LotusGuild/cinny
3
0
Fork 0
Code Issues 27 Pull Requests 5 Actions Packages Projects Releases Wiki Activity

Room Widgets v1 follow-ups: capability-approval consent prompt, Jitsi/stickerpicker types, account-data widgets, per-widget popout #205

New Issue
Closed
opened 2026-09-17 23:25:32 -04:00 by jared · 3 comments
jared commented 2026-09-17 23:25:32 -04:00
Owner
Copy Link
Copy Source

Migrated from LOTUS_TODO.md on 2026-09-17 (the file is now reference-only).

Room Widgets v1 follow-ups:** capability-approval consent prompt (let widgets request send/read room events); Jitsi/stickerpicker special types; account-data (user/sticker) widgets; per-widget popout / always-on-screen. Requires the prod CSP frame-src widening (done in matrix/cinny/nginx.conf → nginx -s reload) or external widgets are blocked.

_Migrated from `LOTUS_TODO.md` on 2026-09-17 (the file is now reference-only)._ Room Widgets v1 follow-ups:** capability-approval consent prompt (let widgets request send/read room events); Jitsi/stickerpicker special types; account-data (user/sticker) widgets; per-widget popout / always-on-screen. Requires the prod CSP `frame-src` widening (done in `matrix/cinny/nginx.conf` → **`nginx -s reload`**) or external widgets are blocked.
widget-prompt.png
694 KiB
widget-prompt.png
jared added this to the Features 2026-Q4 milestone 2026-09-17 23:25:32 -04:00
jared added the enhancementpriority: lowarea: navigation labels 2026-09-17 23:25:32 -04:00
jared commented 2026-09-24 21:18:21 -04:00
Author
Owner
Copy Link
Copy Source

Capability-approval consent prompt: shipped (c1661e48)

  • Room widgets can now ask for more than display-only access. A prompt names the widget, the host that runs it and who added it, and lists each request in plain words (e.g. "Send messages of type “m.text” in this room · as you"). Reading is pre-ticked; sending is not. Deny, Escape or clicking away grants nothing extra.
  • Scope is only the widget's own room. These are never offered, and the driver refuses them again at send time:
    • other rooms' timelines (timeline:*)
    • to-device messages
    • account data
    • uploads
    • user-directory search
    • delayed events
    • writing protected state: power levels, join rules, history visibility, encryption, membership, ACLs, aliases, tombstone, widgets
  • "Remember my choice for this widget on this device" is stored per viewer in localStorage and tied to the widget URL, so a changed URL asks again.
  • Driver and live events: the driver implements send, timeline and state reads, and relation reads. The view feeds the room's live (decrypted) events and state updates, which ClientWidgetApi forwards only when the widget holds the capability.

Verified in Chromium with a cross-origin test widget against a local Synapse:

  • the prompt never showed the power-levels or timeline:* requests
  • after allowing send and read, the widget's message landed on the server, and its power-levels write was refused ("Cannot send state events of this type")
  • the widget received a live message sent by another client
  • after a reload, the remembered choice skipped the prompt

Unit tests cover the classifier: automatic vs asked vs denied, and the protected-state list.

prompt

Still open on this issue: Jitsi/stickerpicker special types, account-data (user/sticker) widgets, per-widget popout / always-on-screen.

## Capability-approval consent prompt: shipped (`c1661e48`) - [x] **Room widgets can now ask for more than display-only access.** A prompt names the widget, the host that runs it and who added it, and lists each request in plain words (e.g. "Send messages of type “m.text” in this room · as you"). Reading is pre-ticked; sending is not. Deny, Escape or clicking away grants nothing extra. - [x] **Scope is only the widget's own room.** These are never offered, and the driver refuses them again at send time: - other rooms' timelines (`timeline:*`) - to-device messages - account data - uploads - user-directory search - delayed events - writing protected state: power levels, join rules, history visibility, encryption, membership, ACLs, aliases, tombstone, widgets - [x] **"Remember my choice for this widget on this device"** is stored per viewer in localStorage and tied to the widget URL, so a changed URL asks again. - [x] **Driver and live events:** the driver implements send, timeline and state reads, and relation reads. The view feeds the room's live (decrypted) events and state updates, which ClientWidgetApi forwards only when the widget holds the capability. **Verified** in Chromium with a cross-origin test widget against a local Synapse: - the prompt never showed the power-levels or `timeline:*` requests - after allowing send and read, the widget's message landed on the server, and its power-levels write was refused ("Cannot send state events of this type") - the widget received a live message sent by another client - after a reload, the remembered choice skipped the prompt Unit tests cover the classifier: automatic vs asked vs denied, and the protected-state list. ![prompt](https://code.lotusguild.org/attachments/310791a1-629e-4b54-bca7-460151bf33ce) Still open on this issue: Jitsi/stickerpicker special types, account-data (user/sticker) widgets, per-widget popout / always-on-screen.
jared commented 2026-10-20 21:07:22 -04:00
Author
Owner
Copy Link
Copy Source

Owner decision (2026-10-20): build popout (#441, merged) and always-on-screen (#443). Don't build Jitsi or stickerpicker widget types or account-data widgets: low value, since Lotus has its own calls and sticker packs.

This issue closes once #443 merges.

Owner decision (2026-10-20): build **popout** (#441, merged) and **always-on-screen** (#443). Don't build Jitsi or stickerpicker widget types or account-data widgets: low value, since Lotus has its own calls and sticker packs. This issue closes once #443 merges.
jared commented 2026-10-20 22:22:30 -04:00
Author
Owner
Copy Link
Copy Source

Done: popout (#441) and always-on-screen (#443) are merged. The other items were declined by the owner (see above). Closing.

Done: popout (#441) and always-on-screen (#443) are merged. The other items were declined by the owner (see above). Closing.
jared closed this issue 2026-10-20 22:22:31 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
a11y
Accessibility: keyboard, screen reader, contrast, motion
 area: appearance
Client area: appearance
 area: auth-session
Client area: auth-session
 area: build-ci
Client area: build-ci
 area: calls
Client area: calls
 area: desktop
Client area: desktop
 area: media
Client area: media
 area: messaging
Client area: messaging
 area: mobile
Client area: mobile
 area: moderation
Client area: moderation
 area: navigation
Client area: navigation
 area: notifications
Client area: notifications
 area: settings
Client area: settings
 area: threads
Client area: threads
 bug
Something is not working
 dependencies
Third-party package versions and advisories
 docs
README / LOTUS_* docs wrong or missing
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 needs-human-review
performance
Re-render storms, leaks, heavy work on hot paths
 planning
priority: critical
Data loss, security hole, or crash on a main path
 priority: high
Broken feature or serious usability problem
 priority: low
Minor issue or polish
 priority: medium
Wrong behaviour in an edge case or notable degradation
 qa
Manual QA: shipped, needs a human in a real environment
 question
More information is needed
 research
security
XSS, unsafe URLs, data leaks, auth/session
 tech-debt
Code health, dead code, fragile patterns
 ux
Usability or visual inconsistency
 wontfix
This won't be fixed
No labels area: navigation enhancement priority: low
Milestone
No items
No Milestone Features 2026-Q4
Projects
Clear projects
No projects
Assignees
Clear assignees
cole (Cole Keller) jared (Jared Vititoe) nathan (Nathan Vititoe)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: LotusGuild/cinny#205