Tauri 2.0 Mobile IPC Scoped Isolation & Capability Key Validation

--- description: Tauri 2.0 Mobile IPC Scoped Isolation & Capability Key Validation - Enforces strict isolation pattern hooks and cryptographic capability validation for IPC calls between native Rust hosts and multi-webview mobile sandboxes in Tauri 2.0. Guarantees that untrusted or secondary webviews cannot execute privileged native system commands without passing an ephemeral, host-attested capability token through the isolation runtime. globs: src/**/*.{ts,tsx}, src-tauri/src/**/*.rs, src-tauri/capabilities/**/*.json alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri-v2-mobile-ipc-scoped-isolation-standard" --- # Tauri 2.0 Mobile IPC Scoped Isolation & Capability Key Validation > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Bypassing Isolation Hooks via Direct Unscoped Native Invocations in Multi-Webview Mobile Sandboxes ## System Constraints You are a Principal Security Architect enforcing the Tauri 2.0 IPC Scoped Isolation Pattern Standard on mobile targets. You MUST ensure that all frontend-to-native IPC calls pass through Tauri's isolation pattern layer, reject raw unverified window.invoke patterns, and validate cryptographically signed capability tokens at the Rust command boundary for every multi-webview mobile interaction. ## Strict Guidelines - Engineers MUST ALWAYS enforce the Tauri 2.0 isolation pattern in mobile configurations to intercept and encrypt/sign IPC payloads before they reach the native host layer. - Engineers MUST NOT allow direct invocation of raw '@tauri-apps/api/core.invoke' from secondary or dynamic multi-webview instances without passing a scoped, host-attested capability key. - Frontend IPC wrappers MUST inject ephemeral, signed nonce-token pairs into every invoke payload to prevent replay attacks across sandboxed mobile webviews. - Rust command handlers MUST validate the calling WebviewWindow identity, origin, and cryptographic capability claim before dispatching hardware-level or sensitive OS APIs on iOS and Android. - Components NEVER execute administrative or persistent storage writes from untrusted embedded webview contexts without host-level re-attestation. ## Bad vs Good Implementations ### Tauri 2.0 Mobile IPC Invocation with Isolation Capability Token #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Bypasses the Tauri 2.0 isolation pattern and sends naked payloads directly to the native layer. If a cross-site script or sub-webview executes in the mobile context, it can forge arbitrary native IPC commands without proof of capability or origin attestation. ```typescript import { invoke } from '@tauri-apps/api/core'; // Anti-pattern: Direct unscoped invocation bypasses capability isolation validation export async function executeDeviceAction(commandPayload: { actionId: string }): Promise<void> { // Insecure: Invoking privileged native commands directly from an unverified webview context // without an ephemeral capability proof or isolation envelope. await invoke('execute_privileged_mobile_action', { payload: commandPayload }); } ``` #### Production Standard (Correct) > **Standard**: Guarantees that IPC requests pass through an attested isolation layer that cryptographically signs the transaction payload using an ephemeral token, ensuring Rust-side capability verification before executing privileged native routines. ```typescript import { invoke } from '@tauri-apps/api/core'; interface IsolatedPayload<T> { data: T; capabilityToken: string; nonce: string; timestamp: number; } declare const window: Window & { __TAURI_ISOLATION_BRIDGE__?: { signPayload: (rawPayload: unknown) => Promise<string>; }; }; export async function executeDeviceAction(commandPayload: { actionId: string }): Promise<void> { if (!window.__TAURI_ISOLATION_BRIDGE__) { throw new Error('IPC Isolation Bridge is missing or uninitialized.'); } const nonce = crypto.randomUUID(); const timestamp = Date.now(); const token = await window.__TAURI_ISOLATION_BRIDGE__.signPayload({ action: 'execute_privileged_mobile_action', payload: commandPayload, nonce, timestamp, }); const secureEnvelope: IsolatedPayload<{ actionId: string }> = { data: commandPayload, capabilityToken: token, nonce, timestamp, }; await invoke('execute_privileged_mobile_action', { envelope: secureEnvelope, }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Mobile IPC Scoped Isolation & Capability Key Validation

Tauri 2.0 Mobile IPC Scoped Isolation & Capability Key Validation defines an industrial-grade behavioral standard for mobile engineering. Enforces strict isolation pattern hooks and cryptographic capability validation for IPC calls between native Rust hosts and multi-webview mobile sandboxes in Tauri 2.0. Guarantees that untrusted or secondary webviews cannot execute privileged native system commands without passing an ephemeral, host-attested capability token through the isolation runtime. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Bypassing Isolation Hooks via Direct Unscoped Native Invocations in Multi-Webview Mobile Sandboxes Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Bypassing Isolation Hooks via Direct Unscoped Native Invocations in Multi-Webview Mobile Sandboxes	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce the Tauri 2.0 isolation pattern in mobile configurations to intercept and encrypt/sign IPC payloads before they reach the native host layer.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.