Clear credentials from clipboard after 60 seconds

[fmeum]

My implementation for #140. This works well on Chrome, but Firefox somehow hangs on the following line indefinitely:

const alarms = await chrome.alarms.getAll();

I don't have any experience with Firefox extensions, do you know why this may happen?

---

Fixes #140

[max-baz]

Good job! Here are some comments to make the code simpler 🙂

[fmeum]

Thanks for the detailed review! I have now addressed all the comments.
It took me a while to figure out the textarea incantations that please both Firefox and Chrome when it comes to pasting clipboard contents, but it seems to work reliably in both browsers now. Could you also verify this?

[fmeum]

For the record: https://bugzilla.mozilla.org/show_bug.cgi?id=1364708#c2 is the only code snippet that I found that works.

[max-baz]

I like the simplicity of the patch, will test tomorrow, but apart from minor details looks good to me!

[erayd]

Related to the permissions discussion above - can the clipboardRead permission be requested on demand the first time somebody tries to use this feature? That would help avoid a mass-disabling of the extension for users, and would help to clarify its purpose for those who don't read the documentation (which let's face it, will be a large fraction of the user base).

[max-baz]

I'm not sure that's a good idea to add optional permissions at this point, it adds a bit of complexity, potential browser issues, and inconsistency with other permissions that are not optional...

How about we keep them required and instead add an upgrade notification "New permissions added to clear copied credentials after 60 seconds"? We already have a framework for that in background.js#onExtensionInstalled().

[fmeum]

Would this work though? I think that the extension would be disabled before the notification can be shown. But of course this would at least explain why after the fact better than the permission dialog by itself.

[max-baz]

It will be disabled for those who install extension via webstore, but as soon as people re-enable it they will instantly understand why we suddenly requested more permissions — sounds acceptable to me, a good compromise between simplicity and usability, let's ask what @erayd thinks 🙂

[fmeum]

I implemented @maximbaz's notification proposal in the newest changeset. @erayd, if you would prefer the permission to be optional and know how to make this work in Firefox, I could always revert to the previous version.

[erayd]

@FabianHenneke If you aren't able to get optional permissions to behave in Firefox, then let's leave things as-is, with the permission mandatory. Firefox is annoying enough already with its sporadic poor / incomplete API implementations, and this is probably just another such area.

[fmeum]

I haven't been able to get optional permissions to work in Firefox, so I would prefer to go with the notification approach.

@maximbaz @erayd Would you like me to make any other changes to the PR?

[max-baz]

LGTM, thanks!