Tauri 2.0 IPC Capability Scopes and Least-Privilege Webview Isolation

--- description: Tauri 2.0 IPC Capability Scopes and Least-Privilege Webview Isolation - Enforces Tauri 2.0 least-privilege capability manifests and strict IPC permission scoping across desktop and mobile WebViews. Prevents arbitrary file system access, unauthorized native API execution, and cross-origin privilege escalation by binding permissions to explicit window labels and path scopes. globs: src-tauri/capabilities/**/*.json, src-tauri/tauri.conf.json, src/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri-v2-ipc-capability-scopes-mobile-standard" --- # Tauri 2.0 IPC Capability Scopes and Least-Privilege Webview Isolation > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Unconstrained Capability Wildcards and Global Plugin Permissions in Tauri WebViews ## System Constraints You are a Principal Security Architect enforcing Tauri 2.0 IPC Permission Capability Scopes for desktop and mobile applications. Tauri 2.0 deprecates global allowlists in favor of capability files under `src-tauri/capabilities/` that bind fine-grained permissions to specific windows and webview labels. You must enforce explicit capability manifests, prevent wildcard permission scopes, isolate untrusted or remote origins, and mandate fine-grained path scopes (e.g., `$APP_DATA`, `$RESOURCE`) for native plugin access. ## Strict Guidelines - Engineers MUST ALWAYS isolate native IPC access by defining dedicated JSON capability manifests under `src-tauri/capabilities/` targeting specific window labels. - Engineers MUST NOT use wildcard permissions (`*`), unrestricted fs plugins, or full shell execution privileges in production capabilities. - Capability manifests MUST explicitly scope filesystem access to sandboxed directories like `$APP_DATA/*`, `$APPDATA/*`, or `$RESOURCE/*` rather than root access. - Remote URLs and external webviews MUST NEVER be assigned capabilities containing core native commands, shell execution, or sensitive device APIs. - Frontend IPC calls via `@tauri-apps/api/core` MUST ALWAYS use strictly typed invoke wrappers and handle scope-rejection errors gracefully. - Services MUST split capabilities by execution environment, maintaining distinct manifests for desktop, mobile (iOS/Android), and secondary webviews. ## Bad vs Good Implementations ### Tauri 2.0 Capability Manifest Scoping #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Assigning permissions to wildcard windows ('*') and using unconstrained fs permissions allows any webview context, including external or compromised frames, to read arbitrary OS files. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "default-capability", "description": "Insecure capability granting wildcard permissions to all windows", "windows": ["*"], "permissions": [ "core:default", "fs:default", "fs:allow-read-text-file", "shell:allow-open" ] } ``` #### Production Standard (Correct) > **Standard**: Constrains capabilities to the 'main' window label and applies explicit directory and URL scopes, preventing path traversal and arbitrary external network queries. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "mobile-app-data-capability", "description": "Least-privilege capability scoped exclusively to primary mobile webview", "windows": ["main"], "permissions": [ "core:default", { "identifier": "fs:allow-read-text-file", "allow": [ { "path": "$APP_DATA/documents/*" } ] }, { "identifier": "http:default", "allow": [ { "url": "https://api.example.com/*" } ] } ] } ``` ### Frontend IPC Wrapper with Boundary Validation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Directly invokes the plugin command with arbitrary paths without verifying whether the path complies with app-scoped boundaries, risking unhandled runtime permission rejections. ```typescript import { invoke } from '@tauri-apps/api/core'; // Unvalidated frontend IPC call relying on unsanitized input export async function readUserData(filePath: string): Promise<string> { return await invoke('plugin:fs|read_text_file', { path: filePath }); } ``` #### Production Standard (Correct) > **Standard**: Sanitizes file input to prevent directory traversal and dynamically constructs paths targeting pre-authorized capability scopes. ```typescript import { invoke } from '@tauri-apps/api/core'; import { appDataDir, join } from '@tauri-apps/api/path'; export async function readSafeDocument(fileName: string): Promise<string> { // Invariant: Prevent directory traversal sequences if (fileName.includes('..') || fileName.includes('/') || fileName.includes('\\')) { throw new Error('Invalid file name: Directory traversal detected'); } const appDir = await appDataDir(); const targetPath = await join(appDir, 'documents', fileName); return await invoke<string>('plugin:fs|read_text_file', { path: targetPath }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 IPC Capability Scopes and Least-Privilege Webview Isolation

Tauri 2.0 IPC Capability Scopes and Least-Privilege Webview Isolation defines an industrial-grade behavioral standard for mobile engineering. Enforces Tauri 2.0 least-privilege capability manifests and strict IPC permission scoping across desktop and mobile WebViews. Prevents arbitrary file system access, unauthorized native API execution, and cross-origin privilege escalation by binding permissions to explicit window labels and path scopes. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Unconstrained Capability Wildcards and Global Plugin Permissions in Tauri WebViews Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Unconstrained Capability Wildcards and Global Plugin Permissions in Tauri WebViews	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS isolate native IPC access by defining dedicated JSON capability manifests under `src-tauri/capabilities/` targeting specific window labels.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.