{"action":"created","issue":{"url":"https://api.github.com/repos/w3c/push-api/issues/116","labels_url":"https://api.github.com/repos/w3c/push-api/issues/116/labels{/name}","comments_url":"https://api.github.com/repos/w3c/push-api/issues/116/comments","events_url":"https://api.github.com/repos/w3c/push-api/issues/116/events","html_url":"https://github.com/w3c/push-api/issues/116","id":58725624,"number":116,"title":"Fire pushsubscriptionchange when user revokes permission","user":{"login":"johnmellor","id":563043,"avatar_url":"https://avatars.githubusercontent.com/u/563043?v=3","gravatar_id":"","url":"https://api.github.com/users/johnmellor","html_url":"https://github.com/johnmellor","followers_url":"https://api.github.com/users/johnmellor/followers","following_url":"https://api.github.com/users/johnmellor/following{/other_user}","gists_url":"https://api.github.com/users/johnmellor/gists{/gist_id}","starred_url":"https://api.github.com/users/johnmellor/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/johnmellor/subscriptions","organizations_url":"https://api.github.com/users/johnmellor/orgs","repos_url":"https://api.github.com/users/johnmellor/repos","events_url":"https://api.github.com/users/johnmellor/events{/privacy}","received_events_url":"https://api.github.com/users/johnmellor/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-02-24T11:27:19Z","updated_at":"2016-01-25T16:58:07Z","closed_at":null,"body":"The spec [says](https://w3c.github.io/push-api/#h-security-and-privacy-considerations), \"When a permission is revoked, all push subscriptions created with that permission must be [deactivated](https://w3c.github.io/push-api/#dfn-deactivated)\" (i.e. automatically unsubscribed).\r\n\r\nWe should clarify in the [pushsubscriptionchange section](https://w3c.github.io/push-api/#the-pushsubscriptionchange-event) that the `pushsubscriptionchange` event must be fired in such cases.\r\n\r\nThis is different from #61 since the webapp's state (cookies, IDB, etc) haven't been reset, and so if we didn't fire `pushsubscriptionchange`, this would create a new state that sites have to explicitly handle.\r\n\r\n(unlike other `pushsubscriptionchange` events, it won't be possible to resubscribe automatically - but that's fine, because sites already have to handle failure to resubscribe, e.g. in case the device is offline)."},"comment":{"url":"https://api.github.com/repos/w3c/push-api/issues/comments/174582174","html_url":"https://github.com/w3c/push-api/issues/116#issuecomment-174582174","issue_url":"https://api.github.com/repos/w3c/push-api/issues/116","id":174582174,"user":{"login":"kitcambridge","id":243830,"avatar_url":"https://avatars.githubusercontent.com/u/243830?v=3","gravatar_id":"","url":"https://api.github.com/users/kitcambridge","html_url":"https://github.com/kitcambridge","followers_url":"https://api.github.com/users/kitcambridge/followers","following_url":"https://api.github.com/users/kitcambridge/following{/other_user}","gists_url":"https://api.github.com/users/kitcambridge/gists{/gist_id}","starred_url":"https://api.github.com/users/kitcambridge/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kitcambridge/subscriptions","organizations_url":"https://api.github.com/users/kitcambridge/orgs","repos_url":"https://api.github.com/users/kitcambridge/repos","events_url":"https://api.github.com/users/kitcambridge/events{/privacy}","received_events_url":"https://api.github.com/users/kitcambridge/received_events","type":"User","site_admin":false},"created_at":"2016-01-25T16:58:07Z","updated_at":"2016-01-25T16:58:07Z","body":"To clarify, this means we should fire `pushsubscriptionchange` twice, right? Once when permission is revoked, and a second time when it's restored.\r\n\r\nSo, after revocation, `self.pushManager.getSubscription()` will resolve to `null` (per @martinthomson's comment in #150), and `subscribe()` will reject with `PermissionDeniedError`. Is that accurate?\r\n\r\nAlso, if the user restores permission, should the browser automatically resubscribe, or leave it up to the service worker? (Firefox currently leaves it up to the worker, but it might be nice to be explicit about the correct behavior).\r\n\r\nThanks!"}}