Fix Android plugin IPC blocked by Tauri ACL system

plugin:name|command IPC from JavaScript is checked against Tauri's ACL
(deny-by-default). Custom inline plugins have no defined permissions, so
all commands are blocked — causing "Plugin not found" errors even after
register_android_plugin succeeds.

Add commands/android.rs with pick_file_to_open and
take_persistable_uri_permission as regular Tauri commands registered via
invoke_handler!. These use PluginHandle::run_mobile_plugin_async which
goes through JNI directly, bypassing the ACL entirely. Store the plugin
handles in app state from the plugin setup callbacks.

Update commands.ts to call invoke('pick_file_to_open') and
invoke('take_persistable_uri_permission') instead of the blocked
plugin:filePicker|openFile and plugin:uriPermission|takePersistablePermission
IPC paths.

https://claude.ai/code/session_01J39pMh3ZymXAf9W5K3Ziyi

Author: claude

src-tauri/src/commands/android.rs

@@ -0,0 +1,87 @@
+// Copyright 2024 AppThere
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+//! Android bridge commands for file picking and URI permission persistence.
+//!
+//! JavaScript cannot call `plugin:name|command` IPC directly because Tauri's
+//! ACL system denies unknown plugins by default. These regular Tauri commands
+//! (registered via `invoke_handler!`) use `PluginHandle::run_mobile_plugin_async`
+//! which goes through JNI directly, bypassing the ACL entirely.
+
+use tauri::Runtime;
+
+/// State holder for the FilePickerPlugin handle (Android only).
+pub struct FilePickerHandle<R: Runtime>(pub tauri::plugin::PluginHandle<R>);
+
+/// State holder for the UriPermissionPlugin handle (Android only).
+pub struct UriPermissionHandle<R: Runtime>(pub tauri::plugin::PluginHandle<R>);
+
+#[derive(serde::Deserialize)]
+struct FilePickerResult {
+    uri: String,
+}
+
+#[derive(serde::Serialize)]
+struct TakePersistableArgs {
+    uri: String,
+}
+
+/// Open a file picker using ACTION_OPEN_DOCUMENT (Android).
+///
+/// Returns the selected `content://` URI as a string. Permissions are
+/// persisted inside the Kotlin activity result callback so the file can
+/// be reopened from Recents after the app process is killed.
+#[cfg(target_os = "android")]
+#[tauri::command]
+pub async fn pick_file_to_open(
+    state: tauri::State<'_, FilePickerHandle<tauri::Wry>>,
+) -> Result<String, String> {
+    state
+        .0
+        .run_mobile_plugin_async::<FilePickerResult>("openFile", ())
+        .await
+        .map(|r| r.uri)
+        .map_err(|e| e.to_string())
+}
+
+/// No-op on non-Android platforms; the desktop file dialog is used instead.
+#[cfg(not(target_os = "android"))]
+#[tauri::command]
+pub async fn pick_file_to_open() -> Result<String, String> {
+    Err("pick_file_to_open is only available on Android".to_string())
+}
+
+/// Persist a `content://` URI permission across app restarts (Android).
+///
+/// Must be called while the temporary SAF grant is still active (i.e. during
+/// the same session in which the URI was obtained from a file picker).
+#[cfg(target_os = "android")]
+#[tauri::command]
+pub async fn take_persistable_uri_permission(
+    uri: String,
+    state: tauri::State<'_, UriPermissionHandle<tauri::Wry>>,
+) -> Result<(), String> {
+    state
+        .0
+        .run_mobile_plugin_async::<()>("takePersistablePermission", TakePersistableArgs { uri })
+        .await
+        .map_err(|e| e.to_string())
+}
+
+/// No-op on non-Android platforms.
+#[cfg(not(target_os = "android"))]
+#[tauri::command]
+pub async fn take_persistable_uri_permission(_uri: String) -> Result<(), String> {
+    Ok(())
+}

src-tauri/src/commands/mod.rs

@@ -1,3 +1,4 @@
+pub mod android;
 pub mod export;
 pub mod fs;
 pub mod locale;

src-tauri/src/lib.rs

@@ -1,6 +1,8 @@
 mod commands;
 mod fonts;
 
+use commands::android::{FilePickerHandle, UriPermissionHandle};
+
 #[cfg_attr(mobile, tauri::mobile_entry_point)]
 pub fn run() {
     eprintln!("DEBUG: run() starting");
@@ -11,18 +13,26 @@ pub fn run() {
         .plugin(tauri_plugin_opener::init())
         .plugin(
             tauri::plugin::Builder::<_, ()>::new("uriPermission")
-                .setup(|_app, api| {
+                .setup(|app, api| {
                     #[cfg(target_os = "android")]
-                    api.register_android_plugin("com.appthere.loki", "UriPermissionPlugin")?;
+                    {
+                        let handle = api
+                            .register_android_plugin("com.appthere.loki", "UriPermissionPlugin")?;
+                        app.manage(UriPermissionHandle(handle));
+                    }
                     Ok(())
                 })
                 .build(),
         )
         .plugin(
             tauri::plugin::Builder::<_, ()>::new("filePicker")
-                .setup(|_app, api| {
+                .setup(|app, api| {
                     #[cfg(target_os = "android")]
-                    api.register_android_plugin("com.appthere.loki", "FilePickerPlugin")?;
+                    {
+                        let handle =
+                            api.register_android_plugin("com.appthere.loki", "FilePickerPlugin")?;
+                        app.manage(FilePickerHandle(handle));
+                    }
                     Ok(())
                 })
                 .build(),
@@ -153,7 +163,9 @@ pub fn run() {
             commands::pdf::validate_pdf_x_conformance,
             commands::pdf::export_pdf_x,
             commands::pdf::validate_text_pdf_x_conformance,
-            commands::pdf::export_text_pdf_x
+            commands::pdf::export_text_pdf_x,
+            commands::android::pick_file_to_open,
+            commands::android::take_persistable_uri_permission
         ])
         .run(tauri::generate_context!())
         .expect("error while running tauri application");

src/lib/tauri/commands.ts

@@ -4,33 +4,27 @@ import type { StyleDefinition, Metadata, LexicalDocumentData } from '../types/od
 /**
  * Android only: persist a content:// URI permission across app restarts.
  *
- * After the user picks a file through the SAF file picker, Android grants a
- * temporary permission for that URI. Calling this command calls
- * `ContentResolver.takePersistableUriPermission()` so the app can still read
- * (and write) the file in future sessions — fixing the Recents open-after-
- * restart permission error.
- *
- * The UriPermissionPlugin is registered on the Rust side (lib.rs) so this IPC
- * call is properly routed. On non-Android platforms this will reject; callers
- * must swallow the error.
+ * Routes through a regular Rust command (`take_persistable_uri_permission`)
+ * which calls `PluginHandle::run_mobile_plugin_async` via JNI — bypassing the
+ * Tauri ACL system that blocks direct `plugin:name|command` IPC from JS.
+ * No-ops on desktop.
  */
 export async function takePersistableUriPermission(uri: string): Promise<void> {
-    await invoke('plugin:uriPermission|takePersistablePermission', { uri });
+    await invoke('take_persistable_uri_permission', { uri });
 }
 
-
 /**
  * Android only: open a file using ACTION_OPEN_DOCUMENT, which grants a
  * persistable content:// URI permission so the file can be reopened from
  * the Recents list after the app process is killed.
  *
- * Returns the selected content:// URI string, or rejects with "cancelled"
- * if the user dismissed the picker. Must not be called on desktop (the
- * plugin is only registered for Android).
+ * Routes through a regular Rust command (`pick_file_to_open`) which calls
+ * `PluginHandle::run_mobile_plugin_async` via JNI — bypassing the Tauri ACL
+ * system that blocks direct `plugin:name|command` IPC from JS.
+ * Returns the selected content:// URI string, or rejects with "cancelled".
  */
 export async function openFilePicker(): Promise<string> {
-    const result = await invoke<{ uri: string }>('plugin:filePicker|openFile');
-    return result.uri;
+    return invoke<string>('pick_file_to_open');
 }
 
 /** Response from `open_document`: native Lexical editor state + styles + metadata. */