Security Model (Capabilities)
Relevant source files
The following files were used as context for generating this wiki page:The Scripty application leverages the Tauri framework's security model, which is built around a system of "capabilities". This model defines a strict boundary between the web-based frontend and the powerful Rust backend, ensuring that the frontend can only access system resources and APIs that are explicitly permitted. Permissions are defined in JSON files and linked to specific application windows or contexts, providing a granular, allow-list approach to security. This prevents untrusted frontend code from performing unauthorized actions.
The core of this model is configured through capability files located in src-tauri/capabilities/ and the main tauri.conf.json file. These files grant permissions for various plugins, such as filesystem access, dialogs, and process execution, which are essential for the application's functionality of managing and running PowerShell scripts.
Global Security Configuration
The primary application configuration in tauri.conf.json includes a security section. In Scripty, the Content-Security-Policy (csp) is explicitly set to null, which disables this browser-level security feature.
// tauri.conf.json:25-28
"security": {
"csp": null
}
Sources: tauri.conf.json:25-28
Capability Definitions
Scripty defines two distinct capability sets, each in its own file, to manage permissions for different contexts.
Default Capability
The default.json capability file defines the primary set of permissions for the application's main window. It is described as the "Capability for the main window" and grants a wide range of permissions required for the application's core features.
This diagram illustrates how the default capability grants a set of permissions to the main window.
The permissions granted are extensive, particularly for the filesystem (fs) plugin.
| Permission Category | Granted Permissions - |
|---|---|
core | default, window:allow-start-dragging, window:allow-close, window:allow-minimize, window:allow-maximize, window:allow-unmaximize - |
opener | default - |
dialog | default - |
updater | default - |
fs | default, allow-app-write, allow-app-write-recursive, and write permissions for nearly all standard directories (appcache, appconfig, appdata, desktop, document, download, etc.), culminating in fs:write-all and fs:write-files. |
| Sources: src-tauri/capabilities/default.json:9-84 |
Desktop Capability
The desktop.json file defines a much more restricted capability set. It is intended for desktop platforms (macOS, windows, linux) and applies to the main window. Its sole purpose is to grant default permissions for the updater plugin, which handles application updates.
// src-tauri/capabilities/desktop.json:1-12
{
"identifier": "desktop-capability",
"platforms": [
"macOS",
"windows",
"linux"
],
"windows": [
"main"
],
"permissions": [
"updater:default"
]
}
Sources: src-tauri/capabilities/desktop.json:1-12
Enabled Plugins and Commands
The permissions granted in the capability files directly correspond to the Tauri plugins enabled in the application's backend.
The following diagram shows which plugins are initialized in the Rust backend, enabling the features that the capability files secure.
Exposed Backend Commands
Beyond the standard plugin APIs, Scripty exposes several custom Rust commands to the frontend. These commands are responsible for executing PowerShell scripts with different privilege levels. The frontend invokes these commands to run the scripts selected by the user.
| Command | Description |
|---|---|
open_terminal | Spawns a powershell process with the provided script content, running as the current user. |
open_admin_terminal | Uses Start-Process with the -Verb RunAs argument to execute a PowerShell script with administrator privileges. |
run_sys_terminal | Executes an embedded syspwsh.exe to run a command as the SYSTEM user. |
read_ps1 | Reads the content of a .ps1 file from a given path on the local filesystem. |
Sources: src-tauri/src/lib.rs:34-61
The following sequence diagram shows the flow when a user decides to run a script with administrator privileges from the UI.
Summary
Scripty's security model is defined by Tauri's capability system, which restricts frontend access to backend functionality. The configuration is split between a permissive default capability for the main window and a minimal desktop capability for the updater. The default capability grants extensive permissions, especially for filesystem write access across numerous user directories. Sensitive operations, such as running scripts with elevated (Admin) or SYSTEM privileges, are encapsulated in custom Rust commands that are explicitly invoked by the frontend, providing a controlled interface for powerful system interactions.