Media Capture Consent and Track Lifecycle

Working case

Reviewer 29 joins a case consultation with audio only. The page explains the request before calling capture; no camera permission is requested. Reviewer 29 denies the microphone once, so the room remains readable and offers typed notes rather than re-prompting in a loop. On a later attempt, capture succeeds and a clear local indicator appears. Reviewer 29 leaves while the remote peer is disconnected; the local audio track stops immediately, the peer connection closes, and the UI shows that capture ended.

Implementation boundary

function mayRequestCapture(secureContext, roomAllowed, userIntent) {
  return secureContext && roomAllowed && userIntent;
}
console.log(mayRequestCapture(true, true, false));
// Output: false

Request only the tracks needed for the current feature. Handle missing device, denied permission, device-busy error, and a track ending unexpectedly. Bind capture lifetime to one session controller rather than a rendering component that may mount twice. Stop tracks on explicit leave, room revocation, page transition, and setup failure after partial acquisition. Do not assume setting enabled to false releases hardware; stop the track when the session ends. Recheck room membership on the server before signaling, and avoid recording media by default.

Cost and boundaries

Camera capture spends power, bandwidth, and CPU even before the remote path becomes useful. Higher resolution can increase encode cost, so choose constraints from the actual consultation need and allow degradation. Repeated permission prompts erode trust and can leave a participant stuck without a fallback. Measure setup failure categories, active track duration, unexpected track ends, and leave-to-stop delay with no media content in metrics. Device behavior and permission persistence differ across browsers; test rather than assuming one prompt pattern.

Failure trace

A reviewer closes the consultation drawer, but the microphone light stays on because the stream is stored in a page-level variable. A second path catches a connection error but never stops a track already acquired. Test close before signaling, denied permission, missing microphone, duplicate mount, remote disconnect, account switch, route navigation, and leave during capture. Confirm each path stops every owned local track and removes references to the preview stream.

Verification

• A denied prompt leaves a usable non-media path.
• Every acquired track stops on leave and failed setup.
• Room access is checked apart from device permission.

Practice drill

Open an audio-only session, deny the first prompt, and verify text notes remain available. Grant permission, then close the drawer before an answer arrives. Inspect each track readyState and the browser capture indicator. Repeat while switching accounts and while the remote peer drops. Finally request a nonexistent input device and ensure the error text identifies a recoverable choice without copying device labels into general telemetry.

Decision note

Tie capture to explicit user intent and session lifetime, with release independent of signaling success.

Common Mistakes

• Requesting camera for an audio-only room.
• Treating mute as hardware release.
• Letting a hidden component retain an active stream.

Connected lessons

Build Project: private peer consultation and review Web Development: browser compute and peer sessions quiz; follow WebRTC and Peer Media Sessions; WebRTC Signaling, Room Authorization, and Offer Order; WebRTC ICE, TURN Fallback, and Session Recovery; Data Channel Backpressure and Peer State; Permission Request Timing and Manual Fallback; Object-Level Authorization for Reads and Writes.