<webview>: First stab at implementing media permission request for guests.

chrome/renderer/resources/extensions/web_view_experimental_api.js

+// Copyright (c) 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Shim extension to provide permission request API (and possibly other future
+// experimental APIs) for <webview> tag.
+// See web_view.js for details.
+//
+// We want to control the permission API feature in <webview> separately from
+// the <webview> feature itself. <webview> is available in stable channel, but
+// permission API would only be available as 'experimental'.
+
+var WebView = require('webview').WebView;
+
+/**
+ * @param {!Object} detail The event details, originated from <object>.
+ * @private
+ */
+WebView.prototype.maybeSetupPermissionEvent_ = function() {
+  var node = this.node_;
+  var objectNode = this.objectNode_;
+  this.objectNode_.addEventListener('-internal-permissionrequest', function(e) {
+    var evt = new Event('permissionrequest', {bubbles: true, cancelable: true});
+    var detail = e.detail ? JSON.parse(e.detail) : {};
+    ['permission', 'url'].forEach(function(attribName) {
+      evt[attribName] = detail[attribName];
+    });
+    var requestId = detail.requestId;
+
+    if (detail.permission == 'media' && detail.requestId !== undefined) {
+      // TODO(lazyboy): Also fill in evt.details (see webview specs).
+      // http://crbug.com/141197.
+      var decisionMade = false;
+      // Construct the event.request object.
+      var request = {
+        allow: function() {
+          if (decisionMade) {
+            throw 'permissionrequest decision has already been made';

[Charlie Reis, 2013/02/11 22:20:56]

This is a string shown to web developers in the exception, right?  Is there a
convention or review needed for that (e.g., punctuation, etc)?

[lazyboy, 2013/02/12 05:03:45]

I'll ask asargent@, he recently added exception messages for app permissions I
think.

+          } else {
+            objectNode['-internal-setPermission']('media', requestId, true);

[Charlie Reis, 2013/02/11 22:20:56]

Can we check anywhere else that we don't call this repeatedly?  Not sure I trust
the page not to bypass this check.

[lazyboy, 2013/02/12 05:03:45]

Calling this > 1 times is no-op since the 'pending request' with request_id
should be gone.

+            decisionMade = true;
+          }
+        },
+        deny: function() {
+          if (decisionMade) {
+            throw 'permissionrequest decision has already been made';
+          } else {
+            objectNode['-internal-setPermission']('media', requestId, false);
+            decisionMade = true;
+          }
+        }
+      };
+      evt.request = request;
+
+      // Make browser plugin track lifetime of |request|.
+      objectNode['-internal-persistObject'](request, requestId);
+
+      var defaultPrevented = !node.dispatchEvent(evt);
+      if (!decisionMade && !defaultPrevented) {
+        decisionMade = true;
+        objectNode['-internal-setPermission']('media', requestId, false);
+      }
+    }
+  });
+};
+