How to Implement Dynamic Permissions

[SpuerMomonga]

I am implementing an extension system that loads code remotely into a webview for execution. How can I implement a dynamic permission system to match the different permission requirements of various extensions? The existing permission system is static.

[augustocesarperin]

For extensions that need different permissions, run each one in its own webview with the minimum capabilities it needs. If it later needs more, show a consent prompt and relaunch that webview with {previous + new} capabilities. Keep small bundles in src-tauri/capabilities/ (e.g., read-only to the extension’s folder or HTTP to specific hosts), and store approvals per extension so you only prompt again for new permissions. Capabilities are set at webview creation, so relaunching is how you go "dynamic"

[SpuerMomonga]

Thank you for your reply. I have found a solution to dynamically set permissions. I want to implement a functionality where, for example, the user needs to be asked for permission when the extension tries to modify a file, and the access can only proceed if the user agrees. However, currently, if the extension fails to obtain the permission, it will directly throw an error, and there is no good way to distinguish between an error caused by failed permission verification and an error caused by file modification issues. What if we add a step to request permission and ask the user for confirmation on top of the existing process?

app.add_capability(
    CapabilityBuilder::new("fs-test")
        .window("main")
        .permission("fs:default")
        .permission_scoped("fs:default", vec!["**/*"], vec![]),
)

[WSH032]

You can use Manager::add_capability

[SpuerMomonga]

Thank you for your reply. Is it possible to grant permissions to the window first and then revoke them?

#[tauri::command(async)]
async fn add_permission<R: Runtime>(app: tauri::AppHandle<R>) -> Result<(), String> {
    app.add_capability(
        CapabilityBuilder::new("fs-test")
            .window("main")
            .permission("fs:default")
            .permission_scoped("fs:default", vec!["**/*"], vec![]),
    )
    .map_err(|e| e.to_string())
}

#[tauri::command(async)]
async fn revoke_permission<R: Runtime>(app: tauri::AppHandle<R>) -> Result<(), String> {
    app.add_capability(
        CapabilityBuilder::new("fs-test")
            .window("main")
            .permission("fs:deny-read")
            .permission_scoped("fs:deny-read", vec!["$APPDATA"], vec![]),
    )
    .map_err(|e| e.to_string())
}

Like the above code.