Solel//dev docs

Grants

An app asks for grants in its manifest, and people approve them when they install it. A grant never gives your app more than the person using it has: an app with files.write still can't touch files that person can't.

How people approve them

  1. Whoever installs the app sees each grant it asks for in plain words, each with a switch that starts on.
  2. They turn off any they'd rather not give, and install. Only what's left on is granted.
  3. They can change their mind at any time on the app's page in Settings › Apps. See Apps and what they can reach.

A child doesn't install apps. They see what an app asks for, leave on what they'd like it to use, and ask a parent, who chooses and installs it for them. A child can take grants away from their apps later, but only a parent can give more.

Every grant

Grant What it lets the app do
files.read, files.write See the person's files; add, change, move, delete and share them. See Files
calendar.read, calendar.write See their calendars; add and change events. See Calendar
contacts.read, contacts.write See their contacts; add and change them. See Contacts
mail.read, mail.send Read their mail; send mail as them
mail.hosting Look after the addresses on the server's own mail domain. Only Solel's own Mail can use it
photos.read, photos.write See their photos; add, change and delete them
notify Send them notifications and put a count on the app's icon. See Notifications and badges
people.read See the names and pictures of the household's people, and its groups
people.manage Add and change people, their details and teams, when someone who manages people uses it
audit.read Read the activity log, when someone allowed to read it uses it
signin.manage Look after the apps people sign in to with Solel, when an admin uses it, and say who's signing in. See Sign in with Solel
jethro.call Ask the person's Jethro for help with what they're doing. See Asking Jethro
sols.talk Talk with the person's Sols
sols.manage Make, change and remove their Sols, see what they remember, and change how Sols behave on this device
network.internet Let the back end reach the internet
gpu.use Let the back end use the server's graphics card
microphone Record from the person's microphone through the desktop, while they choose

The people grants are covered in People and teams, and the last three in Back ends and workers and the reference.

Solel's own Mail and Photos ask for the mail and photos grants. No API in the core checks them, so asking for one gives your app nothing to call.

Someone who may not talk to Sols, such as a child, never sees an app that asks for sols.talk.

These three grants had other names before: arch.call, gens.talk and gens.manage. A manifest that still asks for an old name gets the grant by its new one.

What your app sees

  • In the front end, solel.ready() lists the grants approved for this install in grants.
  • In the back end, GET $SOLEL_CORE_URL/api/apps/self lists them too.
  • When one is missing, the core answers 403, with a message like this app hasn't been granted files.read. Leave out what needs it rather than showing something that fails.

Updates

When a new version asks for a grant the last one didn't, it isn't granted until someone approves it. Grants that were approved and are still asked for carry over.