@mocanvas/mocanvas · constant
declare const embedShapePermissionDefaults: {
readonly accelerometer: true;
readonly autoplay: true;
readonly "clipboard-write": false;
readonly "encrypted-media": true;
readonly fullscreen: true;
readonly gyroscope: true;
readonly "picture-in-picture": true;
readonly camera: false;
readonly "display-capture": false;
readonly geolocation: false;
readonly microphone: false;
readonly midi: false;
readonly payment: false;
readonly "screen-wake-lock": false;
readonly usb: false;
readonly "web-share": false;
readonly "xr-spatial-tracking": false;
}The permissions an embedded page is granted by default, as iframe permissions-policy features.
Everything that can reach the user's hardware or identity is off. What is on is only what a media player needs to be a media player: full screen, sound without a second click, DRM playback, picture-in-picture, and the motion sensors a 360° video reads. A definition may widen this for its own service; nothing widens it for a service that is not on the permit list, because nothing off the permit list is ever put in an iframe at all.
The documented TLEmbedShapePermissions alias for this object's shape is
published from the shapes module alongside the embed util.
Mentioned here
mocanvas is built by Symbio. Free for non-commercial, non-profit and development use; commercial use needs an agreement. Not affiliated with or endorsed by tldraw.