Manifest + permissions policy

[domfarolino]

I came to this from reading parts of the https://github.com/WICG/controlled-frame explainer. https://github.com/WICG/isolated-web-apps/blob/main/Permissions.md mentions the "old" proposal of adding a new Web Manifest field:

There have been several proposals to add a permissions allowlist to the manifest (see w3c/manifest issues 75, 395, 798), none of which progressed to a specification or prototype.

Several closed issues are linked, and shortly below the "new" proposal appears, which is also... adding a manifest field:

We propose adding a new permissions_policy field to the Web App Manifest spec

As far as I can tell the new proposal is the same as the old proposal—what's changed? How is this proposal being developed differently from the ones that have fizzled out in the Web Manifest spec? The only difference I can discern is:

All of the aforementioned problems are solved in Isolated Web Apps through packaging and manifest restrictions. This proposal relies on these Isolated Web App properties and does not attempt to solve these issues for PWAs in general.

It sounds like the "new" proposal is to respect this new filed only for IWAs, and essentially develop this Web Manifest extension/proposal in this repository, without closer integration with the Web Manifest spec. Is that accurate? Is the new field intended to NOT be used by anything but IWAs?

[robbiemc]

This proposal is basically the same as w3c/manifest#798. The other two proposals I linked suggested declaring permissions, not permissions policies, which I don't think is the correct model here as I describe in the permissions explainer.

Nothing has changed since that proposal was made, and all of the issues raised there (and echoed again here in the permissions explainer) still exist for normal web content. The only reason this proposal is viable now is because it can only ever apply to IWAs, which don't have the same asynchronicity and versioning issues that the normal web does.

[domfarolino]

I see, so it sounds like we are no longer pursuing adding this field to the actual Web Manifest spec, but just sort of monkey-patching it in the specs local to this repository. I think it might be good to clarify this in:

We propose adding a new permissions_policy field to the Web App Manifest spec

since I think this line gives the impression that we are pursuing a proposal to the core of the manifest spec, when in fact we intend to deviate from those previous proposals by just monkeypatching it for IWA-only purposes.