class Registry

A coordination mechanism to clearly define the *injecting* of pointer events

into the scene (injection policy, injection context, etc), for *dispatching*

pointer events to UI clients (referenced by |fuchsia.ui.views.ViewRef|).

NOTE WELL! ONLY COMPONENTS IN THE TRUSTED COMPUTING BASE SHOULD BE GRANTED

ACCESS TO THIS PROTOCOL.

(1) The injector device acts with the user's authority. UI clients cannot

tell the difference between a real user and an injector device.

(2) The context is self-specified when registering the injector device. An

injector device that gains access to a sensitive context will operate in

that scope.

(3) The injected events may be arbitrary. An injector device can inject

whatever it wants to the clients it can reach.

This protocol defines the context and target for an injector |Device|,

places a viewport in spatial relation to the target, and connects the

|Device| to the viewport. These parameters are set up in the |Config|. A

|Device| may *inject* pointer events on the viewport, but the *dispatch* of

pointer events to UI clients in the target will depend on the dispatch

policy and the scene topology.

A |Device| operates within a context, and it serves two purposes:

(1) Scoping. It confirms the |Device|'s authority to inject pointer events

on the specified target.

(2) Coordinate system. It provides the reference coordinate system to define

the viewport's position and size, relative to the target.

Guarantees. A |Device| is directed at a specified target in the scene, and

such a target is afforded some guarantees against snooping and interference

from UI clients outside the target's view tree ("non-target clients").

Non-target clients never have injected events dispatched to them: a |Device|

preserves *confidentiality* for target clients. Non-target clients never

block injected events from reaching the target on injection, or from

reaching target clients on dispatch: a |Device| preserves *integrity* and

*availability* for target clients. However, the |Device| itself is subject

to disruption by ancestor views of the target (see connectivity invariant).

Note. This protocol, and its policies, are *not* a sufficient guard against

UI redress attacks! The confidentiality, integrity, and availability

guarantees apply only with respect to non-target clients. Within a

target, UI redress attacks can still happen, between target clients.

Connectivity invariant. A |Device| operates in a stable view tree that is

connected to the root view. When either the target, or both context and

target, are disconnected from the view tree by a UI client, the |Device|

channel is closed. If an event stream was in flight, the server dispatches a

final CANCEL event following channel closure; this CANCEL event is then

propagated according to dispatch policy.