编译期解析

pub struct Resolved {
  /// If we should check the ACL for the app commands
  pub has_app_acl: bool,
  /// The commands that are allowed. Map each command with its context to a [`ResolvedCommand`].
  pub allowed_commands: BTreeMap<String, Vec<ResolvedCommand>>,
  /// The commands that are denied. Map each command with its context to a [`ResolvedCommand`].
  pub denied_commands: BTreeMap<String, Vec<ResolvedCommand>>,
  /// The store of scopes referenced by a [`ResolvedCommand`].
  pub command_scope: BTreeMap<ScopeKey, ResolvedScope>,
  /// The global scope.
  pub global_scope: BTreeMap<String, ResolvedScope>,
}

          if commands.allow.is_empty() && commands.deny.is_empty() {
            // global scope
            global_scope.entry(key).or_default().push(scope);
          } else {
            let scope_id = if scope.allow.is_some() || scope.deny.is_some() {
              current_scope_id += 1;
              command_scope.insert(
                current_scope_id,
                ResolvedScope {
                  allow: scope.allow.unwrap_or_default(),
                  deny: scope.deny.unwrap_or_default(),
                },
              );
              Some(current_scope_id)
            } else {
              None
            };

            for allowed_command in &commands.allow {
              resolve_command(
                &mut allowed_commands,
                if key == APP_ACL_KEY {
                  allowed_command.to_string()
                } else if let Some(core_plugin_name) = key.strip_prefix("core:") {
                  format!("plugin:{core_plugin_name}|{allowed_command}")
                } else {
                  format!("plugin:{key}|{allowed_command}")
                },
                // ...

    let r = Resolved::resolve(&acl, caps, tauri::utils::platform::Target::current()).unwrap();
    println!("has_app_acl: {}", r.has_app_acl);
    for (name, map) in [("allowed_commands", &r.allowed_commands), ("denied_commands", &r.denied_commands)] {
      println!("{name}:");
      for (cmd, list) in map {
        for c in list {
          #[cfg(debug_assertions)]
          let by = format!(" by {}/{}", c.referenced_by.capability, c.referenced_by.permission);
          #[cfg(not(debug_assertions))]
          let by = String::new();
          println!(
            "  {cmd:<18} {:?} windows={:?} webviews={:?} scope_id={:?}{by}",
            c.context,
            c.windows.iter().map(|p| p.as_str()).collect::<Vec<_>>(),
            c.webviews.iter().map(|p| p.as_str()).collect::<Vec<_>>(),
            c.scope_id
          );
        }
      }
    }
    println!("command_scope: {:?}", r.command_scope);
    println!("global_scope: {:?}", r.global_scope);

    let resolved = Resolved::resolve_with_base_scope_id(
      &self.acl,
      capabilities,
      tauri_utils::platform::Target::current(),
      self.scope_manager.last_scope_id(),
    )
    .unwrap();

    call(&main, "greet", remote, serde_json::json!({ "name": "rie" }));
    app
      .add_capability(
        tauri::ipc::CapabilityBuilder::new("remote-greet")
          .remote("http://127.0.0.1:18970/*".into())
          .local(false)
          .window("main")
          .permission("allow-greet"),
      )
      .unwrap();
    call(&main, "greet", remote, serde_json::json!({ "name": "rie" }));
    call(&main, "greet", "http://127.0.0.1:18971/page.html", serde_json::json!({ "name": "rie" }));

[main @ http://127.0.0.1:18970/page.html] greet -> Err:
    greet not allowed on window "main", webview "main", URL: http://127.0.0.1:18970/page.html
    
    allowed on: [windows: "main", URL: local]
    
    referenced by: capability: main, permission: allow-greet
[main @ http://127.0.0.1:18970/page.html] greet -> Ok("hello, rie")
[main @ http://127.0.0.1:18971/page.html] greet -> Err:
    greet not allowed on window "main", webview "main", URL: http://127.0.0.1:18971/page.html
    
    allowed on: [windows: "main", URL: local], [windows: "main", URL: http://127.0.0.1:18970/*]
    
    referenced by: capability: main, permission: allow-greet || capability: remote-greet, permission: allow-greet

      app.add_capability(
        tauri::ipc::CapabilityBuilder::new("typo").window("main").permission("allow-gret"),
      )

thread 'tests::add_capability_typo' (2609264) panicked at ~/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tauri-2.12.5/src/ipc/authority.rs:180:6:
called `Result::unwrap()` on an `Err` value: UnknownPermission { key: "app manifest", permission: "allow-gret" }

manifests: ["__app-acl__", "core", "core:app", "core:event", "core:image", "core:menu", "core:path", "core:resources", "core:tray", "core:webview", "core:window", "files", "inline", "notes"]
has_app_acl: true
allowed_commands:
  greet              Local windows=["main"] webviews=[] scope_id=None by main/allow-greet
  open_doc           Local windows=["main"] webviews=[] scope_id=Some(1) by main/allow-open-docs
  plugin:files|read  Local windows=["main"] webviews=[] scope_id=Some(2) by main/allow-read-tmp
  plugin:files|read  Local windows=["main"] webviews=[] scope_id=Some(3) by main/allow-read
  plugin:inline|read Local windows=["main"] webviews=[] scope_id=None by main/allow-read
  plugin:notes|read  Local windows=["main"] webviews=[] scope_id=None by main/allow-read
  wipe               Local windows=["main"] webviews=[] scope_id=None by main/allow-wipe
denied_commands:
  wipe               Local windows=["audit"] webviews=[] scope_id=None by audit/deny-wipe
command_scope: {1: ResolvedScope { allow: [Map({"path": String("/docs/*")})], deny: [Map({"path": String("/docs/private/*")})] }, 2: ResolvedScope { allow: [Map({"path": String("/tmp/*")})], deny: [] }, 3: ResolvedScope { allow: [Map({"path": String("/home/*")})], deny: [] }}
global_scope: {"__app-acl__": ResolvedScope { allow: [Map({"path": String("/app/*")})], deny: [] }, "files": ResolvedScope { allow: [], deny: [Map({"path": String("*secret*")})] }, "notes": ResolvedScope { allow: [Map({"path": String("/notes/*")})], deny: [] }}