# Permission Rationale Draft

This draft is for Chrome Web Store permission justification and reviewer notes. Keep it aligned with `extension/manifest.json` before submission.

## Single purpose

Time-2-Notion lets a user track time in the browser extension UI and save reviewed time entries into the Notion workspace and data sources the user authorizes.

## Chrome permissions

### `identity`

Used to launch Notion OAuth authorization with `chrome.identity.launchWebAuthFlow` and receive the extension redirect URI. This is required so users can authorize Notion without pasting tokens into the extension.

### `storage`

Used for local extension state: setup values, selected Notion data sources, field mappings, OAuth tokens, cached selector lists, active timer state, pending review entries, and backup-friendly setup data. Data is stored in Chrome extension local storage on the user's device.

## Host permissions

### `https://api.notion.com/*`

Required to call the Notion API after user authorization. The extension searches shared data sources, reads data source schemas, queries project/task lists, refreshes tokens when needed, and creates time-entry pages only in the user-selected Notion data source.

### `https://*/*`

Beta-only broad access for the configurable OAuth relay URL. Users can deploy or enter any HTTPS relay endpoint for exchanging Notion authorization codes and refresh tokens without embedding a Notion client secret in the extension. Before public launch, prefer narrowing this permission to a first-party relay host. If it remains broad, explain this beta/bring-your-own-relay model clearly in reviewer notes.

### `http://localhost/*`

Development-only support for local OAuth relay testing. Remove from the public Chrome Web Store build or use a separate development manifest before submission.

## Permission minimization notes

- The extension does not request `tabs`, `activeTab`, scripting, webRequest, cookies, history, or clipboard permissions.
- The extension UI does not read arbitrary web page contents.
- Production readiness should prioritize replacing configurable relay host access with a narrow first-party host permission.