Tauri 2.0 Granular Capability Manifest Authorization Boundary

--- description: Tauri 2.0 Granular Capability Manifest Authorization Boundary - Enforces strict isolation between native host capabilities and multi-webview rendering contexts across mobile platforms in Tauri 2.0. Eliminates privilege escalation by mapping individual webview window labels to explicit, least-privilege capability manifests and forbidding catch-all wildcards or runtime command bypasses. Ensures remote or compromised untrusted webview contexts cannot invoke privileged core plugins, filesystem APIs, or native hardware bindings. globs: src-tauri/capabilities/**/*.json, src-tauri/tauri.conf.json, src-tauri/src/**/*.rs, src/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri-v2-granular-capability-authorization-boundary" --- # Tauri 2.0 Granular Capability Manifest Authorization Boundary > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Assigning global wildcard capabilities across all webviews or allowing untrusted remote content to invoke core IPC commands ## System Constraints You are a Principal Security Architect enforcing Tauri 2.0 granular capability authorization boundaries. You must enforce strict least-privilege isolation between webview contexts, ensuring that external or multi-webview instances never inherit ambient native permissions. Validate that all capability files partition permissions by exact window labels, explicitly deny wildcard commands on unauthenticated origins, and disallow IPC command reflection. ## Strict Guidelines - Engineers MUST ALWAYS isolate distinct webview instances into dedicated capability files in `src-tauri/capabilities/*.json` targeting exact window labels. - Engineers MUST NOT use wildcard (`*`) targets for `windows` arrays in capability definitions containing sensitive core or plugin permissions. - Untrusted remote or external URLs MUST NEVER be assigned capability profiles that expose filesystem, shell, process, or hardware-level APIs. - IPC invocations from client code MUST be strictly typed and validated against the corresponding permissions assigned to that specific webview context. - Rust command handlers MUST NEVER accept raw deserialized JSON strings or bypass capability enforcement via custom untyped message routers. ## Bad vs Good Implementations ### Tauri 2.0 Capability Manifest Isolation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Using a wildcard window target ('*') allows secondary webviews, auth popups, or external OAuth redirect contexts to execute dangerous filesystem and shell commands. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "default", "description": "Global permissions allowing all windows access to filesystem and core plugins", "windows": ["*"], "permissions": [ "core:default", "fs:allow-read-text-file", "fs:allow-write-text-file", "shell:allow-open" ] } ``` #### Production Standard (Correct) > **Standard**: Pins capabilities explicitly to the 'main' window label and scopes filesystem read access strictly to the dedicated application data directory. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "main-trusted-capability", "description": "Strictly isolated permissions bound exclusively to the authenticated main window", "windows": ["main"], "permissions": [ "core:default", { "identifier": "fs:allow-read-text-file", "allow": [{ "path": "$APP_DATA_DIR/secure/**" }] } ] } ``` ### Multi-Webview Secondary Window Sandbox Definition #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Grants 'core:default' and full 'http:default' to an untrusted guest preview window, enabling network tampering and arbitrary event spoofing across the internal bus. ```json { "identifier": "webview-guest", "windows": ["guest-preview"], "permissions": [ "core:default", "core:event:default", "http:default" ] } ``` #### Production Standard (Correct) > **Standard**: Provides a zero-trust capability profile to the secondary preview context, denying core command execution and restricting event bus access to read-only listening. ```json { "identifier": "guest-preview-sandbox", "description": "Sandboxed capability profile for untrusted third-party guest webviews", "windows": ["guest-preview"], "permissions": [ "core:event:allow-listen" ] } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Granular Capability Manifest Authorization Boundary

Tauri 2.0 Granular Capability Manifest Authorization Boundary defines an industrial-grade behavioral standard for mobile engineering. Enforces strict isolation between native host capabilities and multi-webview rendering contexts across mobile platforms in Tauri 2.0. Eliminates privilege escalation by mapping individual webview window labels to explicit, least-privilege capability manifests and forbidding catch-all wildcards or runtime command bypasses. Ensures remote or compromised untrusted webview contexts cannot invoke privileged core plugins, filesystem APIs, or native hardware bindings. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Assigning global wildcard capabilities across all webviews or allowing untrusted remote content to invoke core IPC commands Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Assigning global wildcard capabilities across all webviews or allowing untrusted remote content to invoke core IPC commands	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS isolate distinct webview instances into dedicated capability files in `src-tauri/capabilities/*.json` targeting exact window labels.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.