Issue
Section §interaction-endpoint — Interaction Response says:
For interaction and payment types, the PS relays the interaction to the user and returns a deferred response (#deferred-responses). The agent polls until the user completes the interaction.
This implies the PS's deferred response terminates on user completion — i.e., the PS is the source of truth for "is the work done?"
But for the common case where the interaction URL points at a resource (e.g. a proxy's OAuth bootstrap page, a merchant's payment-confirmation page), the user actually completes the interaction at the resource, not at the PS. The PS only forwards the user there.
The agent ends up holding two pollUrls:
- one from the resource (the original
Location on the resource's 202)
- one from the PS (the deferred response on the
interaction_endpoint relay)
The spec doesn't say which one signals completion, or how the PS would learn that the resource has closed its pending.
Suggested resolution
Clarify that for resource-hosted interaction URLs, the resource's pollUrl is authoritative for completion. The PS's deferred response should resolve when the user is engaged (e.g. has loaded the URL) or when the agent's optional max_wait window elapses — whichever comes first — and the agent then continues polling the resource pollUrl.
Equivalently: the PS could be required to relay the completion state from the resource, but that's more PS implementation burden (PS polls or subscribes to the resource).
Related
Came up while building Ponte (a Cloudflare-Workers AAuth proxy) — OAuth bootstrap is a resource-hosted interaction, so the agent needs to know which pollUrl is authoritative.
Issue
Section §interaction-endpoint — Interaction Response says:
This implies the PS's deferred response terminates on user completion — i.e., the PS is the source of truth for "is the work done?"
But for the common case where the interaction URL points at a resource (e.g. a proxy's OAuth bootstrap page, a merchant's payment-confirmation page), the user actually completes the interaction at the resource, not at the PS. The PS only forwards the user there.
The agent ends up holding two pollUrls:
Locationon the resource's 202)interaction_endpointrelay)The spec doesn't say which one signals completion, or how the PS would learn that the resource has closed its pending.
Suggested resolution
Clarify that for resource-hosted interaction URLs, the resource's pollUrl is authoritative for completion. The PS's deferred response should resolve when the user is engaged (e.g. has loaded the URL) or when the agent's optional
max_waitwindow elapses — whichever comes first — and the agent then continues polling the resource pollUrl.Equivalently: the PS could be required to relay the completion state from the resource, but that's more PS implementation burden (PS polls or subscribes to the resource).
Related
Came up while building Ponte (a Cloudflare-Workers AAuth proxy) — OAuth bootstrap is a resource-hosted interaction, so the agent needs to know which pollUrl is authoritative.