Use credential type registry for permissions + digital credentials

index.bs

@@ -98,20 +98,15 @@ spec:css-syntax-3;
 </pre>
 <pre class="biblio">
 {
-  "FEDCM": {
-    "authors": [ "Sam Goto" ],
-    "href": "https://fedidcg.github.io/FedCM/",
-    "title": "FedCM API"
-  },
   "WEB-LOGIN": {
     "authors": [ "Jason Denizac", "Robin Berjon", "Anne van Kesteren" ],
     "href": "https://github.com/jden/web-login",
     "title": "web-login"
   },
-  "WEB-OTP": {
-    "authors": [ "Sam Goto" ],
-    "href": "https://wicg.github.io/web-otp/",
-    "title": "WebOTP API"
+  "DIGITAL-CREDENTIALS": {
+    "authors": [ "Marcos Cáceres", "Sam Goto" ],
+    "href": "https://wicg.github.io/digital-credentials/",
+    "title": "Digital Credentials"
   }
 }
 </pre>
@@ -325,42 +320,56 @@ spec:css-syntax-3;
         <small>(in alphabetical order)</small></th>
         <th><dfn for="credential type registry">Options Member Identifier</dfn></th>
         <th><dfn for="credential type registry">Appropriate Interface Object</dfn></th>
+        <th><dfn for="credential type registry">Corresponding Permissions Policy</dfn></th>
         <th>Specification</th>
         <th>Requestor Contact</th>
       </tr>
     </thead>
+    <tr>
+        <td>digital-credential</td>
+        <td>digital</td>
+        <td>{{DigitalCredential}}</td>
+        <td>digital-credentials-get</td>
+        <td>[[DIGITAL-CREDENTIALS]]</td>
+        <td><a href="https://wicg.io/">WICG</a></td>
+    </tr>
     <tr>
         <td>federated</td>
         <td>federated</td>
         <td>{{FederatedCredential}}</td>
+        <td>null</td>
         <td>This specification: [[#federated]]</td>
         <td><a href="https://www.w3.org/2011/webappsec/">W3C</a></td>
     </tr>
     <tr>
         <td>identity</td>
         <td>identity</td>
         <td>{{IdentityCredential}}</td>
+        <td>[=identity-credentials-get=]</td>
         <td>[[FEDCM]]</td>
         <td><a href="https://www.w3.org/community/fed-id/">W3C</a></td>
     </tr>
     <tr>
         <td>otp</td>
         <td>otp</td>
         <td>{{OTPCredential}}</td>
+        <td>otp-credentials</td>
         <td>[[WEB-OTP]]</td>
         <td><a href="https://wicg.io/">WICG</a></td>
     </tr>
     <tr>
         <td>password</td>
         <td>password</td>
         <td>{{PasswordCredential}}</td>
+        <td>null</td>
         <td>This specification: [[#passwords]]</td>
         <td><a href="https://www.w3.org/2011/webappsec/">W3C</a></td>
     </tr>
     <tr>
         <td>public-key</td>
         <td>publicKey</td>
         <td>{{PublicKeyCredential}}</td>
+        <td>[=publickey-credentials-get-feature|publickey-credentials-get=]</td>
         <td>[[WEBAUTHN]]</td>
         <td><a href="https://www.w3.org/blog/webauthn/">W3C</a></td>
     </tr>
@@ -382,6 +391,9 @@ spec:css-syntax-3;
   * Each registry entry must state the [=credential type registry/Appropriate Interface Object=] [=identifier=] for the
     [=credential type registry/credential type=].
 
+  * Each registry entry may state the [=credential type registry/Corresponding Permissions Policy=] [=permission=] for the
+    [=credential type registry/credential type=].
+
   * Each registry entry must include a link that references a publicly available specification
     defining the [=credential type registry/credential type=] and the [=dictionary member=] [=identifier=].
 
@@ -950,8 +962,10 @@ spec:css-syntax-3;
 
     1.  Assert: |settings| is a [=secure context=].
 
-    1.  If |settings|'s [=relevant global object=]'s [=associated Document=] is not [=Document/fully active=],
-        then return [=a promise rejected with=] "{{NotAllowedError}}" {{DOMException}}.
+    1.  Let |document| be |settings|'s [=relevant global object=]'s [=associated Document=].
+
+    1.  If |document| is not [=Document/fully active=], then return [=a promise rejected with=]
+        "{{NotAllowedError}}" {{DOMException}}.
 
     1.  If <code>|options|.{{CredentialRequestOptions/signal}}</code> is [=AbortSignal/aborted=],
         then return [=a promise rejected with=]
@@ -965,8 +979,6 @@ spec:css-syntax-3;
             1.  If |interface| does not support {{CredentialMediationRequirement/conditional}}
                 [=user mediation=], return [=a promise rejected with=] a "{{TypeError}}" {{DOMException}}.
 
-    1.  Let |p| be [=a new promise=].
-
     1. For each |interface| in |options|' <a>relevant credential interface objects</a>:
 
         1. If |settings|' [=active credential types=] [=set/contains=] |interface|'s
@@ -983,21 +995,14 @@ spec:css-syntax-3;
     1.  Let |sameOriginWithAncestors| be `true` if |settings| is [=same-origin with its
         ancestors=], and `false` otherwise.
 
-    1.  If |options|[{{CredentialRequestOptions/identity}}] [=map/exists=] and
-        if |settings|' [=relevant global object=]'s [=associated Document=] is **not**
-        [=allowed to use=] the [=identity-credentials-get=]
-        [=policy-controlled feature=] return [=a promise rejected with=] a "{{NotAllowedError}}"
-        {{DOMException}}.
+    1. For each |permission| in |options|' [=credential type registry/Corresponding Permissions Policy=]:
 
-    1.  If |options|[{{CredentialRequestOptions/publicKey}}] [=map/exists=] and
-        if |settings|' [=relevant global object=]'s [=associated Document=] is **not**
-        [=allowed to use=] the [=publickey-credentials-get-feature|publickey-credentials-get=]
-        [=policy-controlled feature=] return [=a promise rejected with=] a "{{NotAllowedError}}"
-        {{DOMException}}.
+        1. If |permission| is null, continue.
 
-        Note: <a const>`password`</a> and <a const>`federated`</a>
-        [=credential type registry/credential types=] are not presently treated as
-        [=policy-controlled features=], although this may change in the future.
+        1. If |document| is **not** [=allowed to use=] the |permission| [=policy-controlled feature=],
+           return [=a promise rejected with=] a "{{NotAllowedError}}" {{DOMException}}.
+
+    1.  Let |p| be [=a new promise=].
 
     1.  Run the following steps [=in parallel=]: