DeviceStorage should only be able to be requested by Privileged & Certified Apps. (as per https://docs.google.com/a/mozilla.com/spreadsheet/ccc?key=0Akyz_Bqjgf5pdENVekxYRjBTX0dCXzItMnRyUU1RQ0E#gid=0) Currently on Firefox OS (both desktop and device), even web content can request the permission by accessing the API. See http://dogs.creativemisuse.com/ and try clicking the"add an image" or "read music dir" buttons. Note that this issue doesn't seem to be present on Firefox desktop, even when the device.storage.enabled pref is true. (tested in mac 18.0a2) This will be security issue once privileged apps has landed, so should be blocking basecamp I think.
We shouldn't treat missing permissions as prompt permissions. I think I get the right behavior now for http://dogs.creativemisuse.com/ Paul, can you test as well?