Permissions

A plugin with a script does only what the user allowed. It lists what it needs in plugin.toml, notesy asks before it first runs, and every call it makes is checked against the answer.

#When notesy asks

The first time a plugin with a script loads, notesy shows what it asks for and waits: its script doesn't run until the user says yes. A plugin that only adds looks (themes, icons, syntax, colors, languages) runs nothing, so nothing is asked.

The prompt lists each permission and every site it can reach, and warns when a plugin can read what's yours and has a way to send it off: the network, opening links (a page's address can carry what it read), or sharing with other plugins.

#What each one lets it do

The ones in bold are shown in red when notesy asks.

Permission What it lets a plugin do
notes.read Read your notes and their properties
notes.write Create, change, rename and delete notes
files.read Read the other files in your vault, like images and PDFs
files.write Add, change and delete the other files in your vault
editor Read and change the note you're editing, and where the caret is
commands Add commands to the palette, with shortcuts, and run notesy's
ui Add panels, tabs, status bar items, settings pages, right-click menu items, hover card parts and dialogs
clipboard.read Read what you copy
clipboard.write Put things on your clipboard
notify Show notices
links.open Open web pages in your browser
accounts Sign you in to your accounts on the sites it names
plugins.share Share what it chooses with the plugins that ask to hear it

Three more come from other parts of plugin.toml, never listed by hand:

Permission Asked for by
net Naming sites in [net]: it can connect to those, and only those
markdown Naming languages in [contributes] blocks: it draws those blocks in your notes
plugins.hear Naming plugins in [plugins] hears: it hears what they share

#The network

A plugin reaches only the sites in its [net], through notesy's own fetch (notesy::net). *.example.org means that site's subdomains, not the site itself. Plain http goes only to this computer and the local network, named as such. An account's token goes only to that service's own sites, never to another the plugin names.

#Hearing other plugins

A plugin that hears another is approved against what that one could do at the time. When a plugin it hears is later allowed more, it stops until the user approves it again, seeing what changed.

#Updates

An update that asks for nothing new runs as before. One that asks for more, a permission or a site, waits for a yes to what's new, and the prompt shows only that.

#Changing your mind

Settings, Plugins has each plugin, what it may do, the sites it reached, and its log. Turning one off stops it; turning it back on asks for everything again. Removing it can keep its data or delete it too. What was allowed is kept in plugins/grants.toml.

#In a script

A script gets only the modules its permissions cover: one that uses a module it wasn't given doesn't compile. Scripts lists which module needs which.

Every page