Tauri 2.0 Webview Capability Matrix and Scoped IPC Token Isolation Standard

--- description: Tauri 2.0 Webview Capability Matrix and Scoped IPC Token Isolation Standard - Enforces deterministic, window-isolated IPC capability matrices in Tauri 2.0 mobile and desktop architectures. Prohibits ambient native API exposure by mandating window-specific capability definitions and cryptographically verified, short-lived session scope tokens on all privileged native commands. globs: src-tauri/capabilities/**/*.json, src-tauri/src/**/*.rs, src/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri-v2-webview-capability-matrix-isolation" --- # Tauri 2.0 Webview Capability Matrix and Scoped IPC Token Isolation Standard > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Wildcard Window Bindings and Ambient Native Command Invocation Without Scope Tokens ## System Constraints You are a Principal Security Architect enforcing the Tauri 2.0 Webview Capability Matrix Least-Privilege Isolation Standard. You must ensure that webview contexts (especially secondary, OAuth, or dynamically loaded mobile views) are strictly isolated from native OS capabilities. Never permit wildcard window bindings (`"*"`) in capability JSON manifests. Mandate that all privileged IPC commands validate caller window identity and verify ephemeral cryptographic session scope tokens generated by native Rust state. ## Strict Guidelines - Engineers MUST ALWAYS isolate capabilities into separate JSON definitions per webview window label in `src-tauri/capabilities/<window-name>.json` rather than using a single shared capability set. - Engineers MUST NOT use wildcard window matchers (`"windows": ["*"]`) or wildcard command permissions (`"allow": ["core:*"]`) in any capability manifest. - Services MUST validate caller webview labels and cryptographically sign/verify ephemeral scope tokens (`TokenPayload { window_label, exp, scope, nonce }`) inside Rust `#[tauri::command]` handlers for sensitive OS operations. - Code SHOULD enforce compile-time capability schema validation in `tauri.conf.json` and deny webview execution on token verification failure with an explicit audit log. - Components NEVER execute raw `invoke()` calls against privileged native commands without passing a signed ephemeral capability token managed by a dedicated frontend IPC proxy service. ## Bad vs Good Implementations ### Tauri 2.0 Capability Manifest Isolation and Rust Scoped Command Verification #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Declaring wildcard `"windows": ["*"]` grants ambient file system write privileges to every webview context, including third-party payment frames, OAuth webviews, or compromised mobile webviews. The native command executes without verifying window identity or scope tokens. ```typescript // src-tauri/capabilities/default.json (ANTI-PATTERN: Ambient wildcard permissions) // { // "$schema": "../gen/schemas/desktop-schema.json", // "identifier": "ambient-capabilities", // "windows": ["*"], // "permissions": ["core:default", "fs:allow-read-all", "fs:allow-write-all"] // } // Frontend: Unauthenticated direct invocation from untrusted secondary webview import { invoke } from '@tauri-apps/api/core'; export async function writeSensitiveFile(path: string, content: string): Promise<void> { // VULNERABILITY: Any secondary window or injected XSS context has ambient write access await invoke('write_user_document', { path, content }); } ``` #### Production Standard (Correct) > **Standard**: Restricts capability permissions strictly to the verified 'main-editor' window label. Requires an ephemeral, context-bound scope token that the native Rust command verifies using cryptographic HMAC/Ed25519 signatures and window label checks before granting OS access. ```typescript // src-tauri/capabilities/isolated-editor.json // { // "$schema": "../gen/schemas/desktop-schema.json", // "identifier": "isolated-editor", // "windows": ["main-editor"], // "permissions": ["core:default", "app:allow-write-user-document"] // } // Frontend: Context-bound IPC invocation passing cryptographic scope token import { invoke } from '@tauri-apps/api/core'; interface ScopedInvocationPayload { token: string; path: string; content: string; } export class ScopedIpcClient { constructor(private readonly getSessionToken: () => Promise<string>) {} async writeSecureDocument(path: string, content: string): Promise<void> { const token = await this.getSessionToken(); // Enforce invariant: Token proves webview context authorization await invoke<void>('write_user_document', { token, path, content } satisfies ScopedInvocationPayload); } } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Webview Capability Matrix and Scoped IPC Token Isolation Standard

Tauri 2.0 Webview Capability Matrix and Scoped IPC Token Isolation Standard defines an industrial-grade behavioral standard for mobile engineering. Enforces deterministic, window-isolated IPC capability matrices in Tauri 2.0 mobile and desktop architectures. Prohibits ambient native API exposure by mandating window-specific capability definitions and cryptographically verified, short-lived session scope tokens on all privileged native commands. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Wildcard Window Bindings and Ambient Native Command Invocation Without Scope Tokens Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Wildcard Window Bindings and Ambient Native Command Invocation Without Scope Tokens	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS isolate capabilities into separate JSON definitions per webview window label in `src-tauri/capabilities/<window-name>.json` rather than using a single shared capability set.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.