feat(acl): automatically remove outdated autogenerated permission files

Author: Devendra

.changes/cleanup-autogenerated-permissions.md

@@ -0,0 +1,6 @@
+---
+'tauri-utils': 'patch'
+'tauri-cli': 'patch'
+---
+
+Automatically remove outdated autogenerated permission files.

FETCH_HEAD

@@ -5,7 +5,7 @@
 //! ACL items that are only useful inside of build script/codegen context.
 
 use std::{
-  collections::{BTreeMap, HashMap, HashSet},
+  collections::{BTreeMap, HashMap},
   env, fs,
   path::{Path, PathBuf},
 };
@@ -205,15 +205,15 @@ pub fn parse_capabilities(pattern: &str) -> Result<BTreeMap<String, Capability>,
   let mut capabilities_map = BTreeMap::new();
 
   for path in glob::glob(pattern)?
-    .flatten()
-    // filter extension
+    .flatten() // filter extension
     .filter(|p| {
       p.extension()
         .and_then(|e| e.to_str())
         .map(|e| CAPABILITY_FILE_EXTENSIONS.contains(&e))
         .unwrap_or_default()
     })
     // filter schema files
+    // TODO: remove this before stable
     .filter(|p| p.parent().unwrap().file_name().unwrap() != CAPABILITIES_SCHEMA_FOLDER_NAME)
   {
     match CapabilityFile::load(&path)? {
@@ -244,15 +244,13 @@ pub fn parse_capabilities(pattern: &str) -> Result<BTreeMap<String, Capability>,
 }
 
 /// Permissions that are generated from commands using [`autogenerate_command_permissions`].
-/// Autogenerated permission sets (allow + deny)
 pub struct AutogeneratedPermissions {
-    /// List of automatically allowed commands
-    pub allowed: Vec<String>,
-    /// List of automatically denied commands
-    pub denied: Vec<String>,
+  /// The allow permissions generated from commands.
+  pub allowed: Vec<String>,
+  /// The deny permissions generated from commands.
+  pub denied: Vec<String>,
 }
 
-
 /// Autogenerate permission files for a list of commands.
 pub fn autogenerate_command_permissions(
   path: &Path,
@@ -272,7 +270,6 @@ pub fn autogenerate_command_permissions(
       .collect::<PathBuf>()
       .join(PERMISSION_SCHEMAS_FOLDER_NAME)
       .join(PERMISSION_SCHEMA_FILE_NAME);
-
     format!(
       "\n\"$schema\" = \"{}\"\n",
       dunce::simplified(&schema_path)
@@ -289,15 +286,15 @@ pub fn autogenerate_command_permissions(
     denied: Vec::new(),
   };
 
-  // -------------------------------------------------
-  // Generate permission files
-  // -------------------------------------------------
+  let mut generated_files = Vec::new();
+
   for command in commands {
     let slugified_command = command.replace('_', "-");
 
     let toml = format!(
       r###"{license_header}# Automatically generated - DO NOT EDIT!
 {schema_entry}
+
 [[permission]]
 identifier = "allow-{slugified_command}"
 description = "Enables the {command} command without any pre-configured scope."
@@ -314,6 +311,8 @@ commands.deny = ["{command}"]
     write_if_changed(&out_path, toml)
       .unwrap_or_else(|_| panic!("unable to autogenerate {out_path:?}"));
 
+    generated_files.push(out_path);
+
     autogenerated
       .allowed
       .push(format!("allow-{slugified_command}"));
@@ -322,20 +321,18 @@ commands.deny = ["{command}"]
       .push(format!("deny-{slugified_command}"));
   }
 
-  // -------------------------------------------------
-  // 🔥 CLEANUP BLOCK (final version)
-  // -------------------------------------------------
-  let expected: HashSet<String> = commands.iter().map(|cmd| format!("{}.toml", cmd)).collect();
+  use std::collections::HashSet;
+
+  let expected_files: HashSet<PathBuf> = generated_files.into_iter().collect();
 
   if let Ok(entries) = fs::read_dir(path) {
     for entry in entries.flatten() {
-      if entry.file_type().map(|ft| ft.is_file()).unwrap_or(false) {
-        let name = entry.file_name().to_string_lossy().to_string();
+      if let Ok(file_type) = entry.file_type() {
+        if file_type.is_file() {
+          let file_path = entry.path();
 
-        if !expected.contains(&name) {
-          let p = entry.path();
-          if let Err(e) = fs::remove_file(&p) {
-            eprintln!("[cleanup] Failed to remove outdated file {:?}: {}", p, e);
+          if !expected_files.contains(&file_path) {
+            let _ = fs::remove_file(&file_path);
           }
         }
       }
@@ -408,6 +405,10 @@ pub fn generate_docs(
   Ok(())
 }
 
+// TODO: We have way too many duplicated code around getting the config files, e.g.
+//  - crates/tauri-codegen/src/lib.rs          (`get_config`)
+//  - crates/tauri-build/src/lib.rs            (`try_build`)
+//  - crates/tauri-cli/src/helpers/config.rs   (`get_internal`)
 /// Generate allowed commands file for the `generate_handler` macro to remove never allowed commands
 pub fn generate_allowed_commands(
   out_dir: &Path,
@@ -428,9 +429,12 @@ pub fn generate_allowed_commands(
     return Ok(());
   }
 
+  // It's safe to `unwrap` here since we have checked if the result is ok above
   let config_directory = PathBuf::from(remove_unused_commands_env_var.unwrap());
   let capabilities_path = config_directory.join("capabilities");
-
+  // Cargo re-builds if the variable points to an empty path,
+  // so we check for exists here
+  // see https://github.com/rust-lang/cargo/issues/4213
   if capabilities_path.exists() {
     println!("cargo:rerun-if-changed={}", capabilities_path.display());
   }
@@ -450,11 +454,13 @@ pub fn generate_allowed_commands(
 
   println!("cargo:rerun-if-env-changed=TAURI_CONFIG");
 
+  // Set working directory to where `tauri.config.json` is, so that relative paths in it are parsed correctly.
   let old_cwd = std::env::current_dir()?;
-  std::env::set_current_dir(&config_directory)?;
+  std::env::set_current_dir(config_directory)?;
 
   let config: Config = serde_json::from_value(config)?;
 
+  // Reset working directory.
   std::env::set_current_dir(old_cwd)?;
 
   let acl: BTreeMap<String, crate::acl::manifest::Manifest> = permissions_map
@@ -477,18 +483,15 @@ pub fn generate_allowed_commands(
       glob::Pattern::escape(&capabilities_path.to_string_lossy())
     ))?
   };
-
   let capabilities = crate::acl::get_capabilities(&config, capabilities_from_files, None)?;
 
   let permission_entries = capabilities
     .into_iter()
     .flat_map(|(_, capabilities)| capabilities.permissions);
-
   let mut allowed_commands = AllowedCommands {
     has_app_acl: has_app_manifest(&acl),
     ..Default::default()
   };
-
   for permission_entry in permission_entries {
     let Ok(permissions) =
       crate::acl::resolved::get_permissions(permission_entry.identifier(), &acl)

crates/tauri-utils/src/acl/build.rs

@@ -25,6 +25,7 @@
     "example:api:dev": "pnpm run --filter \"api\" tauri dev"
   },
   "devDependencies": {
+    "@changesets/cli": "^2.29.7",
     "prettier": "^3.6.2"
   },
   "minimumReleaseAge": 4320,