{"record":{"id":"03d550cd61c5dcbb","repo":"tauri-apps/tauri","slug":"invalid-permission-identifier-permission","errorCode":null,"errorMessage":"invalid permission identifier '{permission}'","messagePattern":"invalid permission identifier '(.+?)'","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tauri/src/ipc/capability_builder.rs","lineNumber":95,"sourceCode":"  }\n\n  /// Link this capability to the a list of window labels.\n  pub fn webviews(mut self, webviews: impl IntoIterator<Item = impl Into<String>>) -> Self {\n    self\n      .0\n      .webviews\n      .extend(webviews.into_iter().map(|w| w.into()));\n    self\n  }\n\n  /// Add a new permission to this capability.\n  pub fn permission(mut self, permission: impl Into<String>) -> Self {\n    let permission = permission.into();\n    self.0.permissions.push(PermissionEntry::PermissionRef(\n      permission\n        .clone()\n        .try_into()\n        .unwrap_or_else(|_| panic!(\"invalid permission identifier '{permission}'\")),\n    ));\n    self\n  }\n\n  /// Add a new scoped permission to this capability.\n  pub fn permission_scoped<T: Serialize>(\n    mut self,\n    permission: impl Into<String>,\n    allowed: Vec<T>,\n    denied: Vec<T>,\n  ) -> Self {\n    let permission = permission.into();\n    let identifier = permission\n      .clone()\n      .try_into()\n      .unwrap_or_else(|_| panic!(\"invalid permission identifier '{permission}'\"));\n\n    let allowed_scope = allowed","sourceCodeStart":77,"sourceCodeEnd":113,"githubUrl":"https://github.com/tauri-apps/tauri/blob/460ec35447493200d64290dd7f015d5a91d0fd58/crates/tauri/src/ipc/capability_builder.rs#L77-L113","documentation":"CapabilityBuilder::permission pushes a permission reference into a capability being built. The string is converted into a `PermissionEntry::PermissionRef` identifier via TryFrom; if the string is not a valid permission identifier, the builder panics rather than producing a capability with a malformed permission.","triggerScenarios":"Calling `.permission(\"...\")` with a string that fails the identifier conversion — e.g. empty string, invalid characters, or a name not shaped like `plugin:permission-name` / valid set-name.","commonSituations":"Typo'd permission names in capability DSL code, concatenating identifiers dynamically and producing empty/invalid strings, using bare plugin names without the `plugin:` prefix when required by the identifier grammar.","solutions":["Use a valid permission identifier string (e.g. `\"core:default\"`, `\"fs:allow-read\"`) matching the `plugin-or-core:permission` grammar.","Prefer the manifest-generated constants where available instead of hand-typed strings to avoid typos.","Validate the identifier before building: attempt `permission.try_into()` (the same TryInto used internally) and handle the Err.","For user-supplied permission lists, parse/validate all entries before constructing the CapabilityBuilder."],"exampleFix":"// before\nlet perms = std::env::var(\"PERMS\").unwrap_or_default();\nlet cap = CapabilityBuilder::new(\"main\").permission(perms); // panics on empty string\n// after\nlet perms = std::env::var(\"PERMS\").unwrap_or_default();\nlet mut cap = CapabilityBuilder::new(\"main\");\nfor p in perms.split(',') {\n  if let Ok(id) = p.trim().to_string().try_into() {\n    cap = cap.permission(id);\n  } else {\n    eprintln!(\"skipping invalid permission: {p}\");\n  }\n}","handlingStrategy":"validation","validationCode":"fn is_valid_permission(s: &str) -> bool {\n  !s.is_empty()\n    && s.parse::<tauri::ipc::CapabilityFilePermissionIdentifier>() .is_ok()\n}\n// or generically: let Ok(id) = permission.clone().try_into() else { return Err(...) };","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate permission strings with TryInto before passing to the builder","Use generated permission constants rather than raw strings","Reject empty and un-prefixed entries from user/config input","Check plugin docs for exact permission identifiers per version"],"tags":["rust","tauri","permissions","capability","panic"],"backgroundTag":"invalid-identifier-format","analyzedSha":"460ec35447493200d64290dd7f015d5a91d0fd58","analyzedAt":"2026-09-18T23:55:51.277Z","contentChangedAt":"2026-09-18T23:55:51.277Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}