Skip to content
JDesk
Guides

Capabilities & permissions

Commands are deny-by-default. Grant capabilities to windows.

A window can invoke a command only if it holds the required capability.

@DesktopCommand("clipboard.read")
@RequiresCapability("clipboard:read")
public CompletionStage<Clip> read(InvocationContext ctx) { ... }

Grant it in jdesk-capabilities.json:

{ "version": 1, "grants": [ { "capability": "clipboard:read", "windows": ["main"] } ] }

The check runs before deserialization and before your handler. Grant each window only what it needs.