Documentation
¶
Overview ¶
Package policy manages the browser "force-install" enterprise policies that lock the configured extensions in place so they cannot be removed from the browser UI. This file holds the platform-independent data model and helpers; the actual registry reads/writes live in policy_windows.go (and the managed policy files in policy_linux.go).
Index ¶
- Constants
- Variables
- func Apply(cfg Config) error
- func DetectBrowsers() map[Kind]bool
- func Remove(cfg Config) error
- type Config
- func (c Config) AnyEnabled() bool
- func (c *Config) EnableOnly(names []string)
- func (c Config) Only(name string) Config
- func (c *Config) SetEnabled(name string, enabled bool) bool
- func (c Config) Targets(k Kind) []Target
- func (c *Config) UnmarshalJSON(data []byte) error
- func (c Config) UpdateMode() string
- type Extension
- type Kind
- type Status
- type Target
Constants ¶
const ( UpdateNotify = "notify" UpdateApply = "apply" UpdateOff = "off" )
Update modes for Config.AutoUpdate.
Variables ¶
var ChromiumKinds = []Kind{Chrome, Edge, Brave}
ChromiumKinds are the Chromium-based browsers that share the ExtensionInstallForcelist policy mechanism.
Functions ¶
func Apply ¶
Apply writes the force-install policy for every configured extension, across every browser. Writing for a browser that isn't installed is harmless. Requires root.
func DetectBrowsers ¶
DetectBrowsers reports which supported browsers are installed (via PATH).
Types ¶
type Config ¶
type Config struct {
Extensions []Extension `json:"extensions"`
// AutoUpdate controls how the service reacts to a newer release:
// "notify" (default) logs availability, "apply" downloads and installs it
// silently, "off" disables the periodic check. See UpdateMode. Silent "apply"
// should wait until the binaries are code-signed (see docs/pc-version.md).
AutoUpdate string `json:"autoUpdate,omitempty"`
}
Config is the parsed extension-ids.json: the full set of extensions the guard force-installs and locks, plus app-level settings.
func LoadConfig ¶
LoadConfig reads and parses the extension-ids.json file.
func (Config) AnyEnabled ¶
AnyEnabled reports whether at least one extension is enabled.
func (*Config) EnableOnly ¶
EnableOnly enables exactly the extensions whose Name is in names (case-insensitive) and disables the rest, keeping every extension in the catalog. An empty names slice enables all. The installer's component picker uses this so unchosen extensions stay listed and can be turned on later.
func (Config) Only ¶
Only returns a copy containing just the named extension, forced enabled. Used to lift a single extension's browser lock without touching the others.
func (*Config) SetEnabled ¶
SetEnabled flips one extension by name (case-insensitive). Returns false if no extension has that name.
func (Config) Targets ¶
Targets returns every enforced target for a browser kind, one per enabled extension (including empty/placeholder targets; callers skip those via chromiumForcelistValue / firefoxConfigured). Disabled extensions are omitted, so apply/verify/remove never touch an extension the user turned off.
func (*Config) UnmarshalJSON ¶
UnmarshalJSON accepts both the current multi-extension shape ({"extensions": [...]}) and the legacy single-extension flat shape ({"chrome": {...}, "firefox": {...}, ...}), wrapping the latter as one extension so an already-deployed config keeps loading after the upgrade.
func (Config) UpdateMode ¶
UpdateMode returns the normalized auto-update mode, defaulting to "notify" when unset or unrecognized.
type Extension ¶
type Extension struct {
// Name is the stable identifier used by select / enable-extension /
// disable-extension. Label is the friendly display name shown in the status
// window (falls back to Name when empty).
Name string `json:"name,omitempty"`
Label string `json:"label,omitempty"`
Disabled bool `json:"disabled,omitempty"`
Chrome Target `json:"chrome"`
Edge Target `json:"edge"`
Brave Target `json:"brave"`
Firefox Target `json:"firefox"`
}
Extension is one extension to force-install, with a per-browser target (each browser force-installs only from its own store, so IDs/URLs differ per browser). A browser left empty or as a REPLACE_* placeholder is skipped.
Disabled keeps the extension in the catalog but stops the guard enforcing it, so the status window can list it and let the user turn it back on. It defaults to false (enabled), so a config without the field enforces every extension.
type Status ¶
type Status struct {
Kind Kind // which browser
Installed bool // browser detected on this machine
Locked bool // force-install policy present and correct for all configured extensions
Detail string // human-readable note: "ok", "missing", "tampered", "partial (n/m)", "not configured"
}
Status reports whether a browser's force-install policy is correctly applied. With several extensions configured for a browser, Locked means every one of them is force-installed; Detail is "partial (n/total)" when only some are.
type Target ¶
type Target struct {
ExtensionID string `json:"extensionId,omitempty"`
UpdateURL string `json:"updateUrl,omitempty"`
AddonID string `json:"addonId,omitempty"`
InstallURL string `json:"installUrl,omitempty"`
}
Target describes what to force-install for one browser. Chromium browsers use ExtensionID + UpdateURL; Firefox uses AddonID + InstallURL.
Source Files