From 2c5c3aa1248d07db60323bbff3f3cd225faf024f Mon Sep 17 00:00:00 2001
From: Raymes Khoury <raymes@chromium.org>
Date: Tue, 10 Oct 2017 16:03:15 +1100
Subject: [PATCH 1/2] Add support for permissions that have an associated
 Feature Policy

This adds support for denying access to permissions which are not
allowed in the current context based on an associated Feature Policy.
The Feature Name and Default Allowlist of a policy-controlled feature
must still be declared in the owning spec. This also removes specific
support for the media feature policy which is covered by the more
general support.
---
 index.bs | 27 ++++++++++++++++++++-------
 1 file changed, 20 insertions(+), 7 deletions(-)

diff --git a/index.bs b/index.bs
index 91c848b..d848df0 100644
--- a/index.bs
+++ b/index.bs
@@ -44,6 +44,11 @@ spec: sensors; urlPrefix: https://w3c.github.io/sensors/#
 spec: manifest; urlPrefix: https://w3c.github.io/manifest/#
     type: dfn
         text: install; url: dfn-install
+spec: feature-policy; urlPrefix: https://wicg.github.io/feature-policy/#
+    type: dfn
+        text: policy-controlled feature
+    type: dfn
+        text: feature name
 
 </pre>
 <pre class="link-defaults">
@@ -233,6 +238,21 @@ spec: webidl
           and <code>|descriptor|.{{PermissionDescriptor/name}}</code> isn't
           <a>allowed in non-secure contexts</a>, then return {{"denied"}}.
         </li>
+        <li>
+          If there exists a <a>policy-controlled feature</a> with a
+          <a>feature name</a> that is equal to
+          <code>|descriptor|.{{PermissionDescriptor/name}}</code> and
+          |settings| has an <a>associated `Document`</a> named <var>document</var>,
+          run the following step:
+          <ol class="algorithm">
+            <li>
+              If <var>document</var> is not <a>allowed to use</a> the feature
+              with the <a>feature name</a>
+              <code>|descriptor|.{{PermissionDescriptor/name}}</code>
+              return {{"denied"}}.
+            </li>
+          </ol>
+        </li>
         <li>
           If there was a previous invocation of this algorithm with the same
           |descriptor| and |settings|, returning
@@ -786,13 +806,6 @@ spec: webidl
       <a>allowed in non-secure contexts</a>. {{"camera"}} and {{"microphone"}}
       MAY be <a>allowed in non-secure contexts</a>.
     </p>
-    <p>
-      If the <a>current global object</a> has an <a>associated `Document`</a>,
-      and that {{Document}} is not <a>allowed to use</a> the feature indicated
-      by attribute name <{iframe/allowusermedia}>, then the <a>permission
-      state</a> of any descriptor with a {{PermissionDescriptor/name}} of
-      {{"camera"}} or {{"microphone"}} must be {{"denied"}}.
-    </p>
     <dl>
       <dt>
         <a>permission descriptor type</a>

From e5f7e854d5e438effd40043031f3352c2ffd620c Mon Sep 17 00:00:00 2001
From: Raymes Khoury <raymes@chromium.org>
Date: Mon, 3 Sep 2018 16:54:40 +1000
Subject: [PATCH 2/2] Update to comply with recent FP spec

---
 index.bs | 16 ++++------------
 1 file changed, 4 insertions(+), 12 deletions(-)

diff --git a/index.bs b/index.bs
index d848df0..c52bc4e 100644
--- a/index.bs
+++ b/index.bs
@@ -44,11 +44,6 @@ spec: sensors; urlPrefix: https://w3c.github.io/sensors/#
 spec: manifest; urlPrefix: https://w3c.github.io/manifest/#
     type: dfn
         text: install; url: dfn-install
-spec: feature-policy; urlPrefix: https://wicg.github.io/feature-policy/#
-    type: dfn
-        text: policy-controlled feature
-    type: dfn
-        text: feature name
 
 </pre>
 <pre class="link-defaults">
@@ -239,16 +234,13 @@ spec: webidl
           <a>allowed in non-secure contexts</a>, then return {{"denied"}}.
         </li>
         <li>
-          If there exists a <a>policy-controlled feature</a> with a
-          <a>feature name</a> that is equal to
-          <code>|descriptor|.{{PermissionDescriptor/name}}</code> and
-          |settings| has an <a>associated `Document`</a> named <var>document</var>,
-          run the following step:
+          If there exists a [=policy-controlled feature=] identified by
+          <code>|descriptor|.{{PermissionDescriptor/name}}</code> and |settings| has an
+          <a>associated `Document`</a> named <var>document</var>, run the following step:
           <ol class="algorithm">
             <li>
               If <var>document</var> is not <a>allowed to use</a> the feature
-              with the <a>feature name</a>
-              <code>|descriptor|.{{PermissionDescriptor/name}}</code>
+              identified by <code>|descriptor|.{{PermissionDescriptor/name}}</code>
               return {{"denied"}}.
             </li>
           </ol>