From 6726620b168a4e91f9d593f2fd5d872721816f73 Mon Sep 17 00:00:00 2001 From: l2k Date: Wed, 20 May 2026 11:01:14 +0700 Subject: [PATCH] Update permissions for core process and services (#2112) Co-authored-by: Steven Enamakel --- .../permissions/allow-core-process.toml | 58 +++++++++++++++++-- 1 file changed, 52 insertions(+), 6 deletions(-) diff --git a/app/src-tauri/permissions/allow-core-process.toml b/app/src-tauri/permissions/allow-core-process.toml index 12a2420fc..823f46f6f 100644 --- a/app/src-tauri/permissions/allow-core-process.toml +++ b/app/src-tauri/permissions/allow-core-process.toml @@ -1,24 +1,28 @@ [[permission]] identifier = "allow-core-process" -description = "Core RPC URL, sidecar restart, dictation hotkey, webview-account, and gmail-CDP commands" +description = "Privileged desktop permissions for core process control, service management, dictation, account webview, window/UI, screen share, notifications, Gmail CDP, log access, Meet, and CEF/profile maintenance" [permission.commands] + allow = [ + + # ========================= + # CORE PROCESS + # ========================= "core_rpc_url", "core_rpc_token", - "restart_core_process", # `start_core_process` is invoked by BootCheckGate after the user picks # Local mode, before redux-persist hydrates the rest of the app (#1316). # Without this allow entry the invoke is rejected with "Command not # found" and the boot gate stalls. "start_core_process", + "restart_core_process", # `restart_app` triggers `app.restart()` so CEF re-initializes against # the active user's `users//cef` profile after an identity flip # (#900). Without this allow entry, the invoke is silently denied by # Tauri capabilities and webviews keep the prior user's third-party # cookies. "restart_app", - "schedule_cef_profile_purge", # `get_active_user_id` reads `~/.openhuman/active_user.toml` so the # frontend can prime `userScopedStorage` from the Rust source of truth # BEFORE redux-persist hydrates — the prior `localStorage`-only seed @@ -26,25 +30,49 @@ allow = [ # restart-driven flips, causing a false re-flip and restart loop on # every login. (#900) "get_active_user_id", + + # ========================= + # SERVICE MANAGEMENT + # ========================= "service_install_direct", "service_start_direct", "service_stop_direct", "service_status_direct", "service_uninstall_direct", + + # ========================= + # DICTATION + # ========================= "register_dictation_hotkey", "unregister_dictation_hotkey", + + # ========================= + # ACCOUNT WEBVIEW + # ========================= "webview_account_open", "webview_account_close", - "webview_account_purge", + "webview_account_show", + "webview_account_hide", "webview_account_bounds", "webview_account_reveal", - "webview_account_hide", - "webview_account_show", + "webview_account_purge", "webview_recipe_event", + + # ========================= + # WINDOW / UI + # ========================= "activate_main_window", + + # ========================= + # SCREEN SHARE + # ========================= "screen_share_begin_session", "screen_share_thumbnail", "screen_share_finalize_session", + + # ========================= + # NOTIFICATIONS + # ========================= # Native notification surface (see src/native_notifications/). The # frontend bridge in app/src/lib/nativeNotifications/tauriBridge.ts # calls these directly instead of routing through the bundled @@ -55,6 +83,10 @@ allow = [ "notification_permission_state", "notification_permission_request", "show_native_notification", + + # ========================= + # GMAIL CDP + # ========================= # Gmail-CDP surface (see app/src-tauri/src/gmail/). Drives the # logged-in Gmail webview through DOMSnapshot + Input events. Used # by onboarding's LinkedIn-enrichment pipeline today and by future @@ -67,6 +99,10 @@ allow = [ "gmail_trash", "gmail_add_label", "gmail_find_linkedin_profile_url", + + # ========================= + # LOGS + # ========================= # Surface the embedded core's daily-rotated log directory # (`/logs/`) so the Settings → Developer Options panel can # show users the path and reveal it in the platform file manager when @@ -74,11 +110,21 @@ allow = [ # backing commands. "logs_folder_path", "reveal_logs_folder", + + # ========================= + # GOOGLE MEET + # ========================= # Meet call: open / close a dedicated CEF webview window pointed at a # https://meet.google.com/ URL with an isolated per-call data # directory. Surfaced from Intelligence > Calls. Without these allow # entries the invoke is rejected with "Command not found". "meet_call_open_window", "meet_call_close_window", + + # ========================= + # CEF / PROFILE + # ========================= + "schedule_cef_profile_purge", ] + deny = []