feat(runtime/permissions): prompt fallback (denoland#9376)

Co-authored-by: Yoshiya Hinosawa <[email protected]>
Co-authored-by: Bartek Iwańczuk <[email protected]>

cli/file_fetcher.rs

@@ -516,7 +516,7 @@ impl FileFetcher {
  fn fetch_remote(
  &self,
  specifier: &ModuleSpecifier,
- permissions: &Permissions,
+ permissions: &mut Permissions,
  redirect_limit: i64,
  ) -> Pin<Box<dyn Future<Output = Result<File, AnyError>> + Send>> {
  debug!("FileFetcher::fetch_remote() - specifier: {}", specifier);
@@ -560,7 +560,7 @@ impl FileFetcher {
  };
  let maybe_auth_token = self.auth_tokens.get(&specifier);
  let specifier = specifier.clone();
- let permissions = permissions.clone();
+ let mut permissions = permissions.clone();
  let client = self.http_client.clone();
  let file_fetcher = self.clone();
  // A single pass of fetch either yields code or yields a redirect.
@@ -580,7 +580,7 @@ impl FileFetcher {
  FetchOnceResult::Redirect(redirect_url, headers) => {
  file_fetcher.http_cache.set(&specifier, headers, &[])?;
  file_fetcher
- .fetch_remote(&redirect_url, &permissions, redirect_limit - 1)
+ .fetch_remote(&redirect_url, &mut permissions, redirect_limit - 1)
  .await
  }
  FetchOnceResult::Code(bytes, headers) => {
@@ -600,7 +600,7 @@ impl FileFetcher {
  pub async fn fetch(
  &self,
  specifier: &ModuleSpecifier,
- permissions: &Permissions,
+ permissions: &mut Permissions,
  ) -> Result<File, AnyError> {
  debug!("FileFetcher::fetch() - specifier: {}", specifier);
  let scheme = get_validated_scheme(specifier)?;
@@ -718,7 +718,7 @@ mod tests {
  async fn test_fetch(specifier: &ModuleSpecifier) -> (File, FileFetcher) {
  let (file_fetcher, _) = setup(CacheSetting::ReloadAll, None);
  let result = file_fetcher
- .fetch(specifier, &Permissions::allow_all())
+ .fetch(specifier, &mut Permissions::allow_all())
  .await;
  assert!(result.is_ok());
  (result.unwrap(), file_fetcher)
@@ -730,7 +730,7 @@ mod tests {
  let _http_server_guard = test_util::http_server();
  let (file_fetcher, _) = setup(CacheSetting::ReloadAll, None);
  let result: Result<File, AnyError> = file_fetcher
- .fetch_remote(specifier, &Permissions::allow_all(), 1)
+ .fetch_remote(specifier, &mut Permissions::allow_all(), 1)
  .await;
  assert!(result.is_ok());
  let (_, headers) = file_fetcher.http_cache.get(specifier).unwrap();
@@ -1011,7 +1011,7 @@ mod tests {
  file_fetcher.insert_cached(file.clone());
 
  let result = file_fetcher
- .fetch(&specifier, &Permissions::allow_all())
+ .fetch(&specifier, &mut Permissions::allow_all())
  .await;
  assert!(result.is_ok());
  let result_file = result.unwrap();
@@ -1028,7 +1028,7 @@ mod tests {
  .unwrap();
 
  let result = file_fetcher
- .fetch(&specifier, &Permissions::allow_all())
+ .fetch(&specifier, &mut Permissions::allow_all())
  .await;
  assert!(result.is_ok());
 
@@ -1059,7 +1059,7 @@ mod tests {
  let specifier = resolve_url("data:application/typescript;base64,ZXhwb3J0IGNvbnN0IGEgPSAiYSI7CgpleHBvcnQgZW51bSBBIHsKICBBLAogIEIsCiAgQywKfQo=").unwrap();
 
  let result = file_fetcher
- .fetch(&specifier, &Permissions::allow_all())
+ .fetch(&specifier, &mut Permissions::allow_all())
  .await;
  assert!(result.is_ok());
  let file = result.unwrap();
@@ -1089,7 +1089,7 @@ mod tests {
  );
 
  let result = file_fetcher
- .fetch(&specifier, &Permissions::allow_all())
+ .fetch(&specifier, &mut Permissions::allow_all())
  .await;
  assert!(result.is_ok());
  let file = result.unwrap();
@@ -1113,7 +1113,7 @@ mod tests {
  .unwrap();
 
  let result = file_fetcher
- .fetch(&specifier, &Permissions::allow_all())
+ .fetch(&specifier, &mut Permissions::allow_all())
  .await;
  assert!(result.is_ok());
  let file = result.unwrap();
@@ -1136,7 +1136,7 @@ mod tests {
  metadata.write(&cache_filename).unwrap();
 
  let result = file_fetcher_01
- .fetch(&specifier, &Permissions::allow_all())
+ .fetch(&specifier, &mut Permissions::allow_all())
  .await;
  assert!(result.is_ok());
  let file = result.unwrap();
@@ -1157,7 +1157,7 @@ mod tests {
  metadata.write(&cache_filename).unwrap();
 
  let result = file_fetcher_02
- .fetch(&specifier, &Permissions::allow_all())
+ .fetch(&specifier, &mut Permissions::allow_all())
  .await;
  assert!(result.is_ok());
  let file = result.unwrap();
@@ -1179,7 +1179,7 @@ mod tests {
  )
  .expect("setup failed");
  let result = file_fetcher
- .fetch(&specifier, &Permissions::allow_all())
+ .fetch(&specifier, &mut Permissions::allow_all())
  .await;
  assert!(result.is_ok());
  let file = result.unwrap();
@@ -1214,7 +1214,7 @@ mod tests {
  .unwrap();
 
  let result = file_fetcher_01
- .fetch(&specifier, &Permissions::allow_all())
+ .fetch(&specifier, &mut Permissions::allow_all())
  .await;
  assert!(result.is_ok());
 
@@ -1234,7 +1234,7 @@ mod tests {
  )
  .expect("could not create file fetcher");
  let result = file_fetcher_02
- .fetch(&specifier, &Permissions::allow_all())
+ .fetch(&specifier, &mut Permissions::allow_all())
  .await;
  assert!(result.is_ok());
 
@@ -1273,7 +1273,7 @@ mod tests {
  .unwrap();
 
  let result = file_fetcher
- .fetch(&specifier, &Permissions::allow_all())
+ .fetch(&specifier, &mut Permissions::allow_all())
  .await;
  assert!(result.is_ok());
  let file = result.unwrap();
@@ -1334,7 +1334,7 @@ mod tests {
  .unwrap();
 
  let result = file_fetcher
- .fetch(&specifier, &Permissions::allow_all())
+ .fetch(&specifier, &mut Permissions::allow_all())
  .await;
  assert!(result.is_ok());
  let file = result.unwrap();
@@ -1406,7 +1406,7 @@ mod tests {
  .unwrap();
 
  let result = file_fetcher_01
- .fetch(&specifier, &Permissions::allow_all())
+ .fetch(&specifier, &mut Permissions::allow_all())
  .await;
  assert!(result.is_ok());
 
@@ -1426,7 +1426,7 @@ mod tests {
  )
  .expect("could not create file fetcher");
  let result = file_fetcher_02
- .fetch(&redirected_specifier, &Permissions::allow_all())
+ .fetch(&redirected_specifier, &mut Permissions::allow_all())
  .await;
  assert!(result.is_ok());
 
@@ -1453,12 +1453,12 @@ mod tests {
  .unwrap();
 
  let result = file_fetcher
- .fetch_remote(&specifier, &Permissions::allow_all(), 2)
+ .fetch_remote(&specifier, &mut Permissions::allow_all(), 2)
  .await;
  assert!(result.is_ok());
 
  let result = file_fetcher
- .fetch_remote(&specifier, &Permissions::allow_all(), 1)
+ .fetch_remote(&specifier, &mut Permissions::allow_all(), 1)
  .await;
  assert!(result.is_err());
 
@@ -1491,7 +1491,7 @@ mod tests {
  .unwrap();
 
  let result = file_fetcher
- .fetch(&specifier, &Permissions::allow_all())
+ .fetch(&specifier, &mut Permissions::allow_all())
  .await;
  assert!(result.is_ok());
  let file = result.unwrap();
@@ -1539,7 +1539,7 @@ mod tests {
  resolve_url("https://localhost:4545/cli/tests/002_hello.ts").unwrap();
 
  let result = file_fetcher
- .fetch(&specifier, &Permissions::allow_all())
+ .fetch(&specifier, &mut Permissions::allow_all())
  .await;
  assert!(result.is_err());
  let err = result.unwrap_err();
@@ -1574,20 +1574,20 @@ mod tests {
  resolve_url("https://localhost:4545/cli/tests/002_hello.ts").unwrap();
 
  let result = file_fetcher_01
- .fetch(&specifier, &Permissions::allow_all())
+ .fetch(&specifier, &mut Permissions::allow_all())
  .await;
  assert!(result.is_err());
  let err = result.unwrap_err();
  assert_eq!(get_custom_error_class(&err), Some("NotFound"));
  assert_eq!(err.to_string(), "Specifier not found in cache: \"https://localhost:4545/cli/tests/002_hello.ts\", --cached-only is specified.");
 
  let result = file_fetcher_02
- .fetch(&specifier, &Permissions::allow_all())
+ .fetch(&specifier, &mut Permissions::allow_all())
  .await;
  assert!(result.is_ok());
 
  let result = file_fetcher_01
- .fetch(&specifier, &Permissions::allow_all())
+ .fetch(&specifier, &mut Permissions::allow_all())
  .await;
  assert!(result.is_ok());
 
@@ -1605,7 +1605,7 @@ mod tests {
  fs::write(fixture_path.clone(), r#"console.log("hello deno");"#)
  .expect("could not write file");
  let result = file_fetcher
- .fetch(&specifier, &Permissions::allow_all())
+ .fetch(&specifier, &mut Permissions::allow_all())
  .await;
  assert!(result.is_ok());
  let file = result.unwrap();
@@ -1614,7 +1614,7 @@ mod tests {
  fs::write(fixture_path, r#"console.log("goodbye deno");"#)
  .expect("could not write file");
  let result = file_fetcher
- .fetch(&specifier, &Permissions::allow_all())
+ .fetch(&specifier, &mut Permissions::allow_all())
  .await;
  assert!(result.is_ok());
  let file = result.unwrap();

cli/flags.rs

@@ -149,7 +149,7 @@ pub struct Flags {
  pub lock_write: bool,
  pub log_level: Option<Level>,
  pub no_check: bool,
- pub no_prompts: bool,
+ pub prompt: bool,
  pub no_remote: bool,
  pub reload: bool,
  pub repl: bool,
@@ -244,6 +244,7 @@ impl From<Flags> for PermissionsOptions {
  allow_read: flags.allow_read,
  allow_run: flags.allow_run,
  allow_write: flags.allow_write,
+ prompt: flags.prompt,
  }
  }
 }
@@ -1428,6 +1429,11 @@ fn permission_args<'a, 'b>(app: App<'a, 'b>) -> App<'a, 'b> {
  .long("allow-all")
  .help("Allow all permissions"),
  )
+ .arg(
+ Arg::with_name("prompt")
+ .long("prompt")
+ .help("Fallback to prompt if required permission wasn't passed"),
+ )
 }
 
 fn run_subcommand<'a, 'b>() -> App<'a, 'b> {
@@ -1844,6 +1850,9 @@ fn permission_args_parse(flags: &mut Flags, matches: &clap::ArgMatches) {
  flags.allow_plugin = true;
  flags.allow_hrtime = true;
  }
+ if matches.is_present("prompt") {
+ flags.prompt = true;
+ }
 }
 
 // TODO(ry) move this to utility module and add test.

cli/lsp/registries.rs

@@ -347,7 +347,7 @@ impl ModuleRegistry {
  let specifier = origin_url.join(CONFIG_PATH)?;
  let file = self
  .file_fetcher
- .fetch(&specifier, &Permissions::allow_all())
+ .fetch(&specifier, &mut Permissions::allow_all())
  .await?;
  let config: RegistryConfigurationJson = serde_json::from_str(&file.source)?;
  validate_config(&config)?;
@@ -609,7 +609,7 @@ impl ModuleRegistry {
  .ok()?;
  let file = self
  .file_fetcher
- .fetch(&specifier, &Permissions::allow_all())
+ .fetch(&specifier, &mut Permissions::allow_all())
  .await
  .map_err(|err| {
  error!(

cli/ops/runtime_compiler.rs

@@ -60,7 +60,7 @@ async fn op_emit(
  let args: EmitArgs = serde_json::from_value(args)?;
  let root_specifier = args.root_specifier;
  let program_state = state.borrow().borrow::<Arc<ProgramState>>().clone();
- let runtime_permissions = {
+ let mut runtime_permissions = {
  let state = state.borrow();
  state.borrow::<Permissions>().clone()
  };
@@ -86,7 +86,7 @@ async fn op_emit(
  } else {
  let file = program_state
  .file_fetcher
- .fetch(&import_map_specifier, &runtime_permissions)
+ .fetch(&import_map_specifier, &mut runtime_permissions)
  .await?;
  ImportMap::from_json(import_map_specifier.as_str(), &file.source)?
  };

cli/program_state.rs

@@ -108,7 +108,7 @@ impl ProgramState {
  format!("Bad URL (\"{}\") for import map.", import_map_url),
  )?;
  let file = file_fetcher
- .fetch(&import_map_specifier, &Permissions::allow_all())
+ .fetch(&import_map_specifier, &mut Permissions::allow_all())
  .await?;
  let import_map =
  ImportMap::from_json(import_map_specifier.as_str(), &file.source)?;
@@ -149,7 +149,7 @@ impl ProgramState {
  self: &Arc<Self>,
  specifier: ModuleSpecifier,
  lib: TypeLib,
- runtime_permissions: Permissions,
+ mut runtime_permissions: Permissions,
  is_dynamic: bool,
  maybe_import_map: Option<ImportMap>,
  ) -> Result<(), AnyError> {

cli/specifier_handler.rs

@@ -257,7 +257,7 @@ impl SpecifierHandler for FetchHandler {
  // When the module graph fetches dynamic modules, the set of dynamic
  // permissions need to be applied. Other static imports have all
  // permissions.
- let permissions = if is_dynamic {
+ let mut permissions = if is_dynamic {
  self.runtime_permissions.clone()
  } else {
  Permissions::allow_all()
@@ -267,7 +267,7 @@ impl SpecifierHandler for FetchHandler {
 
  async move {
  let source_file = file_fetcher
- .fetch(&requested_specifier, &permissions)
+ .fetch(&requested_specifier, &mut permissions)
  .await
  .map_err(|err| {
  let err = if let Some(e) = err.downcast_ref::<std::io::Error>() {

cli/tools/standalone.rs

@@ -220,7 +220,7 @@ pub fn compile_to_runtime_flags(
  lock_write: false,
  log_level: flags.log_level,
  no_check: false,
- no_prompts: flags.no_prompts,
+ prompt: flags.prompt,
  no_remote: false,
  reload: false,
  repl: false,