From 44dcfbe24aeeb244aa8f5467d88fa29e841eb7b3 Mon Sep 17 00:00:00 2001
From: Yuri Karamian <yuri@arkhost.com>
Date: Mon, 17 Aug 2026 18:57:56 +0200
Subject: [PATCH] fix: tighten app permissions

---
 src-tauri/capabilities/default.json | 23 -----------------------
 src-tauri/tauri.conf.json           |  2 +-
 2 files changed, 1 insertion(+), 24 deletions(-)

diff --git a/src-tauri/capabilities/default.json b/src-tauri/capabilities/default.json
index f7ed022..2f64537 100644
--- a/src-tauri/capabilities/default.json
+++ b/src-tauri/capabilities/default.json
@@ -26,30 +26,7 @@
     "dialog:allow-confirm",
     "fs:default",
     "fs:allow-read",
-    "fs:allow-write",
-    "fs:allow-exists",
-    "fs:allow-mkdir",
-    "fs:allow-remove",
-    "fs:allow-rename",
-    "fs:allow-copy-file",
-    "fs:allow-stat",
-    "fs:allow-read-dir",
     "fs:allow-read-file",
-    "fs:allow-write-file",
-    "fs:allow-watch",
-    "opener:default",
-    {
-      "identifier": "opener:allow-open-path",
-      "allow": [{ "path": "/**" }]
-    },
-    {
-      "identifier": "opener:allow-open-url",
-      "allow": [
-        { "url": "https://**" },
-        { "url": "http://**" },
-        { "url": "mailto:*" }
-      ]
-    },
     "opener:allow-reveal-item-in-dir"
   ]
 }
diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
index 0c7fca8..dff8cf2 100644
--- a/src-tauri/tauri.conf.json
+++ b/src-tauri/tauri.conf.json
@@ -24,7 +24,7 @@
       }
     ],
     "security": {
-      "csp": "default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' asset: http://asset.localhost imgproxy: http://imgproxy.localhost https: blob: data:; font-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-src 'self' asset: http://asset.localhost",
+      "csp": "default-src 'self'; img-src 'self' asset: http://asset.localhost imgproxy: http://imgproxy.localhost https: blob: data:; font-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-src 'self' asset: http://asset.localhost",
       "assetProtocol": {
         "enable": true,
         "scope": ["**/*", "/**", "**/.helixnotes/**"]