Tauri 2.0 Fine-Grained Dynamic IPC Scope and Capability ACL Enforcement

--- description: Tauri 2.0 Fine-Grained Dynamic IPC Scope and Capability ACL Enforcement - Enforces Tauri 2.0 multi-window and multi-webview isolation via explicit compile-time capability manifests, dynamic path scopes, and context-bound IPC command permissions. Prevents privilege escalation and unauthorized native OS primitive access by eliminating global wildcard capabilities and validating window/webview callers during runtime execution. globs: src-tauri/capabilities/**/*.json, src-tauri/tauri.conf.json, src-tauri/src/**/*.rs, src/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri-v2-dynamic-ipc-scope-acl-enforcement" --- # Tauri 2.0 Fine-Grained Dynamic IPC Scope and Capability ACL Enforcement > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Granting Global Capabilities or Wildcard Filesystem/Shell Access Across All Tauri Windows and Dynamic Webviews ## System Constraints You are a Principal Security Architect enforcing Tauri 2.0 dynamic IPC scopes, capability Access Control Lists (ACLs), and process isolation. Tauri 2.0 replaces the legacy allowlist system with a capability-driven security model where every permission must be explicitly declared and scoped to individual window and webview contexts. Mandate zero-trust window isolation, prohibit global wildcard permissions (`*`), strictly define scoped filesystem/shell boundaries using canonical path variables (`$APPDATA`, `$RESOURCE`), and enforce calling-context validation in custom Rust IPC commands. ## Strict Guidelines - Engineers MUST ALWAYS isolate capabilities into discrete configuration files within `src-tauri/capabilities/` organized by window/webview role (e.g., `main.json`, `guest-preview.json`). - Engineers MUST NOT map permissions using the wildcard window target `"windows": ["*"]` or wildcard webview target `"webviews": ["*"]` when exposing sensitive plugins (such as `fs`, `shell`, `http`, or custom privileged commands). - Engineers MUST ALWAYS declare fine-grained dynamic scopes for file and network plugins (e.g., restricting `fs:allow-read-file` to specific relative or resolved system variables like `["$APPDATA/documents/*"]`). - Custom Rust `#[tauri::command]` handlers MUST explicitly inspect caller metadata via `tauri::WebviewWindow` or `tauri::ipc::Request` to prevent unauthorized execution from cross-origin frames or secondary untrusted windows. - Front-end invocations (`@tauri-apps/api/core::invoke`) MUST NEVER pass unvalidated absolute host paths or arbitrary shell arguments across IPC boundaries. - Plugin configuration MUST explicitly disable recursive wildcard glob patterns (`**`) on root or sensitive directories (`$HOME`, `$DESKTOP`, `$SYSTEM`). ## Bad vs Good Implementations ### Tauri 2.0 Capability Manifest: Wildcard Capabilities vs. Window-Scoped Dynamic ACL #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Assigning 'fs:default', 'fs:allow-write-all', and 'shell:default' to wildcard windows ['*'] gives every window, dialog, and third-party remote webview unrestricted access to arbitrary host filesystem read/write and sub-process execution. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "default-capability", "description": "Anti-pattern: Permissive capability applied globally to all windows", "windows": ["*"], "permissions": [ "core:default", "fs:default", "shell:default", "fs:allow-read-all", "fs:allow-write-all" ] } ``` #### Production Standard (Correct) > **Standard**: Permissions are restricted strictly to the 'main' window label. Filesystem read/write operations are confined to precise canonical base directories ($APPDATA, $RESOURCE) with explicit denial rules against executable artifacts. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "main-window-capability", "description": "Production: Strict least-privilege capability bound exclusively to main window with scoped paths", "windows": ["main"], "permissions": [ "core:default", { "identifier": "fs:allow-read-text-file", "allow": [ { "path": "$APPDATA/tenant-data/*" }, { "path": "$RESOURCE/templates/*" } ] }, { "identifier": "fs:allow-write-text-file", "allow": [ { "path": "$APPDATA/tenant-data/*" } ], "deny": [ { "path": "$APPDATA/tenant-data/*.exe" }, { "path": "$APPDATA/tenant-data/*.sh" } ] } ] } ``` ### Rust Custom Command: Unchecked IPC Execution vs. Window Caller Verification & Dynamic Path Scoping #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: This command can be invoked by any compromised or secondary webview within the application. It bypasses Tauri 2.0 capability checks entirely and allows writing arbitrary files anywhere on the operating system. ```rust // Anti-pattern: Command ignores window context and writes arbitrary user-provided paths #[tauri::command] pub async fn export_report(filepath: String, content: String) -> Result<(), String> { std::fs::write(&filepath, content).map_err(|e| e.to_string())?; Ok(()) } ``` #### Production Standard (Correct) > **Standard**: Validates that the calling webview matches the authorized 'main' label, neutralizes directory traversal vulnerabilities using Path::file_name(), and confines file operations strictly to the sandboxed app-data directory resolved via Tauri AppHandle path APIs. ```rust use tauri::{AppHandle, Manager, WebviewWindow, Runtime}; use std::path::{Path, PathBuf}; #[tauri::command] pub async fn export_report<R: Runtime>( app: AppHandle<R>, window: WebviewWindow<R>, filename: String, content: String ) -> Result<(), String> { // 1. Verify caller window authorization if window.label() != "main" { return Err("Unauthorized: IPC command execution restricted to main window context".into()); } // 2. Prevent path traversal attacks in user-provided filename let safe_filename = Path::new(&filename) .file_name() .ok_or_else(|| "Invalid filename supplied".to_string())?; // 3. Resolve to isolated application runtime directory let base_dir = app.path().app_data_dir() .map_err(|e| format!("Failed to resolve app data directory: {e}"))?; let target_path: PathBuf = base_dir.join("reports").join(safe_filename); // 4. Ensure target directory exists and write safely std::fs::create_dir_all(base_dir.join("reports")) .map_err(|e| format!("Failed to create reports directory: {e}"))?; std::fs::write(&target_path, content.as_bytes()) .map_err(|e| format!("Secure write failed: {e}"))?; Ok(()) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Fine-Grained Dynamic IPC Scope and Capability ACL Enforcement

Tauri 2.0 Fine-Grained Dynamic IPC Scope and Capability ACL Enforcement defines an industrial-grade behavioral standard for security engineering. Enforces Tauri 2.0 multi-window and multi-webview isolation via explicit compile-time capability manifests, dynamic path scopes, and context-bound IPC command permissions. Prevents privilege escalation and unauthorized native OS primitive access by eliminating global wildcard capabilities and validating window/webview callers during runtime execution. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Granting Global Capabilities or Wildcard Filesystem/Shell Access Across All Tauri Windows and Dynamic Webviews Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Granting Global Capabilities or Wildcard Filesystem/Shell Access Across All Tauri Windows and Dynamic Webviews	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS isolate capabilities into discrete configuration files within `src-tauri/capabilities/` organized by window/webview role (e.g., `main.json`, `guest-preview.json`).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.