Re: [w3c/webcomponents] Expose shadowRoot on element internals (#871)

So the spec and the implementation definitely allow `attachInternals()` from anywhere, not just the constructor. Mainly for my own benefit, but also for the benefit of this thread, I reviewed the history on the [original issue thread](https://github.com/w3c/webcomponents/issues/758):

The first comment discussing this fact [is here from @caridy](https://github.com/w3c/webcomponents/issues/758#issuecomment-421627195). A bit later, @caridy also suggests the `attachInternals()` name and API, and [mentions](https://github.com/w3c/webcomponents/issues/758#issuecomment-428236374) that it should be called from the constructor. A number of immediately subsequent comments from @annevk and @rniwa are supportive of the "constructor only" limitation. [This comment](https://github.com/w3c/webcomponents/issues/758#issuecomment-428809923) from @domenic brings up that it might be difficult to implement, and @tkent-google confirms [here](https://github.com/w3c/webcomponents/issues/758#issuecomment-428817453) that implementation is difficult. And then the key point: @domenic [reported back from TC39](https://github.com/w3c/webcomponents/issues/758#issuecomment-436676008) with some further input, including that the prior proposals didn't work with subclassing. And the statement that `attachInternals()` works like `attachShadow()`: if the custom element constructor doesn't call either of those, anybody else is free to call them later, with whatever consequences that entails. Both @annevk  and @rniwa [comment](https://github.com/w3c/webcomponents/issues/758#issuecomment-436913783) that they are concerned that this means custom element authors all need to call `attachInternals()` protectively, and instead they preferred a `needsInternals` attribute to opt elements in to `ElementInternals`. After some discussion, the discussion [switches](https://github.com/w3c/webcomponents/issues/758#issuecomment-437140779) to an "opt-out" that is more ergonomic than having custom elements call `attachInternals()` and throw away the result. That discussion bikesheds for a while on naming before petering out without a conclusion, [here](https://github.com/w3c/webcomponents/issues/758#issuecomment-439255878). And the API is implemented without an opt-in or opt-out. The conclusion is therefore that if custom element authors are concerned about exposing `ElementInternals`, they should make sure to call `attachInternals()` in the constructor.

Given the above, the current situation is that **both** `attachShadow()` **and** `attachInternals()` are available for anyone to call. Protection is afforded to custom elements through the fact that they can call both in the constructor, and subsequent calls throw exceptions.

Ok, that's the history - now back to this proposal. Closed shadow roots can be protected by calling ``attachInternals()``, and the proposed `ElementInternals.shadowRoot` should be as safe as anything else in `ElementInternals`.

Thoughts?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/webcomponents/issues/871#issuecomment-675738149