UserScripts permissions can not be requested via permissions API

[Dmitry Seregin]

It looks like if I mark "userScripts" as an optional permission and request for it through chrome.permissions.request() it always returns true, and the status for allowing these user scripts in the extension's settings is the same: inactive, and using user scripts is not available.

But if I manually toggle the permission to allow scripts in the settings, the API becomes available.

Is this a bug or is it intentional?

Attached a small example - https://drive.google.com/file/d/1GbUqkv10522Ijy1dlcNL_YITeNdDLkeb/view?usp=sharing

[Oliver Dunk]

Hi Dmitry,

We've had a lot of discussion about this, but at the moment it is the intended behavior.

Access to user scripts, as you know, requires the following:

1. The `userScripts` permission.
2. The "Allow user scripts" toggle.

Currently the permissions API is only concerned with 1). The permission has no associated warning so it is always granted immediately when requested.

We've discussed having it check both, but it becomes quite difficult to figure out how other things would work in that case. For example, do we return false from permissions.request? The permission request was successful, but you can't actually use the API yet.

There might be a better approach but for now we prioritized shipping the new toggle and we can always revisit this in the future.

Oliver Dunk | DevRel, Chrome Extensions | https://developer.chrome.com/ | London, GB

--
You received this message because you are subscribed to the Google Groups "Chromium Extensions" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extens...@chromium.org.
To view this discussion visit https://groups.google.com/a/chromium.org/d/msgid/chromium-extensions/7b29a6d8-143e-4437-9489-2ac402f0237cn%40chromium.org.

[Dmitry Seregin]

Hi, Oliver! Many thanks for blazing fast answer.

Maybe, this permission could be enabled from two places and synchronized?

1. When requesting it as an optional permission from Chrome, the associated warning could be the same as on the settings page?
2. If I grant permission, the toggle becomes active, and vice versa, if the toggle is activated, requesting permission will return true?

[Oliver Dunk]

1. When requesting it as an optional permission from Chrome, the associated warning could be the same as on the settings page?

The last time I spoke to the team about this, our general view was that the current UI for permissions requests in Chrome was not sufficient. We really want users to need to open the chrome://extensions page to add sufficient friction to enabling a potentially dangerous capability.

I definitely think integrating it with the permissions API would be nice, so never say never, but passing that on as a reason why it might not happen in the short term :)

Oliver Dunk | DevRel, Chrome Extensions | https://developer.chrome.com/ | London, GB

[Dmitry Seregin]

Hello again! :) We faced problems when trying to set up automated integration tests to fully cover how the extension will work with the granted UserScript permissions. We have not found a way to enable this programmatically, as it requires user action, and we don't have access to the shadow DOM on the settings page for the extension and can't toggle it from the Playwright environment.

Maybe you can suggest a way to do this programmatically, e.g. using Playwright?

[Dmitry Seregin]

Oh, okay, looks like i have found selector since these shadow trees are open: `document.querySelector('extensions-manager').shadowRoot.querySelector('#viewManager').querySelector('extensions-detail-view').shadowRoot.querySelector('#allow-user-scripts').shadowRoot.querySelector('#crToggle').click()`