Adding upstream version 1:115.7.0.upstream/1%115.7.0upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 1471 insertions, 0 deletions

diff --git a/browser/actors/WebRTCParent.sys.mjs b/browser/actors/WebRTCParent.sys.mjs
new file mode 100644
index 0000000000..b923d1361b
--- /dev/null
+++ b/browser/actors/WebRTCParent.sys.mjs
@@ -0,0 +1,1471 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+import { XPCOMUtils } from "resource://gre/modules/XPCOMUtils.sys.mjs";
+
+const lazy = {};
+
+ChromeUtils.defineESModuleGetters(lazy, {
+  PrivateBrowsingUtils: "resource://gre/modules/PrivateBrowsingUtils.sys.mjs",
+  SitePermissions: "resource:///modules/SitePermissions.sys.mjs",
+});
+ChromeUtils.defineModuleGetter(
+  lazy,
+  "webrtcUI",
+  "resource:///modules/webrtcUI.jsm"
+);
+
+XPCOMUtils.defineLazyServiceGetter(
+  lazy,
+  "OSPermissions",
+  "@mozilla.org/ospermissionrequest;1",
+  "nsIOSPermissionRequest"
+);
+
+export class WebRTCParent extends JSWindowActorParent {
+  didDestroy() {
+    // Media stream tracks end on unload, so call stopRecording() on them early
+    // *before* we go away, to ensure we're working with the right principal.
+    this.stopRecording(this.manager.outerWindowId);
+    lazy.webrtcUI.forgetStreamsFromBrowserContext(this.browsingContext);
+    // Must clear activePerms here to prevent them from being read by laggard
+    // stopRecording() calls, which due to IPC, may come in *after* navigation.
+    // This is to prevent granting temporary grace periods to the wrong page.
+    lazy.webrtcUI.activePerms.delete(this.manager.outerWindowId);
+  }
+
+  getBrowser() {
+    return this.browsingContext.top.embedderElement;
+  }
+
+  receiveMessage(aMessage) {
+    switch (aMessage.name) {
+      case "rtcpeer:Request": {
+        let params = Object.freeze(
+          Object.assign(
+            {
+              origin: this.manager.documentPrincipal.origin,
+            },
+            aMessage.data
+          )
+        );
+
+        let blockers = Array.from(lazy.webrtcUI.peerConnectionBlockers);
+
+        (async function () {
+          for (let blocker of blockers) {
+            try {
+              let result = await blocker(params);
+              if (result == "deny") {
+                return false;
+              }
+            } catch (err) {
+              console.error(`error in PeerConnection blocker: ${err.message}`);
+            }
+          }
+          return true;
+        })().then(decision => {
+          let message;
+          if (decision) {
+            lazy.webrtcUI.emitter.emit("peer-request-allowed", params);
+            message = "rtcpeer:Allow";
+          } else {
+            lazy.webrtcUI.emitter.emit("peer-request-blocked", params);
+            message = "rtcpeer:Deny";
+          }
+
+          this.sendAsyncMessage(message, {
+            callID: params.callID,
+            windowID: params.windowID,
+          });
+        });
+        break;
+      }
+      case "rtcpeer:CancelRequest": {
+        let params = Object.freeze({
+          origin: this.manager.documentPrincipal.origin,
+          callID: aMessage.data,
+        });
+        lazy.webrtcUI.emitter.emit("peer-request-cancel", params);
+        break;
+      }
+      case "webrtc:Request": {
+        let data = aMessage.data;
+
+        // Record third party origins for telemetry.
+        let isThirdPartyOrigin =
+          this.manager.documentPrincipal.origin !=
+          this.manager.topWindowContext.documentPrincipal.origin;
+        data.isThirdPartyOrigin = isThirdPartyOrigin;
+
+        data.origin = data.shouldDelegatePermission
+          ? this.manager.topWindowContext.documentPrincipal.origin
+          : this.manager.documentPrincipal.origin;
+
+        let browser = this.getBrowser();
+        if (browser.fxrPermissionPrompt) {
+          // For Firefox Reality on Desktop, switch to a different mechanism to
+          // prompt the user since fewer permissions are available and since many
+          // UI dependencies are not available.
+          browser.fxrPermissionPrompt(data);
+        } else {
+          prompt(this, this.getBrowser(), data);
+        }
+        break;
+      }
+      case "webrtc:StopRecording":
+        this.stopRecording(
+          aMessage.data.windowID,
+          aMessage.data.mediaSource,
+          aMessage.data.rawID
+        );
+        break;
+      case "webrtc:CancelRequest": {
+        let browser = this.getBrowser();
+        // browser can be null when closing the window
+        if (browser) {
+          removePrompt(browser, aMessage.data);
+        }
+        break;
+      }
+      case "webrtc:UpdateIndicators": {
+        let { data } = aMessage;
+        data.documentURI = this.manager.documentURI?.spec;
+        if (data.windowId) {
+          if (!data.remove) {
+            data.principal = this.manager.topWindowContext.documentPrincipal;
+          }
+          lazy.webrtcUI.streamAddedOrRemoved(this.browsingContext, data);
+        }
+        this.updateIndicators(data);
+        break;
+      }
+    }
+  }
+
+  updateIndicators(aData) {
+    let browsingContext = this.browsingContext;
+    let state = lazy.webrtcUI.updateIndicators(browsingContext.top);
+
+    let browser = this.getBrowser();
+    if (!browser) {
+      return;
+    }
+
+    state.browsingContext = browsingContext;
+    state.windowId = aData.windowId;
+
+    let tabbrowser = browser.ownerGlobal.gBrowser;
+    if (tabbrowser) {
+      tabbrowser.updateBrowserSharing(browser, {
+        webRTC: state,
+      });
+    }
+  }
+
+  denyRequest(aRequest) {
+    this.sendAsyncMessage("webrtc:Deny", {
+      callID: aRequest.callID,
+      windowID: aRequest.windowID,
+    });
+  }
+
+  //
+  // Deny the request because the browser does not have access to the
+  // camera or microphone due to OS security restrictions. The user may
+  // have granted camera/microphone access to the site, but not have
+  // allowed the browser access in OS settings.
+  //
+  denyRequestNoPermission(aRequest) {
+    this.sendAsyncMessage("webrtc:Deny", {
+      callID: aRequest.callID,
+      windowID: aRequest.windowID,
+      noOSPermission: true,
+    });
+  }
+
+  //
+  // Check if we have permission to access the camera or screen-sharing and/or
+  // microphone at the OS level. Triggers a request to access the device if access
+  // is needed and the permission state has not yet been determined.
+  //
+  async checkOSPermission(camNeeded, micNeeded, scrNeeded) {
+    // Don't trigger OS permission requests for fake devices. Fake devices don't
+    // require OS permission and the dialogs are problematic in automated testing
+    // (where fake devices are used) because they require user interaction.
+    if (
+      !scrNeeded &&
+      Services.prefs.getBoolPref("media.navigator.streams.fake", false)
+    ) {
+      return true;
+    }
+    let camStatus = {},
+      micStatus = {};
+    if (camNeeded || micNeeded) {
+      lazy.OSPermissions.getMediaCapturePermissionState(camStatus, micStatus);
+    }
+    if (camNeeded) {
+      let camPermission = camStatus.value;
+      let camAccessible = await this.checkAndGetOSPermission(
+        camPermission,
+        lazy.OSPermissions.requestVideoCapturePermission
+      );
+      if (!camAccessible) {
+        return false;
+      }
+    }
+    if (micNeeded) {
+      let micPermission = micStatus.value;
+      let micAccessible = await this.checkAndGetOSPermission(
+        micPermission,
+        lazy.OSPermissions.requestAudioCapturePermission
+      );
+      if (!micAccessible) {
+        return false;
+      }
+    }
+    let scrStatus = {};
+    if (scrNeeded) {
+      lazy.OSPermissions.getScreenCapturePermissionState(scrStatus);
+      if (scrStatus.value == lazy.OSPermissions.PERMISSION_STATE_DENIED) {
+        lazy.OSPermissions.maybeRequestScreenCapturePermission();
+        return false;
+      }
+    }
+    return true;
+  }
+
+  //
+  // Given a device's permission, return true if the device is accessible. If
+  // the device's permission is not yet determined, request access to the device.
+  // |requestPermissionFunc| must return a promise that resolves with true
+  // if the device is accessible and false otherwise.
+  //
+  async checkAndGetOSPermission(devicePermission, requestPermissionFunc) {
+    if (
+      devicePermission == lazy.OSPermissions.PERMISSION_STATE_DENIED ||
+      devicePermission == lazy.OSPermissions.PERMISSION_STATE_RESTRICTED
+    ) {
+      return false;
+    }
+    if (devicePermission == lazy.OSPermissions.PERMISSION_STATE_NOTDETERMINED) {
+      let deviceAllowed = await requestPermissionFunc();
+      if (!deviceAllowed) {
+        return false;
+      }
+    }
+    return true;
+  }
+
+  stopRecording(aOuterWindowId, aMediaSource, aRawId) {
+    for (let { browsingContext, state } of lazy.webrtcUI._streams) {
+      if (browsingContext == this.browsingContext) {
+        let { principal } = state;
+        for (let { mediaSource, rawId } of state.devices) {
+          if (aRawId && (aRawId != rawId || aMediaSource != mediaSource)) {
+            continue;
+          }
+          // Deactivate this device (no aRawId means all devices).
+          this.deactivateDevicePerm(
+            aOuterWindowId,
+            mediaSource,
+            rawId,
+            principal
+          );
+        }
+      }
+    }
+  }
+
+  /**
+   * Add a device record to webrtcUI.activePerms, denoting a device as in use.
+   * Important to call for permission grace periods to work correctly.
+   */
+  activateDevicePerm(aOuterWindowId, aMediaSource, aId) {
+    if (!lazy.webrtcUI.activePerms.has(this.manager.outerWindowId)) {
+      lazy.webrtcUI.activePerms.set(this.manager.outerWindowId, new Map());
+    }
+    lazy.webrtcUI.activePerms
+      .get(this.manager.outerWindowId)
+      .set(aOuterWindowId + aMediaSource + aId, aMediaSource);
+  }
+
+  /**
+   * Remove a device record from webrtcUI.activePerms, denoting a device as
+   * no longer in use by the site. Meaning: gUM requests for this device will
+   * no longer be implicitly granted through the webrtcUI.activePerms mechanism.
+   *
+   * However, if webrtcUI.deviceGracePeriodTimeoutMs is defined, the implicit
+   * grant is extended for an additional period of time through SitePermissions.
+   */
+  deactivateDevicePerm(
+    aOuterWindowId,
+    aMediaSource,
+    aId,
+    aPermissionPrincipal
+  ) {
+    // If we don't have active permissions for the given window anymore don't
+    // set a grace period. This happens if there has been a user revoke and
+    // webrtcUI clears the permissions.
+    if (!lazy.webrtcUI.activePerms.has(this.manager.outerWindowId)) {
+      return;
+    }
+    let map = lazy.webrtcUI.activePerms.get(this.manager.outerWindowId);
+    map.delete(aOuterWindowId + aMediaSource + aId);
+
+    // Add a permission grace period for camera and microphone only
+    if (
+      (aMediaSource != "camera" && aMediaSource != "microphone") ||
+      !this.browsingContext.top.embedderElement
+    ) {
+      return;
+    }
+    let gracePeriodMs = lazy.webrtcUI.deviceGracePeriodTimeoutMs;
+    if (gracePeriodMs > 0) {
+      // A grace period is extended (even past navigation) to this outer window
+      // + origin + deviceId only. This avoids re-prompting without the user
+      // having to persist permission to the site, in a common case of a web
+      // conference asking them for the camera in a lobby page, before
+      // navigating to the actual meeting room page. Does not survive tab close.
+      //
+      // Caution: since navigation causes deactivation, we may be in the middle
+      // of one. We must pass in a principal & URI for SitePermissions to use
+      // instead of browser.currentURI, because the latter may point to a new
+      // page already, and we must not leak permission to unrelated pages.
+      //
+      let permissionName = [aMediaSource, aId].join("^");
+      lazy.SitePermissions.setForPrincipal(
+        aPermissionPrincipal,
+        permissionName,
+        lazy.SitePermissions.ALLOW,
+        lazy.SitePermissions.SCOPE_TEMPORARY,
+        this.browsingContext.top.embedderElement,
+        gracePeriodMs
+      );
+    }
+  }
+
+  /**
+   * Checks if the principal has sufficient permissions
+   * to fulfill the given request. If the request can be
+   * fulfilled, a message is sent to the child
+   * signaling that WebRTC permissions were given and
+   * this function will return true.
+   */
+  checkRequestAllowed(aRequest, aPrincipal) {
+    if (!aRequest.secure) {
+      return false;
+    }
+    // Always prompt for screen sharing
+    if (aRequest.sharingScreen) {
+      return false;
+    }
+    let {
+      callID,
+      windowID,
+      audioInputDevices,
+      videoInputDevices,
+      audioOutputDevices,
+      hasInherentAudioConstraints,
+      hasInherentVideoConstraints,
+      audioOutputId,
+    } = aRequest;
+
+    if (audioOutputDevices?.length) {
+      // Prompt if a specific device is not requested, available and allowed.
+      let device = audioOutputDevices.find(({ id }) => id == audioOutputId);
+      if (
+        !device ||
+        !lazy.SitePermissions.getForPrincipal(
+          aPrincipal,
+          ["speaker", device.id].join("^"),
+          this.getBrowser()
+        ).state == lazy.SitePermissions.ALLOW
+      ) {
+        return false;
+      }
+      this.sendAsyncMessage("webrtc:Allow", {
+        callID,
+        windowID,
+        devices: [device.deviceIndex],
+      });
+      return true;
+    }
+
+    let { perms } = Services;
+    if (
+      perms.testExactPermissionFromPrincipal(aPrincipal, "MediaManagerVideo")
+    ) {
+      perms.removeFromPrincipal(aPrincipal, "MediaManagerVideo");
+    }
+
+    // Don't use persistent permissions from the top-level principal
+    // if we're in a cross-origin iframe and permission delegation is not
+    // allowed, or when we're handling a potentially insecure third party
+    // through a wildcard ("*") allow attribute.
+    let limited =
+      (aRequest.isThirdPartyOrigin && !aRequest.shouldDelegatePermission) ||
+      aRequest.secondOrigin;
+
+    let map = lazy.webrtcUI.activePerms.get(this.manager.outerWindowId);
+    // We consider a camera or mic active if it is active or was active within a
+    // grace period of milliseconds ago.
+    const isAllowed = ({ mediaSource, rawId }, permissionID) =>
+      map?.get(windowID + mediaSource + rawId) ||
+      (!limited &&
+        (lazy.SitePermissions.getForPrincipal(aPrincipal, permissionID).state ==
+          lazy.SitePermissions.ALLOW ||
+          lazy.SitePermissions.getForPrincipal(
+            aPrincipal,
+            [mediaSource, rawId].join("^"),
+            this.getBrowser()
+          ).state == lazy.SitePermissions.ALLOW));
+
+    let microphone;
+    if (audioInputDevices.length) {
+      for (let device of audioInputDevices) {
+        if (isAllowed(device, "microphone")) {
+          microphone = device;
+          break;
+        }
+        if (hasInherentAudioConstraints) {
+          // Inherent constraints suggest site is looking for a specific mic
+          break;
+        }
+        // Some sites don't look too hard at what they get, and spam gUM without
+        // adjusting what they ask for to match what they got last time. To keep
+        // users in charge and reduce prompts, ignore other constraints by
+        // returning the most-fit microphone a site already has access to.
+      }
+      if (!microphone) {
+        return false;
+      }
+    }
+    let camera;
+    if (videoInputDevices.length) {
+      for (let device of videoInputDevices) {
+        if (isAllowed(device, "camera")) {
+          camera = device;
+          break;
+        }
+        if (hasInherentVideoConstraints) {
+          // Inherent constraints suggest site is looking for a specific camera
+          break;
+        }
+        // Some sites don't look too hard at what they get, and spam gUM without
+        // adjusting what they ask for to match what they got last time. To keep
+        // users in charge and reduce prompts, ignore other constraints by
+        // returning the most-fit camera a site already has access to.
+      }
+      if (!camera) {
+        return false;
+      }
+    }
+    let devices = [];
+    if (camera) {
+      perms.addFromPrincipal(
+        aPrincipal,
+        "MediaManagerVideo",
+        perms.ALLOW_ACTION,
+        perms.EXPIRE_SESSION
+      );
+      devices.push(camera.deviceIndex);
+      this.activateDevicePerm(windowID, camera.mediaSource, camera.rawId);
+    }
+    if (microphone) {
+      devices.push(microphone.deviceIndex);
+      this.activateDevicePerm(
+        windowID,
+        microphone.mediaSource,
+        microphone.rawId
+      );
+    }
+    this.checkOSPermission(!!camera, !!microphone, false).then(
+      havePermission => {
+        if (havePermission) {
+          this.sendAsyncMessage("webrtc:Allow", { callID, windowID, devices });
+        } else {
+          this.denyRequestNoPermission(aRequest);
+        }
+      }
+    );
+    return true;
+  }
+}
+
+function prompt(aActor, aBrowser, aRequest) {
+  let {
+    audioInputDevices,
+    videoInputDevices,
+    audioOutputDevices,
+    sharingScreen,
+    sharingAudio,
+    requestTypes,
+  } = aRequest;
+
+  let principal =
+    Services.scriptSecurityManager.createContentPrincipalFromOrigin(
+      aRequest.origin
+    );
+
+  // For add-on principals, we immediately check for permission instead
+  // of waiting for the notification to focus. This allows for supporting
+  // cases such as browserAction popups where no prompt is shown.
+  if (principal.addonPolicy) {
+    let isPopup = false;
+    let isBackground = false;
+
+    for (let view of principal.addonPolicy.extension.views) {
+      if (view.viewType == "popup" && view.xulBrowser == aBrowser) {
+        isPopup = true;
+      }
+      if (view.viewType == "background" && view.xulBrowser == aBrowser) {
+        isBackground = true;
+      }
+    }
+
+    // Recording from background pages is considered too sensitive and will
+    // always be denied.
+    if (isBackground) {
+      aActor.denyRequest(aRequest);
+      return;
+    }
+
+    // If the request comes from a popup, we don't want to show the prompt,
+    // but we do want to allow the request if the user previously gave permission.
+    if (isPopup) {
+      if (!aActor.checkRequestAllowed(aRequest, principal, aBrowser)) {
+        aActor.denyRequest(aRequest);
+      }
+      return;
+    }
+  }
+
+  // If the user has already denied access once in this tab,
+  // deny again without even showing the notification icon.
+  for (const type of requestTypes) {
+    const permissionID =
+      type == "AudioCapture" ? "microphone" : type.toLowerCase();
+    if (
+      lazy.SitePermissions.getForPrincipal(principal, permissionID, aBrowser)
+        .state == lazy.SitePermissions.BLOCK
+    ) {
+      aActor.denyRequest(aRequest);
+      return;
+    }
+  }
+
+  let chromeDoc = aBrowser.ownerDocument;
+  const localization = new Localization(
+    ["browser/webrtcIndicator.ftl", "branding/brand.ftl"],
+    true
+  );
+
+  /** @type {"Screen" | "Camera" | null} */
+  let reqVideoInput = null;
+  if (videoInputDevices.length) {
+    reqVideoInput = sharingScreen ? "Screen" : "Camera";
+  }
+  /** @type {"AudioCapture" | "Microphone" | null} */
+  let reqAudioInput = null;
+  if (audioInputDevices.length) {
+    reqAudioInput = sharingAudio ? "AudioCapture" : "Microphone";
+  }
+  const reqAudioOutput = !!audioOutputDevices.length;
+
+  const stringId = getPromptMessageId(
+    reqVideoInput,
+    reqAudioInput,
+    reqAudioOutput,
+    !!aRequest.secondOrigin
+  );
+  const message = localization.formatValueSync(stringId, {
+    origin: "<>",
+    thirdParty: "{}",
+  });
+
+  let notification; // Used by action callbacks.
+  const actionL10nIds = [{ id: "webrtc-action-allow" }];
+
+  let notificationSilencingEnabled = Services.prefs.getBoolPref(
+    "privacy.webrtc.allowSilencingNotifications"
+  );
+
+  const isNotNowLabelEnabled =
+    reqAudioOutput || allowedOrActiveCameraOrMicrophone(aBrowser);
+  let secondaryActions = [];
+  if (reqAudioOutput || (notificationSilencingEnabled && sharingScreen)) {
+    // We want to free up the checkbox at the bottom of the permission
+    // panel for the notification silencing option, so we use a
+    // different configuration for the permissions panel when
+    // notification silencing is enabled.
+
+    let permissionName = reqAudioOutput ? "speaker" : "screen";
+    // When selecting speakers, we always offer 'Not now' instead of 'Block'.
+    // When selecting screens, we offer 'Not now' if and only if we have a
+    // (temporary) allow permission for some mic/cam device.
+    const id = isNotNowLabelEnabled
+      ? "webrtc-action-not-now"
+      : "webrtc-action-block";
+    actionL10nIds.push({ id }, { id: "webrtc-action-always-block" });
+    secondaryActions = [
+      {
+        callback(aState) {
+          aActor.denyRequest(aRequest);
+          if (!isNotNowLabelEnabled) {
+            lazy.SitePermissions.setForPrincipal(
+              principal,
+              permissionName,
+              lazy.SitePermissions.BLOCK,
+              lazy.SitePermissions.SCOPE_TEMPORARY,
+              notification.browser
+            );
+          }
+        },
+      },
+      {
+        callback(aState) {
+          aActor.denyRequest(aRequest);
+          lazy.SitePermissions.setForPrincipal(
+            principal,
+            permissionName,
+            lazy.SitePermissions.BLOCK,
+            lazy.SitePermissions.SCOPE_PERSISTENT,
+            notification.browser
+          );
+        },
+      },
+    ];
+  } else {
+    // We have a (temporary) allow permission for some device
+    // hence we offer a 'Not now' label instead of 'Block'.
+    const id = isNotNowLabelEnabled
+      ? "webrtc-action-not-now"
+      : "webrtc-action-block";
+    actionL10nIds.push({ id });
+    secondaryActions = [
+      {
+        callback(aState) {
+          aActor.denyRequest(aRequest);
+
+          const isPersistent = aState?.checkboxChecked;
+
+          // Choosing 'Not now' will not set a block permission
+          // we just deny the request. This enables certain use cases
+          // where sites want to switch devices, but users back out of the permission request
+          // (See Bug 1609578).
+          // Selecting 'Remember this decision' and clicking 'Not now' will set a persistent block
+          if (!isPersistent && isNotNowLabelEnabled) {
+            return;
+          }
+
+          // Denying a camera / microphone prompt means we set a temporary or
+          // persistent permission block. There may still be active grace period
+          // permissions at this point. We need to remove them.
+          clearTemporaryGrants(
+            notification.browser,
+            reqVideoInput === "Camera",
+            !!reqAudioInput
+          );
+
+          const scope = isPersistent
+            ? lazy.SitePermissions.SCOPE_PERSISTENT
+            : lazy.SitePermissions.SCOPE_TEMPORARY;
+          if (reqAudioInput) {
+            lazy.SitePermissions.setForPrincipal(
+              principal,
+              "microphone",
+              lazy.SitePermissions.BLOCK,
+              scope,
+              notification.browser
+            );
+          }
+          if (reqVideoInput) {
+            lazy.SitePermissions.setForPrincipal(
+              principal,
+              sharingScreen ? "screen" : "camera",
+              lazy.SitePermissions.BLOCK,
+              scope,
+              notification.browser
+            );
+          }
+        },
+      },
+    ];
+  }
+
+  // The formatMessagesSync method returns an array of results
+  // for each message that was requested, and for the ones with
+  // attributes, returns an attributes array with objects like:
+  //     { name: "label", value: "somevalue" }
+  const [mainMessage, ...secondaryMessages] = localization
+    .formatMessagesSync(actionL10nIds)
+    .map(msg =>
+      msg.attributes.reduce(
+        (acc, { name, value }) => ({ ...acc, [name]: value }),
+        {}
+      )
+    );
+
+  const mainAction = {
+    label: mainMessage.label,
+    accessKey: mainMessage.accesskey,
+    // The real callback will be set during the "showing" event. The
+    // empty function here is so that PopupNotifications.show doesn't
+    // reject the action.
+    callback() {},
+  };
+
+  for (let i = 0; i < secondaryActions.length; ++i) {
+    secondaryActions[i].label = secondaryMessages[i].label;
+    secondaryActions[i].accessKey = secondaryMessages[i].accesskey;
+  }
+
+  let options = {
+    name: lazy.webrtcUI.getHostOrExtensionName(principal.URI),
+    persistent: true,
+    hideClose: true,
+    eventCallback(aTopic, aNewBrowser, isCancel) {
+      if (aTopic == "swapping") {
+        return true;
+      }
+
+      let doc = this.browser.ownerDocument;
+
+      // Clean-up video streams of screensharing previews.
+      if (
+        reqVideoInput !== "Screen" ||
+        aTopic == "dismissed" ||
+        aTopic == "removed"
+      ) {
+        let video = doc.getElementById("webRTC-previewVideo");
+        video.deviceId = null; // Abort previews still being started.
+        if (video.stream) {
+          video.stream.getTracks().forEach(t => t.stop());
+          video.stream = null;
+          video.src = null;
+          doc.getElementById("webRTC-preview").hidden = true;
+        }
+        let menupopup = doc.getElementById("webRTC-selectWindow-menupopup");
+        if (menupopup._commandEventListener) {
+          menupopup.removeEventListener(
+            "command",
+            menupopup._commandEventListener
+          );
+          menupopup._commandEventListener = null;
+        }
+      }
+
+      // If the notification has been cancelled (e.g. due to entering full-screen), also cancel the webRTC request
+      if (aTopic == "removed" && notification && isCancel) {
+        aActor.denyRequest(aRequest);
+      }
+
+      if (aTopic != "showing") {
+        return false;
+      }
+
+      // If BLOCK has been set persistently in the permission manager or has
+      // been set on the tab, then it is handled synchronously before we add
+      // the notification.
+      // Handling of ALLOW is delayed until the popupshowing event,
+      // to avoid granting permissions automatically to background tabs.
+      if (aActor.checkRequestAllowed(aRequest, principal, aBrowser)) {
+        this.remove();
+        return true;
+      }
+
+      function listDevices(menupopup, devices, labelID) {
+        while (menupopup.lastChild) {
+          menupopup.removeChild(menupopup.lastChild);
+        }
+        let menulist = menupopup.parentNode;
+        // Removing the child nodes of the menupopup doesn't clear the value
+        // attribute of the menulist. This can have unfortunate side effects
+        // when the list is rebuilt with a different content, so we remove
+        // the value attribute and unset the selectedItem explicitly.
+        menulist.removeAttribute("value");
+        menulist.selectedItem = null;
+
+        for (let device of devices) {
+          let item = addDeviceToList(
+            menupopup,
+            device.name,
+            device.deviceIndex
+          );
+          if (device.id == aRequest.audioOutputId) {
+            menulist.selectedItem = item;
+          }
+        }
+
+        let label = doc.getElementById(labelID);
+        if (devices.length == 1) {
+          label.value = devices[0].name;
+          label.hidden = false;
+          menulist.hidden = true;
+        } else {
+          label.hidden = true;
+          menulist.hidden = false;
+        }
+      }
+
+      let notificationElement = doc.getElementById(
+        "webRTC-shareDevices-notification"
+      );
+
+      function checkDisabledWindowMenuItem() {
+        let list = doc.getElementById("webRTC-selectWindow-menulist");
+        let item = list.selectedItem;
+        if (!item || item.hasAttribute("disabled")) {
+          notificationElement.setAttribute("invalidselection", "true");
+        } else {
+          notificationElement.removeAttribute("invalidselection");
+        }
+      }
+
+      function listScreenShareDevices(menupopup, devices) {
+        while (menupopup.lastChild) {
+          menupopup.removeChild(menupopup.lastChild);
+        }
+
+        // Removing the child nodes of the menupopup doesn't clear the value
+        // attribute of the menulist. This can have unfortunate side effects
+        // when the list is rebuilt with a different content, so we remove
+        // the value attribute and unset the selectedItem explicitly.
+        menupopup.parentNode.removeAttribute("value");
+        menupopup.parentNode.selectedItem = null;
+
+        // "Select a Window or Screen" is the default because we can't and don't
+        // want to pick a 'default' window to share (Full screen is "scary").
+        addDeviceToList(
+          menupopup,
+          localization.formatValueSync("webrtc-pick-window-or-screen"),
+          "-1"
+        );
+        menupopup.appendChild(doc.createXULElement("menuseparator"));
+
+        let isPipeWireDetected = false;
+
+        // Build the list of 'devices'.
+        let monitorIndex = 1;
+        for (let i = 0; i < devices.length; ++i) {
+          let device = devices[i];
+          let type = device.mediaSource;
+          let name;
+          if (device.canRequestOsLevelPrompt) {
+            // When we share content by PipeWire add only one item to the device
+            // list. When it's selected PipeWire portal dialog is opened and
+            // user confirms actual window/screen sharing there.
+            // Don't mark it as scary as there's an extra confirmation step by
+            // PipeWire portal dialog.
+
+            isPipeWireDetected = true;
+            let item = addDeviceToList(
+              menupopup,
+              localization.formatValueSync("webrtc-share-pipe-wire-portal"),
+              i,
+              type
+            );
+            item.deviceId = device.rawId;
+            item.mediaSource = type;
+
+            // In this case the OS sharing dialog will be the only option and
+            // can be safely pre-selected.
+            menupopup.parentNode.selectedItem = item;
+            continue;
+          } else if (type == "screen") {
+            // Building screen list from available screens.
+            if (device.name == "Primary Monitor") {
+              name = localization.formatValueSync("webrtc-share-entire-screen");
+            } else {
+              name = localization.formatValueSync("webrtc-share-monitor", {
+                monitorIndex,
+              });
+              ++monitorIndex;
+            }
+          } else {
+            name = device.name;
+
+            if (type == "application") {
+              // The application names returned by the platform are of the form:
+              // <window count>\x1e<application name>
+              const [count, appName] = name.split("\x1e");
+              name = localization.formatValueSync("webrtc-share-application", {
+                appName,
+                windowCount: parseInt(count),
+              });
+            }
+          }
+          let item = addDeviceToList(menupopup, name, i, type);
+          item.deviceId = device.rawId;
+          item.mediaSource = type;
+          if (device.scary) {
+            item.scary = true;
+          }
+        }
+
+        // Always re-select the "No <type>" item.
+        doc
+          .getElementById("webRTC-selectWindow-menulist")
+          .removeAttribute("value");
+        doc.getElementById("webRTC-all-windows-shared").hidden = true;
+
+        menupopup._commandEventListener = event => {
+          checkDisabledWindowMenuItem();
+          let video = doc.getElementById("webRTC-previewVideo");
+          if (video.stream) {
+            video.stream.getTracks().forEach(t => t.stop());
+            video.stream = null;
+          }
+
+          const { deviceId, mediaSource, scary } = event.target;
+          if (deviceId == undefined) {
+            doc.getElementById("webRTC-preview").hidden = true;
+            video.src = null;
+            return;
+          }
+
+          let warning = doc.getElementById("webRTC-previewWarning");
+          let warningBox = doc.getElementById("webRTC-previewWarningBox");
+          warningBox.hidden = !scary;
+          let chromeWin = doc.defaultView;
+          if (scary) {
+            const warnId =
+              mediaSource == "screen"
+                ? "webrtc-share-screen-warning"
+                : "webrtc-share-browser-warning";
+            doc.l10n.setAttributes(warning, warnId);
+
+            const learnMore = doc.getElementById(
+              "webRTC-previewWarning-learnMore"
+            );
+            const baseURL = Services.urlFormatter.formatURLPref(
+              "app.support.baseURL"
+            );
+            learnMore.setAttribute("href", baseURL + "screenshare-safety");
+            doc.l10n.setAttributes(learnMore, "webrtc-share-screen-learn-more");
+
+            // On Catalina, we don't want to blow our chance to show the
+            // OS-level helper prompt to enable screen recording if the user
+            // intends to reject anyway. OTOH showing it when they click Allow
+            // is too late. A happy middle is to show it when the user makes a
+            // choice in the picker. This already happens implicitly if the
+            // user chooses "Entire desktop", as a side-effect of our preview,
+            // we just need to also do it if they choose "Firefox". These are
+            // the lone two options when permission is absent on Catalina.
+            // Ironically, these are the two sources marked "scary" from a
+            // web-sharing perspective, which is why this code resides here.
+            // A restart doesn't appear to be necessary in spite of OS wording.
+            let scrStatus = {};
+            lazy.OSPermissions.getScreenCapturePermissionState(scrStatus);
+            if (scrStatus.value == lazy.OSPermissions.PERMISSION_STATE_DENIED) {
+              lazy.OSPermissions.maybeRequestScreenCapturePermission();
+            }
+          }
+
+          let perms = Services.perms;
+          let chromePrincipal =
+            Services.scriptSecurityManager.getSystemPrincipal();
+          perms.addFromPrincipal(
+            chromePrincipal,
+            "MediaManagerVideo",
+            perms.ALLOW_ACTION,
+            perms.EXPIRE_SESSION
+          );
+
+          // We don't have access to any screen content besides our browser tabs
+          // on Wayland, therefore there are no previews we can show.
+          if (!isPipeWireDetected || mediaSource == "browser") {
+            video.deviceId = deviceId;
+            let constraints = {
+              video: { mediaSource, deviceId: { exact: deviceId } },
+            };
+            chromeWin.navigator.mediaDevices.getUserMedia(constraints).then(
+              stream => {
+                if (video.deviceId != deviceId) {
+                  // The user has selected a different device or closed the panel
+                  // before getUserMedia finished.
+                  stream.getTracks().forEach(t => t.stop());
+                  return;
+                }
+                video.srcObject = stream;
+                video.stream = stream;
+                doc.getElementById("webRTC-preview").hidden = false;
+                video.onloadedmetadata = function (e) {
+                  video.play();
+                };
+              },
+              err => {
+                if (
+                  err.name == "OverconstrainedError" &&
+                  err.constraint == "deviceId"
+                ) {
+                  // Window has disappeared since enumeration, which can happen.
+                  // No preview for you.
+                  return;
+                }
+                console.error(
+                  `error in preview: ${err.message} ${err.constraint}`
+                );
+              }
+            );
+          }
+        };
+        menupopup.addEventListener("command", menupopup._commandEventListener);
+      }
+
+      function addDeviceToList(menupopup, deviceName, deviceIndex, type) {
+        let menuitem = doc.createXULElement("menuitem");
+        menuitem.setAttribute("value", deviceIndex);
+        menuitem.setAttribute("label", deviceName);
+        menuitem.setAttribute("tooltiptext", deviceName);
+        if (type) {
+          menuitem.setAttribute("devicetype", type);
+        }
+
+        if (deviceIndex == "-1") {
+          menuitem.setAttribute("disabled", true);
+        }
+
+        menupopup.appendChild(menuitem);
+        return menuitem;
+      }
+
+      doc.getElementById("webRTC-selectCamera").hidden =
+        reqVideoInput !== "Camera";
+      doc.getElementById("webRTC-selectWindowOrScreen").hidden =
+        reqVideoInput !== "Screen";
+      doc.getElementById("webRTC-selectMicrophone").hidden =
+        reqAudioInput !== "Microphone";
+      doc.getElementById("webRTC-selectSpeaker").hidden = !reqAudioOutput;
+
+      let camMenupopup = doc.getElementById("webRTC-selectCamera-menupopup");
+      let windowMenupopup = doc.getElementById("webRTC-selectWindow-menupopup");
+      let micMenupopup = doc.getElementById(
+        "webRTC-selectMicrophone-menupopup"
+      );
+      let speakerMenupopup = doc.getElementById(
+        "webRTC-selectSpeaker-menupopup"
+      );
+      let describedByIDs = ["webRTC-shareDevices-notification-description"];
+
+      if (sharingScreen) {
+        listScreenShareDevices(windowMenupopup, videoInputDevices);
+        checkDisabledWindowMenuItem();
+      } else {
+        let labelID = "webRTC-selectCamera-single-device-label";
+        listDevices(camMenupopup, videoInputDevices, labelID);
+        notificationElement.removeAttribute("invalidselection");
+        if (videoInputDevices.length == 1) {
+          describedByIDs.push("webRTC-selectCamera-icon", labelID);
+        }
+      }
+
+      if (!sharingAudio) {
+        let labelID = "webRTC-selectMicrophone-single-device-label";
+        listDevices(micMenupopup, audioInputDevices, labelID);
+        if (audioInputDevices.length == 1) {
+          describedByIDs.push("webRTC-selectMicrophone-icon", labelID);
+        }
+      }
+
+      let labelID = "webRTC-selectSpeaker-single-device-label";
+      listDevices(speakerMenupopup, audioOutputDevices, labelID);
+      if (audioOutputDevices.length == 1) {
+        describedByIDs.push("webRTC-selectSpeaker-icon", labelID);
+      }
+
+      // PopupNotifications knows to clear the aria-describedby attribute
+      // when hiding, so we don't have to worry about cleaning it up ourselves.
+      chromeDoc.defaultView.PopupNotifications.panel.setAttribute(
+        "aria-describedby",
+        describedByIDs.join(" ")
+      );
+
+      this.mainAction.callback = async function (aState) {
+        let remember = false;
+        let silenceNotifications = false;
+
+        if (notificationSilencingEnabled && sharingScreen) {
+          silenceNotifications = aState && aState.checkboxChecked;
+        } else {
+          remember = aState && aState.checkboxChecked;
+        }
+
+        let allowedDevices = [];
+        let perms = Services.perms;
+        if (reqVideoInput) {
+          let listId = sharingScreen
+            ? "webRTC-selectWindow-menulist"
+            : "webRTC-selectCamera-menulist";
+          let videoDeviceIndex = doc.getElementById(listId).value;
+          let allowVideoDevice = videoDeviceIndex != "-1";
+          if (allowVideoDevice) {
+            allowedDevices.push(videoDeviceIndex);
+            // Session permission will be removed after use
+            // (it's really one-shot, not for the entire session)
+            perms.addFromPrincipal(
+              principal,
+              "MediaManagerVideo",
+              perms.ALLOW_ACTION,
+              perms.EXPIRE_SESSION
+            );
+            let { mediaSource, rawId } = videoInputDevices.find(
+              ({ deviceIndex }) => deviceIndex == videoDeviceIndex
+            );
+            aActor.activateDevicePerm(aRequest.windowID, mediaSource, rawId);
+            if (remember) {
+              lazy.SitePermissions.setForPrincipal(
+                principal,
+                "camera",
+                lazy.SitePermissions.ALLOW
+              );
+            }
+          }
+        }
+
+        if (reqAudioInput === "Microphone") {
+          let audioDeviceIndex = doc.getElementById(
+            "webRTC-selectMicrophone-menulist"
+          ).value;
+          let allowMic = audioDeviceIndex != "-1";
+          if (allowMic) {
+            allowedDevices.push(audioDeviceIndex);
+            let { mediaSource, rawId } = audioInputDevices.find(
+              ({ deviceIndex }) => deviceIndex == audioDeviceIndex
+            );
+            aActor.activateDevicePerm(aRequest.windowID, mediaSource, rawId);
+            if (remember) {
+              lazy.SitePermissions.setForPrincipal(
+                principal,
+                "microphone",
+                lazy.SitePermissions.ALLOW
+              );
+            }
+          }
+        } else if (reqAudioInput === "AudioCapture") {
+          // Only one device possible for audio capture.
+          allowedDevices.push(0);
+        }
+
+        if (reqAudioOutput) {
+          let audioDeviceIndex = doc.getElementById(
+            "webRTC-selectSpeaker-menulist"
+          ).value;
+          let allowSpeaker = audioDeviceIndex != "-1";
+          if (allowSpeaker) {
+            allowedDevices.push(audioDeviceIndex);
+            let { id } = audioOutputDevices.find(
+              ({ deviceIndex }) => deviceIndex == audioDeviceIndex
+            );
+            lazy.SitePermissions.setForPrincipal(
+              principal,
+              ["speaker", id].join("^"),
+              lazy.SitePermissions.ALLOW
+            );
+          }
+        }
+
+        if (!allowedDevices.length) {
+          aActor.denyRequest(aRequest);
+          return;
+        }
+
+        const camNeeded = reqVideoInput === "Camera";
+        const micNeeded = !!reqAudioInput;
+        const scrNeeded = reqVideoInput === "Screen";
+        const havePermission = await aActor.checkOSPermission(
+          camNeeded,
+          micNeeded,
+          scrNeeded
+        );
+        if (!havePermission) {
+          aActor.denyRequestNoPermission(aRequest);
+          return;
+        }
+
+        aActor.sendAsyncMessage("webrtc:Allow", {
+          callID: aRequest.callID,
+          windowID: aRequest.windowID,
+          devices: allowedDevices,
+          suppressNotifications: silenceNotifications,
+        });
+      };
+
+      // If we haven't handled the permission yet, we want to show the doorhanger.
+      return false;
+    },
+  };
+
+  function shouldShowAlwaysRemember() {
+    // Don't offer "always remember" action in PB mode
+    if (lazy.PrivateBrowsingUtils.isBrowserPrivate(aBrowser)) {
+      return false;
+    }
+
+    // Don't offer "always remember" action in third party with no permission
+    // delegation
+    if (aRequest.isThirdPartyOrigin && !aRequest.shouldDelegatePermission) {
+      return false;
+    }
+
+    // Don't offer "always remember" action in maybe unsafe permission
+    // delegation
+    if (aRequest.shouldDelegatePermission && aRequest.secondOrigin) {
+      return false;
+    }
+
+    // Speaker grants are always remembered, so no checkbox is required.
+    if (reqAudioOutput) {
+      return false;
+    }
+
+    return true;
+  }
+
+  if (shouldShowAlwaysRemember()) {
+    // Disable the permanent 'Allow' action if the connection isn't secure, or for
+    // screen/audio sharing (because we can't guess which window the user wants to
+    // share without prompting). Note that we never enter this block for private
+    // browsing windows.
+    let reason = "";
+    if (sharingScreen) {
+      reason = "webrtc-reason-for-no-permanent-allow-screen";
+    } else if (sharingAudio) {
+      reason = "webrtc-reason-for-no-permanent-allow-audio";
+    } else if (!aRequest.secure) {
+      reason = "webrtc-reason-for-no-permanent-allow-insecure";
+    }
+
+    options.checkbox = {
+      label: localization.formatValueSync("webrtc-remember-allow-checkbox"),
+      checked: principal.isAddonOrExpandedAddonPrincipal,
+      checkedState: reason
+        ? {
+            disableMainAction: true,
+            warningLabel: localization.formatValueSync(reason),
+          }
+        : undefined,
+    };
+  }
+
+  // If the notification silencing feature is enabled and we're sharing a
+  // screen, then the checkbox for the permission panel is what controls
+  // notification silencing.
+  if (notificationSilencingEnabled && sharingScreen) {
+    options.checkbox = {
+      label: localization.formatValueSync("webrtc-mute-notifications-checkbox"),
+      checked: false,
+      checkedState: {
+        disableMainAction: false,
+      },
+    };
+  }
+
+  let anchorId = "webRTC-shareDevices-notification-icon";
+  if (reqVideoInput === "Screen") {
+    anchorId = "webRTC-shareScreen-notification-icon";
+  } else if (!reqVideoInput) {
+    if (reqAudioInput && !reqAudioOutput) {
+      anchorId = "webRTC-shareMicrophone-notification-icon";
+    } else if (!reqAudioInput && reqAudioOutput) {
+      anchorId = "webRTC-shareSpeaker-notification-icon";
+    }
+  }
+
+  if (aRequest.secondOrigin) {
+    options.secondName = lazy.webrtcUI.getHostOrExtensionName(
+      null,
+      aRequest.secondOrigin
+    );
+  }
+
+  notification = chromeDoc.defaultView.PopupNotifications.show(
+    aBrowser,
+    "webRTC-shareDevices",
+    message,
+    anchorId,
+    mainAction,
+    secondaryActions,
+    options
+  );
+  notification.callID = aRequest.callID;
+
+  let schemeHistogram = Services.telemetry.getKeyedHistogramById(
+    "PERMISSION_REQUEST_ORIGIN_SCHEME"
+  );
+  let userInputHistogram = Services.telemetry.getKeyedHistogramById(
+    "PERMISSION_REQUEST_HANDLING_USER_INPUT"
+  );
+
+  let docURI = aRequest.documentURI;
+  let scheme = 0;
+  if (docURI.startsWith("https")) {
+    scheme = 2;
+  } else if (docURI.startsWith("http")) {
+    scheme = 1;
+  }
+
+  for (let requestType of requestTypes) {
+    if (requestType == "AudioCapture") {
+      requestType = "Microphone";
+    }
+    requestType = requestType.toLowerCase();
+
+    schemeHistogram.add(requestType, scheme);
+    userInputHistogram.add(requestType, aRequest.isHandlingUserInput);
+  }
+}
+
+/**
+ * @param {"Screen" | "Camera" | null} reqVideoInput
+ * @param {"AudioCapture" | "Microphone" | null} reqAudioInput
+ * @param {boolean} reqAudioOutput
+ * @param {boolean} delegation - Is the access delegated to a third party?
+ * @returns {string} Localization message identifier
+ */
+function getPromptMessageId(
+  reqVideoInput,
+  reqAudioInput,
+  reqAudioOutput,
+  delegation
+) {
+  switch (reqVideoInput) {
+    case "Camera":
+      switch (reqAudioInput) {
+        case "Microphone":
+          return delegation
+            ? "webrtc-allow-share-camera-and-microphone-unsafe-delegation"
+            : "webrtc-allow-share-camera-and-microphone";
+        case "AudioCapture":
+          return delegation
+            ? "webrtc-allow-share-camera-and-audio-capture-unsafe-delegation"
+            : "webrtc-allow-share-camera-and-audio-capture";
+        default:
+          return delegation
+            ? "webrtc-allow-share-camera-unsafe-delegation"
+            : "webrtc-allow-share-camera";
+      }
+
+    case "Screen":
+      switch (reqAudioInput) {
+        case "Microphone":
+          return delegation
+            ? "webrtc-allow-share-screen-and-microphone-unsafe-delegation"
+            : "webrtc-allow-share-screen-and-microphone";
+        case "AudioCapture":
+          return delegation
+            ? "webrtc-allow-share-screen-and-audio-capture-unsafe-delegation"
+            : "webrtc-allow-share-screen-and-audio-capture";
+        default:
+          return delegation
+            ? "webrtc-allow-share-screen-unsafe-delegation"
+            : "webrtc-allow-share-screen";
+      }
+
+    default:
+      switch (reqAudioInput) {
+        case "Microphone":
+          return delegation
+            ? "webrtc-allow-share-microphone-unsafe-delegation"
+            : "webrtc-allow-share-microphone";
+        case "AudioCapture":
+          return delegation
+            ? "webrtc-allow-share-audio-capture-unsafe-delegation"
+            : "webrtc-allow-share-audio-capture";
+        default:
+          // This should be always true, if we've reached this far.
+          if (reqAudioOutput) {
+            return delegation
+              ? "webrtc-allow-share-speaker-unsafe-delegation"
+              : "webrtc-allow-share-speaker";
+          }
+          return undefined;
+      }
+  }
+}
+
+/**
+ * Checks whether we have a microphone/camera in use by checking the activePerms map
+ * or if we have an allow permission for a microphone/camera in sitePermissions
+ * @param {Browser} browser - Browser to find all active and allowed microphone and camera devices for
+ * @return true if one of the above conditions is met
+ */
+function allowedOrActiveCameraOrMicrophone(browser) {
+  // Do we have an allow permission for cam/mic in the permissions manager?
+  if (
+    lazy.SitePermissions.getAllForBrowser(browser).some(perm => {
+      return (
+        perm.state == lazy.SitePermissions.ALLOW &&
+        (perm.id.startsWith("camera") || perm.id.startsWith("microphone"))
+      );
+    })
+  ) {
+    // Return early, no need to check for active devices
+    return true;
+  }
+
+  // Do we have an active device?
+  return (
+    // Find all windowIDs that belong to our browsing contexts
+    browser.browsingContext
+      .getAllBrowsingContextsInSubtree()
+      // Only keep the outerWindowIds
+      .map(bc => bc.currentWindowGlobal?.outerWindowId)
+      .filter(id => id != null)
+      // We have an active device if one of our windowIds has a non empty map in the activePerms map
+      // that includes one device of type "camera" or "microphone"
+      .some(id => {
+        let map = lazy.webrtcUI.activePerms.get(id);
+        if (!map) {
+          // This windowId has no active device
+          return false;
+        }
+        // Let's see if one of the devices is a camera or a microphone
+        let types = [...map.values()];
+        return types.includes("microphone") || types.includes("camera");
+      })
+  );
+}
+
+function removePrompt(aBrowser, aCallId) {
+  let chromeWin = aBrowser.ownerGlobal;
+  let notification = chromeWin.PopupNotifications.getNotification(
+    "webRTC-shareDevices",
+    aBrowser
+  );
+  if (notification && notification.callID == aCallId) {
+    notification.remove();
+  }
+}
+
+/**
+ * Clears temporary permission grants used for WebRTC device grace periods.
+ * @param browser - Browser element to clear permissions for.
+ * @param {boolean} clearCamera - Clear camera grants.
+ * @param {boolean} clearMicrophone - Clear microphone grants.
+ */
+function clearTemporaryGrants(browser, clearCamera, clearMicrophone) {
+  if (!clearCamera && !clearMicrophone) {
+    // Nothing to clear.
+    return;
+  }
+  let perms = lazy.SitePermissions.getAllForBrowser(browser);
+  perms
+    .filter(perm => {
+      let [id, key] = perm.id.split(lazy.SitePermissions.PERM_KEY_DELIMITER);
+      // We only want to clear WebRTC grace periods. These are temporary, device
+      // specifc (double-keyed) microphone or camera permissions.
+      return (
+        key &&
+        perm.state == lazy.SitePermissions.ALLOW &&
+        perm.scope == lazy.SitePermissions.SCOPE_TEMPORARY &&
+        ((clearCamera && id == "camera") ||
+          (clearMicrophone && id == "microphone"))
+      );
+    })
+    .forEach(perm =>
+      lazy.SitePermissions.removeFromPrincipal(null, perm.id, browser)
+    );
+}