Capability
A grouping and boundary mechanism developers can use to separate windows or plugins functionality from each other at runtime.
If a window is not matching any capability then it has no access to the IPC layer at all.
This can be done to create trust groups and reduce impact of vulnerabilities in certain plugins or windows. Windows can be added to a capability by exact name or glob patterns like , admin- or main-window.
Object Properties:
- description
- identifier (required)
- local
- permissions (required)
- platforms
- remote
- webviews
- windows
description
string
Description of the capability.
identifier
string
Identifier of the capability.
local
boolean
Whether this capability is enabled for local app URLs or not. Defaults to true
.
Default: true
permissions
List of permissions attached to this capability. Must include the plugin name as prefix in the form of ${plugin-name}:${permission-name}
.
platforms
Target
[] | null
Target platforms this capability applies. By default all platforms are affected by this capability.
remote
CapabilityRemote
| null
Configure remote URLs that can use the capability permissions.
webviews
string
[]
List of webviews that uses this capability. Can be a glob pattern.
This is only required when using on multiwebview contexts, by default all child webviews of a window that matches [Self::windows
] are linked.
windows
string
[]
List of windows that uses this capability. Can be a glob pattern.
On multiwebview windows, prefer [Self::webviews
] for a fine grained access control.
Definitions
CapabilityRemote
Configuration for remote URLs that are associated with the capability.
Object Properties:
- urls (required)
urls
string
[]
Remote domains this capability refers to using the URLPattern standard.
Examples
- ”https://.mydomain.dev”: allows subdomains of mydomain.dev - “https://mydomain.dev/api/”: allows any subpath of mydomain.dev/api
Identifier
string
Number
Any of the following:
integer
formatted asint64
Represents an [i64
].number
formatted asdouble
Represents a [f64
].
A valid ACL number.
PermissionEntry
Any of the following:
Identifier
Reference a permission or permission set by identifier.- Reference a permission or permission set by identifier and extends its scope. Object Properties: - allow - deny - identifier (required) ##### allow
Value
[] |null
Data that defines what is allowed by the scope. ##### denyValue
[] |null
Data that defines what is denied by the scope. ##### identifierIdentifier
Identifier of the permission or permission set.
An entry for a permission value in a [Capability
] can be either a raw permission [Identifier
] or an object that references a permission and extends its scope.
Target
One of the following:
"macOS"
MacOS."windows"
Windows."linux"
Linux."android"
Android."iOS"
iOS.
Platform target.
Value
Any of the following:
null
Represents a null JSON value.boolean
Represents a [bool
].Number
Represents a valid ACL [Number
].string
Represents a [String
].Value
[] Represents a list of other [Value
]s.- Represents a map of [
String
] keys to [Value
]s. Allows additional properties:Value
All supported ACL values.
© 2024 Tauri Contributors. CC-BY / MIT