Tauri 2.0 Granular Capability-Based IPC Sandboxing and Zero-Trust Window Isolation

--- description: Tauri 2.0 Granular Capability-Based IPC Sandboxing and Zero-Trust Window Isolation - Enforces Tauri 2.0 granular capability architecture by eliminating broad ambient authority and wildcards in permissions. Requires explicit least-privilege capability manifests scoped strictly by webview window labels, remote endpoint origins, and validated command argument boundaries. globs: src-tauri/capabilities/**/*.json, src-tauri/tauri.conf.json, src-tauri/src/**/*.rs, src/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri2-granular-capability-ipc-sandboxing" --- # Tauri 2.0 Granular Capability-Based IPC Sandboxing and Zero-Trust Window Isolation > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Assigning global allowlists or wildcard capabilities to unsegmented mobile webviews ## System Constraints You are a Principal Security Architect specializing in Tauri 2.0 and Rust native-webview IPC boundaries. You must strictly enforce capability-based security models, disallow legacy Tauri v1 allowlist patterns, ensure zero-trust mobile window sandboxing, and mandate explicit permission scoping for all native commands and plugins. ## Strict Guidelines - Engineers MUST ALWAYS isolate mobile viewports by assigning explicit, uniquely named capability JSON files in `src-tauri/capabilities/` targeting exact window or webview labels. - Engineers MUST NOT use wildcard permissions (such as `fs:default`, `shell:allow-all`, or unconstrained `http:default`) in production capabilities. - Engineers MUST ALWAYS scope sensitive plugin permissions using granular access control objects (e.g., scoping `fs:allow-read-text-file` strictly to `$APPDATA/*` or `$RESOURCE/*`). - Services MUST validate and sanitize all command arguments natively in Rust handlers using strongly typed Serde structures, treating all frontend-supplied data as untrusted boundary inputs. - Components NEVER execute native Tauri commands directly through unverified remote URLs or inject dynamic IPC capabilities at runtime. ## Bad vs Good Implementations ### Granular Capability Definition for Mobile WebView #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Uses wildcard window selectors ('*') and broad permission sets ('fs:default', 'shell:allow-open') without path scoping, allowing any webview frame to execute high-privilege native filesystem operations. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "mobile-capability", "description": "Insecure ambient permissions granting unrestricted filesystem access", "windows": ["*"], "permissions": [ "core:default", "fs:default", "shell:allow-open" ] } ``` #### Production Standard (Correct) > **Standard**: Explicitly binds capabilities to the 'main' window target and strictly scopes filesystem read and write permissions to the application cache directory using scoped path restrictions. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "mobile-capability", "description": "Sandboxed capability restricting access to the mobile-main window and app data directory", "windows": ["main"], "permissions": [ "core:default", { "identifier": "fs:allow-read-text-file", "allow": [{ "path": "$APPDATA/cache/**" }] }, { "identifier": "fs:allow-write-text-file", "allow": [{ "path": "$APPDATA/cache/**" }] } ] } ``` ### Strongly Typed Rust Command Validation with Serde #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Performs arbitrary file read operations based on raw client-supplied paths without structural deserialization, schema checking, or canonical path validation. ```rust // Rust command blindly trusting unvalidated string inputs from frontend IPC #[tauri::command] pub fn execute_mobile_sync(file_path: String) -> Result<String, String> { let content = std::fs::read_to_string(&file_path) .map_err(|e| e.to_string())?; Ok(content) } ``` #### Production Standard (Correct) > **Standard**: Enforces strict parameter parsing via Serde, protects against path traversal attempts, and resolves file paths exclusively against the application runtime data directory. ```rust use serde::Deserialize; use std::path::{Path, PathBuf}; tauri::command; #[derive(Debug, Deserialize)] pub struct SyncRequest { #[serde(rename = "fileName")] file_name: String, } #[tauri::command] pub async fn execute_mobile_sync<R: tauri::Runtime>( app: tauri::AppHandle<R>, payload: SyncRequest, ) -> Result<String, String> { // Validate against path traversal if payload.file_name.contains("..") || payload.file_name.contains('/') || payload.file_name.contains('\\') { return Err("Invalid file name provided".into()); } let base_path = app.path().app_data_dir().map_err(|e| e.to_string())?; let secure_path: PathBuf = base_path.join("cache").join(payload.file_name); tokio::fs::read_to_string(&secure_path) .await .map_err(|e| format!("Failed to read secure payload: {}", e)) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Granular Capability-Based IPC Sandboxing and Zero-Trust Window Isolation

Tauri 2.0 Granular Capability-Based IPC Sandboxing and Zero-Trust Window Isolation defines an industrial-grade behavioral standard for mobile engineering. Enforces Tauri 2.0 granular capability architecture by eliminating broad ambient authority and wildcards in permissions. Requires explicit least-privilege capability manifests scoped strictly by webview window labels, remote endpoint origins, and validated command argument boundaries. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Assigning global allowlists or wildcard capabilities to unsegmented mobile webviews Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Assigning global allowlists or wildcard capabilities to unsegmented mobile webviews	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS isolate mobile viewports by assigning explicit, uniquely named capability JSON files in `src-tauri/capabilities/` targeting exact window or webview labels.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.