Timing out permissions

[matthiasclasen]

One idea that has come up repeatedly in design discussions around portals and permission uis is to 'time out' permissions that were granted after a period of non-use.

For example, if you grant your web browser permission to use the webcam, and you use it every day for video conferencing, we don't want to ask you again a week later. But if you once needed to scan in some receipt, and a year later the homebanking app tries to turn on your webcam again, we do want to ask again.

To implement this, we need to keep mtime and atime equivalents for permissions. This could mostly be handled in the permission store itself, but unfortunately, we have api that hands out entire tables without a chance for us to know which row was actually accessed, so this needs some rethinking.

[Mikenux]

Alternatively, have a camera portal that allows selecting the camera device with the option to always use that device? Also, maybe have the option of a UX focused on disabling permission rather than re-requesting, e.g. in GNOME there is an indicator (at least shown in mockups), but it could be more obvious, like showing a notification.

Which other portals are concerned?

[RokeJulianLockhart]

#325 (comment)

However, @matthiasclasen, this functionality must be possible to disable, for a specific permission of a specific application, the application itself, user-wide, and system-wide. Some systems are use-critical, and like on my smartphone, I need to be able to disable this at those levels. I am able to on cpe:2.3:o:google:android:13. Of course, #471 (comment) would be relevant for this.