Intent to implement: Payment Request API

[mcac...@mozilla.com]

## Summary
The Payment Request API allows web sites selling goods and services to utilize one or more payment methods through the browser. The browser then facilitates the payment flow between merchant and user.

Initial implementation is going to be limited to “basic card” payments, based on a wallet Firefox will manage… The Firefox folks will have UI mockups and further details about the wallet (and security aspects), as it's outside the scope of the Platform work (but we are working together on it as a team).

At time of writing, the interface are limited to the following methods and event handlers. However, this is subject to change as the spec is still evolving (there are also attributes, but I’ve omitted them as they mostly reflect what goes into the constructor). New methods/attributes/events will be sent with a new intent to implement:

### interface `PaymentRequest`
How a developer requests payment.

- promise show() - request show payment panel.
- promise abort() - request close payment panel, aborting the payment.
- promise canMakeActivePayment()* - not in spec, proposed by Google.
- Events (see PaymentRequestUpdateEvent):
- onshippingaddresschange
- onshippingoptionchange

For discussion around canMakeActivePayment(), please see:
https://github.com/w3c/browser-payment-api/pull/316

### interface `PaymentResponse`
The resulting response from the end-user.

- promise complete() - let’s you know when the flow is done.

### interface `PaymentRequestUpdateEvent`
- updateWith(Promise<PaymentDetails> d) - request an update be made to the payment panel with new payment details.

### interface `PaymentAddress`
A serializable object that represents a physical address in the real world… trying to get this changed to a dictionary, as it's just a bunch of DOM Strings, and an array.

### Extension to IFRAMEs
The API also extends the `HTMLIframeElement` interface by adding a new attribute:

* allowPaymentRequest - defaults to false. Similar in behavior to `.allowFullScreen`.

## Bug
https://bugzilla.mozilla.org/show_bug.cgi?id=1318984

## Link to standard
https://w3c.github.io/browser-payment-api/

## Platform coverage
Desktop first, Android later.

## Estimated or target release:
Sometime in 2017 - not sure yet.

## Preference behind which this will be implemented:
dom.payments.enabled

## DevTools bug:
https://bugzilla.mozilla.org/show_bug.cgi?id=1318994

## Do other browser engines implement this?

### Shipped
Chrome for Android release 53.
Blink-dev intent to ship:
https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/p1DYoxHlkKg
https://www.chromestatus.com/feature/5639348045217792

### Considering
According to Microsoft’s Platform Status, the feature is “in development” in Edge.
https://developer.microsoft.com/en-us/microsoft-edge/platform/status/webpaymentsapi/?q=payments

## Tests
Initial tests have been taken from Chrome’s implementation. However, these have not yet been verified by us, nor merged into the the web platform tests. We intend for those to be merged, and for us to contribute additional tests there.

https://github.com/w3c/web-platform-tests/pull/3441

Kind regards,
Marcos

[santos...@gmail.com]

[Anders Rundgren]

An external security review has been requested. Here is my take on the matter:
https://lists.w3.org/Archives/Public/public-web-security/2017Jan/0004.html

Anders