Tauri 2.0 IPC Granular Capability ACL Sandboxing and Boundary Hardening

--- description: Tauri 2.0 IPC Granular Capability ACL Sandboxing and Boundary Hardening - Enforces strict principle-of-least-privilege IPC boundaries in Tauri 2.0 applications by eliminating wildcard native plugin permissions and unbounded invoke calls. All frontend interactions with native host APIs must route through strongly-typed command wrappers constrained by granular, path-scoped capability manifests bound exclusively to authorized webview labels. globs: src/**/*.{ts,tsx}, src-tauri/capabilities/**/*.json, src-tauri/tauri.conf.json alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri-v2-granular-ipc-capability-acl-sandboxing" --- # Tauri 2.0 IPC Granular Capability ACL Sandboxing and Boundary Hardening > **Severity**: CRITICAL | **Category**: frontend > **Anti-Pattern Warning**: Direct Webview Invocations of Wildcard Plugin Commands Exposing Arbitrary Native Host Execution via XSS ## System Constraints You are a Principal Security Architect enforcing Tauri 2.0 IPC Granular Capability ACL Sandboxing. Mandate that all native capabilities adhere strictly to the principle of least privilege, preventing arbitrary filesystem, shell, and plugin execution from compromised webviews. ## Strict Guidelines - Engineers MUST ALWAYS scope Tauri 2.0 capability permissions to explicit webview windows and strict path/command schemas in capability JSON files instead of granting blanket defaults (e.g., 'fs:default', 'shell:all'). - Engineers MUST NOT invoke internal plugin commands (e.g., 'plugin:fs|read_file' or 'plugin:shell|execute') directly from UI components; all native requests must traverse validated domain-level command wrappers. - Code MUST validate and parse all incoming and outgoing IPC payloads using runtime schema validators (e.g., Zod) on the frontend prior to triggering invoke(). - Services MUST NEVER expose raw Tauri invoke or IPC bridges onto window global scope (e.g., window.__TAURI_INTERNALS__ or custom window.invoke proxies). - Components NEVER construct dynamic command strings or command arguments directly from unsanitized user or remote input. ## Bad vs Good Implementations ### Tauri 2.0 Typed IPC Invocation with Granular Capability Constraints #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Directly invoking native plugin commands with unvalidated parameters exposes the host filesystem to arbitrary file overwriting if an attacker achieves XSS in the webview. It completely undermines Tauri 2.0 ACL sandboxing if paired with broad permission grants. ```typescript import { invoke } from '@tauri-apps/api/core'; // Flaw: Direct invocation of plugin APIs without frontend runtime validation // Bypasses custom command boundaries and assumes broad native permissions export async function exportUserData(filePath: string, content: string): Promise<void> { // Anti-pattern: Calling plugin:fs directly with an arbitrary filesystem path await invoke('plugin:fs|write_text_file', { path: filePath, contents: content, }); } ``` #### Production Standard (Correct) > **Standard**: Enforces strict payload validation on the frontend, routes through a tightly scoped custom Rust command ('export_user_document') rather than raw plugin interfaces, and conforms to scoped ACL capability rules (e.g., restricted to $APPDATA/exports/*). ```typescript import { invoke } from '@tauri-apps/api/core'; import { z } from 'zod'; const SafeExportPayloadSchema = z.object({ filename: z.string().regex(/^[a-zA-Z0-9_-]+\.json$/, 'Invalid export filename format'), payload: z.record(z.unknown()), }); export type SafeExportPayload = z.infer<typeof SafeExportPayloadSchema>; /** * Invokes a domain-specific custom Tauri command guarded by scoped capabilities * defined in `src-tauri/capabilities/app-storage.json`. */ export async function exportUserDataSafe(input: SafeExportPayload): Promise<{ success: boolean }> { const validated = SafeExportPayloadSchema.parse(input); return await invoke<{ success: boolean }>('export_user_document', { request: validated, }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 IPC Granular Capability ACL Sandboxing and Boundary Hardening

Tauri 2.0 IPC Granular Capability ACL Sandboxing and Boundary Hardening defines an industrial-grade behavioral standard for frontend engineering. Enforces strict principle-of-least-privilege IPC boundaries in Tauri 2.0 applications by eliminating wildcard native plugin permissions and unbounded invoke calls. All frontend interactions with native host APIs must route through strongly-typed command wrappers constrained by granular, path-scoped capability manifests bound exclusively to authorized webview labels. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Direct Webview Invocations of Wildcard Plugin Commands Exposing Arbitrary Native Host Execution via XSS Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Direct Webview Invocations of Wildcard Plugin Commands Exposing Arbitrary Native Host Execution via XSS	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS scope Tauri 2.0 capability permissions to explicit webview windows and strict path/command schemas in capability JSON files instead of granting blanket defaults (e.g., 'fs

Engineers MUST ALWAYS scope Tauri 2.0 capability permissions to explicit webview windows and strict path/command schemas in capability JSON files instead of granting blanket defaults (e.g., 'fs:default', 'shell:all').

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.