Tauri 2.0 IPC Capability Scoping & Granular Permission Manifest Guardrail

--- description: Tauri 2.0 IPC Capability Scoping & Granular Permission Manifest Guardrail - Enforces strict compile-time capability isolation and explicit JSON permission manifests across all Tauri 2.0 multi-webview mobile architectures. Prevents cross-webview privilege escalation and remote code execution by ensuring non-trusted contexts and secondary remote webviews cannot access native platform APIs through wildcard IPC bridges. globs: src-tauri/capabilities/**/*.json, src-tauri/tauri.conf.json, src/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri2-mobile-ipc-capability-scoping-production-standard" --- # Tauri 2.0 IPC Capability Scoping & Granular Permission Manifest Guardrail > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Over-Privileged Wildcard Capabilities Exposing Native APIs to Untrusted Mobile Webviews ## System Constraints You are a Principal Security Engineer enforcing Tauri 2.0 IPC capability scoping and granular permission manifests on mobile deployments. Never permit global wildcards ('*') in window targets or permission arrays within Tauri capability files. Ensure that every IPC command invoked from the mobile webview maps strictly to a compile-time declared capability file, and remote URLs or auxiliary webviews (OAuth redirects, in-app browsers) are strictly isolated with zero native command invocations. ## Strict Guidelines - Engineers MUST ALWAYS define separate, isolated capability JSON manifests under `src-tauri/capabilities/` for distinct webview windows and mobile contexts. - Engineers MUST NOT use wildcard patterns (`*`) in capability `windows` arrays or permission sets when external web content, OAuth flows, or third-party webviews are hosted. - Engineers MUST restrict permissions to explicit, least-privilege command lists (e.g., `core:default`, `fs:allow-read-file`) scoped to deterministic path/argument constraints. - Code SHOULD validate the invoking webview label and origin within Rust command handlers via `tauri::ipc::Request` or `tauri::Webview` handle guards for defense-in-depth. - Components NEVER invoke Tauri core APIs or native plugins directly from dynamic, unverified external URLs loaded inside mobile webview containers. ## Bad vs Good Implementations ### Tauri 2.0 Capability Manifest Scoping #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Using '*' in windows grants every webview—including embedded authentication windows, OAuth webviews, and third-party remote links—full access to dangerous core, filesystem, shell, and HTTP plugin APIs. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "default-capability", "description": "Insecure default capability applying to all windows and origins", "windows": ["*"], "permissions": [ "core:default", "fs:default", "shell:allow-open", "http:default" ] } ``` #### Production Standard (Correct) > **Standard**: Restricts permissions strictly to the 'main' local webview on target mobile platforms ('android', 'ios') and precisely scopes filesystem reads to '$APPDATA/cache/**' and HTTP requests to the trusted API origin. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "mobile-primary-capability", "description": "Strictly scoped capability for authenticated local mobile main webview", "windows": ["main"], "platforms": ["android", "ios"], "permissions": [ "core:default", { "identifier": "fs:allow-read-file", "allow": [ { "path": "$APPDATA/cache/**" } ] }, { "identifier": "http:default", "allow": [ { "url": "https://api.production.app.com/*" } ] } ] } ``` ### Type-Safe Scoped IPC Frontend Invocation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Exposing arbitrary invoke calls allows rogue dependencies or injected remote scripts to trigger arbitrary native commands if capabilities leak. ```typescript import { invoke } from '@tauri-apps/api/core'; // Untrusted dynamic caller passing arbitrary native commands without validation export async function runDynamicCommand(commandName: string, payload: unknown) { return await invoke(commandName, { payload }); } ``` #### Production Standard (Correct) > **Standard**: Implements an exhaustive, compile-time typed command registry that prevents arbitrary IPC invocations and aligns directly with the Tauri 2.0 permission manifest. ```typescript import { invoke } from '@tauri-apps/api/core'; type SafeMobileCommands = | { cmd: 'read_app_cache'; args: { fileName: string } } | { cmd: 'get_device_telemetry'; args: Record<string, never> }; export async function executeNativeCommand<T extends SafeMobileCommands>( command: T['cmd'], args: T['args'] ): Promise<unknown> { // Invariant: Native commands are strictly enumerated compile-time types matching capability declarations return await invoke(command, args); } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 IPC Capability Scoping & Granular Permission Manifest Guardrail

Tauri 2.0 IPC Capability Scoping & Granular Permission Manifest Guardrail defines an industrial-grade behavioral standard for mobile engineering. Enforces strict compile-time capability isolation and explicit JSON permission manifests across all Tauri 2.0 multi-webview mobile architectures. Prevents cross-webview privilege escalation and remote code execution by ensuring non-trusted contexts and secondary remote webviews cannot access native platform APIs through wildcard IPC bridges. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Over-Privileged Wildcard Capabilities Exposing Native APIs to Untrusted Mobile Webviews Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Over-Privileged Wildcard Capabilities Exposing Native APIs to Untrusted Mobile Webviews	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS define separate, isolated capability JSON manifests under `src-tauri/capabilities/` for distinct webview windows and mobile contexts.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.