# Relinquishing Permissions

## Draft Community Group Report, 1 January 1970

This version:
  https://jyasskin.github.io/permissions-revoke
Editor:
  Jeffrey Yasskin (Google Inc.)
Tests:
  web-platform-tests permissions-revoke/ (ongoing work)

Copyright © 1970 the Contributors to the Relinquishing Permissions Specification, published by the Web Platform Incubator Community Group under the W3C Community Contributor License Agreement (CLA). A human-readable summary is available.

## Abstract

This specification extends the Permissions API to provide a way to relinquish permission to use powerful features.

## Status of this document

This specification was published by the Web Platform Incubator Community Group. It is not a W3C Standard nor is it on the W3C Standards Track. Please note that under the W3C Community Contributor License Agreement (CLA) there is a limited opt-out and other conditions apply. Learn more about W3C Community and Business Groups.

## 1. Introduction

This document specifies a function to relinquish permissions that are no longer needed.

## 2. Revoke API

    partial interface Permissions {
      Promise<PermissionStatus> revoke(object permissionDesc);
    };

When the `revoke(permissionDesc)` method is invoked, the UA MUST run the following algorithm, passing the parameter permissionDesc:

1. Let rootDesc be the object permissionDesc refers to, converted to an IDL value of type `PermissionDescriptor`. If this throws an exception, return a promise rejected with that exception and abort these steps.

2. Let typedDescriptor be the object permissionDesc refers to, converted to an IDL value of `rootDesc.`name``’s permission descriptor type. If this throws an exception, return a promise rejected with that exception and abort these steps.

3. Return a new promise promise and run the following steps in parallel:

   1. The UA now has new information that the user intends to revoke permission to use the feature described by typedDescriptor.

   2. If any tasks run due to Reacting to users revoking permission, wait for them to finish.

   3. Queue a task to resolve promise with the result of `query(permissionDesc)`.

      This should pass typedDescriptor directly into the parallel part of query().

## 3. Security Considerations

No security considerations have been identified.

## 4. Privacy Considerations

No privacy considerations have been identified.

## Conformance

Conformance requirements are expressed with a combination of descriptive assertions and RFC 2119 terminology. The key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “MAY”, and “OPTIONAL” in the normative parts of this document are to be interpreted as described in RFC 2119. However, for readability, these words do not appear in all uppercase letters in this specification.

All of the text of this specification is normative except sections explicitly marked as non-normative, examples, and notes. [RFC2119]

Examples in this specification are introduced with the words “for example” or are set apart from the normative text with `class="example"`, like this:

This is an example of an informative example.

Informative notes begin with the word “Note” and are set apart from the normative text with `class="note"`, like this:

Note, this is an informative note.

## Index

### Terms defined by this specification

- revoke(permissionDesc), in §2

https://w3c.github.io/FileAPI/#blob-url-resolve Referenced in:

- 2. Revoke API

https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel Referenced in:

- 2. Revoke API

https://html.spec.whatwg.org/multipage/webappapis.html#queue-a-task Referenced in:

- 2. Revoke API

https://w3c.github.io/permissions/#dictdef-permissiondescriptor Referenced in:

- 2. Revoke API

https://w3c.github.io/permissions/#permissionstatus Referenced in:

- 2. Revoke API

https://w3c.github.io/permissions/#permissions Referenced in:

- 2. Revoke API

https://w3c.github.io/permissions/#dom-permissiondescriptor-name Referenced in:

- 2. Revoke API

https://w3c.github.io/permissions/#new-information-about-the-users-intent Referenced in:

- 2. Revoke API

https://w3c.github.io/permissions/#permission-descriptor-type Referenced in:

- 2. Revoke API

https://w3c.github.io/permissions/#dom-permissions-query Referenced in:

- 2. Revoke API

https://www.w3.org/2001/tag/doc/promises-guide/#a-new-promise Referenced in:

- 2. Revoke API

https://www.w3.org/2001/tag/doc/promises-guide/#a-promise-rejected-with Referenced in:

- 2. Revoke API (2)

https://heycam.github.io/webidl/#dfn-convert-ecmascript-to-idl-value Referenced in:

- 2. Revoke API (2)

https://heycam.github.io/webidl/#idl-object Referenced in:

- 2. Revoke API

### Terms defined by reference

- [FileAPI] defines the following terms:
  - resolve
- [HTML] defines the following terms:
  - in parallel
  - queue a task
- [permissions] defines the following terms:
  - PermissionDescriptor
  - PermissionStatus
  - Permissions
  - name
  - new information about the user's intent
  - permission descriptor type
  - query(permissionDesc)
- [promises-guide] defines the following terms:
  - a new promise
  - a promise rejected with
- [WebIDL] defines the following terms:
  - converted to an idl value
  - object

## References

### Normative References

[FileAPI]
  Marijn Kruisselbrink; Arun Ranganathan. File API. 31 May 2019. WD. URL: https://www.w3.org/TR/FileAPI/
[HTML]
  Anne van Kesteren; et al. HTML Standard. Living Standard. URL: https://html.spec.whatwg.org/multipage/
[PERMISSIONS]
  Mounir Lamouri; Marcos Caceres; Jeffrey Yasskin. Permissions. 25 September 2017. WD. URL: https://www.w3.org/TR/permissions/
[PROMISES-GUIDE]
  Domenic Denicola. Writing Promise-Using Specifications. 9 November 2018. TAG Finding. URL: https://www.w3.org/2001/tag/doc/promises-guide
[RFC2119]
  S. Bradner. Key words for use in RFCs to Indicate Requirement Levels. March 1997. Best Current Practice. URL: https://tools.ietf.org/html/rfc2119
[WebIDL]
  Boris Zbarsky. Web IDL. 15 December 2016. ED. URL: https://heycam.github.io/webidl/

## IDL Index

    partial interface Permissions {
      Promise<PermissionStatus> revoke(object permissionDesc);
    };

## Issues Index

This should pass typedDescriptor directly into the parallel part of query(). ↵
#dom-permissions-revoke Referenced in:

- 2. Revoke API