Минимальные разрешения: без tabs, доступ только к http/https

common.js

@@ -14,7 +14,8 @@ const TRIGGERS = [
 ];
 const DEFAULT_ON_COLOR = 'red';
 const DEFAULT_OFF_COLOR = 'light';
-const ALL_URLS = { origins: ['<all_urls>'] };
+// Must match host_permissions in manifest.json
+const SITE_ORIGINS = { origins: ['http://*/*', 'https://*/*'] };
 // Default IDE keys: VS Code - php.debug.ideKey of xdebug/vscode-php-debug,
 // others - as in Xdebug helper extension. Any other value is a custom key.
 const IDE_PRESETS = [
@@ -70,7 +71,7 @@ function isSupportedUrl(url) {
 
 async function hasHostPermission() {
     try {
-        return await api.permissions.contains(ALL_URLS);
+        return await api.permissions.contains(SITE_ORIGINS);
     } catch (e) {
         logError('permissions.contains failed', e);
         return false;
@@ -79,7 +80,7 @@ async function hasHostPermission() {
 
 // Must be called from a user action handler (click)
 async function requestHostPermission() {
-    let granted = await api.permissions.request(ALL_URLS);
+    let granted = await api.permissions.request(SITE_ORIGINS);
     log('host permission granted:', granted);
     return granted;
 }

manifest.json

@@ -15,13 +15,13 @@
     },
 
     "permissions": [
-        "tabs",
         "cookies",
         "storage"
     ],
 
     "host_permissions": [
-        "<all_urls>"
+        "http://*/*",
+        "https://*/*"
     ],
 
     "action": {

store/permissions.md

@@ -6,8 +6,7 @@ for the current site to start PHP debugging, profiling or tracing.
 | Permission | Why it is needed |
 |---|---|
 | `cookies` | Set and remove the Xdebug trigger cookies for the current site; watch cookie changes to show the actual state on the toolbar icon. |
-| `tabs` | Read the URL of the active tab to know which site the cookie is for, and update the toolbar icon and badge per tab. |
 | `storage` | Save extension settings (cookie names and values, IDE, icon colors) and per-site choices. |
-| Host permission `<all_urls>` | The cookies API works only for sites the extension has host permission for. Developers debug arbitrary hosts (localhost, test domains, staging servers), so the list of sites cannot be fixed in advance. |
+| Host permissions `http://*/*`, `https://*/*` | The cookies API works only for sites the extension has host permission for; the same permission gives the URL of the current tab (to know which site the cookie is for and to show the state on the toolbar icon). Developers debug arbitrary hosts (localhost, test domains, staging servers), so the list of sites cannot be fixed in advance. Only http and https are requested: Xdebug cookies make sense only there. |
 | Remote code | Not used. All code is in the package. |
 | Data collection | None. |

tests/chrome.test.js

@@ -190,12 +190,10 @@ describe('Chromium', () => {
     });
 
     it('shows unsupported message on browser pages', async () => {
-        const blank = await context.newPage();
-        await blank.goto('about:blank');
-        const blankTabId = await worker.evaluate(async () => (await api.tabs.query({ url: 'about:blank' }))[0].id);
-        await popup.goto(`chrome-extension://${extensionId}/popup.html?tabId=${blankTabId}`);
+        // Without the "tabs" permission non-http tabs can't be found by URL, so the site tab is reused
+        await site.goto('about:blank');
+        await popup.goto(`chrome-extension://${extensionId}/popup.html?tabId=${siteTabId}`);
         await eventually(async () => assert.ok(await popup.isVisible('.unsupported')));
-        await blank.close();
     });
 
     it('has no unexpected console errors', () => {