Permissions

1. Host declares capabilities at startup
2. Client requests specific capabilities during pairing
3. User approves/denies each requested capability
4. Granted capabilities are persisted for the session
5. RPC methods declare which capability they require
6. Crosslink enforces: only methods with granted capabilities can be called

const server = createCrosslinkServer({
  application: { id: "com.example.myapp", name: "My App", version: "1.0.0" },
  capabilities: [
    { id: "app.control", title: "Control the app", risk: "low" },
    { id: "app.read", title: "Read app data", risk: "low" },
    { id: "app.write", title: "Modify app data", risk: "medium" },
    { id: "app.admin", title: "Admin operations", risk: "high" }
  ]
});

// This method requires "app.control"
server.expose("app.start", (args) => {
  return { started: true };
}, { capability: "app.control" });

// This method requires "app.read"
server.expose("app.getData", (args) => {
  return { data: "..." };
}, { capability: "app.read" });

// This method requires no capability (open to all paired devices)
server.expose("app.version", () => {
  return { version: "1.0.0" };
});

const rpc = await client.connect(["app.control", "app.read"]);

pairing: {
  approve: async (req) => {
    console.log(`Device: ${req.deviceName}`);
    console.log(`Requested: ${req.requestedCaps.join(", ")}`);
    console.log(`SAS: ${req.sas}`);

    // Auto-approve low-risk, ask for high-risk
    const highRisk = req.requestedCaps.filter(c =>
      server.getCapability(c)?.risk === "high"
    );
    if (highRisk.length > 0) {
      return await promptUser(`Allow ${req.deviceName} to: ${highRisk.join(", ")}?`);
    }
    return true;
  }
}

// Client tries to call a method without the required capability
const result = await rpc.call("app.admin");
// Throws: CAPABILITY_DENIED

if (rpc.hasCapability("app.admin")) {
  // Proceed
}

capabilities: [
  { id: "app.temporary", title: "Temporary access", risk: "medium", ttlMs: 3600000 } // 1 hour
]

// Narrow a device's granted capabilities (drops "app.admin")
server.setDeviceCaps(deviceId, ["app.control", "app.read"]);

// Revoke a device entirely (kills its active session, blocks reconnection)
server.revokeDevice(deviceId);