Plugin Permissions Overview
Relevant source files
The following files were used as context for generating this wiki page:
The Tauri Plugin Centrifugo implements a granular permission system to control access to real-time communication features. By default, all potentially dangerous plugin commands are blocked in the Tauri IPC layer to ensure security. Developers must explicitly enable these permissions within their application's capability configuration to allow the frontend to interact with the Centrifugo server.
The permission system is organized into a default set for standard operations and individual granular permissions for fine-grained control over specific commands like connection management, channel subscriptions, and message publishing.
Sources: README.md:310-315, permissions/schemas/schema.json:1-15
Permission Structure and Types
Permissions in this plugin follow the standard Tauri v2 security model, defining explicit privileges for commands. Each permission can either "allow" or "deny" specific command executions.
Default Permission Set
The plugin provides a default identifier which encapsulates the most common operations required for a functional real-time client. This set allows the frontend to establish connections, manage tokens, and perform basic pub/sub actions.
The following flowchart illustrates how a permission identifier relates to the underlying allowed commands:
Granular Command Permissions
Each individual command implemented in the Rust backend has a corresponding allow and deny permission string. This allows architects to restrict certain windows or webviews to "read-only" modes (e.g., allowing get_subscriptions but denying publish).
| Command | Allow Permission | Deny Permission |
|---|---|---|
connect | centrifugo:allow-connect | centrifugo:deny-connect |
publish | centrifugo:allow-publish | centrifugo:deny-publish |
rpc | centrifugo:allow-rpc | centrifugo:deny-rpc |
add_subscription | centrifugo:allow-add-subscription | centrifugo:deny-add-subscription |
set_token | centrifugo:allow-set-token | centrifugo:deny-set-token |
presence | centrifugo:allow-presence | centrifugo:deny-presence |
Sources: permissions/autogenerated/reference.md:30-150, permissions/schemas/schema.json:200-350
Capability Integration
To use the plugin, the permissions must be mapped to specific application windows via a capability JSON file. This mechanism isolates access to the IPC layer.
Example Configuration
Developers typically enable the default permission set in src-tauri/capabilities/default.json:
{
"identifier": "main-capability",
"permissions": [
"core:default",
"centrifugo:default"
],
"windows": ["main"]
}
Sources: README.md:316-324, examples/tauri-app/src-tauri/gen/schemas/desktop-schema.json:40-60
Permission Resolution Logic
When a command is invoked from the guest-js API, the Tauri core validates the request against the configured capabilities. If a command exists in both an allow and deny set within the same context, it is denied by default.
Technical Implementation Details
The permissions are defined in the plugin's source and generated into a schema that Tauri uses for validation.
Permission File Schema
The schema.json defines how permission sets are grouped. It includes:
- DefaultPermission: Works similarly to an identifier named "default".
- PermissionSet: Groups multiple direct permissions under a new name.
- PermissionKind: An enumeration of all valid permission strings supported by the plugin.
Sources: permissions/schemas/schema.json:30-90
Command Mapping in Rust
The plugin initializes by registering command handlers that are protected by these permission strings. The init function in src/lib.rs maps the internal Rust functions to the strings used in the permission files.
pub fn init<R: Runtime>() -> TauriPlugin<R> {
PluginBuilder::new("centrifugo")
.invoke_handler(tauri::generate_handler![
commands::connect,
commands::publish,
commands::rpc,
// ... other commands
])
.build()
}
Sources: src/lib.rs:94-118
Summary
The Centrifugo plugin's permission system provides a robust security layer by requiring explicit opt-in for all IPC communication. By utilizing the centrifugo:default set, developers can quickly enable full functionality, while the granular allow-* and deny-* permissions offer the precision needed for complex, multi-window security architectures.