[bug] [macOs] Tauri updater fails with "Tauri API error: Permission Denied (os error 13)" for standard (non-admin) users

[0rvar]

Describe the bug

The built in Tauri updater (and the official updater plugin for v2) fails with a cryptic error message for "Standard" users, meaning users that are not administrators on their Mac.

Reproduction

https://github.com/tauri-apps/tauri/assets/1098408/b7a447d8-214d-4c28-bc90-168bddf34a50

1. Create and login to a standard user on mac (not an administrator user).
2. Download the next-newest version from https://github.com/spacedriveapp/spacedrive/releases (or any other popular tauri app)
3. Install the app to /Applications, type in an administrator username and password when prompted by the OS
4. Run the app and accept the update prompt
5. Updater fails with "Tauri API error: Permission Denied (os error 13)"

Expected behavior

The scenario should be a first-class citizen, first of all - less cryptic error message, documented.

I have a working, semi tested version of the updater function for mac (#[cfg(target_os = "macos")] fn copy_files_and_run) here: https://github.com/0rvar/tauri/commit/7c740516efaa4ff8b14b27c31d3c9a2cf54e21ed

Let me know if I should create a signed PR with this approach.

It prompts for elevated privileges if needed using Applescript. There are other approaches as well:

• Using security_AuthorizationExecuteWithPrivileges, but this has been deprecated for a very long time
• Using SMJobless. No idea how that works

Platform and versions

Mac, any version

[Caleb-T-Owens]

Hi! I've encountered this issue same too. It would be great to know if there has been any movement on this 👍

[kurdin]

@Caleb-T-Owens I hit the same wall, trying to figure out what to do in case of this error. Did you find any solutions ?

[jamesfebin]

Facing the same issue, help is appreciated.

[kurdin]

@jamesfebin

Facing the same issue, help is appreciated.

I could not find any good automatic solution without hacking/patching the Tauri source code, so here is what I did:

On the frontend, I check for permission errors on update, and if any, I show a notification banner to the user with a message that the update needs to be downloaded and installed manually with a user that has correct (admin) permissions.

Here is my frontend code for checking for the error :

try {
      await checkUpdate();
      await installUpdate();
      get().setIsFirstRunAfterUpdate(true);
      if (availableVersionNumber.value) {
        get().setAppLastUpdateVersion(availableVersionNumber.value);
      }
      if (availableVersionDateISO.value) {
        get().setAppLastUpdateDate(availableVersionDateISO.value);
      }
      setTimeout(() => {
        relaunch();
      }, 600);
    } catch (e) {
      console.error('Install Update Error:', e);
      const { message } = e as Error;
      if (
        message?.toLowerCase().includes('permission') ||
        message?.toLowerCase().includes('denied')
      ) {
        showUpdateErrorPermissionDenied.value = true;
      }
      showUpdateInstalling.value = false;
      showUpdateError.value = true;
    }
  }

In the notification, I have a button with a Download command to the Tauri backend. When the user clicks on the button, Rust will download the file from my server and open it up. I ask the user to quit the app and finish the installation/update. It works fairly well on Mac and Windows, and it is easy to follow the on-screen instructions for average users. Here is my Rust code, if you need an example, for downloading the installer file to a temp folder and opening it: https://github.com/PasteBar/PasteBarApp/blob/main/src-tauri/src/commands/download_update.rs

[jamesfebin]

@kurdin, thank you for the response; I ended up implementing something similar after struggling for a while. But, I was worried about the user experience. But now, since you have done something similar, it gives me confidence that it will work.

Thank you.

[thewh1teagle]

I experience the same issue on v2 project. Relevant issue: https://github.com/thewh1teagle/vibe/issues/161

[jLynx]

Just posting that we are running into the same issue here. Works fine on non locked down macs, but if they are locked down we have the same issue.

[jLynx]

Idea for a potential fix here: https://github.com/tauri-apps/tauri/issues/8372

[jaydevelopsstuff]

Has this been fixed in v2's updater plugin? If not, are there any plans to fix it soon?