What is the purpose of requiring a successful gUM call before enumerateDevices?

[guidou]

In the past, the requirement for enumerateDevices was to have the corresponding permissions granted.
Now a successful gUM call is required, which is a stronger requirement.

I think the old version was better, since that one allowed implementations to have the gUM requirement by making the permission nonpersistent.

Forcing the gUM requirement on implementations with persistent permissions makes persistent permissions largely useless, since one of the objectives of persistent permissions is to avoid constant prompts for frequent users of VC applications.

I agree that always prompting might have some privacy benefits, but this comes at the cost of making things more difficult or inconvenient for frequent users of VC applications. I think this is an area where it is better to let UAs decide the tradeoff that works better for their users.

The old version of the spec also makes it easier to achieve interoperability between UAs without breaking compatibility with existing applications.