Tauri 2.0 Multi-Webview IPC Capability Scoping & Privilege Quarantine Standard

--- description: Tauri 2.0 Multi-Webview IPC Capability Scoping & Privilege Quarantine Standard - Enforces strict principle-of-least-privilege capability mapping across distinct window and webview instances in Tauri 2.0 mobile and desktop architectures. Prevents cross-context native privilege escalation by isolating security-sensitive Rust IPC commands and plugin capabilities to explicitly targeted webview labels. Mandates default-deny capability files and rejects wildcard window bindings across multi-webview environments. globs: src-tauri/capabilities/**/*.json, src-tauri/src/**/*.rs, src-tauri/tauri.conf.json, src/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri-v2-multi-webview-ipc-scoped-quarantine-standard" --- # Tauri 2.0 Multi-Webview IPC Capability Scoping & Privilege Quarantine Standard > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Wildcard Capability Permissiveness and Shared Native Access Across Untrusted Auxiliary Webviews ## System Constraints You are a Principal Security Architect enforcing Tauri 2.0 Multi-Webview IPC Scoped Permission Quarantine. Mandate strict capability boundary enforcement, explicit window/webview targeting in capability definitions, and contextual origin verification in native Rust command handlers. Reject all wildcard ('*') window permissions and unauthenticated inter-webview command proxying. ## Strict Guidelines - Engineers MUST ALWAYS isolate distinct webview instances into individual, dedicated capability JSON files located in `src-tauri/capabilities/`. - Engineers MUST NEVER use wildcard bindings (`"windows": ["*"]` or `"webviews": ["*"]`) in any capability file granting access to core native plugins (e.g., `fs`, `shell`, `dialog`, `keychain`). - Code SHOULD verify the calling webview label inside sensitive custom Rust commands using `tauri::WebviewWindow` or `tauri::ipc::InvokeResolver` before dispatching side-effects. - Services MUST quarantine secondary, modal, authentication, or external-content webviews to read-only or zero-native-capability profiles (`core:default` or empty permissions). - Components NEVER execute raw native host command strings across shared global IPC dispatchers without capability validation. ## Bad vs Good Implementations ### Tauri 2.0 Capability Declaration: Universal Wildcard vs. Quarantined Scopes #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Binding high-privilege permissions (fs, shell, stronghold) to wildcard windows/webviews allows auxiliary or untrusted webviews (e.g., OAuth popups, documentation views) to invoke sensitive host storage and filesystem APIs. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "universal-capability", "description": "Shared capability granting full system access globally", "windows": ["*"], "webviews": ["*"], "permissions": [ "core:default", "fs:default", "fs:allow-read-text-file", "shell:allow-open", "stronghold:default" ] } ``` #### Production Standard (Correct) > **Standard**: Capabilities are isolated strictly to the 'main' window/webview instance with scoped path constraints, ensuring secondary webviews (like 'auth-flow' or 'webview-preview') have zero access to system files. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "main-window-capability", "description": "Strictly isolated capability for primary authenticated UI", "windows": ["main"], "webviews": ["main"], "permissions": [ "core:default", { "identifier": "fs:allow-read-text-file", "allow": [{"path": "$APP_DATA_DIR/secure/**"}] } ] } ``` ### Rust IPC Command: Unchecked Caller vs. Explicit Webview Context Quarantine #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The command handler fails to inspect the calling webview context. Any compromised or unprivileged webview instance capable of sending the IPC invocation string can extract cryptographic vault keys. ```rust #[tauri::command] pub async fn export_vault_key(key_id: String) -> Result<String, String> { // ANTI-PATTERN: Blindly executes sensitive operation regardless of which // window or embedded webview dispatched the IPC invoke request. retrieve_master_key(&key_id).map_err(|e| e.to_string()) } ``` #### Production Standard (Correct) > **Standard**: Injects `tauri::WebviewWindow` and explicitly asserts that the caller matches the authorized primary window label ('main'), creating a defense-in-depth barrier beyond capability manifests. ```rust #[tauri::command] pub async fn export_vault_key( window: tauri::WebviewWindow, key_id: String ) -> Result<String, String> { // Verify caller identity against quarantined window labels if window.label() != "main" { return Err("PermissionDenied: Invocation source not authorized for vault access".into()); } retrieve_master_key(&key_id).map_err(|e| e.to_string()) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Multi-Webview IPC Capability Scoping & Privilege Quarantine Standard

Tauri 2.0 Multi-Webview IPC Capability Scoping & Privilege Quarantine Standard defines an industrial-grade behavioral standard for mobile engineering. Enforces strict principle-of-least-privilege capability mapping across distinct window and webview instances in Tauri 2.0 mobile and desktop architectures. Prevents cross-context native privilege escalation by isolating security-sensitive Rust IPC commands and plugin capabilities to explicitly targeted webview labels. Mandates default-deny capability files and rejects wildcard window bindings across multi-webview environments. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Wildcard Capability Permissiveness and Shared Native Access Across Untrusted Auxiliary Webviews Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Wildcard Capability Permissiveness and Shared Native Access Across Untrusted Auxiliary Webviews	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS isolate distinct webview instances into individual, dedicated capability JSON files located in `src-tauri/capabilities/`.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.