Re: Publishing Web Notification Drafts

On Wed, Oct 13, 2010 at 11:51 AM, John Gregg <johnnyg@google.com> wrote:
>
>
> Should the user agent be required to present it as a package for
> approval (all or nothing, like an extension installation), or allow
> the user to choose a subset?  It might be helpful to come up with some
> use cases as well.
>

I don't think we should require an all-or-nothing permissions grant
(although UAs may choose to implement it like this, it shouldn't be a
requirement). I don't think requiring all-or-nothing provides any useful
guarantees for developers, as it's likely that most UAs will provide
alternate ways to revoke individual permissions (for example, Chrome's
"block notifications from xxxxx.com" UI) so pages need to deal with having
some-but-not-all permissions anyway.

I'm also wondering if specifying a callback to requestPermission() is the
right way to go if we choose to support multiple permissions - the semantics
of this callback are a little weird if the app is requesting multiple
permissions (if the UA chooses to supply multiple sequential permissions UI
for each permission, then when should the callback be invoked? After each
step, or only at the very end?). I'm wondering if a better approach would be
to have a way to request permissions, but then also have a way to register
an onpermissionschange() handler which is invoked whenever *any* permissions
change. This covers the request-multiple-permissions case and also the "app
wants to know when user manually revokes permission" case. I think there are
drawbacks to this approach and the use cases for a general
onpermissionschange handler are kind of weak, but I thought I'd throw it out
there.

-atw