Tauri 2.0 IPC Capability Granular Scoping and Origin Isolation

--- description: Tauri 2.0 IPC Capability Granular Scoping and Origin Isolation - Enforces strict principle-of-least-privilege IPC capabilities and remote-origin isolation across mobile WebViews under Tauri 2.0. Eliminates wildcard IPC plugin bindings, prevents unvalidated origin access to native platform bridges, and guarantees that frontend commands adhere to cryptographically and syntactically scoped JSON capabilities on both Android and iOS runtimes. globs: src-tauri/capabilities/**/*.json, src-tauri/tauri.conf.json, src/**/*.{ts,tsx,js,jsx}, src-tauri/src/**/*.rs alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri2-ipc-capability-origin-isolation" --- # Tauri 2.0 IPC Capability Granular Scoping and Origin Isolation > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Wildcard Capability Bindings and Unscoped IPC Invocations Across Webview Origins ## System Constraints You are a Principal Security Architect enforcing Tauri 2.0 IPC Capability Granular Scoping and Origin Isolation. Mandate invariants that strictly prevent wildcard command execution, prohibit granting sensitive OS plugin APIs to external or wildcrafted webview windows, require distinct JSON capability manifests segregated by window label and origin, and enforce type-safe IPC command invocation on all mobile platforms. ## Strict Guidelines - Engineers MUST ALWAYS declare fine-grained permissions in discrete capability JSON files (`src-tauri/capabilities/*.json`) rather than broad default bundles. - Engineers MUST NOT grant `core:default` or wildcard plugin permissions (e.g., `fs:default`, `shell:allow-all`) to windows exposing dynamic or third-party web contexts. - Engineers MUST ALWAYS scope capabilities explicitly to validated local window labels (`windows: ["main"]`) and restrict remote origins via strict Content Security Policy (CSP) and allowed webview domains. - Frontend bridge invocations MUST ALWAYS use strongly typed, vetted wrappers instead of calling raw `@tauri-apps/api/core::invoke` with arbitrary command strings. - Rust IPC command handlers (`#[tauri::command]`) MUST validate argument schemas internally and MUST NOT rely solely on frontend capabilities for OS boundary authentication. ## Bad vs Good Implementations ### Capability Definition: Wildcard Permissions vs Scoped Invariants #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Granting unrestricted wildcard access ('*') across all windows and binding bulk plugin defaults ('fs:default', 'shell:default') allows any injected script or vulnerable WebView context to invoke privileged OS operations. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "mobile-capability-all", "description": "Allows unrestricted access to plugins on mobile", "windows": ["*"], "permissions": [ "core:default", "fs:default", "shell:default" ] } ``` #### Production Standard (Correct) > **Standard**: Caps permissions to the explicit 'main' window label and strictly confines filesystem read access to the designated '$APPDATA/cache/**' sandbox path using fine-grained rule objects. ```json { "$schema": "../gen/schemas/mobile-schema.json", "identifier": "mobile-scoped-storage", "description": "Restricted filesystem access for the validated main mobile webview", "windows": ["main"], "permissions": [ "core:event:default", { "identifier": "fs:allow-read-text-file", "allow": [ { "path": "$APPDATA/cache/**" } ] } ] } ``` ### Frontend IPC Dispatch: Arbitrary String Invocations vs Type-Safe Guardrails #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Invoking raw plugin endpoints via unchecked string concatenations bypasses TypeScript schema boundaries and allows client-controlled arbitrary path traversal targeting the native host boundary. ```typescript import { invoke } from '@tauri-apps/api/core'; // Direct, unvalidated command execution with unchecked external arguments export async function handleFileOperation(targetPath: string) { return await invoke('plugin:fs|read_file', { path: targetPath }); } ``` #### Production Standard (Correct) > **Standard**: Encapsulates the invocation inside a typed domain function, enforces regex-based sanitization prior to IPC transit, and maps to a custom scoped Rust command rather than an unscoped raw plugin call. ```typescript import { invoke } from '@tauri-apps/api/core'; interface SafeReadPayload { relativePath: string; } interface SafeReadResponse { content: string; } const RELATIVE_PATH_REGEX = /^[a-zA-Z0-9_\-\.]+\.json$/; export async function readApplicationCache(filename: string): Promise<SafeReadResponse> { if (!RELATIVE_PATH_REGEX.test(filename)) { throw new Error('Invalid file identifier: Traversal tokens prohibited.'); } return await invoke<SafeReadResponse>('read_app_cache', { relativePath: filename }); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 IPC Capability Granular Scoping and Origin Isolation

Tauri 2.0 IPC Capability Granular Scoping and Origin Isolation defines an industrial-grade behavioral standard for mobile engineering. Enforces strict principle-of-least-privilege IPC capabilities and remote-origin isolation across mobile WebViews under Tauri 2.0. Eliminates wildcard IPC plugin bindings, prevents unvalidated origin access to native platform bridges, and guarantees that frontend commands adhere to cryptographically and syntactically scoped JSON capabilities on both Android and iOS runtimes. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Wildcard Capability Bindings and Unscoped IPC Invocations Across Webview Origins Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Wildcard Capability Bindings and Unscoped IPC Invocations Across Webview Origins	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS declare fine-grained permissions in discrete capability JSON files (`src-tauri/capabilities/*.json`) rather than broad default bundles.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.