Does PushManager subscribe() need transient activation check?

[youennf]

https://w3c.github.io/push-api/#dom-pushmanager-subscribe does not mention whether a https://html.spec.whatwg.org/multipage/interaction.html#transient-activation check should be done.
AIUI, Chrome and Firefox enforce these checks and WebKit is about to add this check at https://bugs.webkit.org/attachment.cgi?id=455337&action=review.
Would it make sense to update the spec accordingly?

[marcoscaceres]

Yeah, the spec predates the new gesture model. I'll update the spec.

[marcoscaceres]

@youennf, wrote:

Chrome and Firefox enforce these checks and WebKit is about to add this check at

I did some tests and checked the code of what Chrome and Firefox do... it seems that they don't consume the user activation.

Irrespective, I think it makes sense to consume the user active activation when calling subscribe().

[annevk]

I took a fresh look at fixing this and one of the issues I'm running into is that a large part of subscribe() is in parallel, but doing this properly requires it not to be.

At least, I think we want to check for user activation and consume it immediately? And we probably only want to check for user activation if we have to ask for permission.

Also, I think everything up to the permission check can be done synchronously (rejection should probably continue to be from a task). We should probably also remove the note about allowing "validation order" to happen in any order. We decided a long time ago that exception order is important. Individual APIs cannot really decide to override that. Shall I create a PR for that first?

@saschanaz WDYT?

[saschanaz]

SGTM

[annevk]

So #413 took care of that.

I have now updated #348 attempting to follow @saschanaz outlined which I believe also matches WebKit. I also restricted it to window agents as per an earlier comment.