Skip to content

Add [[implicitMediation]] internal slot to Credential #297

Description

@marcoscaceres

Problem

The Credential Management spec's "Request a Credential" algorithm (step 9) rejects with TypeError when mediation: "conditional" is passed to a credential type that doesn't support conditional mediation:

For each interface of interfaces:
If options.mediation is "conditional" and interface does not support "conditional" user mediation, return a promise rejected with a TypeError.

However, the Digital Credentials spec says:

To simplify the developer experience of get() calls involving a DigitalCredential, user agents MUST NOT throw an error if the mediation member is absent or has a value other than "required".

These contradict each other. The Cred Man algorithm fires before DC's [[DiscoverFromExternalSource]] is ever invoked, so DC cannot override the behavior. DC's "MUST NOT throw" instruction is unreachable.

WebKit's implementation simply ignores the mediation value for digital credentials (no TypeError, no check). This matches DC's intent but not Cred Man's algorithm.

Proposal

Add a new internal slot to Credential:

[[implicitMediation]]
  The Credential interface object has an internal slot named [[implicitMediation]],
  which specifies the CredentialMediationRequirement that is always enforced for this
  credential type, regardless of what the developer passes. Its value is null unless
  otherwise specified by a subtype.

Then modify step 9 of "Request a Credential" to skip the conditional/immediate checks for credential types with [[implicitMediation]] set:

For each interface of interfaces:
  If interface's [[implicitMediation]] is not null, continue.
  If options.mediation is "conditional" and interface does not support
  "conditional" user mediation, return a promise rejected with a TypeError.
  ...

Benefits

  • Resolves the contradiction between Cred Man and DC specs
  • Credential types can declare "I always use X mediation" at the type level
  • Cred Man itself respects the declaration (no spec fiction needed in downstream specs)
  • Extensible: other future credential types with similar semantics can use the same slot
  • Aligns with WebKit's existing implementation behavior

Related

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions