Should it be possible for web pages to trigger actions on another page? about mediasession HOT 3 OPEN

It is appealing to enable reuse of the same mechanism for both PiP and media capture handle.
The main difference is that PiP is a trusted source of actions (otherwise the web page would not register callbacks) but another web page might not be as trusted.
It seems reasonable that a web page would like to differentiate these two sources of actions.

If we narrow down to pages being paired through capture handle (capturer and capturee), we can think of the following approach:

1. Capturer API is restricted to a reduced set of actions: play, pause, nexttrack, nextslide make sense, hangup/togglecamera/togglemicrophone do not make a lot of sense.
2. Capturer gains access to this API as a result of a successful getDisplayMedia call that can list capturee supported actions and trigger actions on capturee. API is available as long as capturer getDisplayMedia track is live/not muted.
3. Capturee has a way to differentiate browser trusted actions from page potentially-trusted actions.

There are various ways to implement 3, one important decision point is whether it should be opt-in or whether opt-out is deemed feasible.
The opt-out approach allows capturer to trigger actions on today's web pages that register MediaSession handlers with PiP window in mind only. This has pros and cons.
The opt-out approach could be based on capturer's origin, for instance by adding an optional origin member to MediaSessionActionDetails, something like:

partial dictionary MediaSessionActionDetails {
   USVString origin;
}

A consequence of this API is that capturer would expose its origin when triggering an action.

Based on this origin member field, an opt-in approach could be implemented by extending MediaSession.setActionHandler, for instance by passing an options dictionary as third parameter, this dictionary taking a boolean, say allowCaptureHandleAction, false by default.

partial dictionary MediaSessionActionHandlerOptions {
  boolean allowCaptureHandleAction = false;
}
partial interface MediaSession {
   undefined setActionHandler(MediaSessionAction action, MediaSessionActionHandler? handler, MediaSessionActionHandlerOptions options);
}

from mediasession.

In the 23 May 2022 Media WG / WebRTC joint meeting, @jernoble suggested the idea that would allow a capturing page to delegate Media Session actions to a capturee page, and the UA would manage passing the actions to the capturee.

from mediasession.

Delegating Media Session actions to another page seems fine. Allowing capturing pages to trigger actions on another page though would definitely at least require an opt-in approach (so that existing pages aren't suddenly taking non-UA actions without their knowledge/consent)

from mediasession.