Automatic discovery and retrieval of interoperable applications
Implementations disclosed herein provide for a third-party application an ability to access a first-party notification interface without receiving credentials linked to a first-party user account. In addition, a device-level permission is established such that each third-party application operating on a client device does not need to seek permission to access the notification interface. A third-party application may request an access code from a client device. The access code may be presented to an authentication server. The authentication server may provide an access token and a refresh token to the third-party application. The third party application may provide the access token and data to be included in a notification to the first-party notification interface.
1. A computer-implemented method, comprising:
receiving, by a client device associated with a first user account, a single device-level permission setting that grants a plurality of third-party applications permission to access a single first-party notification interface operating on the client device that would otherwise be restricted to use only by first-party applications on the client device, wherein the plurality of third-party applications comprises at least a first and a second third-party application;
receiving, from the first third-party application operating on the client device, a request for an access code that defines a level of access to the client device, wherein the first third-party application is associated with a second user account at a third-party service;
providing, from the client device to the first third-party application, the access code, wherein the access code is exchangeable by the first third party application for a refresh token and an access token provided by an authentication server;
receiving, from the first third-party application, the access token and data from the third-party service to be included in a notification generated by the first-party notification interface, wherein the access token was obtained by the first third-party application in response to a request comprising the access code;
presenting the notification on the client device;
subsequently receiving a request to deny permission for the second third-party application to access the first-party notification interface; and
in response to the request to deny permission, updating a setting of the client device to prevent the second third-party application from presenting notifications through the first-party notification interface.
2. The method of claim 1 , further comprising:
rejecting a notification request from the second third-party application, the notification request including data from a second third-party service to be included in a notification generated by the first-party notification interface.
3. The method of claim 1 , further comprising:
in response to the request to deny permission, revoking an access token that was previously provided to the second third-party application.
4. The method of claim 1 , further comprising:
receiving a revocation of permission for the plurality of third-party applications to access the first-party notification interface, wherein the revocation prevents the plurality of third-party applications from presenting any notifications through the first-party notification interface;
subsequently, receiving, a reinstatement of permission for the plurality of third-party applications to access the first-party notification interface; and
broadcasting to the third-party applications an indication of the reinstatement of permission.
5. The method of claim 1 , further comprising determining that the client device is a primary device for the first user account, wherein the first user account is also linked to a second client device.
6. The method of claim 5 , wherein the determination is based on a type of the client device.
7. The method of claim 5 , wherein the second client device has a third user account for a third third-party application that is not installed on the client device.
8. The method of claim 7 , wherein a third notice for the third third-party application is presented only on the second client device.
9. The method of claim 4 , further comprising:
receiving, from the first third-party application operating on the client device, a request to obtain a second access code for the first-party notification interface, wherein the second access code is exchanged for a new refresh token and a new access token by the authentication server.
10. A system, comprising:
a non-transitory computer-readable memory having program instructions stored thereon; and
a processor of a client device associated with a first user account, the processor configured execute the program instructions to:
receive a single device-level permission setting that grants a plurality of third-party applications permission to access a single first-party notification interface operating on the client device that would otherwise be restricted to use only by first-party applications on the client device, wherein the plurality of third-party applications comprises at least a first and a second third-party application;
receive, from the first third-party application operating on the client device, a first request for an access code that defines a level of access to the client device, wherein the first third-party application is associated with a second user account at a third-party service;
provide, from the client device to the first third-party application, the access code, wherein the access code is exchangeable by the third party application for a refresh token and an access token provided by an authentication server;
receive, from the first third-party application, the access token and data from the third-party service to be included in a notification generated by the first-party notification interface, wherein the access token was obtained by the first third-party application in response to a request comprising the access code;
present the notification on the client device;
subsequently receive a request to deny permission for a second third-party application to access the first-party notification interface; and
in response to the request to deny permission, update a setting of the client device to prevent the second third-party application from presenting notifications through the first-party notification interface.
11. The system of claim 10 , the processor further configured to execute program instructions to:
reject a notification request from the second third-party application, the notification request including data from a second third-party service to be included in a notification generated by the first-party notification interface.
12. The system of claim 11 , the processor further configured to execute program instructions to:
in response to the request to deny permission, revoke an access token that was previously provided to the second third-party application.
13. The system of claim 10 , the processor further configured to execute program instructions to:
receive a revocation of permission for the plurality of third-party applications to access the first-party notification interface, wherein the revocation prevents the plurality of third-party applications from presenting any notifications through the first-party notification interface;
subsequently, receive, a reinstatement of permission for the plurality of third-party applications to access the first-party notification interface; and
broadcast to the plurality of third-party applications an indication of the reinstatement of permission.
14. The system of claim 10 , the processor further configured to execute program instructions to determine that the client device is a primary device for the first user account, wherein the first user account is also linked to a second client device.
15. The system of claim 14 , wherein the determination is based on a type of the client device.
16. The system of claim 14 , wherein the second client device has a third user account for a third third-party application that is not installed on the client device.
17. The system of claim 16 , wherein a third notice for the third third-party application is presented only on the second client device.
18. The system of claim 13 , the processor further configured to execute program instructions to:
receive, from the third-party application operating on the client device, a third request to obtain a second access code for the first-party notification interface, wherein the second access code is exchanged for a new refresh token and a new access token by the authentication server.
19. A computer-implemented method, comprising:
requesting, by a first third-party application operating on a client device, an access code from the client device, wherein a single device-level permission to access a first-party notification interface operating on the client device that would otherwise be restricted to use only by first-party applications on the client device has been obtained for a plurality of third-party applications comprising at least the first and a second third-party application, wherein the access code defines a level of access to the client device, wherein the first third-party application is associated with a second user account at a third-party service;
receiving, by the first third-party application, the access code from the client device;
sending, by the first third-party application, a request comprising the access code to an authentication server;
responsive to the request comprising the access code, receiving, by the first third-party application, a refresh token and an access token from the authentication server; and
providing, by the first third-party application, a request to the first-party notification interface on the client device that comprises the access token and data from the third-party service to be included in a notification presented by the first-party notification interface, wherein the request initiates a process to present the notification on the client device.
20. The method of claim 19 , further comprising providing the access code to the third-party service.
21. The method of claim 20 , wherein the third-party service presents the access code to the authentication server and receives the refresh token and the access token.
22. A system, comprising:
non-transitory computer-readable memory having program instructions stored thereon; and
a processor of a client device associated with a first user account, the processor configured to execute the program instructions to:
request, by a first third-party application operating on a client device, an access code from the client device, wherein a single device-level permission to access a first-party notification interface operating on the client device that would otherwise be restricted to use only by first-party applications on the client device has been obtained for a plurality of third-party applications comprising at least the first and a second third-party application, wherein the access code defines a level of access to the client device, wherein the first third-party application is associated with a second user account at a third-party service;
receive, by the first third-party application, the access code from the client device;
send a request comprising the access code to an authentication server;
responsive to the request comprising the access code, receive, by the first third-party application, a refresh token and an access token from the authentication server; and
provide, by the first third-party application, a request to the first-party notification interface on the client device that comprises the access token and data from the third-party service to be included in a notification presented by the first-party notification interface, wherein the request initiates a process to present the notification on the client device.
23. The system of claim 22 , the processor further configured to provide the access code to the third-party service.
24. The system of claim 23 , wherein the third-party service presents the access code to the authentication server and receives the refresh token and the access token.
25. The method of claim 1 , further comprising:
subsequently receiving an application-specific revocation of permission for the first third-party application, wherein the application-specific revocation prevents the first third-party application from presenting any notifications through the first-party notification interface, and but does not change permission settings for any other third-party applications.