Right now our discovery stream layout pref has consumer_key baked into it, but there should be a pref for this, and we just need to inject it when we do the fetch.

This is currently how the old top stories fetch works, example: consumer_key=$apiKey

[Tracking Requested - why for this release]: When we do experiments on release, we would like to have API keys less exposed to users.

How to test:

1. go to about:config
2. search for discoverystream.config
3. Verify preference is set to
   {"api_key_pref":"extensions.pocket.oAuthConsumerKey","enabled":true,"show_spocs":true,"layout_endpoint":"https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic"}

With this fix consumer_key is no longer exposed in layout_endpoint and picking value from pref 'extensions.pocket.oAuthConsumerKey'

https://hg.mozilla.org/mozilla-central/rev/abe819688f32

Brahmini, can you test? Steps in comment #3.

I have verified in Nightly v67.0a1 on Mac OS 10.14.3 that browser.newtabpage.activity-stream.discoverystream.config is set to {"api_key_pref":"extensions.pocket.oAuthConsumerKey","enabled":true,"show_spocs":true,"layout_endpoint":"https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic"}

Comment on attachment 9044309 [details]
Bug 1518258 - Inject pref based consumer_key into discovery stream layout_endpoint pref

Beta/Release Uplift Approval Request

Feature/Bug causing the regression

Bug 1512725

User impact if declined

In about:config, user will see consumer key hard coded inside browser.newtabpage.activity-stream.discoverystream.config pref

Is this code covered by automated tests?

Yes

Has the fix been verified in Nightly?

Yes

Needs manual test from QE?

Yes

If yes, steps to reproduce

https://bugzilla.mozilla.org/show_bug.cgi?id=1518258#c3

List of other uplifts needed

None

Risk to taking this patch

Low

Why is the change risky/not risky? (and alternatives if risky)

This patch touches pocket new tab discovery experiment that's not turned on by default in beta

String changes made/needed

None

Comment on attachment 9044309 [details]
Bug 1518258 - Inject pref based consumer_key into discovery stream layout_endpoint pref

Planned work for pocket/new tab. Verified in Nightly.
OK for beta uplift, should land for beta 9.
Landing order: bug 1519879, bug 1525494, bug 1526861, bug 1524669, bug 1527195, bug 1525391, bug 1527347, bug 1525366, bug 1527626, bug 1527397, bug 1518258, bug 1527701, bug 1527370.

I tested on Windows.

FF Nightly version : 67.0a1 (2019-02-15)
OS : Windows 10 Pro

pref browser.newtabpage.activity-stream.discoverystream.config is set to
{"api_key_pref":"extensions.pocket.oAuthConsumerKey","enabled":true,"show_spocs":true,"layout_endpoint":"https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic"}

https://hg.mozilla.org/releases/mozilla-beta/rev/d2aa4c02f9b2

(In reply to Wolasi from comment #7)

I have verified in Nightly v67.0a1 on Mac OS 10.14.3 that
browser.newtabpage.activity-stream.discoverystream.config is set to
{"api_key_pref":"extensions.pocket.oAuthConsumerKey","enabled":true, "show_spocs":true,"layout_endpoint":"https://getpocket.com/v3/newtab/ layout?version=1&consumer_key=$apiKey&layout_variant=basic"}

Can you also please verify this issue on Firefox 66 Beta 9 (https://archive.mozilla.org/pub/firefox/candidates/66.0b9-candidates/build1/)?

(In reply to Camelia Badau [:cbadau], Release Desktop QA from comment #12)

(In reply to Wolasi from comment #7)

I have verified in Nightly v67.0a1 on Mac OS 10.14.3 that
browser.newtabpage.activity-stream.discoverystream.config is set to
{"api_key_pref":"extensions.pocket.oAuthConsumerKey","enabled":true, "show_spocs":true,"layout_endpoint":"https://getpocket.com/v3/newtab/ layout?version=1&consumer_key=$apiKey&layout_variant=basic"}

Can you also please verify this issue on Firefox 66 Beta 9 (https://archive.mozilla.org/pub/firefox/candidates/66.0b9-candidates/build1/)?

I have verified on Firefox v66.09b, the discovery stream pref shows {"api_key_pref":"extensions.pocket.oAuthConsumerKey","enabled":false,"show_spocs":true,"layout_endpoint":"https://getpocket.com/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=basic"} as expected

Thanks for verifying this!