Reduced permissions in the manifest

2026-08-26 17:59:24 +02:00
parent 27f26e615a
commit 7e9bf81bd1
6 changed files with 70 additions and 11 deletions
@@ -1,5 +1,11 @@
 # Chat Log

+### User
+Implement SA-006 permission changes: remove `<all_urls>` and unnecessary `tabs`, request exact access to the configured self-hosted backend, and keep page capture behind `activeTab`.
+
+### Assistant outcome
+Updated the Firefox extension manifest to use `activeTab` and `storage` only, with Firefox-compatible optional HTTP/HTTPS host permissions. The options login page now normalizes the backend to an origin and requests only that origin during the user-initiated login. The popup checks that exact grant before session validation or link submission, so it does not perform backend calls without permission.
+
 ## 2026-08-24

 ### User