Module permissions 

Per-origin permission model for sensitive host APIs.

Sensitive capabilities (camera, microphone, geolocation, screen capture) are not granted automatically. The first time an app requests one, the host queues a PendingPermission and the UI shell renders a Chrome-style prompt (top-left, under the toolbar). Until the user decides, the gated API returns a “pending” code (PERMISSION_PENDING for i32 APIs) and the guest is expected to retry on a later frame.

Decisions are remembered per (origin, kind) pair for the lifetime of the tab, where origin is derived via crate::url::app_origin_of (scheme + host + port for network URLs, the containing directory for file:// URLs).

This flow is deliberately non-blocking: guest frame callbacks run on the UI thread, so a modal prompt inside a host function would deadlock the renderer.

Structs

PendingPermission

A permission request awaiting a user decision, rendered by the UI shell.

PermissionsState

Per-tab permission decisions plus the prompt currently awaiting the user.

Enums

PermissionKind

A sensitive capability that requires an explicit user grant.

PermissionStatus

Outcome of a permission check from a host function.

Constants

PERMISSION_PENDING

Return code for permission-gated i32 host APIs while the prompt is awaiting a decision.

Functions

check_or_request

Looks up the decision for (origin, kind), queueing a prompt when undecided.

resolve_pending

Records the user’s decision for the active prompt and dismisses it.

Type Aliases

SharedPermissions

Shared handle stored in HostState and read by the UI shell each frame.