feat(mcp-apps): add Permission Policy support for sandbox iframes (#6947)

crates/goose-server/src/openapi.rs

@@ -576,6 +576,7 @@ derive_utoipa!(Icon as IconSchema);
         goose::goose_apps::WindowProps,
         goose::goose_apps::McpAppResource,
         goose::goose_apps::CspMetadata,
+        goose::goose_apps::PermissionsMetadata,
         goose::goose_apps::UiMetadata,
         goose::goose_apps::ResourceMetadata,
         super::routes::dictation::TranscribeRequest,

crates/goose-server/src/routes/templates/mcp_app_proxy.html

@@ -33,7 +33,7 @@
 
         let guestIframe = null;
 
-        function createGuestIframe(html) {
+        function createGuestIframe(html, permissions) {
           if (guestIframe) {
             guestIframe.remove();
           }
@@ -46,6 +46,17 @@
           // allow-forms: needed if the app has forms
           guestIframe.setAttribute('sandbox', 'allow-scripts allow-same-origin allow-forms');
 
+          // Build Permission Policy allow attribute from requested permissions
+          // These control access to sensitive browser APIs like camera, microphone, etc.
+          var allowList = [];
+          if (permissions && permissions.camera) allowList.push('camera');
+          if (permissions && permissions.microphone) allowList.push('microphone');
+          if (permissions && permissions.geolocation) allowList.push('geolocation');
+          if (permissions && permissions.clipboardWrite) allowList.push('clipboard-write');
+          if (allowList.length > 0) {
+            guestIframe.setAttribute('allow', allowList.join('; '));
+          }
+
           guestIframe.srcdoc = html;
           guestIframe.style.cssText = 'width:100%; height:100%; border:none;';
 
@@ -73,8 +84,9 @@
           if (method === 'ui/notifications/sandbox-resource-ready') {
             var params = data.params || {};
             var html = params.html || '';
+            var permissions = params.permissions || null;
 
-            createGuestIframe(html);
+            createGuestIframe(html, permissions);
             return;
           }
 
@@ -132,4 +144,4 @@
       })();
     </script>
   </body>
-</html>
+</html>