Struct Builder 

pub struct Builder { /* private fields */ }

Builds the plugin.

Takes a RouterBuilder rather than a finished Router so the base URL can be checked before the router is sealed, which is the only moment that mistake is still visible.

Implementations

impl Builder

pub fn new(router: RouterBuilder) -> Builder

Starts a plugin for router, on the DEFAULT_SCHEME.

pub fn sessions(self, config: SessionConfigBuilder) -> Builder

Available on crate feature session only.

Installs topcoat sessions, carrying the token in this process.

let plugin = tauri_plugin_topcoat::Builder::new(Router::builder())
    .sessions(SessionConfig::builder())
    .build()?;

Why you need this

topcoat’s session token rides a hardened cookie by default, and WebKit throws away every cookie a custom protocol sets. Your login would look like it worked and the next request would arrive anonymous. This swaps the transport and nothing else - minting, hashing, expiry, start and stop and rotate, and your own session storage all stay topcoat’s.

The token is held here, keyed by the webview that asked, and never crosses into the webview at all. Not document.cookie, not a header a script can read, not anything WebKit writes to disk. A browser has to hand a client its token because the server is somewhere else. Here it is the same process, and Tauri tells you which webview asked.

What it costs

The token is ambient with respect to the webview, so whatever document that webview is showing can use it. Confinement is what defends that, so leaving allow_external_navigation off matters more once sessions are on. A webview seen on somebody else’s origin stops being handed the token either way.

Confinement governs navigation, not sub-resources: a document of yours embedding a foreign frame still shows your origin, so the token is still handed out, and what stops that frame spending it is topcoat’s origin check. Serve a Content-Security-Policy if you would rather it could not load.

Reach for this rather than topcoat’s own sessions, which keeps whatever token store the configuration carries - the cookie one, with topcoat’s cookie feature on, whose every sign-in answers 502.

Panics

Never directly. Call this twice and the second store replaces the first, taking the first one’s tokens with it.

pub fn scheme(self, scheme: impl Into<String>) -> Builder

Serves the application under a different scheme name.

The window’s URL must match: <scheme>://localhost/.

pub const fn use_https_scheme(self, https: bool) -> Builder

Overrides WebviewWindowBuilder::use_https_scheme, which changes the URL shape on the platforms that rewrite custom schemes onto http.

Left alone, the plugin reads the same useHttpsScheme the webview does out of the application configuration, so there is no second place to keep in step. Set this only for a webview built in code with a setting the configuration does not carry.

pub const fn allow_external_navigation(self, allow: bool) -> Builder

Lets a webview showing this application navigate to another origin.

Off by default. A desktop application usually wants an external link opened in the user’s browser rather than replacing its own UI, and a webview that cannot reach another origin cannot host content that would try to forge requests against this one.

pub fn build<R: Runtime>(self) -> Result<TauriPlugin<R>, Error>

Builds the plugin.

Errors

Error::Scheme if the scheme name is unusable, and Error::BaseUrlCollision if the router’s base URL is the origin this protocol serves.

pub fn session(self, platform: Platform) -> Result<Session, Error>

Drives the same application without a window, as platform would.

Everything configured here applies, sessions included, so a test exercises the transport the application actually runs on. Naming the platform lets a test check a request the way Windows delivers it while running on macOS.

Errors

The same as Builder::build.

Trait Implementations

impl Debug for Builder

fn fmt(&self, f: &mut Formatter<'_>) -> Result

The router is the bulk of the value and has no Debug of its own, so what is shown is the configuration a reader would be checking.