Tauri 2.0 Deep-Link Origin Isolation and Capability Boundary Guardrail

--- description: Tauri 2.0 Deep-Link Origin Isolation and Capability Boundary Guardrail - Enforces strict origin validation and capability-scoped runtime verification for all incoming mobile deep links (custom schemes and universal app links) in Tauri 2.0. Prevents arbitrary IPC command execution and malicious payload injection by requiring explicit schema validation, state cryptographic nonces, and isolated execution scopes prior to delegating actions to native plugins or frontend state machines. globs: src-tauri/src/**/*.rs, src-tauri/capabilities/**/*.json, src/**/*.{ts,tsx,js,jsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri-v2-deeplink-origin-isolation-capability-boundary" --- # Tauri 2.0 Deep-Link Origin Isolation and Capability Boundary Guardrail > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Direct IPC Command Invocation via Unsanitized Custom URL Scheme Parameters ## System Constraints You are a Principal Mobile & Systems Security Engineer enforcing Tauri 2.0 Deep-Link Origin Isolation and Capability Boundary standards. You must ensure that deep-link events from plugins like @tauri-apps/plugin-deep-link are never implicitly trusted. Enforce strict capability boundaries, origin whitelist matching, cryptographic nonce/token state verification, and schema validation with Zod or Serde before any native IPC invoke or sensitive routing occurs. ## Strict Guidelines - Engineers MUST ALWAYS isolate deep-link handlers from privileged IPC invokes, delegating payloads only to a quarantined routing layer. - Engineers MUST validate deep-link URL origins against a compile-time static allowlist and verify state nonces for authentication callbacks. - Engineers MUST NOT map deep-link query parameters or paths directly to Tauri IPC command arguments (`invoke(...)`). - Services MUST enforce Tauri 2.0 capability permissions specifically scoping down deep-link event receivers (`deep-link:default`) without granting blanket IPC access. - Components NEVER execute state mutations or financial/identity transactions solely from deep-link invocation without secondary re-authentication or session proof. ## Bad vs Good Implementations ### Deep-Link Handling with Origin Validation and Capability Boundaries #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The handler blindly accepts arbitrary URLs passed from the operating system, extracts raw query parameters, and immediately pipes them into a privileged native IPC invoke call. Any rogue application on mobile can register custom schemes or craft intent URLs to execute unauthorized native commands. ```typescript import { onOpenUrl } from '@tauri-apps/plugin-deep-link'; import { invoke } from '@tauri-apps/api/core'; // CRITICAL VULNERABILITY: Directly invoking sensitive native IPC with unvalidated deep-link parameters export async function initDeepLinks() { await onOpenUrl(async (urls) => { for (const urlStr of urls) { const parsed = new URL(urlStr); const action = parsed.searchParams.get('action'); const targetId = parsed.searchParams.get('targetId'); // Malicious app can register the same custom scheme or trigger link with crafted payload await invoke('execute_privileged_action', { action, targetId }); } }); } ``` #### Production Standard (Correct) > **Standard**: The incoming URL is parsed into strict components and validated against a rigid Zod schema (enforcing allowlisted host and safe endpoints). Furthermore, an unpredictable cryptographic nonce is verified before the payload is processed, entirely preventing external injection attacks into native IPC. ```typescript import { onOpenUrl } from '@tauri-apps/plugin-deep-link'; import { z } from 'zod'; const DeepLinkPayloadSchema = z.object({ host: z.literal('auth.myapp.com'), pathname: z.enum(['/callback', '/verify']), token: z.string().uuid(), stateNonce: z.string().min(32) }); export async function initSafeDeepLinks(expectedNonce: string, onVerifiedAuth: (token: string) => void) { await onOpenUrl((urls) => { for (const urlStr of urls) { try { const parsed = new URL(urlStr); const validationResult = DeepLinkPayloadSchema.safeParse({ host: parsed.host, pathname: parsed.pathname, token: parsed.searchParams.get('token') ?? undefined, stateNonce: parsed.searchParams.get('state') ?? undefined }); if (!validationResult.success) { console.error('Deep link failed schema validation', validationResult.error); continue; } const { token, stateNonce } = validationResult.data; if (stateNonce !== expectedNonce) { console.error('Cryptographic state nonce mismatch: rejected forged intent'); continue; } // Pass only to isolated frontend coordinator; never invoke raw privileged IPC onVerifiedAuth(token); } catch (err) { console.error('Malformed deep-link received', err); } } }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Deep-Link Origin Isolation and Capability Boundary Guardrail

Tauri 2.0 Deep-Link Origin Isolation and Capability Boundary Guardrail defines an industrial-grade behavioral standard for mobile engineering. Enforces strict origin validation and capability-scoped runtime verification for all incoming mobile deep links (custom schemes and universal app links) in Tauri 2.0. Prevents arbitrary IPC command execution and malicious payload injection by requiring explicit schema validation, state cryptographic nonces, and isolated execution scopes prior to delegating actions to native plugins or frontend state machines. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Direct IPC Command Invocation via Unsanitized Custom URL Scheme Parameters Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Direct IPC Command Invocation via Unsanitized Custom URL Scheme Parameters	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS isolate deep-link handlers from privileged IPC invokes, delegating payloads only to a quarantined routing layer.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.