Tauri 2.0 Granular Capability Manifests and IPC Boundary Isolation

Tauri 2.0 enforces a multi-layered security architecture where native plugins and IPC commands require explicit, fine-grained capability definitions scoped to specific webview windows and mobile platforms. Unrestricted wildcards or global plugin permissions expose desktop and mobile webviews to arbitrary native bridge escalation if XSS or malicious deep links compromise the frontend context. All native bridge invocations must be bound to minimal capability permission sets, cryptographically validated payloads, and isolated execution windows.

--- description: Tauri 2.0 Granular Capability Manifests and IPC Boundary Isolation - Tauri 2.0 enforces a multi-layered security architecture where native plugins and IPC commands require explicit, fine-grained capability definitions scoped to specific webview windows and mobile platforms. Unrestricted wildcards or global plugin permissions expose desktop and mobile webviews to arbitrary native bridge escalation if XSS or malicious deep links compromise the frontend context. All native bridge invocations must be bound to minimal capability permission sets, cryptographically validated payloads, and isolated execution windows. globs: src-tauri/capabilities/**/*.json, src-tauri/tauri.conf.json, src-tauri/src/**/*.rs, src/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri-v2-ipc-capability-scoping-isolation-boundary" --- # Tauri 2.0 Granular Capability Manifests and IPC Boundary Isolation > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Global Plugin Enablement and Wildcard Capability Mapping Allowing Arbitrary Native Bridge Escalation ## System Constraints You are a Principal Security Architect enforcing Tauri 2.0 IPC boundary isolation and capability scoping across mobile (iOS/Android) and desktop platforms. You must ensure that no broad permissions, wildcards, or unsecured Tauri commands are exposed across the webview bridge. Every native capability must use granular permission flags restricted to explicit window labels and strict payload validations. ## Strict Guidelines - Engineers MUST ALWAYS declare granular capabilities in separate JSON/TOML manifests inside `src-tauri/capabilities/` and assign them strictly to targeted window labels. - Engineers MUST NOT grant wildcard permissions (`*:*`, `fs:default`, or unconstrained `http:default`) in capability manifests across production profiles. - Code SHOULD enforce runtime input validation on the Rust side using Serde and typed structs rather than passing arbitrary raw JSON strings across the IPC boundary. - Services MUST scope mobile native plugins (such as Biometric, Camera, Deep Link, and Secure Storage) to isolated capabilities with explicit platform filters (`"platforms": ["iOS", "Android"]`). - Components NEVER invoke raw untyped `invoke()` commands without an intermediate, strongly typed frontend SDK client that prevents bridge pollution and parameter manipulation. ## Bad vs Good Implementations ### Tauri 2.0 Capability Manifest Scoping and Typed IPC Command #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Using wildcard window selectors ('*') and unbounded permissions like 'fs:allow-all' completely circumvents the Tauri 2.0 capability isolation model. Any malicious script running in any webview or iframe can execute native filesystem actions without restriction. ```typescript // BAD: Global access allowing any webview window to invoke arbitrary file access and unrestricted execution // src-tauri/capabilities/default.json /* { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "default", "description": "Insecure default capability", "windows": ["*"], "permissions": ["core:default", "fs:allow-all"] } */ import { invoke } from '@tauri-apps/api/core'; export async function writeUserData(filename: string, content: string): Promise<void> { // Anti-pattern: Untyped direct invocation with unvalidated parameters await invoke('save_file_unrestricted', { filename, content }); } ``` #### Production Standard (Correct) > **Standard**: The capability manifest limits file write privileges to the specific '$APPDATA/secure_store/*' directory and associates the grant solely with the 'main' window. The frontend bridge call enforces explicit, typed payloads before dispatching to the native handler. ```typescript // GOOD: Granular capability manifest restricted to isolated main window with exact scope // src-tauri/capabilities/mobile-user-data.json /* { "$schema": "../gen/schemas/mobile-schema.json", "identifier": "mobile-user-data", "description": "Scoped access for user data on mobile/desktop", "windows": ["main"], "platforms": ["iOS", "Android", "macos", "windows", "linux"], "permissions": [ "core:default", { "identifier": "fs:allow-write-text-file", "allow": [{ "path": "$APPDATA/secure_store/*" }] } ] } */ import { invoke } from '@tauri-apps/api/core'; interface WriteUserPayload { readonly documentId: string; readonly serializedData: string; } interface SecureWriteResult { readonly success: boolean; readonly timestamp: number; } export async function writeUserData(payload: WriteUserPayload): Promise<SecureWriteResult> { // Invariant: Strictly typed, sanitized invocation matching Rust IPC command signature return await invoke<SecureWriteResult>('write_isolated_user_document', { payload: { documentId: payload.documentId.replace(/[^a-zA-Z0-9_-]/g, ''), serializedData: payload.serializedData } }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Granular Capability Manifests and IPC Boundary Isolation

Tauri 2.0 Granular Capability Manifests and IPC Boundary Isolation defines an industrial-grade behavioral standard for mobile engineering. Tauri 2.0 enforces a multi-layered security architecture where native plugins and IPC commands require explicit, fine-grained capability definitions scoped to specific webview windows and mobile platforms. Unrestricted wildcards or global plugin permissions expose desktop and mobile webviews to arbitrary native bridge escalation if XSS or malicious deep links compromise the frontend context. All native bridge invocations must be bound to minimal capability permission sets, cryptographically validated payloads, and isolated execution windows. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Global Plugin Enablement and Wildcard Capability Mapping Allowing Arbitrary Native Bridge Escalation Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Global Plugin Enablement and Wildcard Capability Mapping Allowing Arbitrary Native Bridge Escalation	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS declare granular capabilities in separate JSON/TOML manifests inside `src-tauri/capabilities/` and assign them strictly to targeted window labels.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.