Reduced permissions in the manifest

webextension/options.js

@@ -13,6 +13,34 @@ const signOutButton = document.getElementById('sign-out');
 
 const t = window.linklogI18n;
 
+function normalizeBackendOrigin(backendUrl) {
+  try {
+    const url = new URL(backendUrl);
+    if (!['http:', 'https:'].includes(url.protocol)) {
+      return null;
+    }
+    return url.origin;
+  } catch (error) {
+    return null;
+  }
+}
+
+async function hasBackendPermission(backendUrl) {
+  const origin = normalizeBackendOrigin(backendUrl);
+  if (!origin) return false;
+  return browser.permissions.contains({origins: [`${origin}/*`]});
+}
+
+async function requestBackendPermission(backendUrl) {
+  const origin = normalizeBackendOrigin(backendUrl);
+  if (!origin) return false;
+  try {
+    return await browser.permissions.request({origins: [`${origin}/*`]});
+  } catch (error) {
+    return false;
+  }
+}
+
 function setStatus(message, isError = false) {
   statusEl.textContent = message;
   statusEl.classList.remove('hidden');
@@ -25,7 +53,7 @@ async function loadSettings() {
   backendUrlInput.value = settings.backendUrl || '';
   emailInput.value = settings.email || '';
 
-  if (settings.accessToken && settings.backendUrl) {
+  if (settings.accessToken && settings.backendUrl && await hasBackendPermission(settings.backendUrl)) {
     try {
       const response = await fetch(
         `${settings.backendUrl}/api/auth/me`,
@@ -61,7 +89,7 @@ async function clearSession() {
 
 async function saveSettingsAndLogin(event) {
   event.preventDefault();
-  const backendUrl = backendUrlInput.value.trim();
+  const backendUrl = normalizeBackendOrigin(backendUrlInput.value.trim());
   const email = emailInput.value.trim();
   const password = passwordInput.value;
   const otp = otpInput.value.trim();
@@ -71,6 +99,11 @@ async function saveSettingsAndLogin(event) {
     return;
   }
 
+  if (!(await requestBackendPermission(backendUrl))) {
+    setStatus(t('unableToLogIn'), true);
+    return;
+  }
+
   try {
     const response = await fetch(`${backendUrl}/api/auth/login`, {
       method: 'POST',
@@ -104,8 +137,9 @@ async function saveSettingsAndLogin(event) {
 
 async function signOut() {
   const settings = await browser.storage.local.get(['accessToken']);
-  if (settings.accessToken) {
-    await fetch(`${backendUrlInput.value.trim()}/api/auth/logout`, {
+  const backendUrl = normalizeBackendOrigin(backendUrlInput.value.trim());
+  if (settings.accessToken && await hasBackendPermission(backendUrl)) {
+    await fetch(`${backendUrl}/api/auth/logout`, {
       method: 'POST',
       headers: { 'Content-Type': 'application/json' },
       body: JSON.stringify({ token: settings.accessToken }),