),
+                        resolveInfo.loadIcon(pm));
+                mResult.put(packageName, app);
+            }
+            app.addMethodName(methodName);
+        }
+
+        @Override
+        public void onInvalidPaymentApp(URI methodName, ResolveInfo resolveInfo) {
+            removePendingApp(methodName, resolveInfo);
+        }
+
+        /** Removes the (method, app) pair from the list of pending information to be verified. */
+        private void removePendingApp(URI methodName, ResolveInfo resolveInfo) {
+            Set<ResolveInfo> pendingAppsForMethod = mPendingApps.get(methodName);
+            pendingAppsForMethod.remove(resolveInfo);
+            if (pendingAppsForMethod.isEmpty()) mPendingApps.remove(methodName);
+            if (mPendingApps.isEmpty()) onSearchFinished();
+        }
+
+        @Override
+        public void onInvalidManifest(URI methodName) {
+            mPendingApps.remove(methodName);
+            if (mPendingApps.isEmpty()) onSearchFinished();
+        }
+
+        /**
+         * Checks for IS_READY_TO_PAY service in each valid payment app and returns the valid apps
+         * to the caller. Called when finished verifying all payment methods and apps.
+         */
+        private void onSearchFinished() {
+            if (mParser != null) {
+                mParser.stopUtilityProcess();
+                mParser = null;
+            }
+

[Ted C, 2017/03/03 17:44:45]

for extra precaution, i'd add assert mPendingApps.isEmpty() here.

[please use gerrit instead, 2017/03/09 18:05:32]

Done.

+            PackageManager pm = ContextUtils.getApplicationContext().getPackageManager();
+            List<ResolveInfo> resolveInfos =
+                    pm.queryIntentServices(new Intent(ACTION_IS_READY_TO_PAY), 0);
+            for (int i = 0; i < resolveInfos.size(); i++) {
+                ResolveInfo resolveInfo = resolveInfos.get(i);
+                AndroidPaymentApp app = mResult.get(resolveInfo.serviceInfo.packageName);
+                if (app != null) app.setIsReadyToPayAction(resolveInfo.serviceInfo.name);
+            }
+
+            for (Map.Entry<String, AndroidPaymentApp> entry : mResult.entrySet()) {
+                mCallback.onPaymentAppCreated(entry.getValue());
+            }
+
+            mCallback.onAllPaymentAppsCreated();
+        }
     }
 
     /**
      * Checks whether there are Android payment apps on device.
      *
      * @return True if there are Android payment apps on device.
      */
     public static boolean hasAndroidPaymentApps() {
         PackageManager pm = ContextUtils.getApplicationContext().getPackageManager();
         // Note that all Android payment apps must support org.chromium.intent.action.PAY action
@@ skipping 18 matching lines @@
 
         for (ResolveInfo match : matches) {
             Pair<String, Drawable> appInfo =
                     new Pair<>(match.loadLabel(pm).toString(), match.loadIcon(pm));
             paymentAppsInfo.put(match.activityInfo.packageName, appInfo);
         }
 
         return paymentAppsInfo;
     }
 }