Tauri 2.0 Webview Capability ACL Scoping and Least-Privilege Origin Isolation

--- description: Tauri 2.0 Webview Capability ACL Scoping and Least-Privilege Origin Isolation - Enforces strict origin-scoped Access Control List (ACL) manifests and fine-grained capability definitions across all Tauri 2.0 window contexts. Prohibits global wildcards or default-allow capability sets to prevent arbitrary native OS privilege escalation and remote code execution from compromised renderers. globs: src-tauri/capabilities/**/*.json, src-tauri/tauri.conf.json, src-tauri/src/**/*.rs, src/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri-v2-capability-acl-scoping" --- # Tauri 2.0 Webview Capability ACL Scoping and Least-Privilege Origin Isolation > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Global Capability Wildcarding and Unscoped Plugin Permissions Across Webview Windows ## System Constraints You are a Principal Security Architect enforcing Tauri 2.0 Webview Capability ACL Scoping. In Tauri 2.0, capabilities decouple security access control from binary builds into declarative JSON/TOML ACL manifests. You must mandate strict principle-of-least-privilege capability mapping per window label and remote origin. Never allow default:all, unconfined file system roots, or unsanitized shell commands. Reject any pull request that merges renderer windows without segregated capability boundaries. ## Strict Guidelines - Engineers MUST ALWAYS define dedicated capability manifests in `src-tauri/capabilities/<context>.json` scoped to specific window labels. - Engineers MUST NOT grant blanket permissions like `core:default`, `fs:default`, or `shell:default` without granular command restrictions. - Code MUST restrict filesystem scope arrays (`scope: allow`) to explicitly parameterized application directories (e.g., `$APPDATA/*`, `$APPCACHE/*`) instead of broad system roots (`$HOME/*` or `**`). - Services invoking IPC commands via `@tauri-apps/api/core` MUST declare explicit custom command permissions inside `src-tauri/permissions/` rather than bypassing permission checks via arbitrary command dispatchers. - Renderers displaying untrusted or remote web content MUST NEVER share a capability manifest with internal administrative windows. - Engineers MUST declare separate capabilities for remote webview contexts using the `remote` property with strictly validated HTTPS domains, disallowing wildcards in the host part. ## Bad vs Good Implementations ### Tauri 2.0 Capability Manifest Scoping #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Windows is set to wildcard '*' and permissions use broad default suites ('fs:default', 'shell:default'). Any renderer context, including modal or untrusted child windows, gains full, unconstrained access to spawn arbitrary shell commands and traverse the entire local filesystem. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "main-capability", "description": "Capability for the main window", "windows": ["*"], "permissions": [ "core:default", "fs:default", "shell:default" ] } ``` #### Production Standard (Correct) > **Standard**: Binds capability specifically to window 'main', rejects shell access, avoids catch-all permission bundles, and tightly scopes filesystem read/write operations exclusively to the isolated $APPDATA/reports directory. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "main-window-capability", "description": "Restricted capabilities strictly bound to main app shell", "windows": ["main"], "permissions": [ "core:event:allow-listen", "core:event:allow-emit", { "identifier": "fs:allow-read-text-file", "allow": [{ "path": "$APPDATA/reports/**" }] }, { "identifier": "fs:allow-write-text-file", "allow": [{ "path": "$APPDATA/reports/*.json" }] } ] } ``` ### Renderer Command Invocation with Strongly Typed Payload Validation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Exposing arbitrary command execution wrappers to the frontend bypasses Tauri 2.0 ACL design, enabling remote execution if XSS occurs. ```typescript import { invoke } from '@tauri-apps/api/core'; // Bad: Renderer blindly passes unvalidated command and unescaped shell-like string args export async function runCommand(cmd: string, args: string[]) { return await invoke('system_execute', { cmd, args }); } ``` #### Production Standard (Correct) > **Standard**: Dispatches to a strongly typed plugin namespace with strict client-side validation, aligning with an ACL manifest that permits only this specific command. ```typescript import { invoke } from '@tauri-apps/api/core'; export interface ExportReportPayload { readonly reportId: string; readonly content: string; } // Good: Concrete typed command invocation mapped to an explicit Tauri 2.0 ACL command permission export async function exportReport(payload: ExportReportPayload): Promise<void> { if (!/^[a-zA-Z0-9_-]+$/.test(payload.reportId)) { throw new Error('Invalid report ID format'); } await invoke('plugin:audit|export_report', { id: payload.reportId, content: payload.content }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Webview Capability ACL Scoping and Least-Privilege Origin Isolation

Tauri 2.0 Webview Capability ACL Scoping and Least-Privilege Origin Isolation defines an industrial-grade behavioral standard for security engineering. Enforces strict origin-scoped Access Control List (ACL) manifests and fine-grained capability definitions across all Tauri 2.0 window contexts. Prohibits global wildcards or default-allow capability sets to prevent arbitrary native OS privilege escalation and remote code execution from compromised renderers. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Global Capability Wildcarding and Unscoped Plugin Permissions Across Webview Windows Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Global Capability Wildcarding and Unscoped Plugin Permissions Across Webview Windows	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS define dedicated capability manifests in `src-tauri/capabilities/<context>.json` scoped to specific window labels.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.