check for right permissions

main.ts

@@ -6,6 +6,7 @@ import { getCurrent, onOpenUrl } from '@tauri-apps/plugin-deep-link'
 import { ask, message } from '@tauri-apps/plugin-dialog'
 import { debug, error, info, trace, warn } from '@tauri-apps/plugin-log'
 import { platform } from '@tauri-apps/plugin-os'
+import { writeText } from '@tauri-apps/plugin-clipboard-manager'
 import { exit, relaunch } from '@tauri-apps/plugin-process'
 import type { Child } from '@tauri-apps/plugin-shell'
 import { check } from '@tauri-apps/plugin-updater'
@@ -75,6 +76,27 @@ try {
     console.error('Could not enable console logs', error)
 }
 
+async function checkFlatpakPermissions() {
+    const hasPermissions = await invoke<boolean>('has_flatpak_permissions')
+    if (hasPermissions) return
+
+    const copyCommand = await ask(
+        'You are running the flatpak version of Rclone UI, which is sandboxed.\n\nrclone is a file management utility that needs disk access in order to run. Please allow it using the following command (copy paste in your terminal):\n\nflatpak override --user --filesystem=host com.rcloneui.RcloneUI\n\nRestart Rclone UI afterwards.',
+        {
+            title: 'Flatpak Permissions Required',
+            kind: 'warning',
+            okLabel: 'Copy Command & Exit',
+            cancelLabel: 'Exit',
+        }
+    )
+
+    if (copyCommand) {
+        await writeText('flatpak override --user --filesystem=host com.rcloneui.RcloneUI')
+    }
+
+    await exit()
+}
+
 async function waitForHydration() {
     console.log('[waitForHydration] waiting for store hydration')
 
@@ -1115,6 +1137,7 @@ async function handleDeepLink() {
 }
 
 waitForHydration()
+    .then(() => checkFlatpakPermissions())
     .then(() => initializeHostStore())
     .then(() => checkHostReachability())
     .then(() => checkVersion())

src-tauri/src/lib.rs

@@ -63,6 +63,70 @@ pub fn is_linux_mint() -> bool {
     }
 }
 
+#[tauri::command]
+pub fn has_flatpak_permissions() -> bool {
+    // Native app: no Flatpak permission needed.
+    if !is_flatpak() {
+        return true;
+    }
+
+    let Ok(contents) = std::fs::read_to_string("/.flatpak-info") else {
+        return false;
+    };
+
+    let mut in_context = false;
+
+    for line in contents.lines() {
+        let line = line.trim();
+
+        if line.is_empty() || line.starts_with('#') {
+            continue;
+        }
+
+        if line.starts_with('[') && line.ends_with(']') {
+            in_context = line == "[Context]";
+            continue;
+        }
+
+        if !in_context {
+            continue;
+        }
+
+        let Some((key, value)) = line.split_once('=') else {
+            continue;
+        };
+
+        if key.trim() != "filesystems" {
+            continue;
+        }
+
+        for raw in value.split(';') {
+            let item = raw.trim();
+
+            if item.is_empty() {
+                continue;
+            }
+
+            // Explicit negative override, e.g. !host
+            if item == "!host" || item.starts_with("!host:") {
+                return false;
+            }
+
+            // Writable host access
+            if item == "host" || item == "host:rw" || item == "host:create" {
+                return true;
+            }
+
+            // Read-only host access is not enough for full rclone filesystem usage
+            if item == "host:ro" {
+                return false;
+            }
+        }
+    }
+
+    false
+}
+
 #[tauri::command]
 fn unzip_file(zip_path: &str, output_folder: &str) -> Result<(), String> {
     // Open the zip file
@@ -857,6 +921,7 @@ pub fn run() {
             test_proxy_connection,
             is_flatpak,
             is_linux_mint,
+            has_flatpak_permissions,
             open_full_window,
             open_window,
             open_small_window,