Reduced permissions in the manifest

webextension/popup.js

@@ -16,6 +16,24 @@ const authSession = document.getElementById('auth-session');
 
 const t = window.linklogI18n;
 
+function normalizeBackendOrigin(backendUrl) {
+  try {
+    const url = new URL(backendUrl);
+    if (!['http:', 'https:'].includes(url.protocol)) {
+      return null;
+    }
+    return url.origin;
+  } catch (error) {
+    return null;
+  }
+}
+
+async function hasBackendPermission(backendUrl) {
+  const origin = normalizeBackendOrigin(backendUrl);
+  if (!origin) return false;
+  return browser.permissions.contains({origins: [`${origin}/*`]});
+}
+
 function setStatus(message, isError = false) {
   statusEl.textContent = message;
   statusEl.classList.remove('hidden');
@@ -33,7 +51,7 @@ async function getSettings() {
 }
 
 async function validateSession(settings) {
-  if (!settings.backendUrl || !settings.accessToken) return null;
+  if (!settings.backendUrl || !settings.accessToken || !(await hasBackendPermission(settings.backendUrl))) return null;
   try {
     const response = await fetch(`${settings.backendUrl}/api/auth/me`, {
       headers: {'Authorization': `Bearer ${settings.accessToken}`},
@@ -157,7 +175,7 @@ async function populateCurrentTab() {
 
 async function checkExistingLink() {
   const settings = await getSettings();
-  if (!settings.backendUrl || !settings.accessToken || !titleInput.value || !urlInput.value) return;
+  if (!settings.backendUrl || !settings.accessToken || !(await hasBackendPermission(settings.backendUrl)) || !titleInput.value || !urlInput.value) return;
   try {
     const response = await fetch(`${settings.backendUrl}/api/links/check?${new URLSearchParams({
       title: titleInput.value,
@@ -181,7 +199,7 @@ async function handleSubmit(event) {
   const token = settings.accessToken;
   const backendUrl = settings.backendUrl;
 
-  if (!token || !backendUrl) {
+  if (!token || !backendUrl || !(await hasBackendPermission(backendUrl))) {
     setStatus(t('configureAndLogIn'), true);
     browser.runtime.openOptionsPage();
     return;