[focus-without-user-activation] Programmatically setting focus behavior

[ffiori]

What is the issue with the HTML Standard?

So far there's a high-level agreement on the focus-without-user-activation Permissions Policy: there's a satisfied TAG review and support from WebKit. There's also a merged spec PR on this repo. But the feature is blocked because there are still some behaviors that need to be agreed upon.

It was resolved in TPAC 2024 that "Focus delegation should also be allowed (allow parent frame programmatically set focus into child iframe)", but these are some scenarios that came up in different discussions:

Let's say we have a top level frame A hosting iframe B hosting iframe C, with B and C having the policy denied:

1. If B has focus,
   a. Can B move focus around inside itself with let's say element.focus()?
   b. What about passing focus to a subframe C with iframe.focus()?
2. If C has focus,
   a. Can B take focus back and set it on any element of itself?

As far as I understand after discussing with customers, all of the above examples (1a, 1b, 2a) should be possible because the idea behind the policy is to prevent stealing focus from the parent, not to restrict what a frame can do once it has focus.

The fact that some webpages count on behaviors like the cases discussed here is the original motivation for discussing this. This tries to avoid breaking existing sites that are embedded with this policy denied so the feature can be more easily adopted, while still fulfilling the need for preventing frames from stealing focus from a parent.

---

Just to further clarify the scenario, I tried to capture all possible cases of the 'allow focus steps' in the following pseudo algorithms (the 3rd if is a new addition that would allow the behaviors in the examples mentioned, the rest of the algorithm works like it's currently spec'd as of now):

algorithm allow_focus(focus_setter_frame, target, currently_focused_frame):
  if focus_setter_frame has the policy allowed:
    return true
  if the user initiated the action (target's frame has transient activation):
    return true
  if currently_focused_frame is an inclusive descendant frame of focus_setter_frame:
    return true

  return false

Would like to hear if anyone has a different point of view and open to discuss this further. Decided to file this issue to have a more suitable place to carry the behavior discussion that was sparked in this PR #11519.