fix: update Chrome host permissions to allow all URLs

[BelKed]

• Fixes Can't grant access to all sites on Chrome #182

---

Important

Updates Chrome host permissions in manifest.json to allow all URLs, fixing issue #182.

• Permissions:
  • Updates {{chrome}}.host_permissions in manifest.json to "<all_urls>", allowing the extension to access all URLs.
• Issue Fix:
  • Fixes issue Can't grant access to all sites on Chrome #182 in the aw-watcher-web repository.

^{This description was created by for ce00279. You can customize this summary. It will automatically update as commits are pushed.}

[ellipsis-dev]

Important

Looks good to me! 👍

Reviewed everything up to ce00279 in 32 seconds. Click for details.

• Reviewed 14 lines of code in 1 files
• Skipped 0 files when reviewing.
• Skipped posting 3 draft comments. View those below.
• Modify your settings and rules to customize what types of comments Ellipsis leaves. And don't forget to react with 👍 or 👎 to teach Ellipsis.

1. src/manifest.json:47

• Draft comment:
  Using <all_urls> is correct to resolve issue 182, but increases risk by granting all-site access. Ensure this is documented and conforms with Chrome guidelines.
• Reason this comment was not posted:
  Confidence changes required: 33% <= threshold 50% None

2. src/manifest.json:47

• Draft comment:
  Verify that Firefox permissions remain intentionally restricted to specific endpoints, and consider if consistency is needed.
• Reason this comment was not posted:
  Confidence changes required: 33% <= threshold 50% None

3. src/manifest.json:47

• Draft comment:
  Using '<all_urls>' now grants full access on Chrome, which resolves issue 182. Confirm that this broad permission is acceptable from a security standpoint.
• Reason this comment was not posted:
  Confidence changes required: 0% <= threshold 50% None

Workflow ID: wflow_gSMzZMnS5kbLJ85b

^{You can customize by changing your verbosity settings, reacting with 👍 or 👎, replying to comments, or adding code review rules.}

[ErikBjare]

I wanted to find where this was documented before merging, and I found:

Host permissions allow extensions to interact with the URL's matching patterns. Some Chrome APIs require host permissions in addition to their own API permissions, which are documented on each reference page. Here are some examples:

• Make fetch() requests from the extension service worker and extension pages.
• Read and query the sensitive tab properties (url, title, and favIconUrl) using the chrome.tabs API.

https://developer.chrome.com/docs/extensions/develop/concepts/declare-permissions

Merging!

[ErikBjare]

They are saying this on submission:

Not sure if we can get around with more narrowly scoped permissions, but still submitting it now.