[w3c/payment-handler] Proposal: Remove requestPermission() (#246)

According the permissions team (@raymeskhoury, @mgiuca) `.requestPermission()` style API is an anti-pattern and users generally do not understand permission prompts. I would like to send a pull-request for removing `.requestPermission()` and recommending browsers to show a prompt when they deem necessary. The exact amount of specification will be hashed out between the implementers. In case of Chrome, we will show a permission prompt only when the website calls `ServiceWorkerREgisgration.paymentManager.instruments.set(key, data)` for the first time, i.e., the `instruments` have never been set for this site. Chrome will require a user gesture for the first-time call to `instruments.set(key, data)`. We will also look into using site engagement, safe browsing database, and certificate validity to outright reject `instruments.set(key, data)` with `NotAllowedError` without showing any prompt at all. I would love to hear feedback from the interested parties, in particular @romandev and @marcoscaceres .

cc: @DurgaTheHutt, @gogerald, @anthonyvd

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/payment-handler/issues/246