[PING] Only allow triggering authentication from a foreground tab

[stephenmcgruer]

During today's PING discussion and review of the changes to SPC, the PING raised a concern that removing the user activation requirement could lead to sites triggering SPC from a background tab. This could confuse users, especially as technically the spec doesn't require a tab-modal dialog (Chrome just implements SPC as a tab-modal UI, which I think any reasonable browser would, but it isn't enforced).

PING has asked that we add a normative step that SPC authentication should fail if the current tab is not foreground.

[stephenmcgruer]

I think this makes sense, a few thoughts:

1. Is this already spec'd in Payment Request somewhere? I couldn't find it at a quick glance (just a check for an active document, which is not the same thing)
2. This should probably be spec'd in Payment Request rather than here, I think. It seems applicable in general to Payment Request, and I think for Chrome we actually already check for not background tab and reject a Payment Request in that case.

[stephenmcgruer]

Jeffrey linked me to https://html.spec.whatwg.org/multipage/interaction.html#page-visibility as the concept we probably want to work from

[ianbjacobs]

The show() method [1] algorithm includes this:

If document is not [fully active](https://html.spec.whatwg.org/multipage/document-sequences.html#fully-active), then return [a promise rejected with](https://webidl.spec.whatwg.org/#a-promise-rejected-with) an "[AbortError](https://webidl.spec.whatwg.org/#aborterror)" [DOMException](https://webidl.spec.whatwg.org/#idl-DOMException).

It does not sound like that suffices (no mention of page-visibility).

[1] https://w3c.github.io/payment-request/#show-method

[ianbjacobs]

@samuelweiler, we've updated the specification based on the PING review. If satisfied, please do the relevant label management. :) Thank you!