FS permissions dependent on dialog action

[Blatman]

Trying to get fs api permissions to work, after app launch fs actions will fail with permission errors.

Strangely I have found that if an Open file dialog is used to open the target file succeeding fs actions will work. They will continue to work even through app refreshes from the monitored dev folder but if the app is closed and relaunched then an fs read of the target file will only start working again after a dialog action.

What does the dialog action do to negate the permissions problem and why should the fs action not work prior to the dialog action?

app.js -
`
var path = window.TAURI.path;

var fs = window.__TAURI__.fs;

Result of fs init - works OK

[Log] window.TAURI.fs (app.js, line 72)
Object

BaseDirectory: {1: "Audio", 2: "Cache", 3: "Config", 4: "Data", 5: "LocalData", 6: "Document", 7: "Download", 8: "Picture", 9: "Public", 10: "Video", …}
FileHandle: function()
SeekMode: {0: "Start", 1: "Current", 2: "End", Start: 0, Current: 1, End: 2}
copyFile: function()
create: function()
exists: function()
lstat: function()
mkdir: function()
open: function()
readDir: function()
readFile: function()
readTextFile: function()
readTextFileLines: function()
remove: function()
rename: function()
stat: function()
truncate: function()
watch: function()
watchImmediate: function()
writeFile: function()
writeTextFile: function()
Object Prototype

...

`
Do read of file -

var filecontent = await fs.readTextFile('test.txt', { baseDir: fs.BaseDirectory.Desktop });			// should be 	/Users/whatever/Desktop/test.txt	

Result in debug console - [Error] Failed to load resource: the server responded with a status of 400 (Bad Request) (plugin:fs|read_text_file, line 0) ipc://localhost/plugin%3Afs%7Cread_text_file

"forbidden path: /Users/whatever/Desktop/test.txt"  - seemingly baseDir reference above has worked but permissions still not right

Dialog code that allows succeeding fs reads to work - (selected file needs to be the same as succeeding selections)
`
var OpenFile = async () => {
try {
let selected = await dialog.open({
filters: [{
name: 'Image',
extensions: ['txt', 'json']
}]
});
console.log('OpenFile-selected', selected);
var filecontent = await fs.readTextFile(selected.name, {baseDir: fs.BaseDirectory.Desktop}); // Works OK
// var filecontent = await fs.readTextFile('test.txt', {baseDir: fs.BaseDirectory.Desktop}); // Works OK
// V1 var filecontent = await fs.readTextFile(selected);
document.getElementById('output').innerHTML = filecontent;
console.log('File Content --> ', filecontent);
} catch (e) {
console.log('Caught in the Open', e);
}
};

`

As I understand it V2 no longer accepts full/relative paths as V1 did so the file and additional subfolders need to be specified along with the BaseDirectory reference.

Old case: V1 - var filecontent = await fs.readTextFile(selected); where selected was a full path

New case: V2 - var filecontent = await fs.readTextFile('selected.name', { baseDir: fs.BaseDirectory.Desktop });

Tauri Info -

[✔] Environment
- OS: Mac OS 12.7.3 X64
✔ Xcode Command Line Tools: installed
✔ rustc: 1.76.0 (07dca489a 2024-02-04)
✔ cargo: 1.76.0 (c84b36747 2024-01-18)
✔ rustup: 1.26.0 (5af9b9484 2023-04-05)
✔ Rust toolchain: stable-aarch64-apple-darwin (default)
- node: 20.11.1
- npm: 10.2.4

[-] Packages
- tauri [RUST]: 2.0.0-beta.11
- tauri-build [RUST]: 2.0.0-beta.9
- wry [RUST]: 0.37.0
- tao [RUST]: 0.26.1
- @tauri-apps/api [NPM]: 2.0.0-beta.4
- @tauri-apps/cli [NPM]: 2.0.0-beta.9

[-] App
- build-type: bundle
- CSP: unset
- frontendDist: ../src

Plugins are all beta.2 (would be good if plugins were shown in the tauri info report).

tauri.config.json - (old allowLists no longer used - files in capabilities folder now referenced)
`
...

"identifier": "uk.org.wanderinghippo.winmanv2.dev",
"plugins": {
"fs": {
"scope": ["$DOCUMENT", $DOCUMENT/", "$APPDATA", "$APPDATA/", "$DESKTOP", $DESKTOP/**"]
}
},
"build": {

...

},
"app": {
"withGlobalTauri": true,
"macOSPrivateApi": true,
"security": {
"assetProtocol": {
"enable": true,
"scope": {
"allow": ["**"]
}
},
"capabilities": [],
"dangerousDisableAssetCspModification": false,
"freezePrototype": false,
"pattern": {
"use": "brownfield"
}
},
"trayIcon": {

 ...

migrated.json - (automagically processed by Tauri apparently)

{
"identifier": "migrated",
"description": "permissions that were migrated from v1",
"local": true,
"windows": [
"main"
],
"permissions": [
"path:default",
"path:allow-basename",
"path:allow-dirname",
"path:allow-extname",
"path:allow-is-absolute",
"path:allow-join",
"path:allow-normalize",
"path:allow-resolve",
"path:allow-resolve-directory",
"event:default",
"window:default",
"app:default",
"resources:default",
"menu:default",
"tray:default",
"fs:allow-read-file",
"fs:allow-write-file",
"fs:allow-read-dir",
"fs:allow-copy-file",
"fs:allow-mkdir",
"fs:allow-remove",
"fs:allow-remove",
"fs:allow-rename",
"fs:allow-exists",
"fs:read-all",
"fs:write-all",
"window:allow-create",

...

`

[Blatman]

Well these permissions in V2 are brutal - the issue of the bad permissions on launch appears to be the use of template/exe/runtime permissions being allowed (I think these may not apply to MacOS) - works a bit better when they were removed. Now the next issue - the new windows have no content!