[Web Install] Error types

[amandabaker]

We once had had a detailed list of error types which was later pruned down to a single AbortError to represent all failure types whether they were related to the user aborting an action or not. Although this may be beneficial for privacy, it poses usability issues as the developer can't tell the difference between bad inputs, user action/cancellation, and misc other technical mishaps. Instead, here is a proposed list of minimal errors that balance usability and privacy:

DOMExceptions:

• InvalidStateError:
  • When used outside of the main frame
• NotAllowedError:
  • When used without user activation
  • Invalid inputs (e.g. install url isn't a valid url)
• AbortError
  • User aborts installation when prompted
  • Browser aborts installation due to privacy settings

Custom rejection messages:

• ManifestIdMismatch: when the provided id param doesn't match the app's id
• NoIdInManifest: For same-origin only. When the app's manifest does not declare a valid id

[dmurph]

Circling back from discussion before break - we want to be careful with these error messages & make sure that they don't enable malicious behavior. I'm expecting that this will be discussed in the explainer.

[diekus]

Minimizing the number of errors implies we need to group them into categories that make it harder for a possible bad actor to accurately identify why an app installation didn't go through. I believe we can cover all errors, including the ones listed in this issue with DataError and AbortError.

From the cases specified in the issue, I'd suggest:

• When user is outside of the main frame: AbortError
• Used without user activation: AbortError
• Invalid inputs (e.g. install url not valid) : DataError

[diekus]

Explainer update to reflect this, view #961

[amandabaker]

@diekus I don't think AbortError is appropriate for main frame and user activation. These are the patterns I see for other APIs:

• Used outside main frame: InvalidStateError:
  • This seems to be the error type used for that case: https://source.chromium.org/search?q=outermostmainframe%20DOMExceptionCode::kInvalidStateError&sq=&ss=chromium
• Used without user activation: NotAllowedError/InvalidStateError:
  • I see cases of both of these being used alongside user activation checks, so I'm not sure which is the best error type to use.
  • NotAllowedError: https://source.chromium.org/search?q=activation%20DOMExceptionCode::kNotAllowedError&ss=chromium
  • InvalidStateError: https://source.chromium.org/search?q=activation%20DOMExceptionCode::kInvalidStateError&sq=&ss=chromium