# Chrome/Payments client-side flows

**Last updated (including links) January 2018**

## Chrome Downstream (card unmasking)

1.  A credit card is selected in the Autofill suggestions dropdown, [which
    triggers](https://cs.chromium.org/chromium/src/components/autofill/core/browser/autofill_manager.cc?l=777&rcl=849244ee60caf4ccc6a7defeddf0a221d4bdfb3a)
    AutofillManager::FillOrPreviewForm, which triggers
    AutofillManager::FillOrPreviewCreditCardForm
2.  If the form is [being filled with a
    MASKED_SERVER_CARD](https://cs.chromium.org/chromium/src/components/autofill/core/browser/autofill_manager.cc?l=716-717&rcl=849244ee60caf4ccc6a7defeddf0a221d4bdfb3a),
    a new payments::FullCardRequest is created, and
    [FullCardRequest::GetFullCard](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/full_card_request.cc?l=47&rcl=849244ee60caf4ccc6a7defeddf0a221d4bdfb3a)
    is called
3.  Some checks occur, and then the [card unmask dialog is
    shown](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/full_card_request.cc?l=78-79&rcl=849244ee60caf4ccc6a7defeddf0a221d4bdfb3a)
    while [Risk data is loaded in
    parallel](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/full_card_request.cc?l=82-84&rcl=849244ee60caf4ccc6a7defeddf0a221d4bdfb3a)
4.  [AutofillManager::ShowUnmaskPrompt](https://cs.chromium.org/chromium/src/components/autofill/core/browser/autofill_manager.cc?l=1056&rcl=849244ee60caf4ccc6a7defeddf0a221d4bdfb3a)
    calls
    [ChromeAutofillClient::ShowUnmaskPrompt](https://cs.chromium.org/chromium/src/chrome/browser/ui/autofill/chrome_autofill_client.cc?l=179&rcl=849244ee60caf4ccc6a7defeddf0a221d4bdfb3a),
    which [creates a
    CardUnmaskPromptView](https://cs.chromium.org/chromium/src/chrome/browser/ui/autofill/create_card_unmask_prompt_view.h?l=20&rcl=849244ee60caf4ccc6a7defeddf0a221d4bdfb3a)
    and calls
    [CardUnmaskPromptControllerImpl::ShowPrompt](https://cs.chromium.org/chromium/src/components/autofill/core/browser/ui/card_unmask_prompt_controller_impl.cc?l=45&rcl=849244ee60caf4ccc6a7defeddf0a221d4bdfb3a)
    with it
5.  On Desktop, a
    [CardUnmaskPromptViews](https://cs.chromium.org/chromium/src/chrome/browser/ui/views/autofill/card_unmask_prompt_views.cc)
    is shown <center>**-- [ Card unmask dialog appears ] --**</center>
6.  On Desktop, if the dialog is accepted,
    [CardUnmaskPromptViews::Accept](https://cs.chromium.org/chromium/src/chrome/browser/ui/views/autofill/card_unmask_prompt_views.cc?l=280&rcl=849244ee60caf4ccc6a7defeddf0a221d4bdfb3a)
    calls
    [CardUnmaskPromptControllerImpl::OnUnmaskResponse](https://cs.chromium.org/chromium/src/chrome/browser/ui/views/autofill/card_unmask_prompt_views.cc?l=284&rcl=849244ee60caf4ccc6a7defeddf0a221d4bdfb3a)
    with the values entered on the dialog
7.  The CardUnmaskDelegate::UnmaskResponse is populated with these values, then
    the delegate’s OnUnmaskResponse [is
    called](https://cs.chromium.org/chromium/src/components/autofill/core/browser/ui/card_unmask_prompt_controller_impl.cc?l=214&rcl=849244ee60caf4ccc6a7defeddf0a221d4bdfb3a)
8.  [FullCardRequest::OnUnmaskResponse](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/full_card_request.cc?l=92&rcl=849244ee60caf4ccc6a7defeddf0a221d4bdfb3a)
    uses these values to set up the PaymentsClient::UnmaskRequestDetails
9.  Once the user has accepted the dialog and Risk data is loaded,
    [FullCardRequest::SendUnmaskCardRequest](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/full_card_request.cc?l=134&rcl=354c7688915f6f86de4dd4b6b6d3cd5df7daafc2)
    calls
    [PaymentsClient::UnmaskCard](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/payments_client.cc?l=487&rcl=a4afafb52823c31b16c582ef1e59ee7bd57266e7)
10. [PaymentsClient::IssueRequest](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/payments_client.cc?l=516&rcl=90585e657db48f93bd73bc45d4caa975323da41b)
    calls
    [PaymentsClient::InitializeUrlFetcher](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/payments_client.cc?l=530&rcl=90585e657db48f93bd73bc45d4caa975323da41b)
    to [set the Payments
    URL](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/payments_client.cc?l=567&rcl=90585e657db48f93bd73bc45d4caa975323da41b)
    to be called ([specified by
    UnmaskCardRequest](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/payments_client.cc?l=205&rcl=90585e657db48f93bd73bc45d4caa975323da41b)),
    then [fires off an HTTP
    request](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/payments_client.cc?l=522-527&rcl=90585e657db48f93bd73bc45d4caa975323da41b)
    to it <center>**-- [ GetRealPanAction called ] --**</center>
11. Google Payments receives the request and returns a response
12. [PaymentsClient::OnURLFetchComplete](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/payments_client.cc?l=589&rcl=b7e2306fd4d8590a41f6fd103dfcc1013d6ca85e)
    is called upon receiving a response, checks for errors, and [calls the
    request-specific RespondToDelegate
    function](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/payments_client.cc?l=654&rcl=b7e2306fd4d8590a41f6fd103dfcc1013d6ca85e)
13. [UnmaskCardRequest::RespondToDelegate](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/payments_client.cc?l=251&rcl=849244ee60caf4ccc6a7defeddf0a221d4bdfb3a)
    calls
    [AutofillManager::OnDidGetRealPan](https://cs.chromium.org/chromium/src/components/autofill/core/browser/autofill_manager.cc?l=1035&rcl=849244ee60caf4ccc6a7defeddf0a221d4bdfb3a),
    which calls
    [FullCardRequest::OnDidGetRealPan](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/full_card_request.cc?l=138&rcl=849244ee60caf4ccc6a7defeddf0a221d4bdfb3a)
14. OnUnmaskVerificationResult [is
    called](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/full_card_request.cc?l=144&rcl=849244ee60caf4ccc6a7defeddf0a221d4bdfb3a)
    on the `|ui_delegate_|`, which updates the UI based on the RPC’s result
    through a long chain of calls that ultimately end at
    [CardUnmaskPromptControllerImpl::OnVerificationResult](https://cs.chromium.org/chromium/src/components/autofill/core/browser/ui/card_unmask_prompt_controller_impl.cc?l=76&rcl=849244ee60caf4ccc6a7defeddf0a221d4bdfb3a)
    and
    [CardUnmaskPromptViews::GotVerificationResult](https://cs.chromium.org/chromium/src/chrome/browser/ui/views/autofill/card_unmask_prompt_views.cc?l=88&rcl=849244ee60caf4ccc6a7defeddf0a221d4bdfb3a)
15. Back in FullCardRequest::OnDidGetRealPan, the RPC’s result [determines how
    to update the web page's
    form](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/full_card_request.cc?l=146&rcl=849244ee60caf4ccc6a7defeddf0a221d4bdfb3a)
    *   On a failure,
        [AutofillManager::OnFullCardRequestFailed](https://cs.chromium.org/chromium/src/components/autofill/core/browser/autofill_manager.cc?l=1052&rcl=849244ee60caf4ccc6a7defeddf0a221d4bdfb3a)
        clears the form
    *   On a success,
        [AutofillManager::OnFullCardRequestSucceeded](https://cs.chromium.org/chromium/src/components/autofill/core/browser/autofill_manager.cc?l=1041&rcl=849244ee60caf4ccc6a7defeddf0a221d4bdfb3a)
        logs the event and fills the form

## Chrome Upstream (upload credit card save)

1.  The user submits a form, triggering
    [AutofillManager::OnFormSubmitted](https://cs.chromium.org/chromium/src/components/autofill/core/browser/autofill_manager.cc?l=368&rcl=ab8d0ea46daf7673a53524a3708f0ffd1ea9ee2d).
    If the form was autofillable, FormDataImporter::ImportFormData [is
    called](https://cs.chromium.org/chromium/src/components/autofill/core/browser/autofill_manager.cc?l=392-393&rcl=ab8d0ea46daf7673a53524a3708f0ffd1ea9ee2d)
2.  An inner [FormDataImporter::ImportFormData
    helper](https://cs.chromium.org/chromium/src/components/autofill/core/browser/form_data_importer.cc?l=169&rcl=ab8d0ea46daf7673a53524a3708f0ffd1ea9ee2d)
    is called, which begins the process of importing both credit card and
    address profile information
3.  [FormDataImporter::ImportCreditCard](https://cs.chromium.org/chromium/src/components/autofill/core/browser/form_data_importer.cc?l=307&rcl=ab8d0ea46daf7673a53524a3708f0ffd1ea9ee2d)
    is called which tries to detect if a new credit card was entered on the
    form, storing it in `|imported_credit_card|` if so
4.  [FormDataImporter::ImportAddressProfiles](https://cs.chromium.org/chromium/src/components/autofill/core/browser/form_data_importer.cc?l=196&rcl=ab8d0ea46daf7673a53524a3708f0ffd1ea9ee2d)
    is called, which tries to [import one address profile per form
    section](https://cs.chromium.org/chromium/src/components/autofill/core/browser/form_data_importer.cc?l=222&rcl=ab8d0ea46daf7673a53524a3708f0ffd1ea9ee2d)
    (maximum of 2)
5.  If the submitted form [included a credit
    card](https://cs.chromium.org/chromium/src/components/autofill/core/browser/form_data_importer.cc?l=120,123&rcl=ab8d0ea46daf7673a53524a3708f0ffd1ea9ee2d)
    and meets [Chrome Upstream
    requirements](https://docs.google.com/document/d/1Fz82dy8Puxgxwmm2lTADA4LQwDmnhFNJ2kshywlCdKQ),
    prepare to attempt to offer credit card upload by calling
    [CreditCardSaveManager::AttemptToOfferCardUploadSave](https://cs.chromium.org/chromium/src/components/autofill/core/browser/credit_card_save_manager.cc?l=98&rcl=ab8d0ea46daf7673a53524a3708f0ffd1ea9ee2d)
6.  The payments::PaymentsClient::UploadRequestDetails [is
    initialized](https://cs.chromium.org/chromium/src/components/autofill/core/browser/credit_card_save_manager.cc?l=101-102&rcl=ab8d0ea46daf7673a53524a3708f0ffd1ea9ee2d),
    which sets the card in the request <center>**-- [ Client-side credit card
    validation ] --**</center>
7.  The form is searched for a [valid CVC
    value](https://cs.chromium.org/chromium/src/components/autofill/core/browser/credit_card_save_manager.cc?l=126-141&rcl=ab8d0ea46daf7673a53524a3708f0ffd1ea9ee2d),
    setting it in the request if found, or taking note of the problem if not (no
    CVC field, empty CVC field, or invalid CVC value) <center>**-- [ Client-side
    address validation ] --**</center>
8.  [CreditCardSaveManager::SetProfilesForCreditCardUpload](https://cs.chromium.org/chromium/src/components/autofill/core/browser/credit_card_save_manager.cc?l=314&rcl=90585e657db48f93bd73bc45d4caa975323da41b)
    is called, which performs Chrome-side Upstream profile verifications,
    logging any problems found in `|upload_decision_metrics_|` (no address,
    conflicting names, no name, conflicting postal codes, no postal code)
9.  If CVC is missing, the CVC fix flow is enabled, and no other problems were
    found, `|should_cvc_be_requested_|` [is set to
    true](https://cs.chromium.org/chromium/src/components/autofill/core/browser/credit_card_save_manager.cc?l=156&rcl=ab8d0ea46daf7673a53524a3708f0ffd1ea9ee2d)
    in order to display the client-side CVC fix flow when upload is offered.
    Otherwise, if CVC is missing, `|upload_decision_metrics_|`
    [records](https://cs.chromium.org/chromium/src/components/autofill/core/browser/credit_card_save_manager.cc?l=168&rcl=ab8d0ea46daf7673a53524a3708f0ffd1ea9ee2d)
    that it was not found
10. If any problems were found and the Send Detected Values experiment is
    disabled, offering upload save [is
    aborted](https://cs.chromium.org/chromium/src/components/autofill/core/browser/credit_card_save_manager.cc?l=177-184&rcl=ab8d0ea46daf7673a53524a3708f0ffd1ea9ee2d)
11. AttemptToOfferCardUploadSave [calls
    PaymentsClient::GetUploadDetails](https://cs.chromium.org/chromium/src/components/autofill/core/browser/credit_card_save_manager.cc?l=199-203&rcl=ab8d0ea46daf7673a53524a3708f0ffd1ea9ee2d)
    with the set of seen addresses, detected values bitmask, and active Chrome
    experiments
12. [PaymentsClient::GetUploadDetails](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/payments_client.cc?l=495&rcl=90585e657db48f93bd73bc45d4caa975323da41b)
    prepares to issue a GetUploadDetailsRequest (a call to Google Payments’
    GetDetailsForSaveCard)
13. [PaymentsClient::IssueRequest](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/payments_client.cc?l=516&rcl=90585e657db48f93bd73bc45d4caa975323da41b)
    calls
    [PaymentsClient::InitializeUrlFetcher](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/payments_client.cc?l=530&rcl=90585e657db48f93bd73bc45d4caa975323da41b)
    to [set the Payments
    URL](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/payments_client.cc?l=567&rcl=90585e657db48f93bd73bc45d4caa975323da41b)
    to be called ([specified by
    GetUploadDetailsRequest](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/payments_client.cc?l=278&rcl=90585e657db48f93bd73bc45d4caa975323da41b)),
    then [fires off an HTTP
    request](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/payments_client.cc?l=522-527&rcl=90585e657db48f93bd73bc45d4caa975323da41b)
    to it <center>**-- [ GetDetailsForSaveCardAction called ] --**</center>
14. Google Payments receives the request and returns a response
15. [PaymentsClient::OnURLFetchComplete](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/payments_client.cc?l=589&rcl=b7e2306fd4d8590a41f6fd103dfcc1013d6ca85e)
    is called upon receiving a response, checks for errors, and [calls the
    request-specific RespondToDelegate
    function](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/payments_client.cc?l=654&rcl=b7e2306fd4d8590a41f6fd103dfcc1013d6ca85e)
16. [GetUploadDetailsRequest::RespondToDelegate](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/payments_client.cc?l=331&rcl=b7e2306fd4d8590a41f6fd103dfcc1013d6ca85e)
    calls
    [CreditCardSaveManager::OnDidGetUploadDetails](https://cs.chromium.org/chromium/src/components/autofill/core/browser/credit_card_save_manager.cc?l=232&rcl=b7e2306fd4d8590a41f6fd103dfcc1013d6ca85e),
    which decides how to proceed based on the GetUploadDetailsRequest’s
    response:
    *   [On a
        success](https://cs.chromium.org/chromium/src/components/autofill/core/browser/credit_card_save_manager.cc?l=238&rcl=b7e2306fd4d8590a41f6fd103dfcc1013d6ca85e),
        the user is prompted to save the card to Google Payments, Risk data is
        loaded in parallel, and metrics note that upload was offered
    *   [On a
        failure](https://cs.chromium.org/chromium/src/components/autofill/core/browser/credit_card_save_manager.cc?l=252&rcl=b7e2306fd4d8590a41f6fd103dfcc1013d6ca85e),
        if name+address+CVC were found, the user is prompted to save locally,
        and metrics note that upload was not offered
17. The final UMA and UKM metric decisions are [finally
    logged](https://cs.chromium.org/chromium/src/components/autofill/core/browser/credit_card_save_manager.cc?l=310&rcl=b7e2306fd4d8590a41f6fd103dfcc1013d6ca85e)
18. ChromeAutofillClient::ConfirmSaveCreditCardToCloud offers to save the card
    to Google by surfacing an [infobar on
    Android](https://cs.chromium.org/chromium/src/chrome/browser/ui/autofill/chrome_autofill_client.cc?l=218-226&rcl=69f38cbb58152f8c9781a4d688adab1ad3c13cf6)
    or a [bubble on
    web](https://cs.chromium.org/chromium/src/chrome/browser/ui/autofill/chrome_autofill_client.cc?l=228-233&rcl=69f38cbb58152f8c9781a4d688adab1ad3c13cf6)
    <center>**-- [ Offer to save UI is shown ] --**</center>
19. Upon accepting save, the infobar/bubble fires a callback for
    [CreditCardSaveManager::OnUserDidAcceptUpload](https://cs.chromium.org/chromium/src/components/autofill/core/browser/credit_card_save_manager.cc?l=491&rcl=69f38cbb58152f8c9781a4d688adab1ad3c13cf6)
    <center>**-- [ User clicked save ] --**</center>
20. Once both the user accepts save and Risk data is loaded,
    [CreditCardSaveManager::SendUploadCardRequest](https://cs.chromium.org/chromium/src/components/autofill/core/browser/credit_card_save_manager.cc?l=510&rcl=69f38cbb58152f8c9781a4d688adab1ad3c13cf6)
    is called, which [sets
    CVC](https://cs.chromium.org/chromium/src/components/autofill/core/browser/credit_card_save_manager.cc?l=521-522&rcl=69f38cbb58152f8c9781a4d688adab1ad3c13cf6)
    in the request if the CVC fix flow was activated
21. [PaymentsClient::UploadCard](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/payments_client.cc?l=508&rcl=6ad45bcd758ad6eaba1da3a71b909f7ca7b46217)
    prepares to issue an UploadCardRequest (a call to Google Payments’ SaveCard)
22. [PaymentsClient::IssueRequest](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/payments_client.cc?l=516&rcl=90585e657db48f93bd73bc45d4caa975323da41b)
    calls
    [PaymentsClient::InitializeUrlFetcher](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/payments_client.cc?l=530&rcl=90585e657db48f93bd73bc45d4caa975323da41b)
    to [set the Payments
    URL](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/payments_client.cc?l=567&rcl=90585e657db48f93bd73bc45d4caa975323da41b)
    to be called ([specified by
    UploadCardRequest](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/payments_client.cc?l=354&rcl=90585e657db48f93bd73bc45d4caa975323da41b)),
    then [fires off an HTTP
    request](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/payments_client.cc?l=522-527&rcl=90585e657db48f93bd73bc45d4caa975323da41b)
    to it <center>**-- [ SaveCardAction called ] --**</center>
23. Google Payments receives the request and returns a response
24. [PaymentsClient::OnURLFetchComplete](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/payments_client.cc?l=589&rcl=b7e2306fd4d8590a41f6fd103dfcc1013d6ca85e)
    is called upon receiving a response, checks for errors, and [calls the
    request-specific RespondToDelegate
    function](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/payments_client.cc?l=654&rcl=b7e2306fd4d8590a41f6fd103dfcc1013d6ca85e)
25. [UploadCardRequest::RespondToDelegate](https://cs.chromium.org/chromium/src/components/autofill/core/browser/payments/payments_client.cc?l=432&rcl=b7e2306fd4d8590a41f6fd103dfcc1013d6ca85e)
    calls
    [CreditCardSaveManager::OnDidUploadCard](https://cs.chromium.org/chromium/src/components/autofill/core/browser/credit_card_save_manager.cc?l=215&rcl=6ad45bcd758ad6eaba1da3a71b909f7ca7b46217),
    which, on a success, saves the credit card as a FULL_SERVER_CARD (so it
    doesn’t need to be unmasked on next use on the same device)