rebase

npm1 · npm1 · commit a7e631d74c86 · 2025-01-13T16:59:45.000-05:00
diff --git a/spec/index.bs b/spec/index.bs
@@ -832,6 +832,15 @@ the exception thrown.
                 |providerMap|[|providerOrigin|] to "mismatch" and [=continue=].
         1. Assert: |accountsList| is not failure and the size of |accountsList| is not 0.
         1. [=Set the login status=] for |providerOrigin| to [=logged-in=].
+        1. For each |acc| in |accountsList|:
+            1. If |acc|["{{IdentityProviderAccount/picture}}"] is present, [=fetch the account picture=]
+                with |acc| and |globalObject|. If the [=user agent=] displays this picture to
+                the user at any point, it MUST reuse the result of this fetch instead of redownloading
+                the picture.
+
+            Note: We require downloading the pictures here before we potentially filter the account
+                list so that the identity provider cannot determine what hints were provided
+                based on which fetches occurred.
         1. If |provider|'s {{IdentityProviderRequestOptions/loginHint}} is not empty:
             1. For every |account| in |accountList|, remove |account| from |accountList| if |account|'s
                 {{IdentityProviderAccount/login_hints}} does not [=list/contain=] |provider|'s
@@ -853,13 +862,6 @@ the exception thrown.
     1. Let |selectedAccount| be null.
     1. For each (|providerOrigin|, |value|) in |providerMap|:
         1. If |value| is not a [=list=] |accountsList|, [=continue=].
-        1. For each |acc| in |accountsList|:
-            1. If |acc|["{{IdentityProviderAccount/picture}}"] is present, [=fetch the account picture=]
-                with |acc| and |globalObject|.
-
-            Note: The [=user agent=] may choose to show UI which does not initially require fetching the
-            account pictures. In these cases, the [=user agent=] may delay these fetches until they are
-            needed. Because errors from these fetches are ignored, they can happen in any order.
         1. For each |acc| in |accountsList|:
             1. If |acc| is [=eligible for auto reauthentication=] given the relevant |provider|, and
                 |globalObject|, set |registeredAccount| to |acc|, increase |numRegisteredAccounts| by 1,
@@ -873,7 +875,7 @@ the exception thrown.
         1. Set |isAutoSelected| to true.
     1. Otherwise, if |mediation| is "{{CredentialMediationRequirement/silent}}" and |providerMap|'s
         [=map/values=] do not [=map/contain=] "mismatch", return (failure, true).
-    1. Let |permission|, |disclosureTextShown|, and |isAutoSelected| be set to false.
+    1. Let |permission|, |permissionRequested|, and |isAutoSelected| be set to false.
     1. Build UI by adding the following for each (|providerOrigin|, |value|) in |providerMap|:
         1. If |value| is "logged-out", the user agent adds one of the following:
             * Nothing: no UI is shown regarding this [=IDP=].
@@ -902,7 +904,7 @@ the exception thrown.
             1. Wait until one of the following occurs:
 
                 * If the user selects another option, do nothing.
-                
+
                 * If the user closes the dialog, return (failure, true).
 
                 * If the [=show an IDP login dialog=] algorithm was triggered:
@@ -911,79 +913,45 @@ the exception thrown.
                     1. If |result| is failure, return (failure, true). The user
                         agent MAY show a dialog to the user before or after
                         returning failure indicating this failure.
-                    1. Otherwise, go back to the [=fetch accounts step=].
-
-    1. Assert: |accountsList| is not failure and the size of |accountsList| is not 0.
-    1. [=Set the login status=] for the [=/origin=] of the
-        {{IdentityProviderConfig/configURL}} to [=logged-in=].
-    1. For each |acc| in |accountsList|:
-        1. If |acc|["{{IdentityProviderAccount/picture}}"] is present, [=fetch the account picture=]
-            with |acc| and |globalObject|. If the [=user agent=] displays this picture to
-            the user at any point, it MUST reuse the result of this fetch instead of redownloading
-            the picture.
-
-        Note: We require downloading the pictures here before we potentially filter the account
-            list so that the identity provider cannot determine what hints were provided
-            based on which fetches occurred.
-    1. If |provider|'s {{IdentityProviderRequestOptions/loginHint}} is not empty:
-        1. For every |account| in |accountList|, remove |account| from |accountList| if |account|'s
-            {{IdentityProviderAccount/login_hints}} does not [=list/contain=] |provider|'s
-            {{IdentityProviderRequestOptions/loginHint}}.
-        1. If |accountList| is now empty, go to the [=mismatch dialog step=].
-    1. If |provider|'s {{IdentityProviderRequestOptions/domainHint}} is not empty:
-        1. For every |account| in |accountList|:
-            1. If {{IdentityProviderRequestOptions/domainHint}} is "any":
-                1. If |account|'s {{IdentityProviderAccount/domain_hints}} is empty, remove
-                    |account| from |accountList|.
-            1. Otherwise, remove |account| from |accountList| if |account|'s
-                {{IdentityProviderAccount/domain_hints}} does not [=list/contain=] |provider|'s
-                {{IdentityProviderRequestOptions/domainHint}}.
-        1. If |accountList| is now empty, go to the [=mismatch dialog step=].
-    1. Let |registeredAccount|, |numRegisteredAccounts| be null and 0, respectively.
-    1. Let |account| be null.
-    1. For each |acc| in |accountsList|:
-        1. If |acc| is [=eligible for auto reauthentication=] given |provider|, and |globalObject|,
-            set |registeredAccount| to |acc| and increase |numRegisteredAccounts| by 1.
-    1. Let |permission|, |permissionRequested|, and |isAutoSelected| be set to false.
-    1. If |mediation| is not "{{CredentialMediationRequirement/required}}", |requiresUserMediation|
-        is false, and |numRegisteredAccounts| is equal to 1:
-        1. Set |account| to |registeredAccount| and |permission| to true. When doing this, the user
-            agent MAY show some UI to the user indicating that they are being
-            [=auto-reauthenticated=].
-        1. Set |isAutoSelected| to true.
-    1. Otherwise, if |mediation| is "{{CredentialMediationRequirement/silent}}", return (failure, true).
-    1. Otherwise, if |accountsList|'s size is 1:
-        1. Set |account| to |accountsList|[0].
-        1. If [=compute the connection status=] of |account|, |provider|, and |globalObject| returns
-            [=compute the connection status/connected=], show a dialog to request user permission to sign
-            in via |account|, and set the result in |permission|. The user agent MAY use |options|'s
-            {{IdentityCredentialRequestOptions/context}} and |options|'s
-            {{IdentityCredentialRequestOptions/mode}} to customize the dialog.
-        1. Otherwise, let |permission| be the result of running [=request permission to sign-up=]
-            algorithm with |account|, |config|, |provider|, and |globalObject|. Also set
-            |permissionRequested| to true if the user agent [=supports showing a permission prompt=].
-    1. Otherwise:
-        1. Set |account| to the result of running the [=select an account=] from the
-            |accountsList|.
-        1. If |account| is failure, return (failure, true).
-        1. If [=compute the connection status=] of |account|, |provider| and |globalObject| is
-            [=compute the connection status/connected=], set |permission| to true.
-        1. Otherwise, if |provider|.{{IdentityProviderRequestOptions/fields}} is [=list/empty=],
-            [=create a connection between the RP and the IdP account=] with |provider|, |account|,
-            and |globalObject|, and set |permission| to true.
-
-            Note: The connection would normally be created in the [=request permission to sign-up=]
-                algorithm, but we do not want to show an extra dialog in this case.
-        1. Otherwise:
-            1. Let |permission| be the result of running the [=request permission to sign-up=]
-                algorithm with |account|, |config|, |provider|, and |globalObject|.
-            1. Set |permissionRequested| to true.
+                    1. Otherwise, go back to the [=fetch accounts step=] to get an updated
+                        value of |providerMap| for this [=IDP=].
+        1. Otherwise, |value| is a [=list=] of accounts. All accounts are aggregated into a single
+            |accountsList| and these are then presented to the user as follows:
+            1. If |accountsList|'s size is 1:
+                1. Set |selectedAccount| to |accountsList|[0].
+                1. If [=compute the connection status=] of |selectedAccount|, the relevant |provider|,
+                    and |globalObject| returns [=compute the connection status/connected=], show a
+                    dialog to request user permission to sign in via |selectedAccount|, and set the
+                    result in |permission|. The user agent MAY use |options|'s
+                    {{IdentityCredentialRequestOptions/context}} and |options|'s
+                    {{IdentityCredentialRequestOptions/mode}} to customize the dialog.
+                1. Otherwise, let |permission| be the result of running [=request permission to sign-up=]
+                    algorithm with |selectedAccount|, the relevant |config|, the relevant |provider|,
+                    and |globalObject|. Also set |permissionRequested| to true if the user agent
+                    [=supports showing a permission prompt=].
+            1. Otherwise:
+                1. Set |selectedAccount| to the result of running the [=select an account=] from the
+                    |accountsList|.
+                1. If |selectedAccount| is failure, return (failure, true).
+                1. If [=compute the connection status=] of |selectedAccount|, the relevant |provider|,
+                    and |globalObject| is [=compute the connection status/connected=], set |permission|
+                    to true.
+                1. Otherwise, if |provider|.{{IdentityProviderRequestOptions/fields}} is [=list/empty=],
+                    [=create a connection between the RP and the IdP account=] with |provider|, |account|,
+                    and |globalObject|, and set |permission| to true.
+                    Note: The connection would normally be created in the [=request permission to sign-up=]
+                        algorithm, but we do not want to show an extra dialog in this case.
+                1. Otherwise:
+                    1. Let |permission| be the result of running the [=request permission to sign-up=]
+                        algorithm with |selectedAccount|, the relevant |config|, the relevant |provider|,
+                        and |globalObject|.
+                    1. Set |permissionRequested| to true.
     1. Wait until the [=user agent=]'s dialogs requesting for user choice or permission to be
         closed, if any are created in the previous steps.
     1. Assert: |selectedAccount| is not null.
     1. If |permission| is false, then return (failure, true).
     1. Let |credential| be the result of running the [=fetch an identity assertion=] algorithm with
-        |selectedAccount|'s {{IdentityProviderAccount/id}}, |disclosureTextShown|, |isAutoSelected|,
+        |selectedAccount|'s {{IdentityProviderAccount/id}}, |permissionRequested|, |isAutoSelected|,
         |provider|, |config|, and |globalObject|.
     1. Return |credential|.
 </div>
@@ -2607,11 +2575,11 @@ The [=remote end steps=] are:
 1. Return [=success=] with data `null`.
 
 <!-- ============================================================ -->
-# Security Considerations # {#security-considerations}
+# Security Considerations # {#security}
 <!-- ============================================================ -->
 
 This section provides a few of the security considerations for the FedCM API. Note that there is a
-separate section for [[#privacy-considerations]].
+separate section for [[#privacy]].
 
 <!-- ============================================================ -->
 ## Content Security Policy ## {#content-security-policy}
@@ -2680,7 +2648,7 @@ the top-level frame wants it so. A sneaky iframe cannot force the FedCM UI to oc
 content from the main page.
 
 <!-- ============================================================ -->
-# Privacy Considerations # {#privacy-considerations}
+# Privacy Considerations # {#privacy}
 <!-- ============================================================ -->
 
 This section is intended to provide a comprehensive overview of the privacy risks associated with
