Tauri 2.0 Multi-Process IPC Capability Scoping & Dynamic Permission Isolation

--- description: Tauri 2.0 Multi-Process IPC Capability Scoping & Dynamic Permission Isolation - Enforces strict principle-of-least-privilege capability manifests in Tauri 2.0, binding native plugins and custom commands exclusively to explicit window identifiers and cryptographically verified origins. Prevents remote code execution and local sandbox escapes across desktop and mobile (iOS/Android) targets by eliminating wildcard permissions and un-scoped filesystem or shell execution bridges. globs: src-tauri/capabilities/**/*.json, src-tauri/tauri.conf.json, src/**/*.{ts,tsx}, src-tauri/src/**/*.rs alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri-v2-ipc-capability-scoping-isolation" --- # Tauri 2.0 Multi-Process IPC Capability Scoping & Dynamic Permission Isolation > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Wildcard Capability Mapping and Un-Scoped System Bridge Exposure in Tauri 2.0 ## System Constraints You are a Principal Security Architect and Tauri 2.0 Specialist enforcing multi-process IPC boundary security, dynamic permission isolation, and strict capability scoping. Tauri 2.0 replaces the v1 allowlist with fine-grained JSON/TOML capability files mapped to specific windows and webview labels. You must ensure that no wildcard window selectors ('*') are used with sensitive native permissions, that remote URLs are strictly partitioned from privileged IPC commands, that path scopes on mobile targets strictly restrict access to sandboxed app directories, and that all frontend-to-Rust invoke calls pass through typed, schema-validated command contracts. ## Strict Guidelines - Engineers MUST ALWAYS isolate native capabilities to explicit, named window/webview labels in 'src-tauri/capabilities/*.json' instead of using wildcard '*' targets. - Engineers MUST NOT grant broad administrative permissions (such as 'fs:default', 'shell:allow-execute', or raw network sockets) to webview windows that load external or dynamically generated content. - Services MUST define explicit path scopes (e.g., '$APPDATA/*', '$RESOURCE/*') for filesystem capabilities rather than permitting unrestricted filesystem access. - Code SHOULD validate and sanitize all command arguments on the Rust native side using Serve/Deserialize structs, treating all IPC inputs as untrusted data across Android WebView and iOS WKWebView boundaries. - Components NEVER execute raw shell commands directly from the frontend; commands requiring native subprocess execution must be wrapped in parameterized Rust handlers with hardcoded binaries and pre-validated arguments. ## Bad vs Good Implementations ### Tauri 2.0 Capability Manifest Permission Scoping #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Granting 'windows: ["*"]' with 'fs:default' and 'shell:allow-execute' permits any webview or injected script to perform arbitrary filesystem operations and run native binaries without sandbox boundaries, leading to full device compromise on desktop and mobile targets. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "mobile-capability", "description": "Anti-pattern: over-privileged capability with wildcard windows and unconstrained FS access", "windows": ["*"], "permissions": [ "core:default", "fs:default", "shell:allow-execute" ] } ``` #### Production Standard (Correct) > **Standard**: Binds permissions strictly to explicit window labels ('main', 'mobile-auth-webview') and scopes the filesystem plugin to allow read/write operations solely within the sandboxed '$APPDATA/secure_cache/**' path, eliminating RCE and arbitrary file overwrite vectors. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "mobile-isolated-capability", "description": "Production: explicit window binding with granular, scoped permissions", "windows": ["main", "mobile-auth-webview"], "permissions": [ "core:default", { "identifier": "fs:allow-read-text-file", "allow": [ { "path": "$APPDATA/secure_cache/**" } ] }, { "identifier": "fs:allow-write-text-file", "allow": [ { "path": "$APPDATA/secure_cache/**" } ] } ] } ``` ### Type-Safe Guarded IPC Bridge Client #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Directly invoking plugin-level raw commands with caller-supplied arbitrary file paths bypasses application-level integrity guards and risks traversal attacks if the underlying manifest is misconfigured. ```typescript import { invoke } from '@tauri-apps/api/core'; // Flaw: Unchecked any-type payload invoked without origin or capability guard export async function writeAppData(filePath: string, contents: string): Promise<void> { await invoke('plugin:fs|write_file', { path: filePath, contents: Array.from(new TextEncoder().encode(contents)) }); } ``` #### Production Standard (Correct) > **Standard**: Validates file payloads strictly via Zod before invoking a domain-specific, hardened Rust command ('save_application_cache') that enforces server-side directory confinement instead of accepting arbitrary client-specified paths. ```typescript import { invoke } from '@tauri-apps/api/core'; import { z } from 'zod'; const SafeCachePayloadSchema = z.object({ filename: z.string().regex(/^[a-zA-Z0-9_-]+\.json$/), content: z.string().max(1024 * 1024) }); type SafeCachePayload = z.infer<typeof SafeCachePayloadSchema>; export async function persistSecureCache(payload: SafeCachePayload): Promise<{ success: boolean }> { const validated = SafeCachePayloadSchema.parse(payload); return await invoke<{ success: boolean }>('save_application_cache', { payload: validated }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Multi-Process IPC Capability Scoping & Dynamic Permission Isolation

Tauri 2.0 Multi-Process IPC Capability Scoping & Dynamic Permission Isolation defines an industrial-grade behavioral standard for mobile engineering. Enforces strict principle-of-least-privilege capability manifests in Tauri 2.0, binding native plugins and custom commands exclusively to explicit window identifiers and cryptographically verified origins. Prevents remote code execution and local sandbox escapes across desktop and mobile (iOS/Android) targets by eliminating wildcard permissions and un-scoped filesystem or shell execution bridges. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Wildcard Capability Mapping and Un-Scoped System Bridge Exposure in Tauri 2.0 Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Wildcard Capability Mapping and Un-Scoped System Bridge Exposure in Tauri 2.0	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS isolate native capabilities to explicit, named window/webview labels in 'src-tauri/capabilities/.json' instead of using wildcard '' targets.

Engineers MUST ALWAYS isolate native capabilities to explicit, named window/webview labels in 'src-tauri/capabilities/*.json' instead of using wildcard '*' targets.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.