Tauri 2.0 Granular Capability Manifests and IPC Sandboxing

--- description: Tauri 2.0 Granular Capability Manifests and IPC Sandboxing - Enforces compile-time capability mapping and strict runtime isolation between Tauri 2.0 webview contexts and native Rust commands. Mandates window-specific capability manifests with explicit command allowlisting, scoped file-system and network boundaries, and zero-trust isolation for untrusted or remote webview windows. globs: src-tauri/capabilities/**/*.json, src-tauri/capabilities/**/*.toml, src-tauri/src/**/*.rs, src-tauri/tauri.conf.json, src/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri-v2-capability-ipc-sandboxing-tauri-2-0-capabi-189" --- # Tauri 2.0 Granular Capability Manifests and IPC Sandboxing > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Monolithic Capabilities, Wildcard Window Binding, and Arbitrary Native IPC Exposure to Untrusted Webviews ## System Constraints You are a Principal Security Architect enforcing Tauri 2.0 capability-based IPC sandboxing and granular permission scoping. In Tauri 2.0, permissions are non-hierarchical and must be explicitly bound to distinct webview window labels via capability manifests under `src-tauri/capabilities/`. You must strictly prevent wildcard window bindings (`*`), open filesystem/shell scopes, and unauthorized native IPC invocation. Every command and plugin permission must be audited for principle of least privilege, ensuring untrusted webview windows possess zero access to sensitive host capabilities. ## Strict Guidelines - Engineers MUST ALWAYS define isolated capability manifests per window label in `src-tauri/capabilities/*.json` instead of a monolithic default capability. - Engineers MUST NOT use wildcard `"*"` in the `windows` or `permissions` arrays of any capability configuration. - Code MUST restrict filesystem (`fs`) and network (`http`) plugin permissions using granular `scope` definitions specifying exact path globs and URL origins. - Commands MUST inspect and validate the caller's `tauri::ipc::InvokeResolver` or `tauri::WebviewWindow` identifier in Rust when executing privileged state mutations. - Components NEVER grant `shell:allow-execute`, `shell:allow-open`, or raw process execution capabilities to any webview window loading remote URLs or untrusted external content. ## Bad vs Good Implementations ### Tauri 2.0 Capability Manifest Scoping #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Binds high-privilege permissions (including unrestricted shell execution and filesystem access) to all windows via the '*' wildcard, allowing any child or untrusted webview window to invoke dangerous host primitives. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "all-access-capability", "description": "Monolithic capability applied indiscriminately", "windows": ["*"], "permissions": [ "core:default", "fs:default", "shell:default", "shell:allow-execute" ] } ``` #### Production Standard (Correct) > **Standard**: Explicitly binds permissions to the 'main' window label only, denies shell execution, and restricts the filesystem and HTTP plugins to exact path globs and target origin patterns. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "main-window-capability", "description": "Least-privilege capability scoped exclusively to the primary authenticated window", "windows": ["main"], "permissions": [ "core:default", { "identifier": "fs:allow-read-text-file", "allow": [ { "path": "$APPDATA/reports/*.json" } ] }, { "identifier": "http:default", "allow": [ { "url": "https://api.internal.corp/v1/*" } ] } ] } ``` ### Rust Custom Command IPC Window Context Validation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Fails to inspect the calling WebviewWindow, allowing any auxiliary window or iframe possessing command permission to execute destructive mutations without context verification. ```rust // Rust: Insecure command omitting caller validation #[tauri::command] pub async fn delete_tenant_record(tenant_id: String) -> Result<(), String> { // Mutates tenant state without verifying caller window identity database::purge_tenant(&tenant_id).map_err(|e| e.to_string()) } ``` #### Production Standard (Correct) > **Standard**: Injects the `tauri::WebviewWindow` context into the command handler and verifies the caller label prior to executing privileged business logic. ```rust // Rust: Enforces window label validation and isolated execution #[tauri::command] pub async fn delete_tenant_record( window: tauri::WebviewWindow, tenant_id: String, ) -> Result<(), String> { if window.label() != "main" { return Err("Unauthorized IPC caller: command restricted to main window context".into()); } database::purge_tenant(&tenant_id).map_err(|e| e.to_string()) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Granular Capability Manifests and IPC Sandboxing

Tauri 2.0 Granular Capability Manifests and IPC Sandboxing defines an industrial-grade behavioral standard for security engineering. Enforces compile-time capability mapping and strict runtime isolation between Tauri 2.0 webview contexts and native Rust commands. Mandates window-specific capability manifests with explicit command allowlisting, scoped file-system and network boundaries, and zero-trust isolation for untrusted or remote webview windows. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Monolithic Capabilities, Wildcard Window Binding, and Arbitrary Native IPC Exposure to Untrusted Webviews Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Monolithic Capabilities, Wildcard Window Binding, and Arbitrary Native IPC Exposure to Untrusted Webviews	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS define isolated capability manifests per window label in `src-tauri/capabilities/*.json` instead of a monolithic default capability.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.