Tauri 2.0 Mobile IPC Capability Sandboxing and Scoped Access Invariant

--- description: Tauri 2.0 Mobile IPC Capability Sandboxing and Scoped Access Invariant - Enforces compile-time granular permission capabilities and runtime parameter validation for Tauri 2.0 mobile webview-to-native IPC. Eliminates arbitrary command execution and privilege escalation on iOS and Android targets by prohibiting wildcard permissions, unconstrained shell execution, and global plugin access. globs: src-tauri/capabilities/**/*.json, src-tauri/src/**/*.rs, src-tauri/tauri.conf.json, src/**/*.{ts,tsx,js,jsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri-v2-mobile-ipc-capability-sandboxing-standard" --- # Tauri 2.0 Mobile IPC Capability Sandboxing and Scoped Access Invariant > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Unsandboxed Tauri 2.0 IPC exposing unrestricted native plugins and shell execution across mobile webviews ## System Constraints You are a Principal Mobile Security Architect enforcing the Tauri 2.0 Mobile IPC Capability Sandboxing Standard. Tauri 2.0 introduces fine-grained capabilities in place of legacy allowlists. You must strictly mandate that all mobile IPC endpoints, plugin permissions, and custom commands follow zero-trust scoping: explicitly define capability files in `src-tauri/capabilities/`, isolate target window/webview contexts, constrain parameters via JSON schemas, and prohibit any direct usage of high-privilege plugins (such as unconstrained shell execution, broad filesystem paths, or arbitrary HTTP proxying) from mobile clients. ## Strict Guidelines - Engineers MUST ALWAYS define granular capability configurations in `src-tauri/capabilities/<capability-name>.json` targeted explicitly to active mobile webview labels rather than relying on default wildcard sets. - Engineers MUST NOT grant blanket permissions like `core:default`, `fs:default`, `shell:default`, or `shell:allow-execute` on mobile targets; scopes MUST be constrained to predefined application-specific paths and commands. - Custom Rust IPC commands MUST validate all incoming payloads using strictly-typed serde structs with bounds checking and reject raw string commands or shell invocations. - Frontend bridge invocations MUST use the official `@tauri-apps/api/core` `invoke` function with explicit TypeScript request/response signatures and NEVER evaluate arbitrary native code via bridge injection. - Services MUST scope filesystem access exclusively to `appDataDir` or `appCacheDir` aliases within the capability permissions, NEVER exposing root (`/`) or broad internal storage paths. ## Bad vs Good Implementations ### Tauri Capability Definition (JSON) #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Grants wildcard window access with comprehensive fs:default and unconstrained shell execution capabilities. On mobile (iOS/Android), this compromises the sandbox, allowing webview scripts to execute arbitrary native processes and access sandboxed device files. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "mobile-capability", "description": "Insecure permissive capability granting unrestricted shell and fs access", "windows": ["*"], "permissions": [ "core:default", "fs:default", "shell:default", "shell:allow-execute" ] } ``` #### Production Standard (Correct) > **Standard**: Explicitly restricts the capability to the 'main' window on mobile platforms, permits only specific sub-commands (read-text-file), scopes path access strictly to $APPDATA/logs/*, and eliminates shell execution. ```json { "$schema": "../gen/schemas/mobile-schema.json", "identifier": "mobile-capability", "description": "Hardened scoped capability for mobile targets", "windows": ["main"], "platforms": ["iOS", "android"], "permissions": [ "core:event:default", { "identifier": "fs:allow-read-text-file", "allow": [{ "path": "$APPDATA/logs/*" }] }, "secure-storage:allow-get-item" ] } ``` ### Native Command Invocation & Validation (Rust) #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Custom command exposes a direct command injection vector over IPC. Any XSS or malicious payload in the webview can run arbitrary native binaries on the host device. ```rust // Insecure custom Tauri command accepting arbitrary shell commands #[tauri::command] pub fn execute_mobile_command(command: String, args: Vec<String>) -> Result<String, String> { use std::process::Command; let output = Command::new(command) .args(args) .output() .map_err(|e| e.to_string())?; Ok(String::from_utf8_lossy(&output.stdout).to_string()) } ``` #### Production Standard (Correct) > **Standard**: Enforces strict type safety and enum/allowlist validation on payload parameters. Operates as an internal native query rather than an execution bridge to external shell processes. ```rust use serde::Deserialize; use tauri::ipc::Response; #[derive(Deserialize)] pub struct DeviceTelemetryRequest { pub metric_key: String, } #[tauri::command] pub async fn get_device_telemetry( payload: DeviceTelemetryRequest, ) -> Result<Response, String> { // Validate input payload against strict allowlist let allowed_metrics = ["battery_level", "memory_usage"]; if !allowed_metrics.contains(&payload.metric_key.as_str()) { return Err("Invalid telemetry metric requested".into()); } let data = match payload.metric_key.as_str() { "battery_level" => "85%", "memory_usage" => "120MB", _ => unreachable!(), }; Ok(Response::new(data.as_bytes().to_vec())) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Mobile IPC Capability Sandboxing and Scoped Access Invariant

Tauri 2.0 Mobile IPC Capability Sandboxing and Scoped Access Invariant defines an industrial-grade behavioral standard for mobile engineering. Enforces compile-time granular permission capabilities and runtime parameter validation for Tauri 2.0 mobile webview-to-native IPC. Eliminates arbitrary command execution and privilege escalation on iOS and Android targets by prohibiting wildcard permissions, unconstrained shell execution, and global plugin access. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Unsandboxed Tauri 2.0 IPC exposing unrestricted native plugins and shell execution across mobile webviews Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Unsandboxed Tauri 2.0 IPC exposing unrestricted native plugins and shell execution across mobile webviews	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS define granular capability configurations in `src-tauri/capabilities/<capability-name>.json` targeted explicitly to active mobile webview labels rather than relying on default wildcard sets.

Engineers MUST ALWAYS define granular capability configurations in `src-tauri/capabilities/<capability-name>.json` targeted explicitly to active mobile webview labels rather than relying on default wildcard sets.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.