Legality of extensions requiring viewers' OAuth permissions

I am aware of the ability to create a trade offer link, but how would that enable the donor to choose items or anything like that from within the Extension?

In that example the viewer only receives items from the extension, he does not give any to the extension.
Therefore the user does not have to authorize himself but only provide the trade URL so the extension can actually transfer anything.
Hope this helps?