# dkackman/tauri-plugin-secure-element architecture

> Architecture diagram of the GitHub repository dkackman/tauri-plugin-secure-element, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-29). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/dkackman/tauri-plugin-secure-element
- Repository: https://github.com/dkackman/tauri-plugin-secure-element

## Overview

Tauri Plugin Secure Element exposes a cross-platform API for generating, listing, signing with, deleting, and inspecting hardware-backed keys, with authentication modes and platform-specific hardware. The user workflow is an application calling the TypeScript bindings; Tauri dispatches commands to the Rust plugin, which uses platform implementations to reach secure hardware. The test app demonstrates key management, signing, hardware status, integration tests, and vectors. Some platform implementation details are represented at their exact source paths based on the repository tree and README; unsampled internal call wiring is omitted.

Main entry points: [`tauri-plugin-secure-element/guest-js/index.ts`](https://github.com/dkackman/tauri-plugin-secure-element/blob/main/tauri-plugin-secure-element/guest-js/index.ts) (JS Bindings), [`test-app/src/App.svelte`](https://github.com/dkackman/tauri-plugin-secure-element/blob/main/test-app/src/App.svelte) (Demo UI), [`tauri-plugin-secure-element/src/commands.rs`](https://github.com/dkackman/tauri-plugin-secure-element/blob/main/tauri-plugin-secure-element/src/commands.rs) (Key Commands), [`tauri-plugin-secure-element/src/windows.rs`](https://github.com/dkackman/tauri-plugin-secure-element/blob/main/tauri-plugin-secure-element/src/windows.rs) (Windows TPM)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_api["App API"]
  node_jsapi["JS Bindings<br/>[index.ts]"]
end

subgraph group_core["Plugin Core"]
  node_dispatch["Command Dispatch<br/>[lib.rs]"]
  node_commands["Key Commands<br/>[commands.rs]"]
  node_validation["Validation<br/>[validation.rs]"]
  node_models["API Models<br/>[models.rs]"]
  node_errors["Error Handling<br/>[error_sanitize.rs]"]
end

subgraph group_platforms["Platform Backends"]
  node_desktop["Desktop Backend<br/>[desktop.rs]"]
  node_mobile["Mobile Backend<br/>[mobile.rs]"]
  node_windows["Windows TPM<br/>[windows.rs]"]
  node_winhello["Windows Hello<br/>[windows_hello.rs]"]
  node_winhandles["Windows Handles<br/>[windows_raii.rs]"]
  node_iosplugin["Apple Plugin<br/>[Plugin.swift]"]
  node_applecore["Secure Enclave"]
  node_android["Android Keystore"]
end

subgraph group_demo["Test App"]
  node_appui["Demo UI<br/>[App.svelte]"]
  node_keymanager["Key Manager<br/>[KeyManager.svelte]"]
  node_signverify["Sign / Verify<br/>[SignVerify.svelte]"]
  node_hardwarestatus["Hardware Status"]
  node_integration["Integration Tests"]
  node_vectors["Test Vectors<br/>[TestVectors.svelte]"]
end

node_appdev(("Tauri App"))
node_tpm[("TPM 2.0")]
node_applehw[("Apple Hardware")]
node_androidhw[("StrongBox / TEE")]

node_appdev -->|"calls"| node_jsapi
node_jsapi -->|"invokes commands"| node_dispatch
node_dispatch -->|"dispatches"| node_commands
node_commands -->|"validates input"| node_validation
node_commands -->|"uses request/response"| node_models
node_commands -->|"sanitizes failures"| node_errors
node_commands -->|"uses desktop backend"| node_desktop
node_commands -->|"uses mobile backend"| node_mobile
node_desktop -->|"routes on Windows"| node_windows
node_windows -->|"uses authentication"| node_winhello
node_windows -->|"manages handles"| node_winhandles
node_windows -->|"uses hardware keys"| node_tpm
node_mobile -->|"dispatches on Apple"| node_iosplugin
node_iosplugin -->|"calls key operations"| node_applecore
node_applecore -->|"uses Secure Enclave"| node_applehw
node_mobile -->|"dispatches on Android"| node_android
node_android -->|"uses hardware keystore"| node_androidhw
node_appui -->|"calls API"| node_jsapi
node_appui -->|"renders"| node_keymanager
node_appui -->|"renders"| node_signverify
node_appui -->|"renders"| node_hardwarestatus
node_appui -->|"renders"| node_integration
node_appui -->|"renders"| node_vectors
node_keymanager -->|"manages keys"| node_jsapi
node_signverify -->|"signs and verifies"| node_jsapi
node_hardwarestatus -->|"checks support"| node_jsapi
node_integration -->|"exercises API"| node_jsapi

click node_jsapi "https://github.com/dkackman/tauri-plugin-secure-element/blob/main/tauri-plugin-secure-element/guest-js/index.ts"
click node_dispatch "https://github.com/dkackman/tauri-plugin-secure-element/blob/main/tauri-plugin-secure-element/src/lib.rs"
click node_commands "https://github.com/dkackman/tauri-plugin-secure-element/blob/main/tauri-plugin-secure-element/src/commands.rs"
click node_validation "https://github.com/dkackman/tauri-plugin-secure-element/blob/main/tauri-plugin-secure-element/src/validation.rs"
click node_models "https://github.com/dkackman/tauri-plugin-secure-element/blob/main/tauri-plugin-secure-element/src/models.rs"
click node_errors "https://github.com/dkackman/tauri-plugin-secure-element/blob/main/tauri-plugin-secure-element/src/error_sanitize.rs"
click node_desktop "https://github.com/dkackman/tauri-plugin-secure-element/blob/main/tauri-plugin-secure-element/src/desktop.rs"
click node_mobile "https://github.com/dkackman/tauri-plugin-secure-element/blob/main/tauri-plugin-secure-element/src/mobile.rs"
click node_windows "https://github.com/dkackman/tauri-plugin-secure-element/blob/main/tauri-plugin-secure-element/src/windows.rs"
click node_winhello "https://github.com/dkackman/tauri-plugin-secure-element/blob/main/tauri-plugin-secure-element/src/windows_hello.rs"
click node_winhandles "https://github.com/dkackman/tauri-plugin-secure-element/blob/main/tauri-plugin-secure-element/src/windows_raii.rs"
click node_iosplugin "https://github.com/dkackman/tauri-plugin-secure-element/blob/main/tauri-plugin-secure-element/ios/Sources/Plugin.swift"
click node_applecore "https://github.com/dkackman/tauri-plugin-secure-element/blob/main/tauri-plugin-secure-element/swift/SecureEnclaveCore.swift"
click node_android "https://github.com/dkackman/tauri-plugin-secure-element/blob/main/tauri-plugin-secure-element/android/src/main/java/SecureKeysPlugin.kt"
click node_appui "https://github.com/dkackman/tauri-plugin-secure-element/blob/main/test-app/src/App.svelte"
click node_keymanager "https://github.com/dkackman/tauri-plugin-secure-element/blob/main/test-app/src/lib/KeyManager.svelte"
click node_signverify "https://github.com/dkackman/tauri-plugin-secure-element/blob/main/test-app/src/lib/SignVerify.svelte"
click node_hardwarestatus "https://github.com/dkackman/tauri-plugin-secure-element/blob/main/test-app/src/lib/HardwareStatus.svelte"
click node_integration "https://github.com/dkackman/tauri-plugin-secure-element/blob/main/test-app/src/lib/IntegrationTests.svelte"
click node_vectors "https://github.com/dkackman/tauri-plugin-secure-element/blob/main/test-app/src/lib/TestVectors.svelte"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_jsapi toneBlue
class node_dispatch,node_commands,node_validation,node_models,node_errors,node_tpm,node_applehw,node_androidhw toneAmber
class node_desktop,node_mobile,node_windows,node_winhello,node_winhandles,node_iosplugin,node_applecore,node_android toneMint
class node_appui,node_keymanager,node_signverify,node_hardwarestatus,node_integration,node_vectors toneRose
class node_appdev toneIndigo
```

## Components

### App API

- [JS Bindings](https://github.com/dkackman/tauri-plugin-secure-element/blob/main/tauri-plugin-secure-element/guest-js/index.ts): `tauri-plugin-secure-element/guest-js/index.ts`

### Plugin Core

- [Command Dispatch](https://github.com/dkackman/tauri-plugin-secure-element/blob/main/tauri-plugin-secure-element/src/lib.rs): `tauri-plugin-secure-element/src/lib.rs`
- [Key Commands](https://github.com/dkackman/tauri-plugin-secure-element/blob/main/tauri-plugin-secure-element/src/commands.rs): `tauri-plugin-secure-element/src/commands.rs`
- [Validation](https://github.com/dkackman/tauri-plugin-secure-element/blob/main/tauri-plugin-secure-element/src/validation.rs): `tauri-plugin-secure-element/src/validation.rs`
- [API Models](https://github.com/dkackman/tauri-plugin-secure-element/blob/main/tauri-plugin-secure-element/src/models.rs): `tauri-plugin-secure-element/src/models.rs`
- [Error Handling](https://github.com/dkackman/tauri-plugin-secure-element/blob/main/tauri-plugin-secure-element/src/error_sanitize.rs): `tauri-plugin-secure-element/src/error_sanitize.rs`

### Platform Backends

- [Desktop Backend](https://github.com/dkackman/tauri-plugin-secure-element/blob/main/tauri-plugin-secure-element/src/desktop.rs): `tauri-plugin-secure-element/src/desktop.rs`
- [Mobile Backend](https://github.com/dkackman/tauri-plugin-secure-element/blob/main/tauri-plugin-secure-element/src/mobile.rs): `tauri-plugin-secure-element/src/mobile.rs`
- [Windows TPM](https://github.com/dkackman/tauri-plugin-secure-element/blob/main/tauri-plugin-secure-element/src/windows.rs): `tauri-plugin-secure-element/src/windows.rs`
- [Windows Hello](https://github.com/dkackman/tauri-plugin-secure-element/blob/main/tauri-plugin-secure-element/src/windows_hello.rs): `tauri-plugin-secure-element/src/windows_hello.rs`
- [Windows Handles](https://github.com/dkackman/tauri-plugin-secure-element/blob/main/tauri-plugin-secure-element/src/windows_raii.rs): `tauri-plugin-secure-element/src/windows_raii.rs`
- [Apple Plugin](https://github.com/dkackman/tauri-plugin-secure-element/blob/main/tauri-plugin-secure-element/ios/Sources/Plugin.swift): `tauri-plugin-secure-element/ios/Sources/Plugin.swift`
- [Secure Enclave](https://github.com/dkackman/tauri-plugin-secure-element/blob/main/tauri-plugin-secure-element/swift/SecureEnclaveCore.swift): `tauri-plugin-secure-element/swift/SecureEnclaveCore.swift`
- [Android Keystore](https://github.com/dkackman/tauri-plugin-secure-element/blob/main/tauri-plugin-secure-element/android/src/main/java/SecureKeysPlugin.kt): `tauri-plugin-secure-element/android/src/main/java/SecureKeysPlugin.kt`

### Test App

- [Demo UI](https://github.com/dkackman/tauri-plugin-secure-element/blob/main/test-app/src/App.svelte): `test-app/src/App.svelte`
- [Key Manager](https://github.com/dkackman/tauri-plugin-secure-element/blob/main/test-app/src/lib/KeyManager.svelte): `test-app/src/lib/KeyManager.svelte`
- [Sign / Verify](https://github.com/dkackman/tauri-plugin-secure-element/blob/main/test-app/src/lib/SignVerify.svelte): `test-app/src/lib/SignVerify.svelte`
- [Hardware Status](https://github.com/dkackman/tauri-plugin-secure-element/blob/main/test-app/src/lib/HardwareStatus.svelte): `test-app/src/lib/HardwareStatus.svelte`
- [Integration Tests](https://github.com/dkackman/tauri-plugin-secure-element/blob/main/test-app/src/lib/IntegrationTests.svelte): `test-app/src/lib/IntegrationTests.svelte`
- [Test Vectors](https://github.com/dkackman/tauri-plugin-secure-element/blob/main/test-app/src/lib/TestVectors.svelte): `test-app/src/lib/TestVectors.svelte`

### Other components

- **Tauri App**
- **TPM 2.0**
- **Apple Hardware**
- **StrongBox / TEE**

## Connections

- Tauri App → JS Bindings: calls
- JS Bindings → Command Dispatch: invokes commands
- Command Dispatch → Key Commands: dispatches
- Key Commands → Validation: validates input
- Key Commands → API Models: uses request/response
- Key Commands → Error Handling: sanitizes failures
- Key Commands → Desktop Backend: uses desktop backend
- Key Commands → Mobile Backend: uses mobile backend
- Desktop Backend → Windows TPM: routes on Windows
- Windows TPM → Windows Hello: uses authentication
- Windows TPM → Windows Handles: manages handles
- Windows TPM → TPM 2.0: uses hardware keys
- Mobile Backend → Apple Plugin: dispatches on Apple
- Apple Plugin → Secure Enclave: calls key operations
- Secure Enclave → Apple Hardware: uses Secure Enclave
- Mobile Backend → Android Keystore: dispatches on Android
- Android Keystore → StrongBox / TEE: uses hardware keystore
- Demo UI → JS Bindings: calls API
- Demo UI → Key Manager: renders
- Demo UI → Sign / Verify: renders
- Demo UI → Hardware Status: renders
- Demo UI → Integration Tests: renders
- Demo UI → Test Vectors: renders
- Key Manager → JS Bindings: manages keys
- Sign / Verify → JS Bindings: signs and verifies
- Hardware Status → JS Bindings: checks support
- Integration Tests → JS Bindings: exercises API