Add unload to the Permission Policy constants.

Author: GeekInTheNorth

src/Stott.Security.Optimizely.Test/Features/PermissionPolicy/PermissionPolicyConstantsTests.cs

@@ -20,6 +20,78 @@ public sealed class PermissionPolicyConstantsTests
         PermissionPolicyConstants.DocumentDomain
     ];
 
+    /// <summary>
+    /// The directives documented at
+    /// https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy
+    /// as of 29/09/2026, plus those which that page has since dropped but which this module
+    /// retains so that existing configuration remains editable.
+    /// </summary>
+    /// <remarks>
+    /// Listed literally rather than derived from PermissionPolicyConstants so that a directive
+    /// cannot be added or removed without a deliberate revalidation against the specification.
+    /// </remarks>
+    private static readonly string[] SpecificationDirectives =
+    [
+        "accelerometer",
+        "ambient-light-sensor",
+        "aria-notify",
+        "attribution-reporting",
+        "autoplay",
+        "bluetooth",
+        "browsing-topics",
+        "camera",
+        "captured-surface-control",
+        "ch-ua-high-entropy-values",
+        "compute-pressure",
+        "cross-origin-isolated",
+        "deferred-fetch",
+        "deferred-fetch-minimal",
+        "display-capture",
+        "document-domain",
+        "encrypted-media",
+        "fullscreen",
+        "gamepad",
+        "geolocation",
+        "gyroscope",
+        "hid",
+        "identity-credentials-get",
+        "idle-detection",
+        "language-detector",
+        "language-model",
+        "local-fonts",
+        "local-network",
+        "local-network-access",
+        "loopback-network",
+        "magnetometer",
+        "microphone",
+        "midi",
+        "on-device-speech-recognition",
+        "otp-credentials",
+        "payment",
+        "picture-in-picture",
+        "private-state-token-issuance",
+        "private-state-token-redemption",
+        "publickey-credentials-create",
+        "publickey-credentials-get",
+        "screen-wake-lock",
+        "serial",
+        "speaker-selection",
+        "storage-access",
+        "summarizer",
+        "translator",
+        "unload",
+        "usb",
+        "web-share",
+        "window-management",
+        "xr-spatial-tracking"
+    ];
+
+    [Test]
+    public void AllDirectives_MatchesTheDirectivesDefinedByTheSpecification()
+    {
+        Assert.That(PermissionPolicyConstants.AllDirectives, Is.EqualTo(SpecificationDirectives));
+    }
+
     [Test]
     [TestCaseSource(nameof(DeprecatedDirectives))]
     public void AllDirectives_ContainsDeprecatedDirectivesSoThatExistingConfigurationRemainsEditable(string name)

src/Stott.Security.Optimizely/Features/PermissionPolicy/PermissionPolicyConstants.cs

@@ -102,6 +102,8 @@ public static class PermissionPolicyConstants
 
     public const string Translator = "translator";
 
+    public const string Unload = "unload";
+
     public const string Usb = "usb";
 
     public const string WebShare = "web-share";
@@ -165,6 +167,7 @@ public static class PermissionPolicyConstants
         new(StorageAccess, "Storage Access", "Controls whether third party content (i.e. embedded in an iframe) is allowed to use the Storage Access API to request access to unpartitioned cookies."),
         new(Summarizer, "Summarizer", "Controls whether the site is allowed to access the Summarizer API."),
         new(Translator, "Translator", "Controls whether the site is allowed to access the translation functionality of the Translator and Language Detector APIs."),
+        new(Unload, "Unload", "Controls whether the site is allowed to run unload event handlers."),
         new(Usb, "USB", "Controls whether the site is allowed to use the WebUSB API."),
         new(WebShare, "Web Share", "Controls whether the site is allowed to use Web Share API to share text, links, images, and other content to arbitrary destinations of the user's choice."),
         new(WindowManagement, "Window Management", "Controls whether the site is allowed to use the Window Management API to manage windows on multiple displays."),