Tauri 2.0 Scoped Capabilities Matrix & Zero-Trust IPC Sandboxing

--- description: Tauri 2.0 Scoped Capabilities Matrix & Zero-Trust IPC Sandboxing - Enforces least-privilege IPC boundaries in Tauri 2.0 mobile architectures via declarative capability manifests and strict runtime payload validation. Eliminates arbitrary native code execution and path traversal by disallowing wildcard permissions, segregating webview contexts, and strictly constraining filesystem and system plugin access to cryptographically validated or sandboxed device scopes. globs: src-tauri/capabilities/**/*.json, src-tauri/tauri.conf.json, src-tauri/src/**/*.rs, src/**/*.{ts,tsx} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tauri2-scoped-capabilities-ipc-sandboxing" --- # Tauri 2.0 Scoped Capabilities Matrix & Zero-Trust IPC Sandboxing > **Severity**: CRITICAL | **Category**: mobile > **Anti-Pattern Warning**: Pervasive Wildcard Plugin Permissions and Unscoped Native Commands Exposing Mobile Shell/Storage to XSS Privilege Escalation ## System Constraints You are a Principal Security Architect and Systems Engineer specializing in Tauri 2.0 mobile platforms (iOS/Android). Enforce zero-trust architecture across the native/webview boundary: every IPC command must be explicitly registered within platform-specific capability sets, payload schemas must be strictly deserialized with serde, and native plugin permissions must enforce immutable path and domain boundaries without wildcards. ## Strict Guidelines - Engineers MUST ALWAYS isolate mobile capabilities into dedicated files under `src-tauri/capabilities/` filtered by platform (`android`, `iOS`). - Engineers MUST NOT grant blanket or default permission groups (e.g., `fs:default`, `shell:allow-all`) in capability files; granular permissions (e.g., `fs:allow-read-file`) with strict `scope` arrays MUST be enforced. - Engineers MUST ALWAYS validate IPC arguments inside Rust `#[tauri::command]` handlers using strongly typed, bounded `serde::Deserialize` structs rather than generic `serde_json::Value` objects. - Code SHOULD restrict `remote` origins entirely on mobile targets, binding capability sets exclusively to internal local-scheme contexts (e.g., `tauri://localhost` or custom asset protocols). - Services MUST NEVER invoke unvalidated dynamic filesystem paths; paths MUST be resolved exclusively through Tauri's `BaseDirectory` API and validated against canonicalized sandboxed mobile application directories. - Components NEVER invoke raw system commands or shell execution APIs directly from webview components. ## Bad vs Good Implementations ### Tauri 2.0 Capability Manifest Sandboxing (JSON) #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Grants global wildcard window access and unconstrained default filesystem/shell plugins. Any XSS inside the webview yields full unconstrained access to device storage and process execution. ```json { "$schema": "../gen/schemas/desktop-schema.json", "identifier": "mobile-capability", "description": "Insecure capability with wildcard access", "windows": ["*"], "permissions": [ "core:default", "fs:default", "shell:default" ] } ``` #### Production Standard (Correct) > **Standard**: Enforces platform boundaries (iOS/Android), restricts invocation to the 'main' window, disallows shell execution entirely, and scopes filesystem read/write access solely to the sandboxed application export directory. ```json { "$schema": "../gen/schemas/mobile-schema.json", "identifier": "mobile-scoped-storage", "description": "Zero-trust capability scoped to sandboxed document directories on mobile targets", "platforms": ["android", "iOS"], "windows": ["main"], "permissions": [ "core:event:allow-listen", "core:event:allow-emit", { "identifier": "fs:allow-read-file", "allow": [ { "path": "$APPDATA/user_exports/*" } ] }, { "identifier": "fs:allow-write-file", "allow": [ { "path": "$APPDATA/user_exports/*" } ] } ] } ``` ### Strict Type-Safe IPC Command Handling (Rust & TypeScript) #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Accepts an unvalidated arbitrary path from the webview, completely circumventing Tauri's capability scope matrix and opening device files to arbitrary read primitives. ```rust // Rust Command: Accepts raw string paths without validation or sandboxing #[tauri::command] pub async fn read_custom_file(file_path: String) -> Result<String, String> { // Vulnerable to absolute path traversal across device root std::fs::read_to_string(file_path).map_err(|e| e.to_string()) } ``` #### Production Standard (Correct) > **Standard**: Enforces path sanitization, prevents path traversal characters ('..', separators), resolves relative to Tauri's managed `BaseDirectory::AppData`, and decouples the native filesystem implementation from untrusted webview inputs. ```rust // Rust Command: Validates target path within sandboxed AppData scope use tauri::{AppHandle, Manager, path::BaseDirectory}; use serde::Deserialize; #[derive(Deserialize)] pub struct SecureReadRequest { // Restrict filename characters via regex or canonical file token pub filename: String, } #[tauri::command] pub async fn read_sandboxed_file( app: AppHandle, payload: SecureReadRequest, ) -> Result<String, String> { if payload.filename.contains("..") || payload.filename.contains('/') || payload.filename.contains('\\') { return Err("Invalid path: traversal detected".into()); } let safe_path = app .path() .resolve(format!("user_exports/{}", payload.filename), BaseDirectory::AppData) .map_err(|e| format!("Failed to resolve sandboxed path: {e}"))?; std::fs::read_to_string(safe_path).map_err(|e| format!("Read error: {e}")) } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tauri 2.0 Scoped Capabilities Matrix & Zero-Trust IPC Sandboxing

Tauri 2.0 Scoped Capabilities Matrix & Zero-Trust IPC Sandboxing defines an industrial-grade behavioral standard for mobile engineering. Enforces least-privilege IPC boundaries in Tauri 2.0 mobile architectures via declarative capability manifests and strict runtime payload validation. Eliminates arbitrary native code execution and path traversal by disallowing wildcard permissions, segregating webview contexts, and strictly constraining filesystem and system plugin access to cryptographically validated or sandboxed device scopes. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Pervasive Wildcard Plugin Permissions and Unscoped Native Commands Exposing Mobile Shell/Storage to XSS Privilege Escalation Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Pervasive Wildcard Plugin Permissions and Unscoped Native Commands Exposing Mobile Shell/Storage to XSS Privilege Escalation	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS isolate mobile capabilities into dedicated files under `src-tauri/capabilities/` filtered by platform (`android`, `iOS`).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.