[PaymentRequest] Enable requiring user-activation for show()

This change makes the minimal changes needed to require user
activation for show(). There will need to be follow-through clean-up
work to remove code that was conditional on user-activation being
present previously.

Changes made:

- Flip blink feature PaymentRequestRequiresUserActivation to 'stable'.
- Change some web test expectations.
- Add a few comments for follow-up cleanup.

Intent to Deprecate and Remove thread:
https://groups.google.com/u/1/a/chromium.org/g/blink-dev/c/xCW746n6XJI

Bug: 825270
Change-Id: I89e6f68d74aae53619e08898d84ae8189ceb60f0
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3351294
Reviewed-by: Mustaq Ahmed <mustaq@chromium.org>
Reviewed-by: Nick Burris <nburris@chromium.org>
Reviewed-by: Mike West <mkwst@chromium.org>
Commit-Queue: Stephen McGruer <smcgruer@chromium.org>
Cr-Commit-Position: refs/heads/main@{#990992}

components/payments/content/payment_request.h

@@ -256,6 +256,8 @@ class PaymentRequest : public content::DocumentService<mojom::PaymentRequest>,
   bool has_recorded_completion_ = false;
 
   // Whether PaymentRequest.show() was invoked with a user gesture.
+  // TODO(crbug.com/825270): Remove this member now that user gesture is always
+  // required for show().
   bool is_show_user_gesture_ = false;
 
   // Whether PaymentRequest.show() was invoked by skipping payment request UI.

third_party/blink/renderer/platform/runtime_enabled_features.json5

@@ -1792,6 +1792,7 @@
     },
     {
       name: "PaymentRequestRequiresUserActivation",
+      status: "stable",
     },
     {
       name: "PaymentRetry",

third_party/blink/web_tests/external/wpt/payment-request/payment-request-show-method.https-expected.txt

@@ -1,6 +1,6 @@
 This is a testharness.js-based test.
-FAIL Calling show() without being triggered by user interaction throws promise_rejects_dom: function "function() { throw e }" threw object "UnknownError: Renderer process could not establish or lost IPC connection to the PaymentRequest service in the browser process." that is not a DOMException SecurityError: property "code" is equal to 0, expected 18
-FAIL Throws if the promise [[state]] is not 'created'. promise_rejects_dom: function "function() { throw e }" threw object "UnknownError: Renderer process could not establish or lost IPC connection to the PaymentRequest service in the browser process." that is not a DOMException SecurityError: property "code" is equal to 0, expected 18
+PASS Calling show() without being triggered by user interaction throws
+FAIL Throws if the promise [[state]] is not 'created'. promise_rejects_dom: function "function() { throw e }" threw object "InvalidStateError: Failed to execute 'show' on 'PaymentRequest': Already called show() once" that is not a DOMException SecurityError: property "code" is equal to 11, expected 18
 FAIL If the user agent's "payment request is showing" boolean is true, then return a promise rejected with an "AbortError" DOMException. promise_rejects_dom: function "function() { throw e }" threw object "UnknownError: Renderer process could not establish or lost IPC connection to the PaymentRequest service in the browser process." that is not a DOMException SecurityError: property "code" is equal to 0, expected 18
 FAIL If payment method consultation produces no supported method of payment, then return a promise rejected with a "NotSupportedError" DOMException. promise_rejects_dom: function "function() { throw e }" threw object "InvalidStateError: Failed to execute 'show' on 'PaymentRequest': Already called show() once" that is not a DOMException NotSupportedError: property "code" is equal to 11, expected 9
 FAIL Calling show() multiple times always returns a new promise. promise_test: Unhandled rejection with value: object "InvalidStateError: Failed to execute 'abort' on 'PaymentRequest': No show() or retry() in progress, so nothing to abort"

third_party/blink/web_tests/external/wpt/payment-request/show-consume-activation.https-expected.txt

@@ -1,4 +1,4 @@
 This is a testharness.js-based test.
-FAIL Calling share consumes user activation promise_rejects_dom: function "function() { throw e }" threw object "UnknownError: Renderer process could not establish or lost IPC connection to the PaymentRequest service in the browser process." that is not a DOMException SecurityError: property "code" is equal to 0, expected 18
+FAIL Calling share consumes user activation promise_rejects_dom: function "function() { throw e }" threw object "InvalidStateError: Failed to execute 'show' on 'PaymentRequest': Already called show() once" that is not a DOMException AbortError: property "code" is equal to 11, expected 20
 Harness: the test ran to completion.
 

third_party/blink/web_tests/payments/payment-request-interface-expected.txt

@@ -1,7 +1,9 @@
-CONSOLE ERROR: Uncaught (in promise) UnknownError: Renderer process could not establish or lost IPC connection to the PaymentRequest service in the browser process.
-CONSOLE ERROR: Uncaught (in promise) UnknownError: Renderer process could not establish or lost IPC connection to the PaymentRequest service in the browser process.
-CONSOLE ERROR: Uncaught (in promise) UnknownError: Renderer process could not establish or lost IPC connection to the PaymentRequest service in the browser process.
-CONSOLE ERROR: Uncaught (in promise) UnknownError: Renderer process could not establish or lost IPC connection to the PaymentRequest service in the browser process.
+CONSOLE WARNING: PaymentRequest.show() requires either transient user activation or delegated payment request capability
+CONSOLE WARNING: PaymentRequest.show() requires either transient user activation or delegated payment request capability
+CONSOLE ERROR: Uncaught (in promise) SecurityError: Failed to execute 'show' on 'PaymentRequest': PaymentRequest.show() requires either transient user activation or delegated payment request capability
+CONSOLE ERROR: Uncaught (in promise) InvalidStateError: Failed to execute 'abort' on 'PaymentRequest': No show() or retry() in progress, so nothing to abort
+CONSOLE ERROR: Uncaught (in promise) SecurityError: Failed to execute 'show' on 'PaymentRequest': PaymentRequest.show() requires either transient user activation or delegated payment request capability
+CONSOLE ERROR: Uncaught (in promise) InvalidStateError: Failed to execute 'abort' on 'PaymentRequest': No show() or retry() in progress, so nothing to abort
 This is a testharness.js-based test.
 PASS Creating a PaymentRequest with empty parameters should not throw or crash.
 PASS Creating a PaymentRequest with extra parameters should not throw or crash.

third_party/blink/web_tests/virtual/basic-card-enabled/payments/payment-request-interface-expected.txt

@@ -1,7 +1,9 @@
-CONSOLE ERROR: Uncaught (in promise) UnknownError: Renderer process could not establish or lost IPC connection to the PaymentRequest service in the browser process.
-CONSOLE ERROR: Uncaught (in promise) UnknownError: Renderer process could not establish or lost IPC connection to the PaymentRequest service in the browser process.
-CONSOLE ERROR: Uncaught (in promise) UnknownError: Renderer process could not establish or lost IPC connection to the PaymentRequest service in the browser process.
-CONSOLE ERROR: Uncaught (in promise) UnknownError: Renderer process could not establish or lost IPC connection to the PaymentRequest service in the browser process.
+CONSOLE WARNING: PaymentRequest.show() requires either transient user activation or delegated payment request capability
+CONSOLE WARNING: PaymentRequest.show() requires either transient user activation or delegated payment request capability
+CONSOLE ERROR: Uncaught (in promise) SecurityError: Failed to execute 'show' on 'PaymentRequest': PaymentRequest.show() requires either transient user activation or delegated payment request capability
+CONSOLE ERROR: Uncaught (in promise) InvalidStateError: Failed to execute 'abort' on 'PaymentRequest': No show() or retry() in progress, so nothing to abort
+CONSOLE ERROR: Uncaught (in promise) SecurityError: Failed to execute 'show' on 'PaymentRequest': PaymentRequest.show() requires either transient user activation or delegated payment request capability
+CONSOLE ERROR: Uncaught (in promise) InvalidStateError: Failed to execute 'abort' on 'PaymentRequest': No show() or retry() in progress, so nothing to abort
 This is a testharness.js-based test.
 PASS Creating a PaymentRequest with empty parameters should not throw or crash.
 PASS Creating a PaymentRequest with extra parameters should not throw or crash.