Sylvestre Ledru
6aeedafb63
Convert widget/windows/docs/*.rst (including windows-pointing-device) to MyST-flavored Markdown. Refresh allowed-warnings glob for windows-pointing-device from .rst to .md. Differential Revision: https://phabricator.services.mozilla.com/D304223
52 lines
2.1 KiB
Markdown
52 lines
2.1 KiB
Markdown
# Windows Limited Access Features
|
|
|
|
## Overview
|
|
|
|
[Limited Access Features (LAF)](https://learn.microsoft.com/en-us/uwp/api/windows.applicationmodel.limitedaccessfeatures?view=winrt-26100) are
|
|
features which require a special token and attestation to unlock them before
|
|
their corresponding APIs can be called. These usually take the form
|
|
`com.microsoft.windows.featureFamily.name`. This is most relevant to Firefox in
|
|
the context of pinning to the Windows taskbar as the new Windows pinning APIs require
|
|
Firefox to first unlock the corresponding `com.microsoft.windows.taskbar.pin`
|
|
LAF.
|
|
|
|
If we need to use a new Limited Access Feature we should notify Microsoft
|
|
if requested in the feature's documentation.
|
|
|
|
## Unlocking Procedure
|
|
|
|
Applications which exist in a packaged context, such as MSIX installs,
|
|
have something called a Package Family Name (PFN). The PFN is generated
|
|
at build time for MSIX installs and varies between channels. This can be
|
|
accessed through Windows API calls on MSIX. For non-MSIX installs we are
|
|
provided a specific PFN by Microsoft which lives in the rc file in
|
|
the final install and can be modified in `create_rc.py`.
|
|
|
|
The registry key corresponding to the LAF can be read at
|
|
`HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\AppModel\LimitedAccessFeatures\<lafId>`
|
|
This key's default value contains a string which is the "key" for the
|
|
Limited Access Feature.
|
|
|
|
To get the complete unlocking token, the LAF identifier, LAF key, and PFN
|
|
can be combined in the format `"<lafId>!<lafKey>!<PFN>"` and then
|
|
encoded in SHA256. Taking the first 16 characters of this output and
|
|
converting to Base64 yields the final token. The overall process is
|
|
as follows:
|
|
|
|
```text
|
|
Base64(SHA256Encode("<lafId>!<lafKey>!<PFN>")[0..16])
|
|
```
|
|
|
|
The other piece of unlocking is the attestation. We first need
|
|
the publisher identifier, which consists of the last 13 characters
|
|
of the PFN. With that, the attestation is assembled using the boilerplate
|
|
below:
|
|
|
|
```text
|
|
<PFN[-13]> has registered their use of <lafId>
|
|
with Microsoft and agrees to the terms of use.
|
|
```
|
|
|
|
The token and attestation can then be passed into `LimitedAccessFeature.TryUnlockFeature()`
|
|
to unlock the corresponding APIs for use.
|