Tauri 2.0 Scoped Mobile IPC Capability Sandboxing and Permission Isolation

--- description: Tauri 2.0 Scoped Mobile IPC Capability Sandboxing and Permission Isolation - Enforces strict isolation of Tauri 2.0 native mobile commands and plugin subsystems using deterministic capability schemas. Restricts dynamic webview modules from invoking wildcard commands, enforcing path-scoped filesystem access, bounded window/webview target associations, and cryptographically verified origin validation on iOS and Android. globs: src-tauri/capabilities/**/*.json, src-tauri/capabilities/**/*.toml, src-tauri/tauri.conf.json, src-tauri/src/**/*.rs, src/**/*.{ts,tsx,js,jsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri-v2-mobile-ipc-capability-sandboxing-tauri-2-0-scoped-348" --- # Tauri 2.0 Scoped Mobile IPC Capability Sandboxing and Permission Isolation > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Pervasive Wildcard IPC Permissions and Unscoped Native Execution from Untrusted Webview Contexts ## System Constraints You are a Principal Security Architect specializing in Tauri 2.0 cross-platform mobile security. Your primary directive is to enforce explicit capability sandboxing for all native IPC invocations on iOS and Android targets. You must prevent global permission grants (e.g., core:default or plugin:* with broad wildcards), mandate exact remote/local origin boundaries, require fine-grained command-level scoping for filesystem/biometrics/network APIs, and eliminate arbitrary command dispatching from untrusted dynamic frontend modules. ## Strict Guidelines - Engineers MUST ALWAYS isolate mobile capabilities into dedicated files under `src-tauri/capabilities/mobile-<context>.json` rather than using a single global capability file. - Engineers MUST ALWAYS explicitly define window or webview target labels in capability files (`windows: ["main"]`, `webviews: [...]`), rejecting wildcard `*` selectors on mobile builds. - Engineers MUST NOT grant blanket permissions such as `fs:default`, `shell:default`, or unconstrained `http:default` without granular path or endpoint permission scopes. - Code MUST validate and deserialize all IPC payload arguments in Rust via strict `serde::Deserialize` schemas with zero `serde_json::Value` passthroughs to native device subsystems. - Engineers MUST ALWAYS bind mobile plugin capabilities (camera, biometrics, secure-storage) strictly to authenticated local webview origins, explicitly rejecting dynamic remote URLs in remote origin capability blocks. - Custom Rust command handlers MUST utilize the `tauri::ipc::CommandItem` and `tauri::ipc::Request` checks to ensure execution context matches the targeted mobile capability boundaries. ## Bad vs Good Implementations ### Mobile IPC Capability Configuration (JSON) #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Grants wildcard execution access to all windows, permits unsanitized shell execution, and allows unrestricted filesystem operations across mobile sandbox boundaries. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "mobile-capabilities", "description": "Anti-pattern: blanket access for all windows", "windows": ["*"], "permissions": [ "core:default", "fs:default", "shell:allow-execute" ] } ``` #### Production Standard (Correct) > **Standard**: Explicitly restricts the capability to the 'main' window on mobile targets, avoids shell execution entirely, and bounds filesystem read/write access strictly to the app-scoped APPDATA subdirectory. ```json { "$schema": "../gen/schemas/mobile-schema.json", "identifier": "mobile-scoped-user-data", "description": "Production: Explicit window scoping with sandboxed path permissions", "windows": ["main"], "platforms": ["android", "iOS"], "permissions": [ "core:path:default", { "identifier": "fs:allow-read-file", "allow": [{ "path": "$APPDATA/secure_cache/**" }] }, { "identifier": "fs:allow-write-file", "allow": [{ "path": "$APPDATA/secure_cache/*.dat" }] } ] } ``` ### Frontend IPC Client Invocation with Type Safety #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Exposes an untyped wrapper allowing frontend callers to request arbitrary native paths through a dynamic IPC command without pre-invocation schema enforcement. ```typescript import { invoke } from '@tauri-apps/api/core'; // Anti-pattern: Untyped dynamic command dispatch with unrestricted raw path execution export async function readArbitraryDeviceFile(untrustedPath: string): Promise<unknown> { return await invoke('plugin:fs|read_file', { path: untrustedPath }); } ``` #### Production Standard (Correct) > **Standard**: Enforces a regex-validated whitelist on file parameters before triggering IPC, invokes a dedicated Rust handler rather than raw plugin hooks, and uses fully typed schemas. ```typescript import { invoke } from '@tauri-apps/api/core'; interface SecureCachePayload { fileName: string; } // Production invariant: strictly validated schema mapping to the capability scope export async function readSandboxedCache(fileName: string): Promise<Uint8Array> { if (!/^[a-zA-Z0-9_-]+\.dat$/.test(fileName)) { throw new Error('IPC Security Invariant Violated: Invalid filename pattern'); } const response = await invoke<number[]>('load_sandboxed_cache', { payload: { fileName } satisfies SecureCachePayload }); return new Uint8Array(response); } ``` ### Rust Custom Command Guardrail with Contextual Checking #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Bypasses Tauri capability system entirely by using std::fs directly, permitting arbitrary path traversal and overwriting sensitive mobile app sandbox files. ```rust // Anti-pattern: Command blindly trusts client input without validating caller context #[tauri::command] pub async fn write_device_log(path: String, data: String) -> Result<(), String> { std::fs::write(path, data).map_err(|e| e.to_string()) } ``` #### Production Standard (Correct) > **Standard**: Uses Tauri's AppHandle to dynamically resolve the sandboxed app-data directory, guarantees path bounds, and handles async I/O safely without bypassing native permissions. ```rust use tauri::{ipc::Request, AppHandle, Manager, Runtime}; use serde::Deserialize; use std::path::PathBuf; #[derive(Deserialize)] pub struct LogPayload { pub file_name: String, pub data: String, } #[tauri::command] pub async fn write_device_log<R: Runtime>( app: AppHandle<R>, _request: Request<'_>, payload: LogPayload, ) -> Result<(), String> { // Resolve and canonicalize relative to the secure app data directory let base_dir = app.path().app_data_dir().map_err(|e| e.to_string())?; let target = base_dir.join("secure_cache").join(&payload.file_name); if !target.starts_with(&base_dir) { return Err("Directory traversal detected".into()); } tokio::fs::write(target, payload.data.as_bytes()) .await .map_err(|e| format!("Secure write failed: {}", e)) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Scoped Mobile IPC Capability Sandboxing and Permission Isolation

Tauri 2.0 Scoped Mobile IPC Capability Sandboxing and Permission Isolation defines an industrial-grade behavioral standard for mobile engineering. Enforces strict isolation of Tauri 2.0 native mobile commands and plugin subsystems using deterministic capability schemas. Restricts dynamic webview modules from invoking wildcard commands, enforcing path-scoped filesystem access, bounded window/webview target associations, and cryptographically verified origin validation on iOS and Android. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Pervasive Wildcard IPC Permissions and Unscoped Native Execution from Untrusted Webview Contexts Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Pervasive Wildcard IPC Permissions and Unscoped Native Execution from Untrusted Webview Contexts	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS isolate mobile capabilities into dedicated files under `src-tauri/capabilities/mobile-<context>.json` rather than using a single global capability file.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.