Huang Xin
7a8354d63b
The fs capability granted the built-in `fs:allow-cache-read` and `fs:allow-cache-write` sets. Those sets bundle `scope-cache`, which carries the external `$CACHE` base directory. At startup Tauri resolves every granted scope entry, so `$CACHE` resolves through Android's `getExternalCacheDir`. On devices whose external storage volume cannot be prepared (e.g. custom ROMs where `/storage/emulated/0/Android/data/ <pkg>/cache` fails to mkdir) that returns null, the resolve errors, and the graceful "skip unresolvable entry" arm is gated to non-Android, so the error propagates: fs scope build fails, app init aborts, and the window stays black. Readest only performs I/O under the internal app cache (`$APPCACHE` -> `getCacheDir`, always available), so it never needs the external `$CACHE` scope. Grant the scope-free `fs:read-all` and `fs:write-all` command sets to preserve command coverage, and move the `$APPCACHE` scope (plus the iOS container path) into `fs:scope`. Startup then never resolves external storage. Add a regression guard asserting the default capability grants no external-`$CACHE` fs permission while keeping the internal cache scope and full read/write command coverage. Closes #4853 Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
194 lines
4.4 KiB
JSON
194 lines
4.4 KiB
JSON
{
|
|
"$schema": "../gen/schemas/desktop-schema.json",
|
|
"identifier": "default",
|
|
"description": "enables the default permissions",
|
|
"windows": ["main", "updater", "reader-*"],
|
|
"permissions": [
|
|
"core:default",
|
|
"fs:default",
|
|
"fs:read-meta",
|
|
"fs:allow-open",
|
|
"fs:allow-write",
|
|
"fs:allow-read",
|
|
"fs:allow-rename",
|
|
"fs:allow-mkdir",
|
|
"fs:allow-remove",
|
|
"fs:allow-stat",
|
|
"fs:allow-fstat",
|
|
"fs:allow-lstat",
|
|
"fs:read-all",
|
|
"fs:write-all",
|
|
{
|
|
"identifier": "fs:scope-appconfig-recursive",
|
|
"allow": [
|
|
{
|
|
"path": "$APPCONFIG"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"identifier": "fs:scope-appdata-recursive",
|
|
"allow": [
|
|
{
|
|
"path": "$APPDATA/Readest/**/*"
|
|
}
|
|
],
|
|
"deny": []
|
|
},
|
|
{
|
|
"identifier": "fs:allow-appdata-read",
|
|
"allow": [
|
|
{
|
|
"path": "$APPDATA/settings.json"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"identifier": "fs:allow-appdata-write",
|
|
"allow": [
|
|
{
|
|
"path": "$APPDATA/settings.json"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"identifier": "fs:scope",
|
|
"allow": [
|
|
{
|
|
"path": "**/Readest"
|
|
},
|
|
{
|
|
"path": "**/Readest/**/*"
|
|
},
|
|
{
|
|
"path": "**/com.github.johnfactotum.Foliate/**/*"
|
|
},
|
|
{
|
|
"path": "**/last-book-cover.png"
|
|
},
|
|
{
|
|
"path": "$TEMP/**/*"
|
|
},
|
|
{
|
|
"path": "$APPCACHE/**/*"
|
|
},
|
|
{
|
|
"path": "/private/var/mobile/Containers/Data/Application/**/*"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"identifier": "http:default",
|
|
"allow": [
|
|
{
|
|
"url": "https://*.readest.com"
|
|
},
|
|
{
|
|
"url": "https://github.com/readest/*"
|
|
},
|
|
{
|
|
"url": "https://*.deepl.com"
|
|
},
|
|
{
|
|
"url": "https://*.cloudflarestorage.com"
|
|
},
|
|
{
|
|
"url": "https://edge.microsoft.com"
|
|
},
|
|
{
|
|
"url": "https://translate.toil.cc"
|
|
},
|
|
{
|
|
"url": "https://*.microsofttranslator.com"
|
|
},
|
|
{
|
|
"url": "https://translate.googleapis.com"
|
|
},
|
|
{
|
|
"url": "http://*:*"
|
|
},
|
|
{
|
|
"url": "https://*:*"
|
|
},
|
|
{
|
|
"url": "http://*"
|
|
},
|
|
{
|
|
"url": "https://*"
|
|
}
|
|
]
|
|
},
|
|
"websocket:default",
|
|
"dialog:default",
|
|
"os:default",
|
|
"core:window:default",
|
|
"core:window:allow-close",
|
|
"core:window:allow-center",
|
|
"core:window:allow-show",
|
|
"core:window:allow-minimize",
|
|
"core:window:allow-unminimize",
|
|
"core:window:allow-maximize",
|
|
"core:window:allow-unmaximize",
|
|
"core:window:allow-set-size",
|
|
"core:window:allow-set-focus",
|
|
"core:window:allow-is-maximized",
|
|
"core:window:allow-start-dragging",
|
|
"core:window:allow-toggle-maximize",
|
|
"core:window:allow-set-fullscreen",
|
|
"core:window:allow-set-always-on-top",
|
|
"core:window:allow-destroy",
|
|
"core:webview:allow-create-webview-window",
|
|
"core:path:allow-resolve-directory",
|
|
"log:default",
|
|
"shell:default",
|
|
"process:default",
|
|
"process:allow-exit",
|
|
"process:allow-restart",
|
|
"oauth:allow-start",
|
|
"oauth:allow-cancel",
|
|
"sign-in-with-apple:default",
|
|
"opener:default",
|
|
{
|
|
"identifier": "opener:allow-open-url",
|
|
"allow": [
|
|
{
|
|
"url": "alipays:*"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"identifier": "shell:allow-spawn",
|
|
"allow": [
|
|
{
|
|
"name": "start-readest",
|
|
"cmd": "cmd",
|
|
"args": ["/C", "start", "", { "validator": "^.*Readest(.*)\\.exe$" }]
|
|
},
|
|
{
|
|
"name": "chmod-appimage",
|
|
"cmd": "chmod",
|
|
"args": ["+x", { "validator": "^.*Readest(.*)\\.AppImage$" }]
|
|
},
|
|
{
|
|
"name": "launch-appimage",
|
|
"cmd": "setsid",
|
|
"args": [{ "validator": "^.*Readest(.*)\\.AppImage$" }]
|
|
}
|
|
]
|
|
},
|
|
"biometric:default",
|
|
"haptics:allow-vibrate",
|
|
"haptics:allow-impact-feedback",
|
|
"haptics:allow-notification-feedback",
|
|
"haptics:allow-selection-feedback",
|
|
"deep-link:default",
|
|
"sharekit:default",
|
|
"clipboard-manager:allow-write-text",
|
|
"clipboard-manager:allow-read-text",
|
|
"device-info:default",
|
|
"turso:default",
|
|
"native-tts:default",
|
|
"native-bridge:default"
|
|
]
|
|
}
|