copilot-swe-agent[bot]
0a3fe11f66
- Create comprehensive PERMISSIONS.md explaining all permissions - Document empty host_permissions array and privacy benefits - Add session cookie security best practices to BrowserExtension.md - Clarify future use case for content script message handler - Improve error message clarity for JSON parsing failures Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
133 lines
4.8 KiB
Markdown
133 lines
4.8 KiB
Markdown
# Browser Extension Permissions
|
|
|
|
This document explains the permissions requested by the DocuElevate browser extension.
|
|
|
|
## Requested Permissions
|
|
|
|
The extension requests the following permissions in `manifest.json`:
|
|
|
|
### activeTab
|
|
- **Purpose**: Get the URL of the currently active tab
|
|
- **Usage**: When you click the extension icon, it reads the current tab's URL to display in the popup
|
|
- **Privacy**: Only accesses the active tab when you explicitly open the popup
|
|
- **Alternative**: Without this, the extension couldn't show you which file you're sending
|
|
|
|
### storage
|
|
- **Purpose**: Save your configuration (server URL and session cookie)
|
|
- **Usage**: Stores your DocuElevate server URL and optional session cookie locally
|
|
- **Privacy**: All data stays on your device; nothing is sent to third parties
|
|
- **Alternative**: Without this, you'd need to reconfigure the extension every time
|
|
|
|
### contextMenus
|
|
- **Purpose**: Add "Send to DocuElevate" to the right-click menu
|
|
- **Usage**: Creates a context menu item for quick access
|
|
- **Privacy**: No data access; only adds a menu item
|
|
- **Alternative**: Without this, you'd only have the toolbar icon
|
|
|
|
### notifications
|
|
- **Purpose**: Show success/error notifications
|
|
- **Usage**: Displays browser notifications when files are sent successfully or errors occur
|
|
- **Privacy**: Only shows notifications based on your actions
|
|
- **Alternative**: Without this, you wouldn't get feedback from context menu actions
|
|
|
|
## No Host Permissions
|
|
|
|
The extension has an **empty `host_permissions` array** (`[]`).
|
|
|
|
### Why Empty?
|
|
|
|
- **Privacy-First**: The extension doesn't request blanket access to all websites
|
|
- **User-Controlled**: You configure the DocuElevate server URL, not us
|
|
- **Minimal Permissions**: Only accesses the server you explicitly configure
|
|
- **Dynamic Access**: API requests are made from popup/background scripts, not from web pages
|
|
|
|
### How It Works
|
|
|
|
1. You configure your DocuElevate server URL in the extension
|
|
2. The extension stores this URL in local storage
|
|
3. When you send a file, the extension makes a direct API request to your configured server
|
|
4. No need for static host permissions because the extension doesn't inject scripts or modify web pages
|
|
|
|
### Comparison to Other Extensions
|
|
|
|
Many similar extensions request:
|
|
- ❌ `"<all_urls>"` or `"*://*/*"` - Access to all websites
|
|
- ❌ `"http://*/*"` and `"https://*/*"` - Access to all HTTP/HTTPS sites
|
|
|
|
DocuElevate requests:
|
|
- ✅ `[]` - No blanket host permissions
|
|
- ✅ Only access to your configured server (via fetch API)
|
|
|
|
## Permission Justification
|
|
|
|
| Permission | Required? | Justification |
|
|
|------------|-----------|---------------|
|
|
| activeTab | ✅ Yes | Must read current tab URL to send files |
|
|
| storage | ✅ Yes | Must save configuration to function |
|
|
| contextMenus | ⚠️ Optional | Nice to have for quick access |
|
|
| notifications | ⚠️ Optional | Nice to have for feedback |
|
|
|
|
## Security Benefits
|
|
|
|
1. **No Web Page Access**: Extension can't read or modify content on websites you visit
|
|
2. **No Browsing History**: Extension doesn't track your browsing
|
|
3. **No Cross-Site Access**: Extension only talks to your configured server
|
|
4. **User-Controlled**: All communication is initiated by you
|
|
5. **Transparent**: All code is visible in the extension folder
|
|
|
|
## How to Verify Permissions
|
|
|
|
### Chrome/Edge
|
|
|
|
1. Go to `chrome://extensions/` or `edge://extensions/`
|
|
2. Find "DocuElevate - Send to Document Processor"
|
|
3. Click "Details"
|
|
4. Review "Permissions" section
|
|
|
|
### Firefox
|
|
|
|
1. Go to `about:addons`
|
|
2. Find "DocuElevate - Send to Document Processor"
|
|
3. Click on the extension name
|
|
4. View "Permissions" tab
|
|
|
|
## Reducing Permissions Further
|
|
|
|
If you want even fewer permissions:
|
|
|
|
1. **Remove contextMenus**: Delete the `contextMenus` permission from `manifest.json`
|
|
- Trade-off: Lose right-click menu option
|
|
- You'd only have the toolbar icon
|
|
|
|
2. **Remove notifications**: Delete the `notifications` permission
|
|
- Trade-off: No success/error notifications
|
|
- You'd only see status in the popup
|
|
|
|
3. **Remove content script**: Delete the `content_scripts` section
|
|
- Trade-off: None (it's not actively used currently)
|
|
- Reduces extension footprint slightly
|
|
|
|
## Privacy Statement
|
|
|
|
The DocuElevate browser extension:
|
|
|
|
- ✅ Does NOT collect any personal data
|
|
- ✅ Does NOT track your browsing history
|
|
- ✅ Does NOT send data to third parties
|
|
- ✅ Does NOT modify web page content
|
|
- ✅ Does NOT inject ads or tracking scripts
|
|
- ✅ Only communicates with YOUR configured DocuElevate server
|
|
- ✅ Stores configuration locally on your device only
|
|
|
|
## Questions?
|
|
|
|
If you have concerns about permissions or privacy, please:
|
|
|
|
- Review the source code in the `browser-extension` folder
|
|
- Open an issue on [GitHub](https://github.com/christianlouis/DocuElevate/issues)
|
|
- Check the [Browser Extension Guide](../docs/BrowserExtension.md)
|
|
|
|
---
|
|
|
|
Last updated: 2024
|