[w3c/permissions] Only allow permissions.request() during user interaction (#77)

Some quotes from Google:
> We believe users should only see a permission prompt if they’ve demonstrated willingness to grant that permission, or at minimum, intent to use a feature which requires that permission. In particular, we strongly advise against triggering permissions prompts on page load.

> Showing users permission prompts they aren’t interested in is distracting and spammy. To ensure Chrome users get the best experience on the web we’re exploring automatically denying permission prompts from sites that display prompts which users largely ignore or deny (or worse, revoke).

from https://docs.google.com/document/d/1WNPIS_2F0eyDm5SS2E6LZ_75tk6XtBSnR1xNjWJ_DPE/edit#heading=h.55stxhevs7pi

> Always request access to location on a user gesture

from https://developers.google.com/web/fundamentals/native-hardware/user-location/user-consent

This new API seems like the perfect opportunity to enforce this restriction to avoid spammy popups: Permission requests shouldn't appear if `permissions.request()` isn't called as a result of user interaction. The older permission APIs can eventually be deprecated in favour of .request(). 

---
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/permissions/issues/77