firefox: add extension permissions (#7402)

Adds extension permissions as suggested in
https://github.com/nix-community/home-manager/issues/7001.
Adds the 'profiles.<name>.extensions.settings.<name>.permissions' to Firefox
derivatives. If set, this option adds an assertion that fails if an extension
package requests permissions that weren't added to the permissions option. In
order to not require 'profiles.<name>.extensions.force' to be set when only
permissions, but no extension settings were defined, the relevant assertions
were changed. They now check whether any 'extensions.settings.<name>.settings'
was set instead of checking whether 'extensions.settings' was set.

---------

Co-authored-by: Robert Helgesson <robert@rycee.net>
Co-authored-by: awwpotato <awwpotato@voidq.com>

modules/programs/firefox/mkFirefoxModule.nix

@@ -80,6 +80,9 @@ let
       if lib.isBool pref || lib.isInt pref || lib.isString pref then pref else builtins.toJSON pref
     );
 
+  extensionSettingsNeedForce =
+    extensionSettings: builtins.any (ext: ext.settings != { }) (attrValues extensionSettings);
+
   mkUserJs =
     prePrefs: prefs: extraPrefs: bookmarksFile: extensions:
     let
@@ -88,7 +91,7 @@ let
           "browser.bookmarks.file" = toString bookmarksFile;
           "browser.places.importBookmarksHTML" = true;
         }
-        // lib.optionalAttrs (extensions != { }) {
+        // lib.optionalAttrs (extensionSettingsNeedForce extensions) {
           "extensions.webextensions.ExtensionStorageIDB.enabled" = false;
         }
         // prefs;
@@ -356,6 +359,12 @@ in
       type = types.attrsOf (
         types.submodule (
           { config, name, ... }:
+          let
+            profilePath = modulePath ++ [
+              "profiles"
+              name
+            ];
+          in
           {
             imports = [ (pkgs.path + "/nixos/modules/misc/assertions.nix") ];
 
@@ -721,7 +730,19 @@ in
                                 options = {
                                   settings = mkOption {
                                     type = types.attrsOf jsonFormat.type;
-                                    description = "Json formatted options for the specified extensionID";
+                                    default = { };
+                                    description = "Json formatted options for this extension.";
+                                  };
+                                  permissions = mkOption {
+                                    type = types.nullOr (types.listOf types.str);
+                                    default = null;
+                                    example = [ "activeTab" ];
+                                    defaultText = "Any permissions";
+                                    description = ''
+                                      Allowed permissions for this extension. See
+                                      <https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/WebExtensions/manifest.json/permissions>
+                                      for a list of relevant permissions.
+                                    '';
                                   };
                                   force = mkOption {
                                     type = types.bool;
@@ -763,36 +784,54 @@ in
             };
 
             config = {
-              assertions = [
+              assertions =
+                [
                   (mkNoDuplicateAssertion config.containers "container")
                   {
-                  assertion = config.extensions.settings == { } || config.extensions.force;
+                    assertion = !(extensionSettingsNeedForce config.extensions.settings) || config.extensions.force;
                     message = ''
-                    Using '${
+                      Using '${lib.showOption profilePath}.extensions.settings' will override all
-                      lib.showAttrPath (
+                      previous extensions settings. Enable
-                        modulePath
+                      '${lib.showOption profilePath}.extensions.force' to acknowledge this.
-                        ++ [
-                          "profiles"
-                          config.name
-                          "extensions"
-                          "settings"
-                        ]
-                      )
-                    }' will override all previous extensions settings.
-                    Enable '${
-                      lib.showAttrPath (
-                        modulePath
-                        ++ [
-                          "profiles"
-                          config.name
-                          "extensions"
-                          "force"
-                        ]
-                      )
-                    }' to acknowledge this.
                     '';
                   }
-              ] ++ config.bookmarks.assertions;
+                ]
+                ++ (builtins.concatMap (
+                  { name, value }:
+                  let
+                    packages = builtins.filter (pkg: pkg.addonId == name) config.extensions.packages;
+                    package = builtins.head packages;
+                    unauthorized = lib.subtractLists value.permissions package.meta.mozPermissions;
+                  in
+                  [
+                    {
+                      assertion = value.permissions == null || length packages == 1;
+                      message = ''
+                        Must have exactly one extension with addonId '${name}'
+                        in '${lib.showOption profilePath}.extensions.packages' but found ${toString (length packages)}.
+                      '';
+                    }
+
+                    {
+                      assertion = value.permissions == null || length packages != 1 || unauthorized == [ ];
+                      message = ''
+                        Extension ${name} requests permissions that weren't
+                        authorized: ${builtins.toJSON unauthorized}.
+                        Consider adding the missing permissions to
+                        '${
+                          lib.showAttrPath (
+                            profilePath
+                            ++ [
+                              "extensions"
+                              name
+                            ]
+                          )
+                        }.permissions'.
+                      '';
+                    }
+                  ]
+                ) (lib.attrsToList config.extensions.settings))
+                ++ config.bookmarks.assertions;
             };
           }
         )
@@ -888,8 +927,7 @@ in
         ++ lib.flip mapAttrsToList cfg.profiles (
           _: profile:
           # Merge the regular profile settings with extension settings
-          mkMerge (
+          mkMerge [
-            [
             {
               "${cfg.profilesPath}/${profile.path}/.keep".text = "";
 
@@ -918,7 +956,7 @@ in
                     || profile.settings != { }
                     || profile.extraConfig != ""
                     || profile.bookmarks.configFile != null
-                      || profile.extensions.settings != { }
+                    || extensionSettingsNeedForce profile.extensions.settings
                   )
                   {
                     text =
@@ -950,20 +988,19 @@ in
                 force = true;
               };
             }
-            ]
+
-            ++
+            (mkMerge (
-              # Add extension settings as separate attributes
+              mapAttrsToList (
-              optional (profile.extensions.settings != { }) (
+                name: settingConfig:
-                mkMerge (
+                mkIf (settingConfig.settings != { }) {
-                  mapAttrsToList (name: settingConfig: {
                   "${cfg.profilesPath}/${profile.path}/browser-extension-data/${name}/storage.js" = {
                     force = settingConfig.force || profile.extensions.force;
                     text = lib.generators.toJSON { } settingConfig.settings;
                   };
-                  }) profile.extensions.settings
+                }
-                )
+              ) profile.extensions.settings
-              )
+            ))
-          )
+          ]
         )
       );
     }

tests/modules/programs/firefox/common.nix

@@ -19,6 +19,7 @@ builtins.mapAttrs
     "${name}-profiles-containers-id-out-of-range" = ./profiles/containers/id-out-of-range.nix;
     "${name}-profiles-duplicate-ids" = ./profiles/duplicate-ids.nix;
     "${name}-profiles-extensions" = ./profiles/extensions;
+    "${name}-profiles-extensions-assertions" = ./profiles/extensions/assertions.nix;
     "${name}-profiles-overwrite" = ./profiles/overwrite;
     "${name}-profiles-search" = ./profiles/search;
     "${name}-profiles-settings" = ./profiles/settings;

tests/modules/programs/firefox/profiles/extensions/assertions.nix

@@ -0,0 +1,74 @@
+modulePath:
+{ config, lib, ... }:
+
+let
+
+  firefoxMockOverlay = import ../../setup-firefox-mock-overlay.nix modulePath;
+
+  uBlockStubPkg = config.lib.test.mkStubPackage {
+    name = "ublock-origin-dummy";
+    extraAttrs = {
+      addonId = "uBlock0@raymondhill.net";
+      meta.mozPermissions = [
+        "privacy"
+        "storage"
+        "tabs"
+        "<all_urls>"
+        "http://*/*"
+        "https://github.com/*"
+      ];
+    };
+  };
+in
+{
+  imports = [ firefoxMockOverlay ];
+
+  config = lib.mkIf config.test.enableBig (
+    lib.setAttrByPath modulePath {
+      enable = true;
+      profiles.extensions = {
+        extensions = {
+          packages = [ uBlockStubPkg ];
+          settings = {
+            "uBlock0@raymondhill.net" = {
+              settings = {
+                selectedFilterLists = [
+                  "ublock-filters"
+                  "ublock-badware"
+                  "ublock-privacy"
+                  "ublock-unbreak"
+                  "ublock-quick-fixes"
+                ];
+              };
+              permissions = [
+                "alarms"
+                "tabs"
+                "https://github.com/*"
+              ];
+            };
+            "unknown@example.com".permissions = [ ];
+          };
+        };
+      };
+    }
+    // {
+      test.asserts.assertions.expected = [
+        ''
+          Using '${lib.showOption modulePath}.profiles.extensions.extensions.settings' will override all
+          previous extensions settings. Enable
+          '${lib.showOption modulePath}.profiles.extensions.extensions.force' to acknowledge this.
+        ''
+        ''
+          Extension uBlock0@raymondhill.net requests permissions that weren't
+          authorized: ["privacy","storage","<all_urls>","http://*/*"].
+          Consider adding the missing permissions to
+          '${lib.showOption modulePath}.profiles.extensions.extensions."uBlock0@raymondhill.net".permissions'.
+        ''
+        ''
+          Must have exactly one extension with addonId 'unknown@example.com'
+          in '${lib.showOption modulePath}.profiles.extensions.extensions.packages' but found 0.
+        ''
+      ];
+    }
+  );
+}