Reduced permissions in the manifest

2026-08-26 17:59:24 +02:00
parent 27f26e615a
commit 7e9bf81bd1
6 changed files with 70 additions and 11 deletions
@@ -1,5 +1,11 @@
 # Chat Log

+### User
+Implement SA-006 permission changes: remove `<all_urls>` and unnecessary `tabs`, request exact access to the configured self-hosted backend, and keep page capture behind `activeTab`.
+
+### Assistant outcome
+Updated the Firefox extension manifest to use `activeTab` and `storage` only, with Firefox-compatible optional HTTP/HTTPS host permissions. The options login page now normalizes the backend to an origin and requests only that origin during the user-initiated login. The popup checks that exact grant before session validation or link submission, so it does not perform backend calls without permission.
+
 ## 2026-08-24

 ### User
@@ -181,6 +181,7 @@
 161. The popup still shows the sign-in block even though the authenticated session text is displayed; show the block only when signed out.
 162. The authenticated session text and sign-in block are still shown together.
 163. Use the VIBE directory to log interactions.
+164. Implement SA-006: remove broad Firefox extension host access and unnecessary tabs permission, request exact configured backend origin access, and keep page capture behind activeTab.

 ## Future entries