From 5a9e77265cdaf9bf076145ef106036ea9660105c Mon Sep 17 00:00:00 2001 From: Lucas Nogueira Date: Tue, 20 May 2025 17:07:04 -0300 Subject: [PATCH 1/7] fix(core): capability filtering crashing allowed command generation tauri-plugin and tauri build scripts cannot have access to the capabilities file (generated by tauri-build) and can only infer capabilities from the config path --- .changes/fix-capability-filter.md | 5 +++++ crates/tauri-build/src/lib.rs | 2 ++ crates/tauri-codegen/src/context.rs | 2 +- crates/tauri-utils/src/acl/build.rs | 23 ++++++++++++++++------- crates/tauri-utils/src/acl/mod.rs | 14 ++++++-------- 5 files changed, 30 insertions(+), 16 deletions(-) create mode 100644 .changes/fix-capability-filter.md diff --git a/.changes/fix-capability-filter.md b/.changes/fix-capability-filter.md new file mode 100644 index 000000000000..38b5f55e5432 --- /dev/null +++ b/.changes/fix-capability-filter.md @@ -0,0 +1,5 @@ +--- +"tauri-utils": patch:bug +--- + +Fix capability filtering via `tauri.conf.json > app > security > capabilities` not working when generating allowed commands. diff --git a/crates/tauri-build/src/lib.rs b/crates/tauri-build/src/lib.rs index 07f98e9b95e5..446aeaa5d888 100644 --- a/crates/tauri-build/src/lib.rs +++ b/crates/tauri-build/src/lib.rs @@ -367,6 +367,8 @@ impl Attributes { /// Set the glob pattern to be used to find the capabilities. /// + /// **WARNING:** The `removeUnusedCommands` option does not work with a custom capabilities path. + /// /// **Note:** You must emit [rerun-if-changed] instructions for your capabilities directory. /// /// [rerun-if-changed]: https://doc.rust-lang.org/cargo/reference/build-scripts.html#rerun-if-changed diff --git a/crates/tauri-codegen/src/context.rs b/crates/tauri-codegen/src/context.rs index dc79df85760b..0a8064266dbd 100644 --- a/crates/tauri-codegen/src/context.rs +++ b/crates/tauri-codegen/src/context.rs @@ -395,7 +395,7 @@ pub fn context_codegen(data: ContextData) -> EmbeddedAssetsResult { let capabilities_file_path = out_dir.join(CAPABILITIES_FILE_NAME); let capabilities = get_capabilities( &config, - Some(&capabilities_file_path), + &capabilities_file_path, additional_capabilities.as_deref(), ) .unwrap(); diff --git a/crates/tauri-utils/src/acl/build.rs b/crates/tauri-utils/src/acl/build.rs index 701843d11377..1c4982873e7e 100644 --- a/crates/tauri-utils/src/acl/build.rs +++ b/crates/tauri-utils/src/acl/build.rs @@ -11,7 +11,7 @@ use std::{ }; use crate::{ - acl::{has_app_manifest, AllowedCommands, Error}, + acl::{has_app_manifest, AllowedCommands, Error, CAPABILITIES_FILE_NAME}, config::Config, write_if_changed, }; @@ -419,11 +419,6 @@ pub fn generate_allowed_commands( println!("cargo:rerun-if-changed={}", capabilities_path.display()); } - let mut capabilities = crate::acl::build::parse_capabilities(&format!( - "{}/**/*", - glob::Pattern::escape(&capabilities_path.to_string_lossy()) - ))?; - let target_triple = env::var("TARGET")?; let target = crate::platform::Target::from_triple(&target_triple); let (mut config, config_paths) = crate::config::parse::read_from(target, &config_directory)?; @@ -460,9 +455,23 @@ pub fn generate_allowed_commands( }) .collect(); - capabilities.extend(crate::acl::get_capabilities(&config, None, None)?); + let capabilities_file_path = out_dir.join(CAPABILITIES_FILE_NAME); + // the capabilities file only exist in the tauri-build context + if !capabilities_file_path.exists() { + let capabilities = crate::acl::build::parse_capabilities(&format!( + "{}/**/*", + glob::Pattern::escape(&capabilities_path.to_string_lossy()) + ))?; + // write to capabilities path because we still want to go through acl::get_capabilities because it filters based on the config + std::fs::write( + &capabilities_file_path, + serde_json::to_string(&capabilities)?, + )?; + } + let capabilities = crate::acl::get_capabilities(&config, &capabilities_file_path, None)?; let permission_entries = capabilities + .clone() .into_iter() .flat_map(|(_, capabilities)| capabilities.permissions); let mut allowed_commands = AllowedCommands { diff --git a/crates/tauri-utils/src/acl/mod.rs b/crates/tauri-utils/src/acl/mod.rs index 1ebd2a24e6d0..fde455680a5d 100644 --- a/crates/tauri-utils/src/acl/mod.rs +++ b/crates/tauri-utils/src/acl/mod.rs @@ -352,17 +352,15 @@ pub fn has_app_manifest(acl: &BTreeMap) /// Get the capabilities from the config file pub fn get_capabilities( config: &Config, - pre_built_capabilities_file_path: Option<&Path>, + pre_built_capabilities_file_path: &Path, additional_capability_files: Option<&[PathBuf]>, ) -> anyhow::Result> { let mut capabilities_from_files: BTreeMap = BTreeMap::new(); - if let Some(capabilities_file_path) = pre_built_capabilities_file_path { - if capabilities_file_path.exists() { - let capabilities_file = - std::fs::read_to_string(capabilities_file_path).context("failed to read capabilities")?; - capabilities_from_files = - serde_json::from_str(&capabilities_file).context("failed to parse capabilities")?; - } + if pre_built_capabilities_file_path.exists() { + let capabilities_file = std::fs::read_to_string(pre_built_capabilities_file_path) + .context("failed to read capabilities")?; + capabilities_from_files = + serde_json::from_str(&capabilities_file).context("failed to parse capabilities")?; } let mut capabilities = if config.app.security.capabilities.is_empty() { From bd5453287895f37f1beb7850b7250343f88d6365 Mon Sep 17 00:00:00 2001 From: Lucas Nogueira Date: Wed, 21 May 2025 11:50:03 -0300 Subject: [PATCH 2/7] cleanup --- crates/tauri-build/src/acl.rs | 2 +- crates/tauri-codegen/src/context.rs | 9 ++++++++- crates/tauri-plugin/src/build/mod.rs | 2 +- crates/tauri-utils/src/acl/build.rs | 20 ++++++++------------ crates/tauri-utils/src/acl/mod.rs | 8 +------- crates/tauri/build.rs | 2 +- 6 files changed, 20 insertions(+), 23 deletions(-) diff --git a/crates/tauri-build/src/acl.rs b/crates/tauri-build/src/acl.rs index 8060bae8b903..474c63006d73 100644 --- a/crates/tauri-build/src/acl.rs +++ b/crates/tauri-build/src/acl.rs @@ -437,7 +437,7 @@ pub fn build(out_dir: &Path, target: Target, attributes: &Attributes) -> super:: permissions_map.insert(APP_ACL_KEY.to_string(), app_acl.permission_files); } - tauri_utils::acl::build::generate_allowed_commands(out_dir, permissions_map)?; + tauri_utils::acl::build::generate_allowed_commands(out_dir, Some(capabilities), permissions_map)?; Ok(()) } diff --git a/crates/tauri-codegen/src/context.rs b/crates/tauri-codegen/src/context.rs index 0a8064266dbd..03914db1e7f4 100644 --- a/crates/tauri-codegen/src/context.rs +++ b/crates/tauri-codegen/src/context.rs @@ -393,9 +393,16 @@ pub fn context_codegen(data: ContextData) -> EmbeddedAssetsResult { }; let capabilities_file_path = out_dir.join(CAPABILITIES_FILE_NAME); + let capabilities_from_files = if capabilities_file_path.exists() { + let capabilities_json = + std::fs::read_to_string(&capabilities_file_path).expect("failed to read capabilities"); + serde_json::from_str(&capabilities_json).expect("failed to parse capabilities") + } else { + Default::default() + }; let capabilities = get_capabilities( &config, - &capabilities_file_path, + capabilities_from_files, additional_capabilities.as_deref(), ) .unwrap(); diff --git a/crates/tauri-plugin/src/build/mod.rs b/crates/tauri-plugin/src/build/mod.rs index f90c66ed7d9f..921ebca18df7 100644 --- a/crates/tauri-plugin/src/build/mod.rs +++ b/crates/tauri-plugin/src/build/mod.rs @@ -137,7 +137,7 @@ impl<'a> Builder<'a> { let mut permissions_map = BTreeMap::new(); permissions_map.insert(name.clone(), permissions); - tauri_utils::acl::build::generate_allowed_commands(&out_dir, permissions_map)?; + tauri_utils::acl::build::generate_allowed_commands(&out_dir, None, permissions_map)?; if let Some(global_scope_schema) = self.global_scope_schema { acl::build::define_global_scope_schema(global_scope_schema, &name, &out_dir)?; diff --git a/crates/tauri-utils/src/acl/build.rs b/crates/tauri-utils/src/acl/build.rs index 1c4982873e7e..05860a4705ee 100644 --- a/crates/tauri-utils/src/acl/build.rs +++ b/crates/tauri-utils/src/acl/build.rs @@ -393,6 +393,7 @@ pub fn generate_docs( /// Generate allowed commands file for the `generate_handler` macro to remove never allowed commands pub fn generate_allowed_commands( out_dir: &Path, + capabilities_from_files: Option>, permissions_map: BTreeMap>, ) -> Result<(), anyhow::Error> { println!("cargo:rerun-if-env-changed={REMOVE_UNUSED_COMMANDS_ENV_VAR}"); @@ -455,20 +456,15 @@ pub fn generate_allowed_commands( }) .collect(); - let capabilities_file_path = out_dir.join(CAPABILITIES_FILE_NAME); - // the capabilities file only exist in the tauri-build context - if !capabilities_file_path.exists() { - let capabilities = crate::acl::build::parse_capabilities(&format!( + let capabilities_from_files = if let Some(capabilities) = capabilities_from_files { + capabilities + } else { + crate::acl::build::parse_capabilities(&format!( "{}/**/*", glob::Pattern::escape(&capabilities_path.to_string_lossy()) - ))?; - // write to capabilities path because we still want to go through acl::get_capabilities because it filters based on the config - std::fs::write( - &capabilities_file_path, - serde_json::to_string(&capabilities)?, - )?; - } - let capabilities = crate::acl::get_capabilities(&config, &capabilities_file_path, None)?; + ))? + }; + let capabilities = crate::acl::get_capabilities(&config, capabilities_from_files, None)?; let permission_entries = capabilities .clone() diff --git a/crates/tauri-utils/src/acl/mod.rs b/crates/tauri-utils/src/acl/mod.rs index fde455680a5d..4a799bc4625a 100644 --- a/crates/tauri-utils/src/acl/mod.rs +++ b/crates/tauri-utils/src/acl/mod.rs @@ -352,16 +352,10 @@ pub fn has_app_manifest(acl: &BTreeMap) /// Get the capabilities from the config file pub fn get_capabilities( config: &Config, - pre_built_capabilities_file_path: &Path, + capabilities_from_files: BTreeMap, additional_capability_files: Option<&[PathBuf]>, ) -> anyhow::Result> { let mut capabilities_from_files: BTreeMap = BTreeMap::new(); - if pre_built_capabilities_file_path.exists() { - let capabilities_file = std::fs::read_to_string(pre_built_capabilities_file_path) - .context("failed to read capabilities")?; - capabilities_from_files = - serde_json::from_str(&capabilities_file).context("failed to parse capabilities")?; - } let mut capabilities = if config.app.security.capabilities.is_empty() { capabilities_from_files diff --git a/crates/tauri/build.rs b/crates/tauri/build.rs index a1d3c69b6781..3c8eb8944655 100644 --- a/crates/tauri/build.rs +++ b/crates/tauri/build.rs @@ -350,7 +350,7 @@ fn main() { } let permissions = define_permissions(&out_dir); - tauri_utils::acl::build::generate_allowed_commands(&out_dir, permissions).unwrap(); + tauri_utils::acl::build::generate_allowed_commands(&out_dir, None, permissions).unwrap(); } const LICENSE_HEADER: &str = r"# Copyright 2019-2024 Tauri Programme within The Commons Conservancy From 0fc2c214213ebba2ae04656cb0297c1b95399266 Mon Sep 17 00:00:00 2001 From: Lucas Nogueira Date: Wed, 21 May 2025 12:06:59 -0300 Subject: [PATCH 3/7] unused import --- crates/tauri-utils/src/acl/build.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crates/tauri-utils/src/acl/build.rs b/crates/tauri-utils/src/acl/build.rs index 05860a4705ee..3a22dce5124c 100644 --- a/crates/tauri-utils/src/acl/build.rs +++ b/crates/tauri-utils/src/acl/build.rs @@ -11,7 +11,7 @@ use std::{ }; use crate::{ - acl::{has_app_manifest, AllowedCommands, Error, CAPABILITIES_FILE_NAME}, + acl::{has_app_manifest, AllowedCommands, Error}, config::Config, write_if_changed, }; From 8ce74d5eb32b62d9eec309aa3204b0c353d63eba Mon Sep 17 00:00:00 2001 From: Lucas Nogueira Date: Wed, 21 May 2025 12:07:14 -0300 Subject: [PATCH 4/7] followup --- crates/tauri-utils/src/acl/mod.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crates/tauri-utils/src/acl/mod.rs b/crates/tauri-utils/src/acl/mod.rs index 4a799bc4625a..1a42263e92d5 100644 --- a/crates/tauri-utils/src/acl/mod.rs +++ b/crates/tauri-utils/src/acl/mod.rs @@ -28,7 +28,7 @@ use std::{ collections::{BTreeMap, HashSet}, fs, num::NonZeroU64, - path::{Path, PathBuf}, + path::PathBuf, str::FromStr, sync::Arc, }; From f758449669286b0fba1ea2b41c6fb50d1d0bb423 Mon Sep 17 00:00:00 2001 From: Lucas Nogueira Date: Wed, 21 May 2025 12:08:01 -0300 Subject: [PATCH 5/7] fix reassign --- crates/tauri-utils/src/acl/mod.rs | 2 -- 1 file changed, 2 deletions(-) diff --git a/crates/tauri-utils/src/acl/mod.rs b/crates/tauri-utils/src/acl/mod.rs index 1a42263e92d5..a3cccc939e9d 100644 --- a/crates/tauri-utils/src/acl/mod.rs +++ b/crates/tauri-utils/src/acl/mod.rs @@ -355,8 +355,6 @@ pub fn get_capabilities( capabilities_from_files: BTreeMap, additional_capability_files: Option<&[PathBuf]>, ) -> anyhow::Result> { - let mut capabilities_from_files: BTreeMap = BTreeMap::new(); - let mut capabilities = if config.app.security.capabilities.is_empty() { capabilities_from_files } else { From 2f24e5d2008160e00167ccd7bad6481d09219891 Mon Sep 17 00:00:00 2001 From: Lucas Nogueira Date: Wed, 21 May 2025 12:08:30 -0300 Subject: [PATCH 6/7] mut --- crates/tauri-utils/src/acl/mod.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crates/tauri-utils/src/acl/mod.rs b/crates/tauri-utils/src/acl/mod.rs index a3cccc939e9d..4d2322c39c23 100644 --- a/crates/tauri-utils/src/acl/mod.rs +++ b/crates/tauri-utils/src/acl/mod.rs @@ -352,7 +352,7 @@ pub fn has_app_manifest(acl: &BTreeMap) /// Get the capabilities from the config file pub fn get_capabilities( config: &Config, - capabilities_from_files: BTreeMap, + mut capabilities_from_files: BTreeMap, additional_capability_files: Option<&[PathBuf]>, ) -> anyhow::Result> { let mut capabilities = if config.app.security.capabilities.is_empty() { From 39938ef97e5c63d8279f2cb37995960b32f1df10 Mon Sep 17 00:00:00 2001 From: Lucas Fernandes Nogueira Date: Thu, 22 May 2025 07:33:08 -0300 Subject: [PATCH 7/7] Update crates/tauri-utils/src/acl/build.rs Co-authored-by: Tony <68118705+Legend-Master@users.noreply.github.com> --- crates/tauri-utils/src/acl/build.rs | 1 - 1 file changed, 1 deletion(-) diff --git a/crates/tauri-utils/src/acl/build.rs b/crates/tauri-utils/src/acl/build.rs index 3a22dce5124c..9b339e2a14e1 100644 --- a/crates/tauri-utils/src/acl/build.rs +++ b/crates/tauri-utils/src/acl/build.rs @@ -467,7 +467,6 @@ pub fn generate_allowed_commands( let capabilities = crate::acl::get_capabilities(&config, capabilities_from_files, None)?; let permission_entries = capabilities - .clone() .into_iter() .flat_map(|(_, capabilities)| capabilities.permissions); let mut allowed_commands = AllowedCommands {