storage-access.ts

1/**2 * Restrict persistent extension storage from content scripts when the browser3 * exposes the WebExtensions access-level API. Firefox versions without this4 * method remain safe for the sensitive paths because message authorization and5 * session-owned secrets do not rely on this defense-in-depth setting.6 */7export async function restrictLocalStorageToTrustedContexts(): Promise<void> {8  const local = chrome.storage?.local as (typeof chrome.storage.local & {9    setAccessLevel?: (options: { accessLevel: "TRUSTED_CONTEXTS" }) => Promise<void>;10  }) | undefined;11  if (typeof local?.setAccessLevel !== "function") return;12  try {13    await local.setAccessLevel({ accessLevel: "TRUSTED_CONTEXTS" });14  } catch {15    // Optional browser hardening must never prevent the extension from16    // starting; the message policy remains the primary security boundary.17  }18}