GKaszewski/k-os
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(settings): settings app: apps list + per-capability allow/revoke, about (who/role), sign out; system-only caps permissions/session (install refused); pm MANAGE_BADGE copy (list/apps/allow/revoke only), APPS op; init WHO + session pass-on; factory decisions seeded for new system apps; k-ui list_item/toggle, screens/back/scroll

Browse Source
This commit is contained in:
Gabriel Kaszewski
2026-10-28 13:14:35 +01:00
parent a2d4a7d085
commit 29becf297c
38 changed files with 947 additions and 85 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
docs/apps.md
View File

@@ -87,6 +87,13 @@ optional one is simply not granted.
|---|---|
| `display` | a window of its own, named from its manifest: its pixels, and the keyboard while it is in front |
| `storage` | the user's `data/<id>/`, read-write (its own folder only) |
| `permissions` | a management copy of the permission manager's endpoint (below) |
| `session` | init's session copy: who is signed in (`WHO`), and signing out |
`permissions` and `session` are **system only**: only an app on the system
image (with a factory decision) has them. Installing an app that asks for
either, required or optional, is refused (`SYSTEM_ONLY`). Settings
(`kos.settings`) is the app that holds them.
## Decisions
@@ -100,7 +107,9 @@ granted = ["display"]
Written by the permission manager when the user decides; apps on the
system image ship with their decisions already recorded under
`factory/permissions/` (pre-approved by whoever built the image), and init
seeds them into each new user's `permissions/`. Changing one later is that
seeds them into each new user's `permissions/`; a system app added to the
image later is seeded into existing users' at their next sign-in (decisions
already there are left alone). Changing one later is that
user's call, through the permission manager.
## Permission manager
@@ -141,6 +150,14 @@ permission manager:
5. Replies with a handle (the process capability, call-only) the launcher
can wait on and kill.
### Managing
`APPS` lists every installed app, a line each: `id`, `name`, then the
required, optional and granted capabilities as bit masks, tab separated.
An app granted `permissions` gets a copy of the permission manager's
endpoint badged `MANAGE_BADGE`: it may only `LIST`, `APPS`, `ALLOW` and
`REVOKE`, never install or launch. The copy is revoked when the app dies.
### Revoke
The user withdraws a capability: the decision changes and the next launch