diff --git a/index.html b/index.html index 3c96521..5a5b3f0 100644 --- a/index.html +++ b/index.html @@ -1424,7 +1424,7 @@

Credential Management Level 1

-

Editor’s Draft,

+

Editor’s Draft,

This version: @@ -1530,7 +1530,7 @@

Table of Contents

  • 3.3 Algorithms
      -
    1. 3.3.1 PasswordCredential's [[CollectFromCredentialStore]](options) +
    2. 3.3.1 PasswordCredential's [[CollectFromCredentialStore]](origin, options)
    3. 3.3.2 PasswordCredential's [[Create]](options)
    4. 3.3.3 PasswordCredential's [[Store]](credential)
    5. 3.3.4 Create a PasswordCredential from an HTMLFormElement @@ -1549,7 +1549,7 @@

      Table of Contents

    6. 4.2 Algorithms
        -
      1. 4.2.1 FederatedCredential's [[CollectFromCredentialStore]](options) +
      2. 4.2.1 FederatedCredential's [[CollectFromCredentialStore]](origin, options)
      3. 4.2.2 FederatedCredential's [[Create]](options)
      4. 4.2.3 FederatedCredential's [[Store]](credential)
      5. 4.2.4 Create a FederatedCredential from FederatedCredentialInit @@ -1762,8 +1762,9 @@

        2.2.1. Credential Internal Methods

        Each interface object created for interfaces which inherit from Credential defines several internal methods that allow retrieval and storage of Credential objects:

        - [[CollectFromCredentialStore]](options) is called - with a CredentialRequestOptions, and returns a set of Credential objects from the user + [[CollectFromCredentialStore]](origin, options) is called + with an origin and a CredentialRequestOptions, and returns + a set of Credential objects from the user agent’s credential store that match the options provided. If no matching Credential objects are available, the returned set will be empty.
            @@ -1773,8 +1774,9 @@

        - [[DiscoverFromExternalSource]](options) is called - with a CredentialRequestOptions object. It returns a Credential if one can be + [[DiscoverFromExternalSource]](origin, options) is called + with an origin and a CredentialRequestOptions object. + It returns a Credential if one can be returned given the options provided, null if no credential is available, or an error if discovery fails (for example, incorrect options could produce a TypeError). If this kind of Credential is only effective for a single use or a limited time, this @@ -2141,11 +2143,13 @@

      6. Let p be a new promise.

        +
      7. +

        Let origin be the current settings object's origin.

      8. Run the following steps in parallel:

        1. -

          Let credentials be the result of collecting Credentials from the credential store, given options.

          +

          Let credentials be the result of collecting Credentials from the credential store, given origin and options.

        2. If credentials is an exception, reject p with credentials.

        3. @@ -2155,7 +2159,7 @@

          credentials’ size is 1

        4. -

          settings’ origin does not require user mediation

          +

          origin does not require user mediation

        5. options is matchable a priori.

        6. @@ -2178,7 +2182,7 @@

          Assert: choice is an interface object.

        7. -

          Let result be the result of executing choice’s [[DiscoverFromExternalSource]](options), given options.

          +

          Let result be the result of executing choice’s [[DiscoverFromExternalSource]](origin, options), given origin and options.

        8. If result is a Credential or null, resolve p with result.

          Otherwise, reject p with result.

          @@ -2187,7 +2191,8 @@

          Return p.

        2.5.2. Collect Credentials from the credential store

        -

        Given a CredentialRequestOptions (options), the user agent may collect Credentials from the credential store, +

        Given an origin (origin) and + a CredentialRequestOptions (options), the user agent may collect Credentials from the credential store, returning a set of Credential objects stored by the user agent locally that match options’ filter. If no such Credential objects are known, the returned set will be empty:

          @@ -2197,7 +2202,7 @@

          relevant credential interface objects:

          1. -

            Let r be the result of executing interface’s [[CollectFromCredentialStore]](options) internal method on options.

            +

            Let r be the result of executing interface’s [[CollectFromCredentialStore]](origin, options) internal method on origin and options.

          2. If r is an exception, return r.

          3. @@ -2524,11 +2529,12 @@

            < };

            PasswordCredential objects are origin bound.

            -

            PasswordCredential's interface object inherits Credential's implementation of [[DiscoverFromExternalSource]](options), and defines its own implementation of [[CollectFromCredentialStore]](options), [[Create]](options), and [[Store]](credential).

            +

            PasswordCredential's interface object inherits Credential's implementation of [[DiscoverFromExternalSource]](origin, options), and defines its own implementation of [[CollectFromCredentialStore]](origin, options), [[Create]](options), and [[Store]](credential).

            3.3. Algorithms

            -

            3.3.1. PasswordCredential's [[CollectFromCredentialStore]](options)

            -

            [[CollectFromCredentialStore]](options) is called - with a CredentialRequestOptions (options), and returns a set of Credential objects from +

            3.3.1. PasswordCredential's [[CollectFromCredentialStore]](origin, options)

            +

            [[CollectFromCredentialStore]](origin, options) is called + with an origin (origin) and a CredentialRequestOptions (options), + and returns a set of Credential objects from the credential store. If no matching Credential objects are available, the returned set will be empty.

              @@ -2542,7 +2548,7 @@

              The credential is a PasswordCredential

            1. -

              The credential’s [[origin]] is the same origin as the current settings object's origin.

              +

              The credential’s [[origin]] is the same origin as origin.

          3.3.2. PasswordCredential's [[Create]](options)

          @@ -2785,9 +2791,9 @@

          };

          FederatedCredential objects are origin bound.

          -

          FederatedCredential's interface object inherits Credential's implementation of [[DiscoverFromExternalSource]](options), and defines its own implementation of [[CollectFromCredentialStore]](options), [[Create]](options), and [[Store]](credential).

          +

          FederatedCredential's interface object inherits Credential's implementation of [[DiscoverFromExternalSource]](origin, options), and defines its own implementation of [[CollectFromCredentialStore]](origin, options), [[Create]](options), and [[Store]](credential).

          Note: If, in the future, we teach the user agent to obtain authentication tokens on a user’s - behalf, we could do so by building an implementation of [[DiscoverFromExternalSource]](options).

          + behalf, we could do so by building an implementation of [[DiscoverFromExternalSource]](origin, options).

          4.1.1. Identifying Providers

          Every site should use the same identifier when referring to a specific federated identity provider. For example, Facebook Login shouldn’t be referred to as "Facebook" and "Facebook Login" and "FB" and "FBL" and "Facebook.com" @@ -2799,9 +2805,10 @@

          https://accounts.google.com/ is clearly intended to be the same as https://accounts.google.com.

          4.2. Algorithms

          -

          4.2.1. FederatedCredential's [[CollectFromCredentialStore]](options)

          -

          [[CollectFromCredentialStore]](options) is called - with a CredentialRequestOptions (options), and returns a set of Credential objects from +

          4.2.1. FederatedCredential's [[CollectFromCredentialStore]](origin, options)

          +

          [[CollectFromCredentialStore]](origin, options) is called + with an origin (origin) and a CredentialRequestOptions (options), + and returns a set of Credential objects from the credential store. If no matching Credential objects are available, the returned set will be empty.

            @@ -2813,7 +2820,7 @@

            The credential is a FederatedCredential

          1. -

            The credential’s [[origin]] is the same origin as the current settings object's origin.

            +

            The credential’s [[origin]] is the same origin as origin.

          2. If options["federated"]["providers"] exists, its value contains the credentials’s provider.

          3. @@ -3119,11 +3126,12 @@

  • -

    Define appropriate [[Create]](options), [[CollectFromCredentialStore]](options), [[DiscoverFromExternalSource]](options), and [[Store]](credential) methods on ExampleCredential's interface object. [[CollectFromCredentialStore]](options) is appropriate for credentials that remain effective forever and - can therefore simply be copied out of the credential store, while [[DiscoverFromExternalSource]](options) is appropriate for credentials that need to be re-generated from a credential source.

    -
    - ExampleCredential's [[CollectFromCredentialStore]](options) internal method is called - with a CredentialRequestOptions object (options), and returns a set of Credential objects that match the options provided. If no matching Credential objects are +

    Define appropriate [[Create]](options), [[CollectFromCredentialStore]](origin, options), [[DiscoverFromExternalSource]](origin, options), and [[Store]](credential) methods on ExampleCredential's interface object. [[CollectFromCredentialStore]](origin, options) is appropriate for credentials that remain effective forever and + can therefore simply be copied out of the credential store, while [[DiscoverFromExternalSource]](origin, options) is appropriate for credentials that need to be re-generated from a credential source.

    +
    + ExampleCredential's [[CollectFromCredentialStore]](origin, options) internal method is called + with an origin (origin) and a CredentialRequestOptions + object (options), and returns a set of Credential objects that match the options provided. If no matching Credential objects are available, the returned set will be empty.
    1. @@ -3248,7 +3256,7 @@

      ask to choose, in §5.3
    2. collect Credentials from the credential store, in §2.5.2
    3. - [[CollectFromCredentialStore]](options) + [[CollectFromCredentialStore]](origin, options)
    4. CredentialUserData, in §2.2.2 -
    5. [[DiscoverFromExternalSource]](options), in §2.2.1 +
    6. [[DiscoverFromExternalSource]](origin, options), in §2.2.1
    7. [[discovery]], in §2.2
    8. effective, in §2
    9. @@ -3708,11 +3716,11 @@

      2.5.5. Prevent Silent Access (2)
    10. 3.1.1. Password-based Sign-in
    11. 3.3.1. - PasswordCredential's [[CollectFromCredentialStore]](options) (2) + PasswordCredential's [[CollectFromCredentialStore]](origin, options) (2)
    12. 3.3.3. PasswordCredential's [[Store]](credential) (2) (3)
    13. 4.2.1. - FederatedCredential's [[CollectFromCredentialStore]](options) (2) + FederatedCredential's [[CollectFromCredentialStore]](origin, options) (2)
    14. 4.2.3. FederatedCredential's [[Store]](credential) (2) (3)
    15. 5.2. Requiring User Mediation @@ -3725,9 +3733,9 @@

      #abstract-opdef-credential-store-retrieve-a-list-of-credentialsReferenced in:

    Collect `Credential`s from the credential store

    - Given a {{CredentialRequestOptions}} (|options|), the user agent may + Given an [=environment settings object/origin=] (|origin|) and + a {{CredentialRequestOptions}} (|options|), the user agent may collect `Credential`s from the credential store, returning a set of {{Credential}} objects stored by the user agent locally that match |options|' filter. If no such {{Credential}} objects are known, the returned set will be empty: @@ -751,7 +755,8 @@

    Collect `Credential`s from the creden 2. For each |interface| in |options|' relevant credential interface objects: 1. Let |r| be the result of executing |interface|'s - {{Credential/[[CollectFromCredentialStore]](options)}} internal method on |options|. + {{Credential/[[CollectFromCredentialStore]](origin, options)}} internal method on + |origin| and |options|. 2. If |r| is an [=exception=], return |r|. @@ -1133,19 +1138,20 @@

    Prevent Silent Access

    {{PasswordCredential}} objects are [=Credential/origin bound=]. {{PasswordCredential}}'s [=interface object=] inherits {{Credential}}'s implementation of - {{Credential/[[DiscoverFromExternalSource]](options)}}, and defines its own implementation of - {{PasswordCredential/[[CollectFromCredentialStore]](options)}}, + {{Credential/[[DiscoverFromExternalSource]](origin, options)}}, and defines its own implementation of + {{PasswordCredential/[[CollectFromCredentialStore]](origin, options)}}, {{PasswordCredential/[[Create]](options)}}, and {{PasswordCredential/[[Store]](credential)}}. ## Algorithms ## {#passwordcredential-algorithms}

    - `PasswordCredential`'s `[[CollectFromCredentialStore]](options)` + `PasswordCredential`'s `[[CollectFromCredentialStore]](origin, options)`

    - \[[CollectFromCredentialStore]](options) is called - with a {{CredentialRequestOptions}} (|options|), and returns a set of {{Credential}} objects from + \[[CollectFromCredentialStore]](origin, options) is called + with an [=environment settings object/origin=] (|origin|) and a {{CredentialRequestOptions}} (|options|), + and returns a set of {{Credential}} objects from the [=credential store=]. If no matching {{Credential}} objects are available, the returned set will be empty. @@ -1158,8 +1164,7 @@

    credentials from the [=credential store=] that match the following filter: 1. The credential is a {{PasswordCredential}} - 2. The credential's {{Credential/[[origin]]}} is the [=same origin=] as the - [=current settings object=]'s [=environment settings object/origin=]. + 2. The credential's {{Credential/[[origin]]}} is the [=same origin=] as |origin|.

    @@ -1437,13 +1442,13 @@

    {{FederatedCredential}} objects are [=Credential/origin bound=]. {{FederatedCredential}}'s [=interface object=] inherits {{Credential}}'s implementation of - {{Credential/[[DiscoverFromExternalSource]](options)}}, and defines its own implementation of - {{FederatedCredential/[[CollectFromCredentialStore]](options)}}, + {{Credential/[[DiscoverFromExternalSource]](origin, options)}}, and defines its own implementation of + {{FederatedCredential/[[CollectFromCredentialStore]](origin, options)}}, {{FederatedCredential/[[Create]](options)}}, and {{FederatedCredential/[[Store]](credential)}}. Note: If, in the future, we teach the user agent to obtain authentication tokens on a user's - behalf, we could do so by building an implementation of `[[DiscoverFromExternalSource]](options)`. + behalf, we could do so by building an implementation of `[[DiscoverFromExternalSource]](origin, options)`. ### Identifying Providers ### {#provider-identification} @@ -1468,11 +1473,12 @@

    ## Algorithms ## {#federatedcredential-algorithms}

    - `FederatedCredential`'s `[[CollectFromCredentialStore]](options)` + `FederatedCredential`'s `[[CollectFromCredentialStore]](origin, options)`

    - \[[CollectFromCredentialStore]](options) is called - with a {{CredentialRequestOptions}} (|options|), and returns a set of {{Credential}} objects from + \[[CollectFromCredentialStore]](origin, options) is called + with an [=environment settings object/origin=] (|origin|) and a {{CredentialRequestOptions}} (|options|), + and returns a set of {{Credential}} objects from the [=credential store=]. If no matching {{Credential}} objects are available, the returned set will be empty. @@ -1483,8 +1489,7 @@

    credentials from the [=credential store=] that match the following filter: 1. The credential is a {{FederatedCredential}} - 2. The credential's {{Credential/[[origin]]}} is the [=same origin=] as the - [=current settings object=]'s [=environment settings object/origin=]. + 2. The credential's {{Credential/[[origin]]}} is the [=same origin=] as |origin|. 3. If |options|["{{CredentialRequestOptions/federated}}"]["{{FederatedCredentialRequestOptions/providers}}"] [=map/exists=], its value [=list/contains=] the credentials's {{FederatedCredential/provider}}. 4. If |options|["{{CredentialRequestOptions/federated}}"]["{{FederatedCredentialRequestOptions/protocols}}"] @@ -1893,18 +1898,19 @@

    2. Define appropriate {{Credential/[[Create]](options)}}, - {{Credential/[[CollectFromCredentialStore]](options)}}, - {{Credential/[[DiscoverFromExternalSource]](options)}}, and + {{Credential/[[CollectFromCredentialStore]](origin, options)}}, + {{Credential/[[DiscoverFromExternalSource]](origin, options)}}, and {{Credential/[[Store]](credential)}} methods on `ExampleCredential`'s - [=interface object=]. {{Credential/[[CollectFromCredentialStore]](options)}} + [=interface object=]. {{Credential/[[CollectFromCredentialStore]](origin, options)}} is appropriate for [=credentials=] that remain [=effective=] forever and can therefore simply be copied out of the [=credential store=], while - {{Credential/[[DiscoverFromExternalSource]](options)}} is appropriate for + {{Credential/[[DiscoverFromExternalSource]](origin, options)}} is appropriate for [=credentials=] that need to be re-generated from a [=credential source=].
    - `ExampleCredential`'s `[[CollectFromCredentialStore]](options)` internal method is called - with a CredentialRequestOptions object (`options`), and returns a set of {{Credential}} + `ExampleCredential`'s `[[CollectFromCredentialStore]](origin, options)` internal method is called + with an [=environment settings object/origin=] (`origin`) and a CredentialRequestOptions + object (`options`), and returns a set of {{Credential}} objects that match the options provided. If no matching {{Credential}} objects are available, the returned set will be empty.