Improvement: Optional permissions

[TheChilliPL]

With each update adding support for a new website, every user is asked to accept new permissions for new websites. If the user doesn't accept (e.g. clicks somewhere else so the popup gets hidden), the extension gets disabled.

An easy way to fix that would be to make each website an optional permission the user gets asked for when trying to enable DualSub in that website.

To do that, you need two parts:

1. Valid manifest: each optional permission should be placed in the optional_permissions array, instead of the normal permissions. (Google Chrome Permission API documentation)
2. JavaScript handling optional permissions—asking the user for permission once the DualSub button is clicked on a supported website, or showing the usual subtitle menu if the permission is already granted.

[muzuiget]

Because Chrome treat content scripts host permission is a type of required permission.

The Dualsub manifest.json file:

{
    "permissions": [
        "http://*.dualsub.xyz/*",
        "https://*.dualsub.xyz/*",
        "storage"
    ],
    "content_scripts": [
        {
            "matches": [
                "https://www.youtube.com/*" <- host pattern declare here, is a required permission
            ],
            "js": [
                "content.js"
            ]
        }
    ]

}

This call declarative injection, even though content script can be Inject programmatically, but this not fit the Dualsub situation. The declarative way can let the code run at early stage, so Dualsub can sniff/copy the subtitle list when the video player communicate with the server. If Dualsub code run after the video player ready-to-play state, it won't get the subtitle list.

And the field optional_permissions is not design for your suggestion. It usually use with the webRequest feature, in Manifest V3, because Google remove the webRequest feature, so the optional_permissions also remove the host patterns.

So there are nothing can change on this behavior in Manifest V2 extension, but I think to warning popup is fine, it can treat a version update changelog message for users.

[TheChilliPL]

I see some chrome.scripting.registerContentScript function for that, but it's apparently experimental and only supported on Chrome Canary at the moment. Firefox has a similar function by default (it even has an unofficial Chrome polyfill but I doubt it supports early script execution).

I'd suggest starting using those once the Chrome dynamic registering works (and supports early execution) but for now, it seems like there's really no way to do that without making the script execute later than normal

[muzuiget]

The chrome.scripting.registerContentScript only works on Manifest V3, Manifest V3 only works for Chrome 88+, and it's not stable, no plan to move to Manifest V3.

The polyfill just wrap the chrome.tabs.executeScript API, it is also a programmatically way, not a really declarative way as in Manifest V3.

[TheChilliPL]

Yeah, that's why I assumed it couldn't support early script execution.

Are you planning on moving to Manifest V3 once it gets stable?

[muzuiget]

Yes, If the API of Manifest V3 meets the requirements of Dualsub. But now some Manifest V3 design is quite controversial.

[TheChilliPL]

What kinds of design do you mean by controversial?

[muzuiget]

1. Remove the webRequest API, so the Adblock type extensions won't works.
2. Disallow remotely hosted code, it just disable the JavaScript eval() function, so many JavaScript library won't work, also the Greasemonkey script won't works.

You can see the forum, lot of discussions on Manifest V3.