Permissions

An extension can always read and write its own types: the ones it brings, the ones it adds fields to, or the person's own types they mapped it onto. Everything else, it asks for in uses:

"uses": ["pages.read", "assets"]

Use	Allows	Shown at install as
objects.read	Reading every object and type	Every object
pages.read	Reading pages	Pages
pages.write	Reading and writing pages	Pages
entries.read	Reading the day log	Day log
entries.write	Reading and writing the day log	Day log
calendar.read	Reading events and tasks	Calendar
calendar.write	Reading and writing events and tasks	Calendar
assets	Uploading and reading files	Files

Ask for the least you need. The person sees the list before installing, marked read or read and write.

What each call needs

Sorus checks each call where it runs, whichever tier the extension is in.

Calls	Need
workspace.get, types.list	Nothing. Without objects.read, types.list returns only your types.
objects.create, objects.upsert	The object is of one of your types.
objects.update, trash.move	The object is of one of your types.
objects.batch	Each write passes on its own.
objects.get	One of your types, or objects.read.
objects.query	query.type is one of your types, or objects.read.
Other object reads (list, links, resolve, referrers)	objects.read.
pages.*	pages.read, or pages.write to change them.
entries.*	entries.read, or entries.write to change them.
calendar.*	calendar.read, or calendar.write to change them.
assets.*, upload, download	assets.

Anything else, such as changing types, saved views or templates, is refused.

Network

Hosts in network, and the hosts of connections, are approved with the rest. See Jobs, network and connections.

Updates

An update that asks for more than the version before (a new use, host, or connection) doesn't run until the person approves again. What's new is marked New. So does an extension that arrives on another device through sync: each device approves on its own.

Extensions loaded from a folder are approved for what they ask, without a prompt.