fai/chain-studio
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(store): trust gate before every module install
Some checks failed
Security / Security check (push) Failing after 2s
Details

Browse source 
One-click installs showed no trust signal at all (top security
finding of the usertest panel). Every install path — store card,
detail sheet, and the flow list's quick fix — now routes through
one confirmation dialog showing what the hub actually knows
before download: origin store, version, license, maturity, and
required services/capabilities, plus the sandbox model and an
honest note that per-entry signature status is not in the store
index yet (verification happens hub-side at install). Widget
tests cover content and confirm/cancel semantics.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>
This commit is contained in:
flemming-it 2026-07-17 23:44:14 +02:00
parent c253f5d23e
commit 039f11b6bc
10 changed files with 477 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

66
lib/l10n/app_localizations.dart
View file

@ -4640,6 +4640,72 @@ abstract class AppLocalizations {
/// **'Search & commands'**
String get sidebarSearchLabel;
/// No description provided for @installConfirmTitle.
///
/// In en, this message translates to:
/// **'Install \"{name}\"?'**
String installConfirmTitle(String name);
/// No description provided for @installConfirmVersion.
///
/// In en, this message translates to:
/// **'Version'**
String get installConfirmVersion;
/// No description provided for @installConfirmSource.
///
/// In en, this message translates to:
/// **'Source'**
String get installConfirmSource;
/// No description provided for @installConfirmSourceBundled.
///
/// In en, this message translates to:
/// **'Bundled store index'**
String get installConfirmSourceBundled;
/// No description provided for @installConfirmLicense.
///
/// In en, this message translates to:
/// **'License'**
String get installConfirmLicense;
/// No description provided for @installConfirmStatus.
///
/// In en, this message translates to:
/// **'Maturity'**
String get installConfirmStatus;
/// No description provided for @installConfirmNeedsServices.
///
/// In en, this message translates to:
/// **'Required services'**
String get installConfirmNeedsServices;
/// No description provided for @installConfirmNeedsCapabilities.
///
/// In en, this message translates to:
/// **'Required capabilities'**
String get installConfirmNeedsCapabilities;
/// No description provided for @installConfirmTrustTitle.
///
/// In en, this message translates to:
/// **'Trust & security'**
String get installConfirmTrustTitle;
/// No description provided for @installConfirmTrustBody.
///
/// In en, this message translates to:
/// **'The module runs in a sandbox: it may only touch the network endpoints, files, and environment variables it declares itself — the hub enforces that list. The full permission list is visible in the module details after installation.'**
String get installConfirmTrustBody;
/// No description provided for @installConfirmSignatureNote.
///
/// In en, this message translates to:
/// **'The hub verifies signatures at install time whenever the security profile requires them. The store index does not yet show a per-entry signature status up front (alpha).'**
String get installConfirmSignatureNote;
/// No description provided for @settingsSidebarPinnedTitle.
///
/// In en, this message translates to: