feat(core): add capability devOnly field

a dev environment might need particular scope configurations (such as allowing a localhost API). This change allows marking a whole capability file as "dev only"

.changes/capability-dev-only.md

@@ -0,0 +1,7 @@
+---
+"tauri-utils": minor:feat
+"tauri-codegen": minor:feat
+"tauri": minor:feat
+---
+
+Added `devOnly` option to the capability that lets you define a capability only for development - for instance to allow local APIs in scopes.

.changes/tauri-runtime-wry-optional.md

@@ -0,0 +1,5 @@
+---
+tauri: patch:bug
+---
+
+Make `tauri-runtime-wry` optional even with features like `macos-private-api`

.github/workflows/publish-cli-js.yml

@@ -44,7 +44,7 @@ jobs:
             architecture: x64
             target: aarch64-pc-windows-msvc
             build: pnpm build --target aarch64-pc-windows-msvc
-          - host: ubuntu-20.04
+          - host: ubuntu-22.04
             target: x86_64-unknown-linux-gnu
             docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:lts-debian
             build: |
@@ -52,7 +52,7 @@ jobs:
               cd packages/cli
               pnpm build --target x86_64-unknown-linux-gnu
               strip *.node
-          - host: ubuntu-20.04
+          - host: ubuntu-22.04
             target: x86_64-unknown-linux-musl
             docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:lts-alpine
             build: |
@@ -64,7 +64,7 @@ jobs:
             build: |
               pnpm build --features native-tls-vendored --target=aarch64-apple-darwin
               strip -x *.node
-          - host: ubuntu-20.04
+          - host: ubuntu-22.04
             target: aarch64-unknown-linux-gnu
             docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:lts-debian-aarch64
             build: |
@@ -72,7 +72,7 @@ jobs:
               cd packages/cli
               pnpm build --target aarch64-unknown-linux-gnu
               aarch64-unknown-linux-gnu-strip *.node
-          - host: ubuntu-20.04
+          - host: ubuntu-22.04
             architecture: x64
             target: armv7-unknown-linux-gnueabihf
             setup: |
@@ -81,7 +81,7 @@ jobs:
             build: |
               pnpm build --target=armv7-unknown-linux-gnueabihf
               arm-linux-gnueabihf-strip *.node
-          - host: ubuntu-20.04
+          - host: ubuntu-22.04
             architecture: x64
             target: aarch64-unknown-linux-musl
             docker: ghcr.io/napi-rs/napi-rs/nodejs-rust:lts-alpine
@@ -319,7 +319,6 @@ jobs:
           - '20'
         image:
           - ghcr.io/napi-rs/napi-rs/nodejs:aarch64-16
-          - ghcr.io/napi-rs/napi-rs/nodejs:armhf-16
     runs-on: ubuntu-latest
     steps:
       - run: docker run --rm --privileged multiarch/qemu-user-static:register --reset

.github/workflows/publish-cli-rs.yml

@@ -18,7 +18,7 @@ jobs:
       fail-fast: false
       matrix:
         config:
-          - os: ubuntu-20.04
+          - os: ubuntu-22.04
             rust_target: x86_64-unknown-linux-gnu
             ext: ''
             args: ''

crates/tauri-cli/config.schema.json

@@ -1409,6 +1409,10 @@
           "items": {
             "$ref": "#/definitions/Target"
           }
+        },
+        "devOnly": {
+          "description": "Whether this capability is only applied on dev or not.",
+          "type": "boolean"
         }
       }
     },

crates/tauri-cli/src/acl/capability/new.rs

@@ -103,6 +103,7 @@ pub fn command(options: Options) -> Result<()> {
       })
       .collect(),
     platforms: None,
+    dev_only: false,
   };
 
   let path = match options.out {

crates/tauri-cli/src/migrate/migrations/v1/config.rs

@@ -46,6 +46,7 @@ pub fn migrate(tauri_dir: &Path) -> Result<MigratedConfig> {
         webviews: vec![],
         permissions,
         platforms: None,
+        dev_only: false,
       })?,
     )?;
 

crates/tauri-codegen/src/context.rs

@@ -398,7 +398,10 @@ pub fn context_codegen(data: ContextData) -> EmbeddedAssetsResult<TokenStream> {
     Some(&capabilities_file_path),
     additional_capabilities.as_deref(),
   )
-  .unwrap();
+  .unwrap()
+  .into_iter()
+  .filter(|(_key, capability)| !capability.dev_only || dev)
+  .collect();
 
   let resolved = Resolved::resolve(&acl, capabilities, target).expect("failed to resolve ACL");
 

crates/tauri-schema-generator/schemas/capability.schema.json

@@ -64,6 +64,10 @@
       "items": {
         "$ref": "#/definitions/Target"
       }
+    },
+    "devOnly": {
+      "description": "Whether this capability is only applied on dev or not.",
+      "type": "boolean"
     }
   },
   "definitions": {

crates/tauri-schema-generator/schemas/config.schema.json

@@ -1409,6 +1409,10 @@
           "items": {
             "$ref": "#/definitions/Target"
           }
+        },
+        "devOnly": {
+          "description": "Whether this capability is only applied on dev or not.",
+          "type": "boolean"
         }
       }
     },

crates/tauri-utils/src/acl/capability.rs

@@ -202,6 +202,18 @@ pub struct Capability {
   /// `["macOS","windows"]`
   #[serde(skip_serializing_if = "Option::is_none")]
   pub platforms: Option<Vec<Target>>,
+  /// Whether this capability is only applied on dev or not.
+  #[serde(
+    default,
+    skip_serializing_if = "is_false",
+    rename = "devOnly",
+    alias = "dev-only"
+  )]
+  pub dev_only: bool,
+}
+
+fn is_false(f: &bool) -> bool {
+  !f
 }
 
 impl Capability {
@@ -431,6 +443,7 @@ mod tests {
       webviews: vec![],
       permissions: vec![],
       platforms: None,
+      dev_only: false,
     };
     let capability_json = serde_json::to_string(&capability).unwrap();
 

crates/tauri/Cargo.toml

@@ -181,13 +181,13 @@ objc2-web-kit = { version = "0.3", features = [
 
 [features]
 default = ["wry", "compression", "common-controls-v6"]
-unstable = ["tauri-runtime-wry/unstable"]
+unstable = ["tauri-runtime-wry?/unstable"]
 common-controls-v6 = [
   "tray-icon?/common-controls-v6",
   "muda/common-controls-v6",
 ]
 tray-icon = ["dep:tray-icon"]
-tracing = ["dep:tracing", "tauri-macros/tracing", "tauri-runtime-wry/tracing"]
+tracing = ["dep:tracing", "tauri-macros/tracing", "tauri-runtime-wry?/tracing"]
 test = []
 compression = ["tauri-macros/compression", "tauri-utils/compression"]
 wry = ["webview2-com", "webkit2gtk", "tauri-runtime-wry"]
@@ -201,13 +201,13 @@ custom-protocol = ["tauri-macros/custom-protocol"]
 native-tls = ["reqwest/native-tls"]
 native-tls-vendored = ["reqwest/native-tls-vendored"]
 rustls-tls = ["reqwest/rustls-tls"]
-devtools = ["tauri-runtime/devtools", "tauri-runtime-wry/devtools"]
+devtools = ["tauri-runtime/devtools", "tauri-runtime-wry?/devtools"]
 process-relaunch-dangerous-allow-symlink-macos = [
   "tauri-utils/process-relaunch-dangerous-allow-symlink-macos",
 ]
 macos-private-api = [
   "tauri-runtime/macos-private-api",
-  "tauri-runtime-wry/macos-private-api",
+  "tauri-runtime-wry?/macos-private-api",
 ]
 webview-data-url = ["data-url"]
 protocol-asset = ["http-range"]
@@ -215,7 +215,7 @@ config-json5 = ["tauri-macros/config-json5"]
 config-toml = ["tauri-macros/config-toml"]
 image-ico = ["image/ico"]
 image-png = ["image/png"]
-macos-proxy = ["tauri-runtime-wry/macos-proxy"]
+macos-proxy = ["tauri-runtime-wry?/macos-proxy"]
 specta = ["dep:specta"]
 
 [[example]]

crates/tauri/src/ipc/authority.rs

@@ -95,6 +95,7 @@ impl CapabilityBuilder {
       webviews: Vec::new(),
       permissions: Vec::new(),
       platforms: None,
+      dev_only: false,
     })
   }