shadowdaoandClaude Opus 5.5
05d991181d
build.rs now derives an AppManifest from generate_handler!, which makes tauri 2.11 apply the ACL to app commands (it skips them entirely without one). default.json grants the 110 main-window commands, file-viewer.json the five viewer_* commands, and build.rs refuses to build on a missing, misspelled, duplicated, misfiled or deny-* grant, or on a hand-written permission file. Stale autogenerated permissions are pruned per build. Closes the residual risk recorded by the terminal file viewer: a compromised viewer window could invoke any app command. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
17 lines
1.6 KiB
JSON
17 lines
1.6 KiB
JSON
{
|
|
"identifier": "file-viewer",
|
|
"description": "The terminal file viewer windows (`file-viewer-<n>`, opened by `open_file_viewer` on the app's own `viewer.html`). Same rules as `default.json`: app commands need no entry here and are gated by label inside `commands/file_viewer_commands.rs`; this file is the plugin-command surface a compromised viewer webview could reach, and it is the smallest one that lets the window work. `core:event:allow-listen`/`allow-unlisten` are for `file-viewer-goto` (Rust → this window; the viewer subscribes through `getCurrentWindow().listen`, because a bare `listen()` in *any* window receives an `emit_to`). `core:window:allow-destroy` is not optional: `getCurrentWindow().onCloseRequested` in @tauri-apps/api 2.11 makes Rust `prevent_close()` whenever a JS listener exists and then calls `destroy()` itself, so without this grant the window's X button does nothing once the unsaved-changes guard is installed. `allow-close` is deliberately absent — nothing calls it, and `destroy` is the only exit. No `set-title`/`set-focus`/`unminimize`: those are done from Rust when a second click targets an already-open file. `core:webview:allow-internal-toggle-devtools` is the same dev-only convenience `default.json` carries.",
|
|
"windows": ["file-viewer-*"],
|
|
"permissions": [
|
|
"core:event:allow-listen",
|
|
"core:event:allow-unlisten",
|
|
"core:window:allow-destroy",
|
|
"core:webview:allow-internal-toggle-devtools",
|
|
"allow-viewer-get-state",
|
|
"allow-viewer-choose-file",
|
|
"allow-viewer-read-file",
|
|
"allow-viewer-poll-file",
|
|
"allow-viewer-write-file"
|
|
]
|
|
}
|