Public WebView permission API

BUG: 13699047
Change-Id: Ibcc8c0d4f1bba4365cb71c1991a0fcb1d7febb94

api/current.txt

@@ -32973,6 +32973,16 @@ package android.webkit {
     method public boolean hasMimeType(java.lang.String);
   }
 
+  public abstract interface PermissionRequest {
+    method public abstract void deny();
+    method public abstract android.net.Uri getOrigin();
+    method public abstract long getResources();
+    method public abstract void grant(long);
+    field public static final long RESOURCE_AUDIO_CAPTURE = 4L; // 0x4L
+    field public static final long RESOURCE_GEOLOCATION = 1L; // 0x1L
+    field public static final long RESOURCE_VIDEO_CAPTURE = 2L; // 0x2L
+  }
+
   public abstract interface PluginStub {
     method public abstract android.view.View getEmbeddedView(int, android.content.Context);
     method public abstract android.view.View getFullScreenView(int, android.content.Context);
@@ -33032,6 +33042,8 @@ package android.webkit {
     method public boolean onJsConfirm(android.webkit.WebView, java.lang.String, java.lang.String, android.webkit.JsResult);
     method public boolean onJsPrompt(android.webkit.WebView, java.lang.String, java.lang.String, java.lang.String, android.webkit.JsPromptResult);
     method public deprecated boolean onJsTimeout();
+    method public void onPermissionRequest(android.webkit.PermissionRequest);
+    method public void onPermissionRequestCanceled(android.webkit.PermissionRequest);
     method public void onProgressChanged(android.webkit.WebView, int);
     method public deprecated void onReachedMaxAppCacheSize(long, long, android.webkit.WebStorage.QuotaUpdater);
     method public void onReceivedIcon(android.webkit.WebView, android.graphics.Bitmap);
@@ -33319,6 +33331,7 @@ package android.webkit {
     method public boolean pageUp(boolean);
     method public void pauseTimers();
     method public void postUrl(java.lang.String, byte[]);
+    method public void preauthorizePermission(android.net.Uri, long);
     method public void reload();
     method public void removeJavascriptInterface(java.lang.String);
     method public void requestFocusNodeHref(android.os.Message);

core/java/android/webkit/PermissionRequest.java

@@ -19,14 +19,11 @@ package android.webkit;
 import android.net.Uri;
 
 /**
- * This class wraps a permission request, and is used to request permission for
- * the web content to access the resources.
+ * This interface defines a permission request and is used when web content
+ * requests access to protected resources.
  *
- * Either {@link #grant(long) grant()} or {@link #deny()} must be called to response the
- * request, otherwise, {@link WebChromeClient#onPermissionRequest(PermissionRequest)} will
- * not be invoked again if there is other permission request in this WebView.
- *
- * @hide
+ * Either {@link #grant(long) grant()} or {@link #deny()} must be called in UI
+ * thread to respond to the request.
  */
 public interface PermissionRequest {
     /**
@@ -62,8 +59,6 @@ public interface PermissionRequest {
      *        must be equals or a subset of granted resources.
      *        This parameter is designed to avoid granting permission by accident
      *        especially when new resources are requested by web content.
-     *        Calling grant(getResources()) has security issue, the new permission
-     *        will be granted without being noticed.
      */
     public void grant(long resources);
 

core/java/android/webkit/WebChromeClient.java

@@ -304,7 +304,6 @@ public class WebChromeClient {
      * If this method isn't overridden, the permission is denied.
      *
      * @param request the PermissionRequest from current web content.
-     * @hide
      */
     public void onPermissionRequest(PermissionRequest request) {
         request.deny();
@@ -314,8 +313,7 @@ public class WebChromeClient {
      * Notify the host application that the given permission request
      * has been canceled. Any related UI should therefore be hidden.
      *
-     * @param request the PermissionRequest need be canceled.
-     * @hide
+     * @param request the PermissionRequest that needs be canceled.
      */
     public void onPermissionRequestCanceled(PermissionRequest request) {}
 

core/java/android/webkit/WebView.java

@@ -1682,13 +1682,15 @@ public class WebView extends AbsoluteLayout
 
     /**
      * Preauthorize the given origin to access resources.
-     * This authorization only valid for this WebView instance life cycle and
+     * The authorization only valid for this WebView instance's life cycle and
      * will not retained.
      *
+     * In the case that an origin has had resources preauthorized, calls to
+     * {@link WebChromeClient#onPermissionRequest(PermissionRequest)} will not be
+     * made for those resources from that origin.
+     *
      * @param origin the origin authorized to access resources
      * @param resources the resource authorized to be accessed by origin.
-     *
-     * @hide
      */
     public void preauthorizePermission(Uri origin, long resources) {
         checkThread();