Add tauri:// as a supported origin scheme#11589
Conversation
Co-authored-by: stnguyen90 <[email protected]>
Security Scan Results for PRDocker Image Scan Results
Source Code Scan Results🎉 No vulnerabilities found! |
✨ Benchmark results
⚡ Benchmark Comparison
|
Greptile SummaryThis PR adds Key observations:
Confidence Score: 3/5
Important Files Changed
Last reviewed commit: "feat: add support fo..." |
| self::SCHEME_FIREFOX_EXTENSION => 'Web (Firefox Extension)', | ||
| self::SCHEME_SAFARI_EXTENSION => 'Web (Safari Extension)', | ||
| self::SCHEME_EDGE_EXTENSION => 'Web (Edge Extension)', | ||
| self::SCHEME_TAURI => 'Web (Tauri)', |
There was a problem hiding this comment.
getHostnames() / getSchemes() handling for Tauri
Platform::getNameByScheme() now maps tauri → 'Web (Tauri)', so the validation error message will correctly tell users to "Register … as a new Web (Tauri) platform". However, getHostnames() only adds hostnames for TYPE_WEB and TYPE_FLUTTER_WEB, and getSchemes() has no branch for a Tauri platform type. There is also no TYPE_TAURI constant.
This creates a gap: if the console allows a user to register a "Web (Tauri)" platform entry, the hostname they supply will never appear in $allowedHostnames because getHostnames() won't process it. As a result, tauri://localhost works today only because localhost is already registered under a TYPE_WEB platform — not because a dedicated Tauri entry was registered.
Browser-extension schemes (chrome-extension, moz-extension, etc.) face the same situation, so if that's intentional design and users are expected to register extension IDs / Tauri hostnames as plain TYPE_WEB hostnames, that should be documented. Otherwise, a TYPE_TAURI constant and a matching case in getHostnames() (and potentially getSchemes()) are needed:
// Platform.php
public const TYPE_TAURI = 'tauri';
// In getHostnames():
case self::TYPE_TAURI:
if (!empty($hostname)) {
$hostnames[] = $hostname;
}
break;| $this->assertEquals(true, $validator->isValid('tauri://localhost')); | ||
| $this->assertEquals(false, $validator->isValid('tauri://example.com')); | ||
| $this->assertEquals('Invalid Origin. Register your new client (example.com) as a new Web (Tauri) platform on your project console dashboard', $validator->getDescription()); |
There was a problem hiding this comment.
The HTTP/HTTPS tests include a port variant (http://localhost:80) to verify that Hostname validation still passes when a port is present. There is no equivalent for the tauri:// scheme. Adding one would confirm that parse_url strips the port correctly before hostname comparison, and guard against regressions.
| $this->assertEquals(true, $validator->isValid('tauri://localhost')); | |
| $this->assertEquals(false, $validator->isValid('tauri://example.com')); | |
| $this->assertEquals('Invalid Origin. Register your new client (example.com) as a new Web (Tauri) platform on your project console dashboard', $validator->getDescription()); | |
| $this->assertEquals(true, $validator->isValid('tauri://localhost')); | |
| $this->assertEquals(true, $validator->isValid('tauri://localhost:1420')); | |
| $this->assertEquals(false, $validator->isValid('tauri://example.com')); | |
| $this->assertEquals('Invalid Origin. Register your new client (example.com) as a new Web (Tauri) platform on your project console dashboard', $validator->getDescription()); |
Tauri apps use
tauri://localhostas their origin, which was rejected by Appwrite's origin validator sincetauriwas not a recognized scheme.Changes
Platform.php: AddedSCHEME_TAURI = 'tauri'constant and registered it in the names map as'Web (Tauri)'Origin.php: AddedPlatform::SCHEME_TAURIto the$webPlatformsarray —tauri://origins now go through hostname validation, consistent withhttp://,https://, and browser extension schemesOriginTest.php: Added test cases coveringtauri://localhost(valid) andtauri://example.com(invalid with descriptive error)With these changes,
tauri://localhostis accepted whenlocalhostis registered as an allowed hostname on the project, and unregistered hosts produce the standard error message:💬 Send tasks to Copilot coding agent from Slack and Teams to turn conversations into code. Copilot posts an update in your thread when it's finished.