#107 Narrow remote-origin capabilities: notification plugin and opener URL scope

[Anonymous]

Originally created by: kristofferR

src-tauri/capabilities/default.json granted the remote facebook.com origin more than the injected code uses:

• notification:default bundles allow-notify/allow-show, but the page only ever calls is_permission_granted/request_permission (banners are delivered Rust-side via carrier:notify). A hostile FB-origin script could pop arbitrary native notifications, bypassing dedup, Mute, and Hide Preview.
• opener:allow-open-url carried no URL scope. The plugin source reads as deny-by-default on an empty scope, yet calls demonstrably succeed in production (zero ipc.open-url diags), so in practice it behaved as allow-any — including non-web schemes handed to the OS opener.

Fix (in flight): notification narrowed to the two query permissions; opener scoped to http/https/mailto:/tel: plus the macOS privacy-pane deep link used by media-permissions.ts. Follow-up capability work is tracked separately (core:default narrowing). Ref [#50].

[Anonymous]

Ticket changed by: kristofferR

• status: open --> closed

[Anonymous]

Originally posted by: kristofferR

Fixed in [#136]. The remote-origin capabilities were narrowed: notification:default was reduced to the two permission-query commands the page actually calls (banners are delivered Rust-side via carrier:notify), and the opener grant now carries an explicit URL scope (http/https/mailto:/tel: plus the macOS privacy-pane deep link).