Tauri 2.0 Biometric-Enforced Keychain IPC Token Verification

--- description: Tauri 2.0 Biometric-Enforced Keychain IPC Token Verification - Enforces cryptographic verification of hardware-backed biometric authentication (Secure Enclave / Android KeyStore) before releasing raw access tokens across the Tauri 2.0 mobile IPC bridge into WebView memory. Prevents token exfiltration and bypass attacks by requiring nonce-based challenge-response signatures verified in Rust core prior to credential release. globs: src-tauri/src/**/*.rs, src-tauri/capabilities/**/*.json, src/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri-mobile-biometric-keychain-invariant" --- # Tauri 2.0 Biometric-Enforced Keychain IPC Token Verification > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Trusting Client-Side Biometric Prompts Without Hardware Nonce Signatures Over Tauri IPC ## System Constraints You are a Principal Mobile Security Engineer enforcing the Tauri 2.0 Mobile Biometric Auth-Token Keychain Invariant. You must reject any architecture where biometric authentication merely returns a boolean success flag to the frontend before retrieving tokens. Mandate that mobile IPC plugin bridges verify a cryptographic signature generated inside the hardware Secure Enclave / KeyStore against an ephemeral backend/Rust-generated nonce before releasing protected keychain secrets across the WebView boundary. ## Strict Guidelines - Engineers MUST ALWAYS require a server- or Rust-generated cryptographically secure pseudorandom nonce (CSPRN) before initiating biometric signing operations. - Engineers MUST NEVER trust a plain boolean `success: true` from frontend biometric prompts to unlock sensitive tokens across the IPC boundary. - Engineers MUST store mobile refresh/access tokens in OS-native secure storage using biometric access control flags (e.g., `kSecAccessControlBiometryAny` on iOS, `KeyGenParameterSpec.Builder.setUserAuthenticationRequired(true)` on Android). - Services MUST verify the cryptographic signature produced by the Secure Enclave/KeyStore within the native Rust layer or backend service prior to decrypting or issuing access tokens. - Code MUST invalidate ephemeral challenges immediately upon verification or after a strict time-to-live (maximum 30 seconds) to prevent replay attacks across IPC. ## Bad vs Good Implementations ### Insecure Boolean Biometric Check vs Hardware-Signed Nonce Challenge Over Tauri 2.0 IPC #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The frontend evaluates a client-side boolean flag from the biometric prompt. An attacker with WebView code execution or an altered binary can hook this call or directly execute the 'retrieve_raw_token' IPC command to extract credentials without ever touching the biometric sensor. ```typescript import { invoke } from '@tauri-apps/api/core'; import { authenticate } from '@tauri-apps/plugin-biometric'; export async function getSessionToken(): Promise<string> { // VULNERABILITY: Client-side boolean verification can be bypassed via WebView tampering or IPC injection const authResult = await authenticate('Authenticate to access your account'); if (authResult) { // Insecure: IPC command trusts the caller without cryptographic proof of hardware auth return await invoke<string>('retrieve_raw_token'); } throw new Error('Biometric authentication failed'); } ``` #### Production Standard (Correct) > **Standard**: Eliminates the trusting of boolean flags. The token is locked behind a Secure Enclave/KeyStore hardware key. The native layer issues an ephemeral challenge, ensures the hardware-backed biometric signature over the nonce is valid, and only releases the token upon strict cryptographic verification. ```typescript import { invoke } from '@tauri-apps/api/core'; interface SignedAuthPayload { signature: string; nonce: string; } export async function getSessionToken(): Promise<string> { // 1. Request single-use cryptographic challenge generated by Rust core const nonce = await invoke<string>('generate_biometric_challenge'); // 2. Hardware Enclave prompts user and signs nonce using private key requiring biometrics const signature = await invoke<string>('sign_with_hardware_key', { challenge: nonce }); const payload: SignedAuthPayload = { signature, nonce }; // 3. Rust core verifies signature against the Enclave public key and single-use nonce before releasing token return await invoke<string>('verify_and_retrieve_token', { payload }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Biometric-Enforced Keychain IPC Token Verification

Tauri 2.0 Biometric-Enforced Keychain IPC Token Verification defines an industrial-grade behavioral standard for mobile engineering. Enforces cryptographic verification of hardware-backed biometric authentication (Secure Enclave / Android KeyStore) before releasing raw access tokens across the Tauri 2.0 mobile IPC bridge into WebView memory. Prevents token exfiltration and bypass attacks by requiring nonce-based challenge-response signatures verified in Rust core prior to credential release. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Trusting Client-Side Biometric Prompts Without Hardware Nonce Signatures Over Tauri IPC Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Trusting Client-Side Biometric Prompts Without Hardware Nonce Signatures Over Tauri IPC	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS require a server- or Rust-generated cryptographically secure pseudorandom nonce (CSPRN) before initiating biometric signing operations.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.