Tauri 2.0 Mobile Fine-Grained Capability & IPC Sandboxing Invariant

--- description: Tauri 2.0 Mobile Fine-Grained Capability & IPC Sandboxing Invariant - Tauri 2.0 replaces v1 allowlists with explicit, capability-based security contexts. In mobile environments (Android WebView and iOS WKWebView), sensitive native host API invocations and custom IPC commands must be bound exclusively to cryptographically pinned origin windows and explicit window labels rather than wildcard targets. Failure to isolate capabilities exposes privileged native bridges to auxiliary webviews, in-app browser popups, and injected third-party scripts. globs: src-tauri/capabilities/**/*.json, src-tauri/tauri.conf.json, src-tauri/src/**/*.rs, src/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri-v2-mobile-capability-ipc-sandboxing-tauri-2-0-fine-g-772" --- # Tauri 2.0 Mobile Fine-Grained Capability & IPC Sandboxing Invariant > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Wildcard Capability Mapping and Unscoped Native IPC Dispatch in Mobile WebViews ## System Constraints You are a Principal Security Architect enforcing Tauri 2.0 capability-based security architecture on mobile platforms (iOS and Android). You must mandate fine-grained capability isolation, prohibit wildcard window assignments, require explicit permission scoping, and enforce window-origin verification across all IPC boundaries. ## Strict Guidelines - Engineers MUST ALWAYS isolate capabilities into dedicated JSON definitions in `src-tauri/capabilities/` and explicitly specify the target `windows` array with immutable window labels. - Engineers MUST NOT use wildcard assignments (`"windows": ["*"]`) or ambient grants for sensitive permissions (e.g., biometric authentication, filesystem, secure storage, camera). - Engineers MUST configure explicit `platforms` arrays (e.g., `["android", "ios"]`) for mobile-specific capabilities to prevent unexpected desktop capability leakage. - Engineers MUST NEVER permit auxiliary webviews (such as OAuth redirect views, payment gateways, or documentation viewers) to inherit capabilities from the primary authenticated window. - Code MUST validate caller window labels and origin headers in native Rust commands using `tauri::ipc::Request` or `tauri::WebviewWindow` before fulfilling high-privilege operations. - Components NEVER execute raw `window.__TAURI_INTERNALS__.invoke` calls directly; they MUST route requests through strongly typed `@tauri-apps/api` bindings bounded by capability verification. ## Bad vs Good Implementations ### Tauri 2.0 Capability Declaration: Wildcard Exposure vs Isolated Mobile Capability #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Assigning windows to '*' allows any webview instance—including auxiliary browser modals, OAuth flows, and third-party framed contexts—to invoke privileged native APIs such as biometrics and arbitrary filesystem writes. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "mobile-capabilities", "description": "Anti-pattern: Ambient permissions granted to all webviews", "windows": ["*"], "permissions": [ "core:default", "biometrics:allow-authenticate", "fs:allow-read-text-file", "fs:allow-write-text-file" ] } ``` #### Production Standard (Correct) > **Standard**: The capability explicitly binds biometrics and scoped filesystem reads strictly to the pinned 'main' window on mobile platforms, eliminating cross-webview privilege escalation from secondary web views. ```json { "$schema": "../gen/schemas/mobile-schema.json", "identifier": "mobile-auth-secured-capability", "description": "Production Invariant: Privileged capabilities locked to explicit window and platform", "windows": ["main"], "platforms": ["android", "ios"], "permissions": [ "core:default", "biometrics:allow-authenticate", { "identifier": "fs:allow-read-text-file", "allow": [{ "path": "$APPDATA/secure_store/*" }] } ] } ``` ### Rust Native IPC Command: Origin and Window Label Enforcement #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The command does not inspect the caller window or request context. Any webview capable of calling 'read_vault_token' receives the token, regardless of whether it is an in-app browser or unverified frame. ```rust // Rust Command Anti-Pattern: No window label or origin validation #[tauri::command] pub async fn read_vault_token() -> Result<String, String> { // Ambient execution without validating caller webview context get_secure_keychain_value("vault_token") .map_err(|e| e.to_string()) } ``` #### Production Standard (Correct) > **Standard**: The native Rust command requires the caller's `WebviewWindow` context and validates the label against authorized mobile view IDs, defending against privilege escalation from unauthorized windows. ```rust // Rust Command Production Standard: Caller verification via WebviewWindow use tauri::{command, WebviewWindow}; #[command] pub async fn read_vault_token( window: WebviewWindow ) -> Result<String, String> { // Mandate that only the cryptographically designated main window can execute this command if window.label() != "main" { return Err("AccessDenied: Invocations restricted to pinned main window context.".into()); } get_secure_keychain_value("vault_token") .map_err(|e| format!("Failed to load vault token: {}", e)) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Mobile Fine-Grained Capability & IPC Sandboxing Invariant

Tauri 2.0 Mobile Fine-Grained Capability & IPC Sandboxing Invariant defines an industrial-grade behavioral standard for mobile engineering. Tauri 2.0 replaces v1 allowlists with explicit, capability-based security contexts. In mobile environments (Android WebView and iOS WKWebView), sensitive native host API invocations and custom IPC commands must be bound exclusively to cryptographically pinned origin windows and explicit window labels rather than wildcard targets. Failure to isolate capabilities exposes privileged native bridges to auxiliary webviews, in-app browser popups, and injected third-party scripts. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Wildcard Capability Mapping and Unscoped Native IPC Dispatch in Mobile WebViews Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Wildcard Capability Mapping and Unscoped Native IPC Dispatch in Mobile WebViews	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS isolate capabilities into dedicated JSON definitions in `src-tauri/capabilities/` and explicitly specify the target `windows` array with immutable window labels.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.