Skip to main content
configuring-tauri-permissions Configure the Tauri v2 permission system controlling frontend access to backend commands and resources. USE WHEN defining allow/deny lists, enabling plugin permissions, referencing permission identifiers, or wiring permissions into scopes and capabilities.
Jump to install Skills Marketplace Discover and explore AI skills built by the community.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Show prompt details A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/Sheshiyer/skill-clusters --skill configuring-tauri-permissionsThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Download Zip Downloading... More from this repository Arcplume runs Grok through the Grok Build CLI's own OAuth-authenticated session (grok login) for image generation, with strict preflight validation, secret-safe handling, and headless CLI-driven execution -- no separate XAI_API_KEY billing. Video falls back to the billed xAI API. USE WHEN a user wants to generate an image via a locally logged-in Grok Build CLI session, e.g. 'generate an image with grok', 'use grok build', or 'use my logged-in grok session'.
Shared reference for the Selemene cluster: the two report surfaces (deterministic Rust reports vs. narrative witness-pipeline readings), the @selemene/bridge CLI contract, the output manifest format, and non-prescriptive witnessing tone. USE WHEN deciding which Selemene surface to invoke or when routing between birth/compatibility/transit reports and solo/dyadic readings.
Route Selemene Engine tasks to the right surface: deterministic reports (birth/compatibility/transit) via selemene-core and the @selemene/bridge CLI, or narrative witness readings via selemene-report. USE WHEN the user wants anything under the Selemene/Noesis umbrella but has not named the exact surface.
Related occupations SOC
Based on SOC occupation classification
name configuring-tauri-permissions description Configure the Tauri v2 permission system controlling frontend access to backend commands and resources. USE WHEN defining allow/deny lists, enabling plugin permissions, referencing permission identifiers, or wiring permissions into scopes and capabilities. cluster tauri version 1.0.0
Tauri Permissions Configuration
This skill covers the Tauri v2 permission system for controlling frontend access to backend commands and system resources.
Permission System Overview
Permissions in Tauri are explicit privileges that grant or deny access to specific commands. They form the security boundary between frontend code and system resources.
Core Components
Component Purpose Permission Defines access to specific commands Scope Restricts commands to specific paths/resources Capability Links permissions to windows/webviews Identifier Unique name referencing a permission
Security Model
Frontend code cannot access commands without explicit permission
Deny rules always take precedence over allow rules
Permissions must be linked to capabilities to be active
Each window/webview can have different permissions
Permission Identifiers
Naming Convention Format: <plugin-name>:<permission-type>
Pattern Example Description <name>:defaultfs:defaultDefault permission set <name>:allow-<command>fs:allow-read-fileAllow specific command <name>:deny-<command>fs:deny-write-fileDeny specific command <name>:allow-<scope>fs:allow-app-readAllow with predefined scope
Identifier Rules
Lowercase ASCII letters only: [a-z]
Maximum length: 116 characters
Plugin prefixes (tauri-plugin-) added automatically at compile time
Directory Structure
Application Structure src-tauri/
├── capabilities/
│ ├── default.json # Main capability file
│ └── admin.toml # Additional capabilities
├── permissions/
│ └── custom-permission.toml # Custom app permissions
└── tauri.conf.json
Plugin Structure tauri-plugin-example/
├── permissions/
│ ├── default.toml # Default permission set
│ ├── autogenerated/ # Auto-generated from commands
│ │ └── commands/
│ └── custom-scope.toml # Custom scopes
└── src/
├── commands.rs
└── build.rs
Capability Configuration Capabilities link permissions to windows and define what frontend contexts can access.
JSON Format (Recommended for Apps) {
"$schema" : "../gen/schemas/desktop-schema.json" ,
"identifier" : "main-capability" ,
"description" : "Main window permissions" ,
"windows" : [ "main" ] ,
"permissions" : [
"core:default" ,
"fs:default" ,
"fs:allow-read-text-file" ,
{
"identifier" : "fs:allow-write-text-file" ,
"allow" : [ { "path" : "$APPDATA/*" } ]
}
]
}
TOML Format "$schema" = "../gen/schemas/desktop-schema.json"
identifier = "main-capability"
description = "Main window permissions"
windows = ["main" ]
permissions = [
"core:default" ,
"fs:default" ,
"fs:allow-read-text-file"
]
[[permissions]]
identifier = "fs:allow-write-text-file"
allow = [{ path = "$APPDATA/*" }]
Window Targeting {
"identifier" : "admin-capability" ,
"windows" : [ "admin" , "settings" ] ,
"permissions" : [ "fs:allow-write-all" ]
}
Use "*" to target all windows:
{
"windows" : [ "*" ] ,
"permissions" : [ "core:default" ]
}
Platform-Specific Capabilities {
"identifier" : "desktop-capability" ,
"platforms" : [ "linux" , "macOS" , "windows" ] ,
"windows" : [ "main" ] ,
"permissions" : [ "fs:allow-app-read-recursive" ]
}
{
"identifier" : "mobile-capability" ,
"platforms" : [ "iOS" , "android" ] ,
"windows" : [ "main" ] ,
"permissions" : [ "fs:allow-app-read" ]
}
Allow and Deny Lists
Basic Scope Configuration {
"identifier" : "fs:allow-read-file" ,
"allow" : [
{ "path" : "$HOME/Documents/*" } ,
{ "path" : "$APPDATA/**" }
] ,
"deny" : [
{ "path" : "$HOME/Documents/secrets/*" }
]
}
Scope Variables Variable Description $APPApplication install directory $APPCONFIGApp config directory $APPDATAApp data directory $APPLOCALDATAApp local data directory $APPCACHEApp cache directory $APPLOGApp log directory $HOMEUser home directory $DESKTOPDesktop directory $DOCUMENTDocuments directory $DOWNLOADDownloads directory $RESOURCEApp resource directory $TEMPTemporary directory
Glob Patterns Pattern Matches *Any file in directory **Recursive (all subdirectories) *.txtFiles with .txt extension
Deny Precedence Deny rules always override allow rules:
{
"permissions" : [
{
"identifier" : "fs:allow-read-file" ,
"allow" : [ { "path" : "$HOME/**" } ] ,
"deny" : [ { "path" : "$HOME/.ssh/**" } ]
}
]
}
Plugin Permissions
Using Default Plugin Permissions {
"permissions" : [
"fs:default" ,
"shell:default" ,
"http:default" ,
"dialog:default"
]
}
Common Plugin Permission Patterns
Filesystem Plugin {
"permissions" : [
"fs:default" ,
"fs:allow-read-text-file" ,
"fs:allow-write-text-file" ,
"fs:allow-app-read-recursive" ,
"fs:allow-app-write-recursive" ,
"fs:deny-default"
]
}
HTTP Plugin {
"permissions" : [
"http:default" ,
{
"identifier" : "http:default" ,
"allow" : [ { "url" : "https://api.example.com/*" } ] ,
"deny" : [ { "url" : "https://api.example.com/admin/*" } ]
}
]
}
Shell Plugin {
"permissions" : [
"shell:allow-open" ,
{
"identifier" : "shell:allow-execute" ,
"allow" : [
{ "name" : "git" , "cmd" : "git" , "args" : true }
]
}
]
}
Directory-Specific Filesystem Permissions Permission Access fs:allow-appdata-readRead $APPDATA (non-recursive) fs:allow-appdata-read-recursiveRead $APPDATA (recursive) fs:allow-appdata-writeWrite $APPDATA (non-recursive) fs:allow-appdata-write-recursiveWrite $APPDATA (recursive) fs:allow-home-read-recursiveRead $HOME (recursive) fs:allow-temp-writeWrite to temp directory
Custom Permission Definition
TOML Permission File Create src-tauri/permissions/my-permission.toml:
[[permission]]
identifier = "my-app:config-access"
description = "Access to app configuration files"
commands.allow = ["read_config" , "write_config" ]
[[scope.allow]]
path = "$APPCONFIG/*"
[[scope.deny]]
path = "$APPCONFIG/secrets.json"
Permission Sets Group multiple permissions:
[[set]]
identifier = "my-app:full-access"
description = "Full application access"
permissions = [
"my-app:config-access" ,
"fs:allow-app-read-recursive" ,
"fs:allow-app-write-recursive"
]
Auto-Generated Command Permissions const COMMANDS: &[&str ] = &["get_user" , "save_user" , "delete_user" ];
fn main () {
tauri_plugin::Builder::new (COMMANDS)
.build ();
}
allow-get-user / deny-get-userallow-save-user / deny-save-userallow-delete-user / deny-delete-user
Default Permission Set Create permissions/default.toml:
[default]
description = "Default permissions for my-plugin"
permissions = [
"allow-get-user" ,
"allow-save-user"
]
Remote Access Configuration Allow remote URLs to access Tauri APIs (use with caution):
{
"identifier" : "remote-capability" ,
"windows" : [ "main" ] ,
"remote" : {
"urls" : [ "https://*.myapp.com" ]
} ,
"permissions" : [
"core:default"
]
}
Security Warning : Linux and Android cannot distinguish iframe requests from window requests.
Configuration in tauri.conf.json Reference capabilities by identifier:
{
"app" : {
"security" : {
"capabilities" : [ "main-capability" , "admin-capability" ]
}
}
}
Or inline capabilities directly:
{
"app" : {
"security" : {
"capabilities" : [
{
"identifier" : "inline-capability" ,
"windows" : [ "*" ] ,
"permissions" : [ "core:default" ]
}
]
}
}
}
Troubleshooting
Common Errors "Not allowed on this command"
Verify command permission is in capability
Check scope includes the target path
Ensure capability targets correct window
Check identifier spelling (lowercase only)
Verify plugin is installed
Run cargo build to regenerate permissions
Debugging Permissions
Check generated schema: src-tauri/gen/schemas/
Review capability files load correctly
Verify window names match capability targets
Check deny rules are not blocking access
Best Practices
Principle of Least Privilege : Only grant permissions actually neededUse Specific Scopes : Prefer $APPDATA/* over $HOME/**Deny Sensitive Paths : Always deny access to .ssh, credentials, etc.Separate Capabilities : Use different capabilities for different window typesDocument Custom Permissions : Include clear descriptionsReview Plugin Defaults : Understand what default permissions grantPlatform-Specific Config : Use platform targeting for OS-specific needs 