Audio / video capture is not working on macOS Catalina

NWJS Version : 0.43.6 Operating System : macOS Catalina (10.15.2)

Expected behavior

navigator.mediaDevices.getUserMedia should return stream with audio and video tracks, permissions for app to use microphone / camera should be requested if needed

Actual behavior

“DOMException: Could not start video source” is thrown or stream is returned with audio track that can not actually use microphone

How to reproduce

run either of the following in dev tools

navigator.webkitGetUserMedia({audio: true, video: true}, stream => console.info(stream), err => console.error(err))

navigator.mediaDevices.getUserMedia({video:true, audio: true}).then(stream => console.info(stream)).catch(err => console.error(err))

We’ve noticed this issue on recent releases of macOS Catalina. If permissions for use of microphone or camera were requested on macOS Mojave then everything works fine after upgrade to macOS Catalina, but if it’s new install or permissions were reset via tccutil reset Microphone / tccutil reset Camera following instructions from https://developer.apple.com/documentation/avfoundation/cameras_and_media_capture/requesting_authorization_for_media_capture_on_macos then permissions are not requested and getUserMedia fails with DOMException.

Adding videoCapture / audioCapture permissions in manifest does not seem to change anything.

If NSMicrophoneUsageDescription / NSCameraUsageDescription are added to Info.plist then exception is not thrown, but permissions are not requested and media tracks in resulting stream don’t provide any audio / video, don’t activate microphone / camera.

Is there something like systemPreferences.askForMediaAccess(mediaType) https://electronjs.org/docs/all#systempreferencesaskformediaaccessmediatype-macos that we are missing to call?

[arudnev]

I’ve added those 3 entitlements, so the file used in codesign process looks something like this:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>com.apple.security.device.camera</key>
    <true/>
    <key>com.apple.security.device.audio-input</key>
    <true/>
    <key>com.apple.security.device.microphone</key>
    <true/>
    <key>com.apple.security.automation.apple-events</key>
    <true/>
    <key>com.apple.security.cs.allow-dyld-environment-variables</key>
    <true/>
    <key>com.apple.security.cs.allow-jit</key>
    <true/>
    <key>com.apple.security.cs.allow-unsigned-executable-memory</key>
    <true/>
    <key>com.apple.security.cs.disable-executable-page-protection</key>
    <true/>
    <key>com.apple.security.cs.disable-library-validation</key>
    <true/>
  </dict>
</plist>

I presume one would use some scripts for signing and notarization along the lines of what’s described in #7117

We use something like this for signing (I believe there is more generic code available in some of those tickets):

#!/bin/bash

export CODESIGN_ALLOCATE="/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/codesign_allocate"

# Run the following to get a list of certs: security find-identity
identity="${1}"
# Location of the app
app="${2}"
# Path to the entitlements file
entitlements="${3:-neededToRun.entitlements}"

framework="Contents/Frameworks/nwjs Framework.framework"
base="${framework}/Versions/Current"

parts=(
  "${base}/libffmpeg.dylib"
  "${base}/libnode.dylib"
  "${base}/Libraries/libEGL.dylib"
  "${base}/Libraries/libGLESv2.dylib"
  "${base}/Libraries/libswiftshader_libEGL.dylib"
  "${base}/Libraries/libswiftshader_libGLESv2.dylib"
  "${base}/Helpers/chrome_crashpad_handler"
  "${base}/Helpers/app_mode_loader"
  "${base}/Helpers/nwjs Helper.app"
  "${base}/Helpers/nwjs Helper (GPU).app"
  "${base}/Helpers/nwjs Helper (Plugin).app"
  "${base}/Helpers/nwjs Helper (Renderer).app"
  "${base}/XPCServices/AlertNotificationService.xpc"
  # "${base}/nwjs Framework"
  # "${base}"
  "${framework}"
)

for part in "${parts[@]}"
do
  echo "### signing ${part}"
  codesign --force --verbose=4 --strict --options runtime --timestamp --sign "${identity}" --entitlements "${entitlements}" "${app}/${part}"
done

echo "### signing app"
codesign --force --verbose=4 --strict --options runtime --timestamp --deep --sign "${identity}" --entitlements "${entitlements}" "${app}"

echo "### verifying signature"
codesign --verify --verbose=4 "${app}"
spctl --assess --verbose=4 "${app}"

And then something similar to https://github.com/electron/electron-notarize for notarization.

We have not done update of localized strings that are used in permission prompt dialogs, but one would be looking for some process to update some of the values in InfoPlist.strings files as part of the app build process. See something like this for details:

cat ./nwjs-sdk-v0.44.0-osx-x64/nwjs.app/Contents/Resources/*.lproj/InfoPlist.strings | grep UsageDescription

[arudnev]

Hm, strange, we fixed our app when it was still on 0.43.x, it has been working for us since then, including 0.45.5, which is the latest at the moment.

I remember that at some point we did run into some issues because permission request from our app was blocked by similar requests for zoom or skype that got queued and ignored by us as part of testing, but reboot or going into System Preference -> Security & Privacy brought all those queued pop-ups back to live.

I’ll re-test with 0.45.5 once again just in case to make sure that we did not miss it somehow.