feat!: support manifest v3

sidvishnoi commented 3 months ago

Context

Closes https://github.com/interledger/web-monetization-extension/issues/23

Changes proposed in this pull request

Use updated manifestv3.json, and modify it as needed for Firefox/Chrome support.
As MV3 doesn't enable hosts permissions on install (automatically or manually), show an error message that permissions are required, along with a button to request permission. No other part of UI is shown until we've the permissions.
Make Webpack generate self-contained bundles. Otherwise, it uses dynamic script loading with document.createElement('script'), and document isn't defined in MV3 background service workers, which causes a fatal crash.
Clear all install-time warnings in Firefox as well as Chrome.
In MV3, production extension will only work on https:// websites. (See comment)

Questions:

[x] Should I get rid of manifest v2 stuff? I tested it works fine in Firefox 110 even.
- ~Decided to retain functionality, with a --mv2 flag during build.~
- Decided later in meeting to remove v2 stuff.
[x] Should I show the permission error/prompt on all screens?
- Decided in meeting we'll show only the error if we don't have the permissions.

raducristianpopa commented 3 months ago

Extension builds preview

Name	Link
Latest commit	ea9ee330a8f0c5c7249f0268f78c4c2ecff339f0
Latest job logs	Run #9495986026
	Download
	Download

raducristianpopa commented 3 months ago

1. Should I get rid of manifest v2 stuff? I tested it works fine in Firefox 110 even.

I would keep them for now. We can probably default to using MV3 (renaming manifestv3.json to manifest.json) and keep the old manifest for the moment.

2. Should I show the permission error/prompt on all screens?

i don't think so, since the button will be disabled and we check the permission when the user submits the form.

sidvishnoi commented 3 months ago

Should I show the permission error/prompt on all screens?

i don't think so, since the button will be disabled and we check the permission when the user submits the form.

So, content script also won't be injected if current URL isn't doesn't have the permission. We ask for the permission only on connect screen, but if some has connected before, and they update the extension, they won't see that they haven't given the permissions. Also valid in case the permission is removed later (for some reason - like mistake or browsers being more strict in future with privacy considerations, like removing permission after N days).

interledger / web-monetization-extension