security & permissions

5 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Permissions system migration from allowlist to ACL

The v1 allowlist has been rewritten into a new permissions system that works as an Access Control List (ACL) for individual plugins. It allows permitting or denying commands, assigning permissions to specific windows and domains, and defining access scopes. Create capability files in `src-tauri/capabilities` folder, and Tauri automatically configures everything. The `migrate` command automatically analyzes the v1 allowlist and generates the associated capability file.

Tauri v2: Rust scope API changes

Scope API changes in v2: scope::ipc::RemoteDomainAccessScope::enable_tauri_api and enables_tauri_api removed (enable core plugins individually via scope::ipc::RemoteDomainAccessScope::add_plugin); scope::IpcScope removed (use scope::ipc::Scope); scope::FsScope, scope::GlobPattern, scope::FsScopeEvent removed (replaced by scope::fs::Scope, scope::fs::Pattern, scope::fs::Event).

Tauri v2: permission system rewrite

v1 permission allowlist completely rewritten to new permission system functioning as access control list (ACL). Allows enabling/disabling commands, assigning permissions to specific windows and domains, and defining access scope. Permissions configured via capability files in src-tauri/capabilities folder. The migrate CLI command automatically parses v1 allowlist and generates related capability files.

Core plugin permission identifiers require core: prefix in Tauri v2 release candidate

All core permission identifiers in the permissions array must be prefixed with 'core:'. The following permissions changed: 'path:default' to 'core:path:default', 'event:default' to 'core:event:default', 'window:default' to 'core:window:default', 'app:default' to 'core:app:default', 'image:default' to 'core:image:default', 'resources:default' to 'core:resources:default', 'menu:default' to 'core:menu:default', and 'tray:default' to 'core:tray:default'. Alternatively, you can use the new 'core:default' permission set which includes all default permissions for all core plugins.

core:default permission set replaces all core plugin permissions

A new special 'core:default' permission set was added in Tauri v2.0 release candidate that includes all default permissions for all core plugins. This simplifies the permissions configuration and can replace listing individual core permissions like core:path:default, core:event:default, core:window:default, etc.

Give your agent this brain