Tauri 2.0 Dynamic Capability ACL Multi-Origin Webview Guardrail

--- description: Tauri 2.0 Dynamic Capability ACL Multi-Origin Webview Guardrail - Enforces strict origin-scoped capabilities and cryptographic context verification across disparate webviews in Tauri 2.0 desktop and mobile builds. Prevents lateral privilege escalation and cross-frame capability leakage by ensuring dynamic webview instances cannot inherit high-privilege native plugin permissions assigned to the primary application frame. globs: src-tauri/capabilities/**/*.json, src-tauri/tauri.conf.json, src-tauri/src/**/*.rs, src/**/*.{ts,tsx,js,jsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri-v2-dynamic-capability-acl-guardrail" --- # Tauri 2.0 Dynamic Capability ACL Multi-Origin Webview Guardrail > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Global Plugin Exposure and Wildcard ACL Grants across Heterogeneous Webview Contexts ## System Constraints You are a Principal Security Architect enforcing the Tauri 2.0 Dynamic Capability ACL Multi-Origin Webview Guardrail. Mandate that every webview frame adheres to least-privilege capability separation. Disallow global permissions, wildcard IPC bindings, and shared capabilities between primary shells and dynamic or external origin child frames. Enforce cryptographic validation of origin handles and explicit window/label-based target filtering in capability configuration files. ## Strict Guidelines - Engineers MUST ALWAYS isolate dynamic secondary webviews into distinct capability sets bounded by explicit window labels or remote origin matches in `src-tauri/capabilities/*.json`. - Engineers MUST NOT grant native filesystem, shell execution, or sensitive device APIs to generic wildcards (`*`) or unverified external HTTPS origins. - Code SHOULD enforce strict payload and origin schema validation in Rust IPC commands using `tauri::ipc::Request` and `tauri::WebviewWindow` handles before dispatching native operations. - Services MUST revoke or deny ambient capabilities whenever spawning child webviews or authentication popups via `WebviewWindowBuilder`. - Components NEVER invoke raw `window.__TAURI_INTERNALS__.invoke` directly; all invocations MUST route through typed client bindings guarded by isolated channel policies. ## Bad vs Good Implementations ### Configuring Scoped Capabilities vs Over-Permissive Global ACLs #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Using wildcard window targets ('*') with destructive capabilities (fs, shell) allows unverified child webviews, third-party authentication frames, or compromised dynamic origins to invoke privileged native system plugins. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "default-capability", "description": "Anti-pattern: exposes fs and shell across all windows and webviews", "windows": ["*"], "permissions": [ "core:default", "fs:default", "fs:allow-read-text-file", "shell:allow-execute" ] } ``` #### Production Standard (Correct) > **Standard**: Explicitly binds the restricted capability profile to deterministic window labels ('tenant-frame-*') without access to filesystem, shell, or unbounded native interfaces. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "guest-tenant-capability", "description": "Production invariant: strictly confines untrusted/dynamic tenant frames", "windows": ["tenant-frame-*"], "permissions": [ "core:default", { "identifier": "http:default", "allow": [{ "url": "https://api.tenant.domain.com/*" }] } ] } ``` ### Rust Webview Instantiation with Origin Isolation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Spawns an external webview without explicit window-label capability fencing or origin verification, potentially exposing the default application IPC commands to malicious external content. ```rust // Anti-pattern: Inherits default capability shell and opens unrestricted origin pub fn spawn_tenant_webview(app: &tauri::AppHandle, tenant_url: tauri::Url) -> Result<(), tauri::Error> { tauri::WebviewWindowBuilder::new( app, "guest-window", tauri::WebviewUrl::External(tenant_url) ) .build()?; Ok(()) } ``` #### Production Standard (Correct) > **Standard**: Ensures that the newly constructed webview window matches the tightly scoped 'tenant-frame-*' capability ACL and enforces incognito session boundaries. ```rust // Production Invariant: Dynamically verifies origin and enforces isolated label convention pub fn spawn_tenant_webview(app: &tauri::AppHandle, tenant_id: &str, target_url: tauri::Url) -> Result<tauri::WebviewWindow, tauri::Error> { if target_url.scheme() != "https" { return Err(tauri::Error::AssetNotFound("Insecure origin scheme rejected".into())); } // Label matches the restrictive capability ACL wildcard 'tenant-frame-*' let window_label = format!("tenant-frame-{}", tenant_id); tauri::WebviewWindowBuilder::new(app, &window_label, tauri::WebviewUrl::External(target_url)) .disable_drag_drop_handler() .incognito(true) .build() } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Dynamic Capability ACL Multi-Origin Webview Guardrail

Tauri 2.0 Dynamic Capability ACL Multi-Origin Webview Guardrail defines an industrial-grade behavioral standard for mobile engineering. Enforces strict origin-scoped capabilities and cryptographic context verification across disparate webviews in Tauri 2.0 desktop and mobile builds. Prevents lateral privilege escalation and cross-frame capability leakage by ensuring dynamic webview instances cannot inherit high-privilege native plugin permissions assigned to the primary application frame. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Global Plugin Exposure and Wildcard ACL Grants across Heterogeneous Webview Contexts Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Global Plugin Exposure and Wildcard ACL Grants across Heterogeneous Webview Contexts	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS isolate dynamic secondary webviews into distinct capability sets bounded by explicit window labels or remote origin matches in `src-tauri/capabilities/*.json`.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.