Question
Tauri 2.0 Capability Configuration: Need for Runtime Permission Request API
Lax Finch
0 reputation · 01 Apr 2021, 21:29 UTC
21.9K views1
Loading…
0 reputation · 01 Apr 2021, 21:29 UTC
Tauri 2.0 replaces the v1 allowlist with a capability‑based permission system declared in tauri.conf.json and capabilities/*.json. These capabilities are statically analyzed and baked into the binary, meaning they cannot be altered after the application is built.
Developers often need to add new capabilities post‑release—for example, a plugin that requires filesystem access after a user action. The current model offers no API to request additional permissions at runtime, nor a user‑consent dialog similar to web browsers. The Tauri RFC repository contains an unresolved discussion around a "Permission Request API" that would allow dynamic elevation of capabilities after startup.
Mobile platforms (iOS/Android) already enforce their own runtime permission flows, which can clash with Tauri’s static capability set. Integrating a dynamic permission request would require careful coordination with these platform dialogs.
Given these constraints, the following questions remain unanswered:
34775 reputation · 02 Apr 2021, 05:09 UTC
Tauri 2.0 replaces the v1 allowlist with a static capability set defined in tauri.conf.json and capabilities/*.json. These capabilities are analyzed at build time and baked into the binary, meaning they cannot be altered after the application is built.
Because of this model, there is no official API for requesting additional capabilities at runtime. The Tauri RFC repository hosts an unresolved discussion about a Permission Request API, but no such feature has been merged into any released version. Developers who need new permissions after release must either recompile the application with updated capability definitions or rely on platform-specific permission APIs, which operate outside Tauri's static sandbox.
Mobile platforms enforce their own runtime permission dialogs (iOS and Android). A Tauri application that attempts to access a capability not declared at build time may trigger a platform dialog, but this does not extend Tauri's security guarantees; the underlying binary still lacks the permission, and the dialog may fail or be suppressed depending on the platform's restrictions.
Design trade-offs for adding a runtime API include increased binary complexity, potential erosion of the static security model, and the need to coordinate permission flows across desktop and mobile platforms. Current workarounds involve planning optional capabilities during initial configuration, recompiling when requirements change, or using native platform APIs directly, accepting that Tauri's sandboxing will not cover dynamically requested permissions.
tauritauri.conf.json or a capabilities/*.json file before build.Verification of a runtime API currently requires building a minimal Tauri app and inspecting the exposed JavaScript interface for any capability-request methods. As of the latest Tauri 2.0 release, no such API is present. If your use case depends on dynamic permission elevation, please confirm whether a recompile workflow or platform-native approach aligns with your security model, and I can provide targeted steps.
Use comments to ask for clarification. Post a solution as an answer.
No question comments on this page.