configuring-tauri-scopes

Define filesystem scopes in capability files at src-tauri/capabilities/default.json using the fs:scope or command-specific identifiers like fs:allow-read-text-file. Add allow and deny arrays with path patterns using variables like $APPDATA and glob syntax such as $DOCUMENT/**.

Deny rules always take precedence over allow rules in Tauri scopes. When both exist for a permission, any path matching a deny pattern is blocked even if it also matches an allow pattern, which is useful for excluding sensitive subdirectories.

Yes, use the FsExt trait from tauri_plugin_fs in Rust to call fs_scope().allow_directory() or allow_file() at runtime. Always validate that paths exist and never expand scope based on unvalidated user input.

This error means the requested path falls outside your capability's allow list or matches a deny rule. Check path variable spelling, verify glob patterns match the target paths, and confirm no deny rule is blocking the location.

Tauri provides runtime-injected variables including $APPDATA, $APPCONFIG, $DOCUMENT, $HOME, $DOWNLOAD, $RESOURCE, and $TEMP among others. These map to platform-specific directories and are preferred over hardcoded paths for portability.