mirror of
https://github.com/denoland/deno.git
synced 2024-11-26 16:09:27 -05:00
f3751e498f
This commits adds adds "permissions" option to the test definitions which allows tests to run with different permission sets than the process's permission. The change will only be in effect within the test function, once the test has completed the original process permission set is restored. Test permissions cannot exceed the process's permission. You can only narrow or drop permissions, failure to acquire a permission results in an error being thrown and the test case will fail.
66 lines
1.9 KiB
Rust
66 lines
1.9 KiB
Rust
// Copyright 2018-2021 the Deno authors. All rights reserved. MIT license.
|
|
|
|
use deno_core::error::generic_error;
|
|
use deno_core::error::AnyError;
|
|
use deno_core::serde_json;
|
|
use deno_core::serde_json::Value;
|
|
use deno_core::OpState;
|
|
use deno_core::ZeroCopyBuf;
|
|
use deno_runtime::ops::worker_host::create_worker_permissions;
|
|
use deno_runtime::ops::worker_host::PermissionsArg;
|
|
use deno_runtime::permissions::Permissions;
|
|
use uuid::Uuid;
|
|
|
|
pub fn init(rt: &mut deno_core::JsRuntime) {
|
|
super::reg_sync(rt, "op_pledge_test_permissions", op_pledge_test_permissions);
|
|
super::reg_sync(
|
|
rt,
|
|
"op_restore_test_permissions",
|
|
op_restore_test_permissions,
|
|
);
|
|
}
|
|
|
|
#[derive(Clone)]
|
|
struct PermissionsHolder(Uuid, Permissions);
|
|
|
|
pub fn op_pledge_test_permissions(
|
|
state: &mut OpState,
|
|
args: Value,
|
|
_zero_copy: Option<ZeroCopyBuf>,
|
|
) -> Result<Uuid, AnyError> {
|
|
deno_runtime::ops::check_unstable(state, "Deno.test.permissions");
|
|
|
|
let token = Uuid::new_v4();
|
|
let parent_permissions = state.borrow::<Permissions>().clone();
|
|
let worker_permissions = {
|
|
let permissions: PermissionsArg = serde_json::from_value(args)?;
|
|
create_worker_permissions(parent_permissions.clone(), permissions)?
|
|
};
|
|
|
|
state.put::<PermissionsHolder>(PermissionsHolder(token, parent_permissions));
|
|
|
|
// NOTE: This call overrides current permission set for the worker
|
|
state.put::<Permissions>(worker_permissions);
|
|
|
|
Ok(token)
|
|
}
|
|
|
|
pub fn op_restore_test_permissions(
|
|
state: &mut OpState,
|
|
token: Uuid,
|
|
_zero_copy: Option<ZeroCopyBuf>,
|
|
) -> Result<(), AnyError> {
|
|
deno_runtime::ops::check_unstable(state, "Deno.test.permissions");
|
|
|
|
if let Some(permissions_holder) = state.try_take::<PermissionsHolder>() {
|
|
if token != permissions_holder.0 {
|
|
panic!("restore test permissions token does not match the stored token");
|
|
}
|
|
|
|
let permissions = permissions_holder.1;
|
|
state.put::<Permissions>(permissions);
|
|
Ok(())
|
|
} else {
|
|
Err(generic_error("no permissions to restore"))
|
|
}
|
|
}
|