v0.5.0

host-api-test-sdk 0.5.0

Permission enforcement (kind of breaking change)

The test host previously auto-approved all permission requests silently. This meant products that forgot to call hostApi.permission() before signing would pass E2E tests but fail in production — real hosts (polkadot-desktop, dot.li) require TransactionSubmit to be granted before signing works.

Now the test host enforces this too. Signing without a prior TransactionSubmit permission grant fails with SigningErr::PermissionDenied.

Products that already request permissions correctly are unaffected. For tests that don't exercise the permission flow, there's an escape hatch:

await testHost.setEnforcePermissions(false);

Device permissions

The test host now handles handleDevicePermission requests (Camera, Microphone, Location, Bluetooth). When granted, the iframe allow attribute is updated with the corresponding Permissions Policy directive, matching how dot.li enforces device access at the browser level.

Permission control API

Tests can pre-grant, revoke, and inspect permissions:

// Pre-grant without product requesting
await testHost.grantPermission("TransactionSubmit");

// Revoke a grant
await testHost.revokePermission("TransactionSubmit");

// Inspect granted set
const granted = await testHost.getGrantedPermissions();

// Reject all permission requests
await testHost.setPermissionBehavior("reject-all");

// Check what was requested
const log = await testHost.getPermissionLog();

Updated dependencies

@novasamatech/host-api, @novasamatech/host-container, and @novasamatech/product-sdk updated to 0.6.17.

---

• permissions v2 by @mordamax in #9

Full Changelog: v0.4.0...v0.5.0