From 631ea9db65ccb1bce9343c987bfe318d32f2e09d Mon Sep 17 00:00:00 2001 From: Danny Kim Date: Wed, 30 Sep 2026 17:46:44 +0900 Subject: [PATCH] Remove host allowlists from WebDAV plugin setup --- README.md | 11 ++++------- manifest.json | 3 +-- wit/filesystem.wit | 20 ++++++++++---------- 3 files changed, 15 insertions(+), 19 deletions(-) diff --git a/README.md b/README.md index 1974c81..9a02c16 100644 --- a/README.md +++ b/README.md @@ -7,6 +7,8 @@ interface, under the connection's permissions. It registers one provider, `webdav`, for the `webdav` and `davs` schemes. +This package requires a Memona version that supports plugin manifest schema 2. + ## Connecting | Field | Meaning | @@ -15,13 +17,8 @@ It registers one provider, `webdav`, for the `webdav` and `davs` schemes. | Username | Optional account name for HTTP basic authentication | | Password | Optional password, stored as a secret | -In Memona's connection permissions, enter the server's hostname or IP in -**Allowed hosts**, without the URL scheme, port or path. For example, -`http://192.168.1.20:8080/dav/` needs `192.168.1.20`. An empty list blocks every -request, even when the address and credentials are correct. Turn on -**Private network** as well for a server on localhost or a private network; -this switch does not grant a host by itself. Save and reconnect after changing -these permissions. +For localhost or a server on a private network, turn on **Private network** in +the connection settings. Save and reconnect after changing these settings. Listing, reading, writing, creating directories, renaming and deleting are supported. Reads and writes stream in pieces of at most 1 MiB, so a file of any diff --git a/manifest.json b/manifest.json index e5b5712..e44e761 100644 --- a/manifest.json +++ b/manifest.json @@ -1,5 +1,5 @@ { - "schemaVersion": 1, + "schemaVersion": 2, "id": "memona/webdav", "name": "WebDAV", "version": "0.1.2", @@ -7,7 +7,6 @@ "description": "Open a WebDAV server as a folder, and let agents work in it.", "license": "MIT", "entry": "plugin.wasm", - "networkHosts": ["*"], "networkPorts": [], "providers": [ { diff --git a/wit/filesystem.wit b/wit/filesystem.wit index dc8d5c8..b5bcdf8 100644 --- a/wit/filesystem.wit +++ b/wit/filesystem.wit @@ -35,10 +35,10 @@ interface host { /// `respond`. An empty result means the body is complete. pull: func(limit: u32) -> result, host-error>; } - /// Begins a request to a host both declared by the package and granted on - /// the connection. Each redirect and DNS result is checked, and DNS is - /// pinned. Private/LAN addresses additionally require the private-network - /// grant. Cross-origin redirects remove request headers; HTTPS cannot + /// Begins a request to any public HTTP or HTTPS host. Each redirect and + /// DNS result is checked, and DNS is pinned. Private/LAN addresses require + /// the connection's private-network grant. Cross-origin redirects remove + /// request headers; HTTPS cannot /// downgrade. The host bounds total bytes per exchange, not buffer size. http: func(request: request) -> result; @@ -51,13 +51,13 @@ interface host { /// Writes at most 1,048,576 bytes and returns how many were accepted. write: func(data: list) -> result; } - /// Opens a socket to a host and port both declared by the package and - /// granted on the connection. The host resolves and pins DNS, applies the - /// same private-address rule as `http`, and starts TLS when asked. Ports - /// negotiated at runtime, such as an FTP data channel, still need a grant. + /// Opens a socket to any public host on a package-declared port. + /// The host resolves and pins DNS, applies the same private-address rule + /// as `http`, and starts TLS when asked. Ports + /// negotiated at runtime, such as an FTP data channel, must be declared. connect: func(host: string, port: u16, tls: bool) -> result; - /// One datagram socket connected to a single granted peer. + /// One datagram socket connected to a single peer. resource udp { /// Sends one datagram of at most 65,507 bytes. send: func(data: list) -> result; @@ -65,7 +65,7 @@ interface host { /// means none arrived inside the host's wait, not that the peer left. receive: func(limit: u32) -> result, host-error>; } - /// Connects a datagram socket under the same declaration and grant rules + /// Connects a datagram socket under the same port and private-network rules /// as `connect`, for the few filesystem protocols that still need one. bind: func(host: string, port: u16) -> result;