Disable sensitive APIs (eg. window.ipfs.config). Provide a capabilities API.

[olizilla]

A dapp should't be able to change my IPFS node config.

It may reasonably want to know what features are enabled. Peerpad uses pubsub, so it would need to check if window.ipfs provided the capabilities it requires before deciding whether to use it or init a custom one. We could let dapps read the config, but an considered api for determining what capabilities window.ipfs is offering seems preferable. Perhaps a "can i have an ipfs node with this config" api?

window.getIpfs({
  EXPERIMENTS: {
   pubsub: true
  }
})

which returns null or throws if the ipfs instance you'd get back can't match your requirements.

or just a "tell me what is enabled api"

window.ipfs.getEnabledExperiments()
// [{ name: 'pubsub', verson: '1'}]

vaguely relevant.
https://developer.mozilla.org/en-US/docs/Web/API/Media_Streams_API/Constraints

[lidel]

List of APIs we should remove for now:

• bootstrap/*
• config/*
• stop

Things we should disable until calls are safely sandboxed (prefixed with dapps scope):

• files (already done, see feat: scope mfs calls to an application path #431)
• key (do not allow self as a name, just to avoid confusion)
• name/publish (deny publishing to self)

Open questions:

• pubsub (too important to hide, but topic names can't be sandboxed, we have a privacy leak of sorts here)
• how to handle newly added APIs?
  • deny everything by default and have an explicit, manual whitelist of "safe" APIs