Internal APIs changed in dev (was: The assertion object is not serializable (on development))

[st3fan]

I'm using the following code to call BrowserID and then pass the assertion to our own backend for verification:

function doBrowserId() {
  navigator.id.getVerifiedEmail(function(assertion) {
    if (assertion) {
      $.ajax({
        url: "/browserid/verify",
        data: { 'assertion': assertion },
        dataType: "json",
        success: function(data, status, xhr) {
           // Not important what happens here
        },
        error: function(xhr, status, error) {
           // Not important what happens here
        }
      });
    } else {
        // Not important what happens here
    }
  });
}

This works ok in production but fails on development. The assertion is serialized as "[Object object]" instead of a proper JSON encoded dictionary. Since this is pretty much based on sample code that many people have in production, I wonder if this should break like this.

[lloyd]

@st3fan - steps to reproduce?

[st3fan]

Not sure how to document that. Login to browserid & serialize assertion?

[benadida]

@st3fan you're doing this on dev.myfavoritebeer.org?

[lloyd]

this is a regression in our internal APIs. It won't affect a lot of people, but the people it will affect are important (looking at you, @st3fan). I think it's easy to work around this, and don't think we should needlessly break contracts. Here's the conclusion I reached on IRC in discussing with @st3fan, with the context preceeding it: http://irclog.gr/#show/irc.mozilla.org/identity/73222

given this, assigning to self and giving it 5 stars.

I repeat, dev specific, internal api specific.

[lloyd]

so I'm unhappy with our testing of this feature. It seems like the only tests we have don't actually execute the code, and they don't catch this regression...

[benadida]

@lloyd yeah, we haven't given the internal API enough love, agreed. We should, especially as we're about to add more.

[lloyd]

The only way I can think of improving the situation is to simulate native embedding with a test specific iframe that mimics how pancake (and other native code) will use our internal API, then to script that with something like selenium...

For the purposes of this bug I'm going to deploy a blind fix on a branch/ephemeral VM and let @st3fan test it...

[lloyd]

@benadida - @callahad reports that there are people interested in this feature. so that's a +1 to formalizing it, documenting it, providing and example, and making sure we have tests that validate our API isn't inadvertently broken.

context: http://irclog.gr/#show/irc.mozilla.org/identity/73775