Open AstraLuma opened 12 years ago
What I'm thinking is that when an extension makes a request for the first time, the user is prompted to OK it.
The management permission is asked for as an optional perm (see chrome.permissions).
We use the management API to get the necessary metadata to generate the permissions dialog. After that, we don't need it.
Calling apps have several permission levels:
The permissions list is not accessible from the external API.
An API method should be added for extensions to explicitly request a permission level.
Should we add authorization code to API calls from other extensions? Basically keep a list of user-approved extensions.
Proper UI for this would require the management permission, too.