Keep widget URL in permission screen to one line

[jryans]

This keeps the widget URL to one line max, so that the allow button will always
be visible. The full URL can be viewed by hovering.

Fixes element-hq/element-web#10402

[turt2live]

for user safety, it might be best to just let the pane scroll

[jryans]

Hmm, I keep going back and forth on this...

Personally, I feel like showing the first line (with origin, which should be the important bit in most cases) with the full URL still available for those interested should be good enough, as it's quite similar to how browsers reveal URLs when hovering links. Is there some reason the case of widgets should be treated with even more paranoia than regular links, such that we should force the full URL on screen?

[turt2live]

I'm not sure what the original rationale was, but personally I feel like the warning is needlessly scary for users. I guess this would be fine, given users probably don't really know what to do with this information anyways.

[jryans]

I agree the current message is too angry and not very informative... Maybe separate work could add metadata like the widget creator, widget type, etc. that might make this more understandable.

[dbkr]

Do we know if this screen is staying with the terms stuff? ie. would users sometimes have to click through both?

Either way I think this is fine, maybe we can do more but it's no worse.

[bwindels]

Agree the message could be improved. For now, we could perhaps include the uncapped hostname in the message, and then the capped URL? Something like:

Do you want to load the widget from https://vector-im.github.io (full url...)?

Not sure if a scrollbar is better than a tooltip though, I'm fine with leaving it as it is as well.

[jryans]

Do we know if this screen is staying with the terms stuff? ie. would users sometimes have to click through both?

I don't know what's intended here, as I don't think the terms designs account for the widget permission step. The widget permission is saved per widget, while IM terms agreement is saved for an account with an IM. So yes, it's possible to be confronted with both the widget permission and IM terms flows, but fundamentally they are about agreeing to different things. (Whether that's at all clear to users, I am not sure... 😭)

[jryans]

Do you want to load the widget from https://vector-im.github.io (full url...)?

I think it is nice to see at glance a bit more than the origin, so tempted to leave it as is. We should check with Nad on this when he gets back.

I'll open a new issue to consider some of these problems.

[jryans]

I filed element-hq/element-web#10413 to improve the permission prompt overall.