Module webxdc_permissions 

Mini App Permissions System

This module handles optional permissions that Mini Apps can request. Permissions are declared when publishing an app and must be explicitly granted by users before they take effect.

Security Model

By default, ALL sensitive permissions are denied via the Permissions-Policy header. Apps can request specific permissions in their metadata, but users must:

1. Be prompted on first launch (if any permissions are requested)
2. Explicitly grant each permission
3. Have the ability to toggle permissions at any time in App Details

Available Permissions

• microphone - Access to microphone for voice chat, recording, etc.
• camera - Access to camera for video calls, photos, etc.
• geolocation - Access to device location
• clipboard-read - Read from clipboard
• clipboard-write - Write to clipboard
• fullscreen - Allow fullscreen mode
• autoplay - Allow media autoplay
• display-capture - Screen capture via getDisplayMedia()
• midi - Web MIDI API for musical instruments
• picture-in-picture - Picture-in-Picture video mode
• screen-wake-lock - Prevent screen from sleeping
• speaker-selection - Select audio output device
• accelerometer - Device acceleration sensor
• gyroscope - Device orientation/rotation sensor
• magnetometer - Compass/magnetic field sensor
• ambient-light-sensor - Ambient light level sensor
• bluetooth - Web Bluetooth API

Nostr Event Tag Format

Permissions are stored as a tag in the marketplace event:

["permissions", "microphone,camera,fullscreen"]

The value is a comma-separated list of permission names.

Structs

PermissionInfo

Permission info for frontend display

Enums

MiniAppPermission

Available permissions that Mini Apps can request

Functions

build_isolated_permissions_policy

Permissions-Policy for an app served cross-origin isolated: the user’s grants plus cross-origin-isolated=(self). Chromium honours () and would switch isolation (and with it SharedArrayBuffer) back off.

build_permissions_policy

Build a dynamic Permissions-Policy header based on granted permissions

get_all_permission_info

Get all available permissions as PermissionInfo for frontend display

parse_permissions

Parse a comma-separated string of permissions into a set