Tauri Dev

Communication between processes uses IPC (Inter-Process Communication) via commands and events.

Project Structure Best Practices

my-app/
  src-tauri/
    src/
      lib.rs          # App setup, plugin registration
      main.rs         # Entry point (calls lib)
      commands/        # Command modules
    capabilities/      # Permission definitions (JSON)
    Cargo.toml
    tauri.conf.json    # App configuration
  src/                 # Frontend source
  package.json

• Organize Rust commands into modules by domain (e.g., commands/file_ops.rs, commands/settings.rs)
• Keep lib.rs focused on app builder setup and plugin registration
• Use tauri.conf.json for app metadata, window config, and bundle settings

Command Design

Basic Pattern

#[tauri::command]
fn greet(name: &str) -> String {
    format!("Hello, {}!", name)
}

Error Handling

Always return Result for commands that can fail:

#[derive(Debug, thiserror::Error)]
enum AppError {
    #[error("IO error: {0}")]
    Io(#[from] std::io::Error),
    #[error("Not found: {0}")]
    NotFound(String),
}

impl serde::Serialize for AppError {
    fn serialize<S>(&self, serializer: S) -> Result<S::Ok, S::Error>
    where S: serde::Serializer {
        serializer.serialize_str(self.to_string().as_str())
    }
}

#[tauri::command]
fn read_data(path: String) -> Result<String, AppError> {
    std::fs::read_to_string(&path).map_err(AppError::from)
}

Async Commands

Use async for I/O-bound operations:

#[tauri::command]
async fn fetch_data(url: String) -> Result<String, AppError> {
    let response = reqwest::get(&url).await?.text().await?;
    Ok(response)
}

State Management

Use manage() to share state across commands:

use std::sync::Mutex;
use tauri::State;

struct AppState {
    counter: Mutex<i32>,
}

#[tauri::command]
fn increment(state: State<'_, AppState>) -> i32 {
    let mut counter = state.counter.lock().unwrap();
    *counter += 1;
    *counter
}

// In lib.rs setup:
// app.manage(AppState { counter: Mutex::new(0) });

• Use Mutex<T> for mutable shared state
• Use RwLock<T> when reads greatly outnumber writes
• Keep state structs focused; prefer multiple small states over one large one

IPC Design: Commands vs Events

Security Requirements

Capabilities / ACL (v2)

• Principle of least privilege: Only grant permissions the app actually needs
• Define capabilities in src-tauri/capabilities/*.json
• Each capability specifies allowed commands and scoped permissions
• Default deny: commands are inaccessible unless explicitly permitted

Content Security Policy (CSP)

Configure in tauri.conf.json:

• Restrict script-src, style-src, connect-src to trusted origins
• Never use unsafe-eval in production
• Allow ipc: scheme for Tauri IPC

Input Validation

• Validate all data received from the frontend in Rust commands
• Use strong types (enums, newtypes) instead of raw strings where possible
• Sanitize file paths to prevent directory traversal

Frontend Integration

Register commands in lib.rs: