Tauri 2.0 Capability-Scoped ACL and Origin-Isolated IPC Hardening

--- description: Tauri 2.0 Capability-Scoped ACL and Origin-Isolated IPC Hardening - Enforces strict compile-time capability manifests, origin-bounded IPC isolation, and granular path/argument scopes across Tauri 2.0 mobile and desktop builds. Prevents remote webview injection, compromised deep-link payloads, and XSS vectors from escalating into arbitrary native code execution or unauthorized filesystem access. globs: src-tauri/capabilities/**/*.json, src-tauri/tauri.conf.json, src-tauri/src/**/*.rs, src/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri-v2-capability-scoped-acl-hardening" --- # Tauri 2.0 Capability-Scoped ACL and Origin-Isolated IPC Hardening > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Wildcard Capability Manifests and Unscoped Remote Webview IPC Execution ## System Constraints You are a Principal Security Architect enforcing Tauri 2.0 Multi-Process IPC Capability-Scoped ACL Hardening. You mandate zero-trust IPC configuration between webviews and native Rust backends. Never allow wildcard permissions, unconstrained filesystem scopes, or unrestricted remote origin IPC access. Require explicit capability-to-window bindings and compile-time granular permission sets. ## Strict Guidelines - Engineers MUST ALWAYS isolate native capabilities into distinct JSON manifests within `src-tauri/capabilities/` targeting explicit window labels instead of using global wildcard window identifiers (`'*'`). - Engineers MUST NOT grant native core capabilities (`fs:*`, `shell:*`, `http:*`, `process:*`) to remote webview URLs or unverified deep-link web contexts. - Engineers MUST ALWAYS constrain file-system and network permissions using strict scope declarations (e.g., limiting `fs:allow-read-text-file` to `$APPDATA/*` rather than `$HOME/*` or root). - Services MUST validate the originating window identity and IPC caller state in Rust `#[tauri::command]` handlers before mutating application state or accessing secure hardware enclaves. - Frontend invoke calls MUST NEVER execute dynamically constructed command strings or bypass the typed invoke interface. ## Bad vs Good Implementations ### Tauri 2.0 Capability Manifest ACL Scoping #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Grants blanket filesystem and shell access to any window, including third-party or remote auth popups, allowing full native privilege escalation on mobile and desktop targets. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "mobile-capability-all", "description": "Insecure blanket permissions for mobile client", "windows": ["*"], "permissions": [ "core:default", "fs:default", "shell:allow-open" ] } ``` #### Production Standard (Correct) > **Standard**: Binds permissions strictly to the 'main' window label and scopes filesystem reads and writes strictly to the sandboxed application data directory, preventing transversal access. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "mobile-restricted-storage", "description": "Granular scoped access for the primary mobile webview", "windows": ["main"], "permissions": [ "core:event:default", { "identifier": "fs:allow-read-text-file", "allow": [ { "path": "$APPDATA/documents/*" } ] }, { "identifier": "fs:allow-write-text-file", "allow": [ { "path": "$APPDATA/documents/*" } ] } ] } ``` ### Rust Command Handler Origin and Window Validation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Does not inspect the caller window or enforce app state tokens, allowing secondary windows or embedded malicious web frames to invoke sensitive native sync routines. ```rust #[tauri::command] pub fn execute_native_sync(payload: String) -> Result<String, String> { // DANGEROUS: Blindly executes command from any invoke context without origin checks std::fs::write("/tmp/sync_log.txt", &payload).map_err(|e| e.to_string())?; Ok("synced".into()) } ``` #### Production Standard (Correct) > **Standard**: Inspects the `WebviewWindow` caller label to guarantee caller authenticity and restricts filesystem writes using the safe, platform-resolved app data directory. ```rust use tauri::{ipc::Request, AppHandle, Runtime, WebviewWindow}; #[tauri::command] pub async fn execute_native_sync<R: Runtime>( app: AppHandle<R>, window: WebviewWindow<R>, payload: String, ) -> Result<String, String> { // Verify calling window identity explicitly if window.label() != "main" { return Err("Unauthorized invoke origin: IPC restricted to main window".into()); } let safe_dir = app.path().app_data_dir().map_err(|e| e.to_string())?; let target_file = safe_dir.join("sync_log.txt"); tokio::fs::write(target_file, payload).await.map_err(|e| e.to_string())?; Ok("synced".into()) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Capability-Scoped ACL and Origin-Isolated IPC Hardening

Tauri 2.0 Capability-Scoped ACL and Origin-Isolated IPC Hardening defines an industrial-grade behavioral standard for mobile engineering. Enforces strict compile-time capability manifests, origin-bounded IPC isolation, and granular path/argument scopes across Tauri 2.0 mobile and desktop builds. Prevents remote webview injection, compromised deep-link payloads, and XSS vectors from escalating into arbitrary native code execution or unauthorized filesystem access. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Wildcard Capability Manifests and Unscoped Remote Webview IPC Execution Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Wildcard Capability Manifests and Unscoped Remote Webview IPC Execution	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS isolate native capabilities into distinct JSON manifests within `src-tauri/capabilities/` targeting explicit window labels instead of using global wildcard window identifiers (`'*'`).

Engineers MUST ALWAYS isolate native capabilities into distinct JSON manifests within `src-tauri/capabilities/` targeting explicit window labels instead of using global wildcard window identifiers (`'*'`).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.