thunderbird-patch-review

Easy-to-use patch review interface for Thunderbird

Contribute: ~marcc/thunderbird-review-plugin@lists.sr.ht

git clone git://mccd.space/thunderbird-patch-review

commit e8bb1e18ae937df4e758b752066586b4d464c38f
parent e393a93c0b8e95be43077f7087ee151a924234b7
Author: Pi Agent <agent@pi.local>
Date:   Sat, 18 Jul 2026 17:18:37 +0200

docs: add a PERMISSIONS section explaining each requested permission

List the seven permissions in the manifest and what each is actually used
for (messagesRead/accountsRead/strore/compose/compose.send/downloads/tabs),
and note that the privileged Apply/Browse.../Open editor code is not a
Mozilla permission but a WebExtension Experiment shipped in the XPI.
Added to both the README and patch-review.1.

Diffstat:
M
README
 | 
33
+++++++++++++++++++++++++++++++++
M
patch-review.1
 | 
45
+++++++++++++++++++++++++++++++++++++++++++++

2 files changed, 78 insertions(+), 0 deletions(-)
diff --git a/README b/README
@@ -82,6 +82,39 @@ CONFIGURATION
        Thunderbird's native directory chooser; the path field stays editable
        either way.
 
+PERMISSIONS
+       The extension requests the fewest permissions it needs; none are
+       granted to remote content.  What each is for:
+
+       messagesRead
+	      Reads the selected message and its sibling patches in the
+	      same folder (subject, author, body) to build the review.
+
+       accountsRead
+	      Resolves the default identity of the account that owns the
+	      reviewed message, for the From-address label and send-as.
+
+       storage
+	      Persists draft comments (keyed by Message-ID) across restarts,
+	      and the editor command, apply strategy, repo mappings, and
+	      the last applied repository path.
+
+       compose, compose.send
+	      Opens reply-to-all compose windows from Send review, and
+	      sends them in Send now mode.  Without compose.send the review
+	      can only be previewed in compose, never sent.
+
+       downloads
+	      Writes the Download patchset .mbox to disk.
+
+       tabs
+	      Opens the review tab and removes it after a successful send.
+
+       The privileged Apply / Browse... / Open editor code does not
+       use a Mozilla permission: it is a WebExtension Experiment
+       (experiment_apis.patchHost) shipped inside the XPI and runs
+       only when the extension is loaded.
+
 SOURCEHUT INTEGRATION
        When the series arrives via a sourcehut mailing list (a lists.sr.ht
        address in the List-Id or recipients), the review tab shows a set
diff --git a/patch-review.1 b/patch-review.1
@@ -128,6 +128,51 @@ Repository paths can be chosen with the
 .B Browse
 button, which opens Thunderbird's native directory chooser; the path field
 stays editable either way.
+.SH PERMISSIONS
+The extension requests the fewest permissions it needs;
+none are granted to remote content.
+.TP
+.B messagesRead
+Reads the selected message and its sibling patches in the same folder
+(subject, author, body) to build the review.
+.TP
+.B accountsRead
+Resolves the default identity of the account that owns the reviewed
+message, for the From-address label and send-as.
+.TP
+.B storage
+Persists draft comments (keyed by Message-ID) across restarts,
+plus the editor command, apply strategy, repo mappings, and the last
+applied repository path.
+.TP
+.BR compose , " (compose.send)"
+Opens reply-to-all compose windows from
+.B "Send review"
+and sends them in
+.I "Send now"
+mode.
+Without
+.B compose.send
+the review can only be previewed in compose, never sent.
+.TP
+.B downloads
+Writes the
+.I "Download patchset"
+.B .mbox
+to disk.
+.TP
+.B tabs
+Opens the review tab and removes it after a successful send.
+.PP
+The privileged
+.BR Apply ,
+.IR "Browse... " ,
+and
+.I "Open editor"
+code does not use a Mozilla permission:
+it is a WebExtension Experiment
+.RB ( experiment_apis.patchHost )
+shipped inside the XPI and runs only when the extension is loaded.
 .SH SOURCEHUT INTEGRATION
 When the series arrives via a sourcehut mailing list (a
 .B lists.sr.ht