permission-auditor 0.1.0

Audit a list of Chrome / Manifest V3 extension permissions against a curated risk database: every MV3 permission + host-access patterns + plain-English risk descriptions, summarized into a per-extension report. Powers the zovo.one extension security scanner.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57

//! # permission-auditor
//!
//! Audit a list of Chrome / **Manifest V3** extension permissions against a
//! curated risk database and produce a per-extension [`AuditReport`]:
//!
//! - a **risk level** (`Low` / `Medium` / `High` / `Critical`) for each
//!   permission, plus a short plain-English description of what it grants,
//! - recognition for **host-access patterns** (`<all_urls>`, scheme
//!   wildcards, scoped match-patterns) and broad-vs-scoped classification,
//! - an **overall verdict** for the whole extension, with the count of each
//!   severity and the single highest permission driving it.
//!
//! This is a more comprehensive companion to
//! [`ext-permission-risk`](https://crates.io/crates/ext-permission-risk):
//! it covers the full MV3 permission surface, adds a `Critical` tier for the
//! truly dangerous combinations (arbitrary host access + code injection),
//! and returns a structured report rather than a single lookup.
//!
//! Pure Rust, **zero dependencies**, `#![forbid(unsafe_code)]`, fully tested.
//!
//! This is the audit engine behind the
//! [**zovo.one**](https://zovo.one/) Chrome-extension privacy &amp; security
//! scanner.
//!
//! ## Quick example
//!
//! ```
//! use permission_auditor::{audit, RiskLevel};
//!
//! let report = audit(&[
//!     "activeTab",
//!     "storage",
//!     "tabs",
//!     "<all_urls>",
//!     "scripting",
//!     "cookies",
//! ]);
//!
//! // activeTab and storage are Low; tabs is Medium; <all_urls> is Critical;
//! // scripting + cookies are High. The broad-host + code combo escalates to
//! // Critical — this is the canonical surveillance capability set.
//! assert_eq!(report.overall, RiskLevel::Critical);
//! assert!(report.critical_count >= 1);
//! assert!(report.high_count >= 2);
//! assert_eq!(report.findings.len(), 6);
//! assert!(report.findings.iter().any(|f| f.token == "<all_urls>"));
//! ```

#![forbid(unsafe_code)]

mod db;
mod host;
mod report;

pub use db::{PermissionEntry, RiskLevel, RISK_DATABASE, find_permission};
pub use host::{HostScope, classify_host_pattern, is_host_access_pattern};
pub use report::{Finding, FindingKind, AuditReport, audit, audit_with_manifest_version};