fix(cef): check origin for permission policy

src-tauri/src/main.rs

@@ -21,7 +21,6 @@ fn prompt_cef_permission(message: String, tx: std::sync::mpsc::Sender<bool>) {
         dialog.set_title("Permission request");
 
         let tx = std::cell::RefCell::new(Some(tx));
-        let dialog_ptr = dialog.clone();
         dialog.connect_response(move |dlg, response| {
             if let Some(tx) = tx.take() {
                 let _ = tx.send(matches!(response, ResponseType::Yes));
@@ -100,7 +99,7 @@ fn main() {
             return;
         }
 
-        // Allow call media capture (mic, camera, screen-share) for our webview.
+        // Allow call media capture (mic, camera, screen-share) and geolocation for our webview.
         // Cache granted permissions so we only prompt once per kind.
         use std::collections::HashSet;
         use std::sync::{Mutex, OnceLock};
@@ -110,11 +109,16 @@ fn main() {
         tauri_runtime_cef::set_permission_policy(move |request, responder| {
             use tauri_runtime_cef::{DenyReason, PermissionKind};
 
-            if request.webview_label != "main" {
+            if request.webview_label != "main"
+                || !request
+                    .origin
+                    .as_ref()
+                    .is_some_and(|origin| origin.is_app_local())
+            {
                 return responder.deny(DenyReason::NoPolicy);
             }
 
-            let media_kinds: Vec<PermissionKind> = request
+            let permission_kinds: Vec<PermissionKind> = request
                 .kinds
                 .iter()
                 .filter(|kind| {
@@ -125,24 +129,26 @@ fn main() {
                             | PermissionKind::CameraPanTiltZoom
                             | PermissionKind::ScreenCapture
                             | PermissionKind::CapturedSurfaceControl
+                            | PermissionKind::Geolocation
                     )
                 })
                 .cloned()
                 .collect();
 
-            if media_kinds.is_empty() {
+            if permission_kinds.is_empty() {
                 return responder.deny(DenyReason::NoPolicy);
             }
 
             // Check cache: if all requested kinds were already granted, allow immediately.
-            let kind_names: Vec<&'static str> = media_kinds
+            let kind_names: Vec<&'static str> = permission_kinds
                 .iter()
                 .map(|k| match k {
                     PermissionKind::Microphone => "mic",
                     PermissionKind::Camera | PermissionKind::CameraPanTiltZoom => "cam",
                     PermissionKind::ScreenCapture | PermissionKind::CapturedSurfaceControl => {
                         "screen"
                     }
+                    PermissionKind::Geolocation => "geolocation",
                     _ => "other",
                 })
                 .collect();
@@ -154,14 +160,15 @@ fn main() {
                 }
             }
 
-            let msg = match media_kinds.as_slice() {
+            let msg = match permission_kinds.as_slice() {
                 [PermissionKind::Microphone] => "Sable wants to access your microphone.",
                 [PermissionKind::Camera] => "Sable wants to access your camera.",
                 [PermissionKind::ScreenCapture] | [PermissionKind::CapturedSurfaceControl] => {
                     "Sable wants to share your screen."
                 }
-                _ if media_kinds.contains(&PermissionKind::Microphone)
-                    && media_kinds.contains(&PermissionKind::Camera) =>
+                [PermissionKind::Geolocation] => "Sable wants to access your location.",
+                _ if permission_kinds.contains(&PermissionKind::Microphone)
+                    && permission_kinds.contains(&PermissionKind::Camera) =>
                 {
                     "Sable wants to access your microphone and camera."
                 }