[w3c/permissions] "Requesting more permission" algorithms are tightly coupled to prompts (#153)

Currently, the "request permission to use" and "prompt the user to choose,"
algorithms are specified to request input from the user and block until the
user responds to that specific request. If the UA receives new information
about the user's intent through some other mechanism than that request, the
algorithm continues to block.

This allows the following user flow:

1. Visit a site that prompts for permission to use geolocation data
2. Receive a prompt to allow access
3. Ignore prompt, but allow Geolocation access through some other means
4. Note that the prompt is still active

This seems like a potential oversight. At this point in the interaction, the
user's intent is clear, and the prompt is arguably superfluous. While the
prompt itself is largely inconsequential, it reflects the control flow through
application code (via the `request` method). This means applications themselves
would exhibit the same behavior under these circumstances.

I'm wondering if it makes more sense for the "requesting more permissions"
algorithms to prompt the user, but to then block on the receipt of new
information about the user's intent (regardless of the source).



-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/permissions/issues/153