tauri-apps/tauri · error

invalid permission {p}

Error message

invalid permission {p}

What it means

Panic in the `tauri capability` CLI command. Each --permission string is converted with TryFrom<String> for the ACL Identifier type, which enforces: non-empty, lowercase ASCII alphanumeric/ha hyphen characters, at most one ':' prefix separator (prefix must have a base), no leading/trailing hyphen, no 'tauri-plugin-' start, and a length cap. A string violating those rules aborts capability creation with this panic.

Source

Thrown at crates/tauri-cli/src/acl/capability/new.rs:97

      }
    })
    .unwrap_or_default(),
  };

  let capability = Capability {
    identifier,
    description: description.unwrap_or_default(),
    remote: None,
    local: true,
    windows,
    webviews: Vec::new(),
    permissions: permissions
      .into_iter()
      .map(|p| {
        PermissionEntry::PermissionRef(
          p.clone()
            .try_into()
            .unwrap_or_else(|_| panic!("invalid permission {p}")),
        )
      })
      .collect(),
    platforms: None,
  };

  let path = match options.out {
    Some(o) => o
      .canonicalize()
      .fs_context("failed to canonicalize capability file path", o.clone())?,
    None => {
      let capabilities_dir = dirs.tauri.join("capabilities");
      capabilities_dir.join(format!(
        "{}.{}",
        capability.identifier,
        options.format.extension()
      ))
    }

View on GitHub (pinned to 52e4b6e71d)

Solutions

1. Use canonical lowercase identifiers with a single colon, e.g. `fs:allow-read-text-file`, `core:default`
2. List available permissions to copy exact names: `tauri permission list`
3. Quote each --permission argument in shell scripts so spaces/globs cannot mangle it

Example fix

# before
tauri capability add media --permission 'FS:Read' --permission fs__read  # panic: invalid permission

# after
tauri capability add media --permission 'fs:allow-read-file' --permission 'core:default'

const VALID_PERMISSION = /^[a-z0-9][a-z0-9-]*(:[a-z0-9][a-z0-9-]*)?$/;
function isPermissionId(p) {
  return typeof p === 'string'
    && VALID_PERMISSION.test(p)
    && !p.startsWith('tauri-plugin-')
    && !p.endsWith('-')
    && p.length <= 64;
}
isPermissionId('fs:allow-read-file'); // true
isPermissionId('FS:Read');            // false

When it happens

Trigger: Passing `--permission` values like 'FS:Read' (uppercase), 'fs read' (space), 'fs__read' (underscore), 'core::default' (double separator), 'fs:' (prefix without base), or shell-unquoted arguments that get split.

Common situations: Guessing permission names instead of copying canonical ones; uppercase or camelCase identifiers; scripting the CLI with unquoted args; typos in automation.

Related errors

• permission file not found, please build your application onc
• Permission already exists at {}
• invalid identifier in permission set?
• Couldn't find capabilities directory at {}
• You did not select any capabilities to update

AI-assisted analysis of tauri-apps/tauri@52e4b6e71d (2026-08-20). Data as JSON: /api/errors/532eb272213b08b8. Report an issue: GitHub.