768931 - Each permission in the manifest should support a corresponding "intended usage"

Status: RESOLVED FIXED

(Core Graveyard :: DOM: Apps, defect)

Description

[Lucas Adamski [:ladamski]]

Developers should be able to provide an "intended usage" to describe the intended use of each permission requested and any data obtained.

This should be short to fit in a mobile UI dialog.

Localization is a big challenge.  Could we provide a generic set of pre-localized options?

See https://groups.google.com/group/mozilla.dev.webapps/browse_thread/thread/aa0ff6e8ba9742ad/25595a281f08312e?lnk=raot#25595a281f08312e for background

Comment 1

[Lucas Adamski [:ladamski]]

Intended usage should only displayed to the user for trusted applications.  
Certified applications don't display permission dialogs.  
Use of APIs by installed web apps (aka untrusted apps) can't be verified so we should not be displaying untrustworthy 3rd party claims in a trusted system dialog.

Having the rationale for all types of applications can still be useful for reviewers however.

Comment 2

[Jason Smith [:jsmith]]

Would this be a required or optional parameter in the manifest? Would there be an assumed default value if nothing is specified if this is optional?

Comment 3

[Sid Stamm [:geekboy or :sstamm]]

I think it should be required; this will cause app developers to at least briefly think about what they will do with the data obtained through having permission.

Comment 4

[Jason Smith [:jsmith]]

Anant - Can we get an update on this bug for the spec piece?

Comment 5

[Anant Narayanan [:anant]]

https://github.com/mozilla/webapps-spec/commit/cdae925cc5b98537164fd9182be9e8827482044a

The property "description" will contain the intended use of the permission.