diff --git a/.github/workflows/auto-publish.yml b/.github/workflows/auto-publish.yml index 51ba911..9964ab8 100644 --- a/.github/workflows/auto-publish.yml +++ b/.github/workflows/auto-publish.yml @@ -8,7 +8,7 @@ jobs: name: Build, Validate and Deploy runs-on: ubuntu-20.04 steps: - - uses: actions/checkout@v2 + - uses: actions/checkout@v3 - uses: w3c/spec-prod@v2 with: SOURCE: index.html diff --git a/EXPLAINER.md b/EXPLAINER.md index c2c202d..aef10aa 100644 --- a/EXPLAINER.md +++ b/EXPLAINER.md @@ -93,6 +93,7 @@ interface HIDInputReportEvent : Event { dictionary HIDDeviceRequestOptions { required sequence filters; + sequence exclusionFilters; }; dictionary HIDDeviceFilter { @@ -117,6 +118,7 @@ interface HIDDevice { readonly attribute FrozenArray collections; Promise open(); Promise close(); + Promise forget(); Promise sendReport([EnforceRange] octet reportId, BufferSource data); Promise sendFeatureReport([EnforceRange] octet reportId, BufferSource data); Promise receiveFeatureReport([EnforceRange] octet reportId); diff --git a/README.md b/README.md index 35dc964..cc39a8d 100644 --- a/README.md +++ b/README.md @@ -9,3 +9,7 @@ Details about the API including example usage code snippets and its motivation, ### Code of conduct We are committed to providing a friendly, safe and welcoming environment for all. Please read and respect the [W3C Code of Ethics and Professional Conduct](https://www.w3.org/Consortium/cepc/). + +### Implementation status + +This API is implemented in [Blink](https://source.chromium.org/chromium/chromium/src/+/main:third_party/blink/renderer/modules/hid/). It is available in browsers based on Chromium 89 and later, such as Google Chrome and Microsoft Edge. Individual Chromium-based browsers may choose to enable or disable this API. Chromium-based Android browsers do not support this API because Android itself does not provide a direct API for accessing HID devices ([Chromium issue 964441](https://crbug.com/964441)). For the same reason this API is not available in Android WebView ([Chromium issue 1164125](https://crbug.com/1164125)). \ No newline at end of file diff --git a/WEBHID_IN_EXTENSION_SERVICE_WORKERS_EXPLAINER.md b/WEBHID_IN_EXTENSION_SERVICE_WORKERS_EXPLAINER.md new file mode 100644 index 0000000..92e85ea --- /dev/null +++ b/WEBHID_IN_EXTENSION_SERVICE_WORKERS_EXPLAINER.md @@ -0,0 +1,33 @@ +# WebHID in Extension Service Workers Explainer + +A proposal to expose WebHID in Extension Service Workers. + + + + +## Introduction +WebHID is a proposed specification that allows web pages to access connected Human Interface Devices (HID) with the user’s permission. At the moment, in browser extensions, it is common to access WebHID from the extension background page. As the mechanism of using service workers is more prevalent with the advantages like open web compatibility and performance, we want to provide an alternative to the extension developers for accessing WebHID in extension service workers. + +## Potential specification changes + +### requestDevice() method +Requesting device permissions requires that the browser display a permissions dialog to the user. Since the dialog cannot be shown from a service worker context, the steps for `requestDevice()` will be updated to throw [NotSupportedError](https://webidl.spec.whatwg.org/#notsupportederror) when the [relevant global object](https://html.spec.whatwg.org/multipage/webappapis.html#concept-relevant-global) is not a [Window](https://html.spec.whatwg.org/multipage/window-object.html#window) object. + +### HID interface +The HID global accessible component `navigator.hid` will be exposed in Service Worker Context. + +```webidl +[Exposed=(Window,ServiceWorker), SecureContext] +interface HID : EventTarget { + attribute EventHandler onconnect; + attribute EventHandler ondisconnect; + Promise> getDevices(); + Promise> requestDevice( + HIDDeviceRequestOptions options); +} +``` + +In the proposed implementation, `navigator.hid` is exposed to Service Workers **only in the browser extension**. This should be realized in user agents’ implementations. + +## Security +Exposing WebHID in Extension Service Workers does not come with any significant security considerations. Both the WebHID and Service Worker features already contain security measures such as preventing cross-origin access and are also integrated into the Feature Policy, so developers can control where and how these features are exposed in their web applications. The Feature Policy is enforced across the pages and service workers from the same origin. To receive permission to access a HID device, the `requestDevice()` method prompts the user to select a device to connect to. Since `requestDevice()` will not be allowed to be accessed by service workers, the permission request should be done on the page. \ No newline at end of file diff --git a/blocklist.txt b/blocklist.txt index 8ddfbea..89558bf 100644 --- a/blocklist.txt +++ b/blocklist.txt @@ -43,4 +43,7 @@ // Block Jabra access to certain proprietary functionality. { vendor:0x0b0e, usagePage:0xff00, reportId:0x05, reportType:"output" }, + + // Block all OnlyKey access + { vendor:0x1d50, product:0x60fc }, ] diff --git a/index.html b/index.html index b960964..527f655 100644 --- a/index.html +++ b/index.html @@ -10,13 +10,14 @@