Tauri v2 权限配置指南：安全控制命令与系统资源访问

configuring-tauri-permissions by dchuk/claude-code-tauri-skills

140 周安装量

12 GitHub Stars

GitHub

安装命令

npx skills add https://github.com/dchuk/claude-code-tauri-skills --skill configuring-tauri-permissions

桌面应用 Rust 安全

🇨🇳中文介绍

Tauri 权限配置

本技能涵盖 Tauri v2 权限系统，用于控制前端对后端命令和系统资源的访问。

权限系统概述

Tauri 中的权限是明确的特权，用于授予或拒绝对特定命令的访问。它们构成了前端代码与系统资源之间的安全边界。

核心组件

组件	用途
Permission	定义对特定命令的访问权限
Scope	将命令限制在特定路径/资源
Capability	将权限链接到窗口/webview
Identifier	引用权限的唯一名称

安全模型

前端代码没有明确权限无法访问命令
拒绝规则始终优先于允许规则
权限必须链接到能力才能生效
每个窗口/webview 可以有不同的权限

权限标识符

命名约定

格式：<plugin-name>:<permission-type>

模式	示例

广告位招租

在这里展示您的产品或服务

触达数万 AI 开发者，精准高效

联系我们

JSON 格式（推荐用于应用）

{
  "$schema": "../gen/schemas/desktop-schema.json",
  "identifier": "main-capability",
  "description": "主窗口权限",
  "windows": ["main"],
  "permissions": [
    "core:default",
    "fs:default",
    "fs:allow-read-text-file",
    {
      "identifier": "fs:allow-write-text-file",
      "allow": [{ "path": "$APPDATA/*" }]
    }
  ]
}

"$schema" = "../gen/schemas/desktop-schema.json"
identifier = "main-capability"
description = "主窗口权限"
windows = ["main"]
permissions = [
  "core:default",
  "fs:default",
  "fs:allow-read-text-file"
]

[[permissions]]
identifier = "fs:allow-write-text-file"
allow = [{ path = "$APPDATA/*" }]

{
  "identifier": "admin-capability",
  "windows": ["admin", "settings"],
  "permissions": ["fs:allow-write-all"]
}

使用 "*" 定位所有窗口：

{
  "windows": ["*"],
  "permissions": ["core:default"]
}

{
  "identifier": "desktop-capability",
  "platforms": ["linux", "macOS", "windows"],
  "windows": ["main"],
  "permissions": ["fs:allow-app-read-recursive"]
}



{
  "identifier": "mobile-capability",
  "platforms": ["iOS", "android"],
  "windows": ["main"],
  "permissions": ["fs:allow-app-read"]
}

允许和拒绝列表

{
  "identifier": "fs:allow-read-file",
  "allow": [
    { "path": "$HOME/Documents/*" },
    { "path": "$APPDATA/**" }
  ],
  "deny": [
    { "path": "$HOME/Documents/secrets/*" }
  ]
}

变量	描述
`$APP`	应用程序安装目录
`$APPCONFIG`	应用配置目录
`$APPDATA`	应用数据目录
`$APPLOCALDATA`	应用本地数据目录
`$APPCACHE`	应用缓存目录
`$APPLOG`	应用日志目录
`$HOME`	用户主目录
`$DESKTOP`	桌面目录
`$DOCUMENT`	文档目录
`$DOWNLOAD`	下载目录
`$RESOURCE`	应用资源目录
`$TEMP`	临时目录

模式	匹配内容
`*`	目录中的任何文件
`**`	递归（所有子目录）
`*.txt`	扩展名为 .txt 的文件

拒绝规则始终覆盖允许规则：

{
  "permissions": [
    {
      "identifier": "fs:allow-read-file",
      "allow": [{ "path": "$HOME/**" }],
      "deny": [{ "path": "$HOME/.ssh/**" }]
    }
  ]
}

使用默认插件权限

{
  "permissions": [
    "fs:default",
    "shell:default",
    "http:default",
    "dialog:default"
  ]
}

常见插件权限模式

{
  "permissions": [
    "fs:default",
    "fs:allow-read-text-file",
    "fs:allow-write-text-file",
    "fs:allow-app-read-recursive",
    "fs:allow-app-write-recursive",
    "fs:deny-default"
  ]
}

{
  "permissions": [
    "http:default",
    {
      "identifier": "http:default",
      "allow": [{ "url": "https://api.example.com/*" }],
      "deny": [{ "url": "https://api.example.com/admin/*" }]
    }
  ]
}

{
  "permissions": [
    "shell:allow-open",
    {
      "identifier": "shell:allow-execute",
      "allow": [
        { "name": "git", "cmd": "git", "args": true }
      ]
    }
  ]
}

目录特定文件系统权限

权限	访问权限
`fs:allow-appdata-read`	读取 $APPDATA（非递归）
`fs:allow-appdata-read-recursive`	读取 $APPDATA（递归）
`fs:allow-appdata-write`	写入 $APPDATA（非递归）
`fs:allow-appdata-write-recursive`	写入 $APPDATA（递归）
`fs:allow-home-read-recursive`	读取 $HOME（递归）
`fs:allow-temp-write`	写入临时目录

自定义权限定义

创建 src-tauri/permissions/my-permission.toml：

[[permission]]
identifier = "my-app:config-access"
description = "访问应用配置文件"
commands.allow = ["read_config", "write_config"]

[[scope.allow]]
path = "$APPCONFIG/*"

[[scope.deny]]
path = "$APPCONFIG/secrets.json"

分组多个权限：

[[set]]
identifier = "my-app:full-access"
description = "完全应用访问权限"
permissions = [
  "my-app:config-access",
  "fs:allow-app-read-recursive",
  "fs:allow-app-write-recursive"
]

自动生成的命令权限

在插件 src/build.rs 中：

const COMMANDS: &[&str] = &["get_user", "save_user", "delete_user"];

fn main() {
    tauri_plugin::Builder::new(COMMANDS)
        .build();
}

allow-get-user / deny-get-user
allow-save-user / deny-save-user
allow-delete-user / deny-delete-user

创建 permissions/default.toml：

[default]
description = "my-plugin 的默认权限"
permissions = [
  "allow-get-user",
  "allow-save-user"
]

允许远程 URL 访问 Tauri API（谨慎使用）：

{
  "identifier": "remote-capability",
  "windows": ["main"],
  "remote": {
    "urls": ["https://*.myapp.com"]
  },
  "permissions": [
    "core:default"
  ]
}

安全警告：Linux 和 Android 无法区分 iframe 请求和窗口请求。

tauri.conf.json 中的配置

通过标识符引用能力：

{
  "app": {
    "security": {
      "capabilities": ["main-capability", "admin-capability"]
    }
  }
}

或直接内联能力：

{
  "app": {
    "security": {
      "capabilities": [
        {
          "identifier": "inline-capability",
          "windows": ["*"],
          "permissions": ["core:default"]
        }
      ]
    }
  }
}

"此命令不允许"

验证命令权限是否在能力中
检查范围是否包含目标路径
确保能力定位到正确的窗口

检查标识符拼写（仅小写）
验证插件是否已安装
运行 cargo build 重新生成权限

检查生成的模式：src-tauri/gen/schemas/
查看能力文件是否正确加载
验证窗口名称是否与能力目标匹配
检查拒绝规则是否阻止了访问

最小权限原则：仅授予实际需要的权限
使用特定范围：优先使用 $APPDATA/* 而非 $HOME/**
拒绝敏感路径：始终拒绝对 .ssh、凭证等的访问
分离能力：为不同类型的窗口使用不同的能力
记录自定义权限：包含清晰的描述
审查插件默认值：了解默认权限授予的内容
平台特定配置：针对操作系统特定需求使用平台定位

🇺🇸English

Tauri Permissions Configuration

This skill covers the Tauri v2 permission system for controlling frontend access to backend commands and system resources.

Permission System Overview

Permissions in Tauri are explicit privileges that grant or deny access to specific commands. They form the security boundary between frontend code and system resources.

Core Components

Component	Purpose
Permission	Defines access to specific commands
Scope	Restricts commands to specific paths/resources
Capability	Links permissions to windows/webviews
Identifier	Unique name referencing a permission

Security Model

Frontend code cannot access commands without explicit permission
Deny rules always take precedence over allow rules
Permissions must be linked to capabilities to be active
Each window/webview can have different permissions

Permission Identifiers

Naming Convention

Format: <plugin-name>:<permission-type>

Pattern	Example	Description
`<name>:default`	`fs:default`	Default permission set
`<name>:allow-<command>`	`fs:allow-read-file`	Allow specific command
`<name>:deny-<command>`	`fs:deny-write-file`	Deny specific command
`<name>:allow-<scope>`

Identifier Rules

Lowercase ASCII letters only: [a-z]
Maximum length: 116 characters
Plugin prefixes (tauri-plugin-) added automatically at compile time

Directory Structure

Application Structure

src-tauri/
├── capabilities/
│   ├── default.json          # Main capability file
│   └── admin.toml            # Additional capabilities
├── permissions/
│   └── custom-permission.toml # Custom app permissions
└── tauri.conf.json

Plugin Structure

tauri-plugin-example/
├── permissions/
│   ├── default.toml          # Default permission set
│   ├── autogenerated/        # Auto-generated from commands
│   │   └── commands/
│   └── custom-scope.toml     # Custom scopes
└── src/
    ├── commands.rs
    └── build.rs

Capability Configuration

Capabilities link permissions to windows and define what frontend contexts can access.

JSON Format (Recommended for Apps)

{
  "$schema": "../gen/schemas/desktop-schema.json",
  "identifier": "main-capability",
  "description": "Main window permissions",
  "windows": ["main"],
  "permissions": [
    "core:default",
    "fs:default",
    "fs:allow-read-text-file",
    {
      "identifier": "fs:allow-write-text-file",
      "allow": [{ "path": "$APPDATA/*" }]
    }
  ]
}

TOML Format

"$schema" = "../gen/schemas/desktop-schema.json"
identifier = "main-capability"
description = "Main window permissions"
windows = ["main"]
permissions = [
  "core:default",
  "fs:default",
  "fs:allow-read-text-file"
]

[[permissions]]
identifier = "fs:allow-write-text-file"
allow = [{ path = "$APPDATA/*" }]

Window Targeting

{
  "identifier": "admin-capability",
  "windows": ["admin", "settings"],
  "permissions": ["fs:allow-write-all"]
}

Use "*" to target all windows:

{
  "windows": ["*"],
  "permissions": ["core:default"]
}

Platform-Specific Capabilities

{
  "identifier": "desktop-capability",
  "platforms": ["linux", "macOS", "windows"],
  "windows": ["main"],
  "permissions": ["fs:allow-app-read-recursive"]
}



{
  "identifier": "mobile-capability",
  "platforms": ["iOS", "android"],
  "windows": ["main"],
  "permissions": ["fs:allow-app-read"]
}

Allow and Deny Lists

Basic Scope Configuration

{
  "identifier": "fs:allow-read-file",
  "allow": [
    { "path": "$HOME/Documents/*" },
    { "path": "$APPDATA/**" }
  ],
  "deny": [
    { "path": "$HOME/Documents/secrets/*" }
  ]
}

Scope Variables

Variable	Description
`$APP`	Application install directory
`$APPCONFIG`	App config directory
`$APPDATA`	App data directory
`$APPLOCALDATA`	App local data directory
`$APPCACHE`	App cache directory
`$APPLOG`	App log directory

Glob Patterns

Pattern	Matches
`*`	Any file in directory
`**`	Recursive (all subdirectories)
`*.txt`	Files with .txt extension

Deny Precedence

Deny rules always override allow rules:

{
  "permissions": [
    {
      "identifier": "fs:allow-read-file",
      "allow": [{ "path": "$HOME/**" }],
      "deny": [{ "path": "$HOME/.ssh/**" }]
    }
  ]
}

Plugin Permissions

Using Default Plugin Permissions

{
  "permissions": [
    "fs:default",
    "shell:default",
    "http:default",
    "dialog:default"
  ]
}

Common Plugin Permission Patterns

Filesystem Plugin

{
  "permissions": [
    "fs:default",
    "fs:allow-read-text-file",
    "fs:allow-write-text-file",
    "fs:allow-app-read-recursive",
    "fs:allow-app-write-recursive",
    "fs:deny-default"
  ]
}

HTTP Plugin

{
  "permissions": [
    "http:default",
    {
      "identifier": "http:default",
      "allow": [{ "url": "https://api.example.com/*" }],
      "deny": [{ "url": "https://api.example.com/admin/*" }]
    }
  ]
}

Shell Plugin

{
  "permissions": [
    "shell:allow-open",
    {
      "identifier": "shell:allow-execute",
      "allow": [
        { "name": "git", "cmd": "git", "args": true }
      ]
    }
  ]
}

Directory-Specific Filesystem Permissions

Permission	Access
`fs:allow-appdata-read`	Read $APPDATA (non-recursive)
`fs:allow-appdata-read-recursive`	Read $APPDATA (recursive)
`fs:allow-appdata-write`	Write $APPDATA (non-recursive)
`fs:allow-appdata-write-recursive`	Write $APPDATA (recursive)
`fs:allow-home-read-recursive`	Read $HOME (recursive)
`fs:allow-temp-write`

Custom Permission Definition

TOML Permission File

Create src-tauri/permissions/my-permission.toml:

[[permission]]
identifier = "my-app:config-access"
description = "Access to app configuration files"
commands.allow = ["read_config", "write_config"]

[[scope.allow]]
path = "$APPCONFIG/*"

[[scope.deny]]
path = "$APPCONFIG/secrets.json"

Permission Sets

Group multiple permissions:

[[set]]
identifier = "my-app:full-access"
description = "Full application access"
permissions = [
  "my-app:config-access",
  "fs:allow-app-read-recursive",
  "fs:allow-app-write-recursive"
]

Auto-Generated Command Permissions

In plugin src/build.rs:

const COMMANDS: &[&str] = &["get_user", "save_user", "delete_user"];

fn main() {
    tauri_plugin::Builder::new(COMMANDS)
        .build();
}

This generates:

allow-get-user / deny-get-user
allow-save-user / deny-save-user
allow-delete-user / deny-delete-user

Default Permission Set

Create permissions/default.toml:

[default]
description = "Default permissions for my-plugin"
permissions = [
  "allow-get-user",
  "allow-save-user"
]

Remote Access Configuration

Allow remote URLs to access Tauri APIs (use with caution):

{
  "identifier": "remote-capability",
  "windows": ["main"],
  "remote": {
    "urls": ["https://*.myapp.com"]
  },
  "permissions": [
    "core:default"
  ]
}

Security Warning : Linux and Android cannot distinguish iframe requests from window requests.

Configuration in tauri.conf.json

Reference capabilities by identifier:

{
  "app": {
    "security": {
      "capabilities": ["main-capability", "admin-capability"]
    }
  }
}

Or inline capabilities directly:

{
  "app": {
    "security": {
      "capabilities": [
        {
          "identifier": "inline-capability",
          "windows": ["*"],
          "permissions": ["core:default"]
        }
      ]
    }
  }
}

Troubleshooting

Common Errors

"Not allowed on this command"

Verify command permission is in capability
Check scope includes the target path
Ensure capability targets correct window

Permission not found

Check identifier spelling (lowercase only)
Verify plugin is installed
Run cargo build to regenerate permissions

Debugging Permissions

Check generated schema: src-tauri/gen/schemas/
Review capability files load correctly
Verify window names match capability targets
Check deny rules are not blocking access

Best Practices

Principle of Least Privilege : Only grant permissions actually needed
Use Specific Scopes : Prefer $APPDATA/* over $HOME/**
Deny Sensitive Paths : Always deny access to .ssh, credentials, etc.
Separate Capabilities : Use different capabilities for different window types
Document Custom Permissions : Include clear descriptions
Review Plugin Defaults : Understand what default permissions grant
Platform-Specific Config : Use platform targeting for OS-specific needs

Weekly Installs

Repository

dchuk/claude-co…i-skills

GitHub Stars

First Seen

Jan 24, 2026

Security Audits

Gen Agent Trust HubPass SocketPass SnykPass

Installed on

opencode77

gemini-cli76

codex72

claude-code65

github-copilot64

cursor63

Azure PostgreSQL 无密码身份验证配置指南：Entra ID 迁移与访问管理

34,800 周安装

`<name>:default`	`fs:default`	默认权限集
`<name>:allow-<command>`	`fs:allow-read-file`	允许特定命令
`<name>:deny-<command>`	`fs:deny-write-file`	拒绝特定命令
`<name>:allow-<scope>`	`fs:allow-app-read`	允许使用预定义范围

Tauri v2 权限配置指南：安全控制命令与系统资源访问

🇨🇳中文介绍

Tauri 权限配置

权限系统概述

核心组件

安全模型

权限标识符

命名约定

相关 Skills

标识符规则

目录结构

应用程序结构

插件结构

能力配置