Only return the approved widget capabilities instead of accepting all…

… requested capabilities (#7454)

* Only return the approved widget capabilities instead of accepting all requested capabilities

* Restore the original logic that only keeps accepted permissions if they were requested

Signed-off-by: Dominik Henneke <dominik.henneke@nordeck.net>

src/stores/widgets/StopGapWidgetDriver.ts

@@ -34,7 +34,7 @@ import { IContent, IEvent, MatrixEvent } from "matrix-js-sdk/src/models/event";
 import { Room } from "matrix-js-sdk/src/models/room";
 import { logger } from "matrix-js-sdk/src/logger";
 
-import { iterableDiff, iterableUnion } from "../../utils/iterables";
+import { iterableDiff, iterableIntersection } from "../../utils/iterables";
 import { MatrixClientPeg } from "../../MatrixClientPeg";
 import ActiveRoomObserver from "../../ActiveRoomObserver";
 import Modal from "../../Modal";
@@ -131,7 +131,9 @@ export class StopGapWidgetDriver extends WidgetDriver {
             }
         }
 
-        const allAllowed = new Set(iterableUnion(allowedSoFar, requested));
+        // discard all previously allowed capabilities if they are not requested
+        // TODO: this results in an unexpected behavior when this function is called during the capabilities renegotiation of MSC2974 that will be resolved later.
+        const allAllowed = new Set(iterableIntersection(allowedSoFar, requested));
 
         if (rememberApproved) {
             setRememberedCapabilitiesForWidget(this.forWidget, Array.from(allAllowed));