agilebits / onepassword-app-extension

1Password Extension for iOS Apps
2.58k stars 312 forks source link

Add callback feature for password change confirmation in 1 password before change 1password data. #331

Closed acandelaria1 closed 8 years ago

acandelaria1 commented 8 years ago

So I am having an issue where the password and 1password data become out of sync because of issues with password update. For example we only allow password changes once every hour so if the password has already been changed within the hour and the user attempts to change the password again then the password will become out of sync. It will be updated in the 1password app but the user will then get a notification that the password was not successfully changed. Is there anyway to revert the password back to the old information without presenting the modal 1password view or to have one password wait for a success or error callback from the application before changing the 1password data.

radazzouz commented 8 years ago

Hi @acandelaria1,

Thanks so much for taking the time to write in and for starting such an Awesome debate! :+1:

I will address your questions and concerns in order:

For example we only allow password changes once every hour so if the password has already been changed within the hour and the user attempts to change the password again then the password will become out of sync.

You can choose to hide or to disable the 1Password button from within your app if the user already changed the password in the last 60 minutes. The implementation should look like this:

self.onepasswordButton.hidden = !self.canChangePassword()

Or, you can show the 1Password button and show an alert if when user tries to change the password in less than an hour.

@IBAction func changePasswordIn1Password(sender:AnyObject) -> Void {
    if self.canChangePassword() {
        OnePasswordExtension.sharedExtension().changePasswordForLoginForURLString("https://www.mysite.com", loginDetails: newLoginDetails, passwordGenerationOptions: passwordGenerationOptions, forViewController: self, sender: sender) { (loginDictionary, error) -> Void in
            // Change the password
        }
    }
    else {
        // Show an alert with the remaining time until the user can change the password.
        }
    }
}

It will be updated in the 1password app but the user will then get a notification that the password was not successfully changed.

The are no APIs in 1Password and its App Extension that currently allow third party developer to prevent password changes. Even if you implement my suggestions from above, which will prevent the user to change the password from within your app using the 1Password extension, the user can still open 1Password (the main app) and change the password there. We simply can't offer such an API.

Is there anyway to revert the password back to the old information without presenting the modal 1password view or to have one password wait for a success or error callback from the application before changing the 1password data.

The short answer is no. And here it is why: The 1Password App Extension API is build upon the Apple Extensibility APIs which are not designed to have a "session"-like method of communication between the host app (your app) and the 1Password extension. In other words, we can't establish a bidirectional way of communicating between the 1Password extension and a host app. Here's how it actually works:

  1. The user calls the 1Password extension from within your app.
  2. The 1Password extension shows up with the payload that you sent us via changePasswordForURLString:
  3. The user will change the password in the extension and will send it back to your app alongside the old password when they save the changes.

For more information about how the 1Password extension and its API work, please take a look at the Apple Extensibility APIs documentation.

I am closing this issue as won't do, hoping that the explanations help.

If you have any other questions, please do not hesitate to ask.

Cheers!

acandelaria1 commented 8 years ago

Thank you for the great response!

Sincerely, Alexis Candelaria

On Tue, Jun 21, 2016 at 10:47 AM, Rad Azzouz notifications@github.com wrote:

Hi @acandelaria1 https://github.com/acandelaria1,

Thanks so much for taking the time to write in and for starting such an Awesome debate! πŸ‘

I will address your questions and concerns in order:

For example we only allow password changes once every hour so if the password has already been changed within the hour and the user attempts to change the password again then the password will become out of sync.

You can choose to hide or to disable the 1Password button from within your app if the user already changed the password in the last 60 minutes. The implementation should look like this:

self.onepasswordButton.hidden = !self.canChangePassword()

Or, you can show the 1Password button and show an alert if when user tries to change the password in less than an hour.

@IBAction func changePasswordIn1Password(sender:AnyObject) -> Void { if self.canChangePassword() { OnePasswordExtension.sharedExtension().changePasswordForLoginForURLString("https://www.mysite.com", loginDetails: newLoginDetails, passwordGenerationOptions: passwordGenerationOptions, forViewController: self, sender: sender) { (loginDictionary, error) -> Void in // Change the password } } else { // Show an alert with the remaining time until the user can change the password. } } }

It will be updated in the 1password app but the user will then get a notification that the password was not successfully changed.

The are no APIs in 1Password and its App Extension that currently allow third party developer to prevent password changes. Even if you implement my suggestions from above, which will prevent the user to change the password from within your app using the 1Password extension, the user can still open 1Password (the main app) and change the password there. We simply can't offer such an API.

Is there anyway to revert the password back to the old information without presenting the modal 1password view or to have one password wait for a success or error callback from the application before changing the 1password data.

The short answer is no. And here it is why: The 1Password App Extension API is build upon the Apple Extensibility APIs which are not designed to have a "session"-like method of communication between the host app (your app) and the 1Password extension. In other words, we can't establish a bidirectional way of communicating between the 1Password extension and a host app. Here's how it actually works:

  1. The user calls the 1Password extension from within your app.
  2. The 1Password extension shows up with the payload that you sent us via changePasswordForURLString:
  3. The user will change the password in the extension and will send it back to your app alongside the old password when they save the changes.

For more information about how the 1Password extension and its API work, please take a look at the Apple Extensibility APIs documentation https://developer.apple.com/library/ios/documentation/General/Conceptual/ExtensibilityPG/index.html .

I am closing this issue as won't do, hoping that the explanations help.

If you have any other questions, please do not hesitate to ask.

Cheers!

β€” You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/AgileBits/onepassword-app-extension/issues/331#issuecomment-227517450, or mute the thread https://github.com/notifications/unsubscribe/AEIP54MyUKGvAC8uQFsz5K9vkzSrDxUVks5qOCOrgaJpZM4I69zo .

radazzouz commented 8 years ago

Thank you Alexis, for asking such a great question in the first place! I am really glad that I could help. ☺️

If there's anything else that I can assist with, please do let me know!

Best,

acandelaria1 commented 8 years ago

One last question along similar lines. Best way to manage changing of email and keeping in sync? On Jun 21, 2016 12:07 PM, "Rad Azzouz" notifications@github.com wrote:

Thank _you_Alexis for asking such a great question in the first place! I am really glad that I could help. ☺️

If there's anything else that I can assist with, please do let me know!

Best,

β€” You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub https://github.com/AgileBits/onepassword-app-extension/issues/331#issuecomment-227540174, or mute the thread https://github.com/notifications/unsubscribe/AEIP57oI57KlwO8okjRw8-M-C_MpIxGXks5qODZugaJpZM4I69zo .

radazzouz commented 8 years ago

What a nice followup question, @acandelaria1! πŸ‘

The answer is that we no longer have an API to changing the email (or username field to be exact). User used to have it in changePasswordForURLString:, but it ended up being a mess (due to the lack of standards when it comes to username changes), so we removed it.

Please make sure take a look at issue #173, especially at this comment.

Hope that this helps.