stabilize Deno.cwd and require --allow-read (#5068)

8 files changed, 23 insertions, 59 deletions

diff --git a/cli/js/deno.ts b/cli/js/deno.ts
index c60ebdae3..38b2f6d2a 100644
--- a/cli/js/deno.ts
+++ b/cli/js/deno.ts
@@ -19,7 +19,7 @@ export {
   DiagnosticItem,
   DiagnosticMessageChain,
 } from "./diagnostics.ts";
-export { chdir } from "./ops/fs/dir.ts";
+export { chdir, cwd } from "./ops/fs/dir.ts";
 export { errors } from "./errors.ts";
 export {
   File,
diff --git a/cli/js/deno_unstable.ts b/cli/js/deno_unstable.ts
index 1f4baefdc..98e60f665 100644
--- a/cli/js/deno_unstable.ts
+++ b/cli/js/deno_unstable.ts
@@ -14,7 +14,6 @@ export { setRaw } from "./ops/tty.ts";
 export { utimeSync, utime } from "./ops/fs/utime.ts";
 export { ShutdownMode, shutdown } from "./net.ts";
 export { listen, listenDatagram, connect } from "./net_unstable.ts";
-export { cwd } from "./ops/fs/dir.ts";
 export { startTls } from "./tls.ts";
 export { kill } from "./ops/process.ts";
 export {
diff --git a/cli/js/lib.deno.ns.d.ts b/cli/js/lib.deno.ns.d.ts
index 45730acbc..6adaf26ef 100644
--- a/cli/js/lib.deno.ns.d.ts
+++ b/cli/js/lib.deno.ns.d.ts
@@ -144,6 +144,20 @@ declare namespace Deno {
    */
   export function chdir(directory: string): void;
 
+  /**
+   * Return a string representing the current working directory.
+   *
+   * If the current directory can be reached via multiple paths (due to symbolic
+   * links), `cwd()` may return any one of them.
+   *
+   *       const currentWorkingDirectory = Deno.cwd();
+   *
+   * Throws `Deno.errors.NotFound` if directory not available.
+   *
+   * Requires --allow-read
+   */
+  export function cwd(): string;
+
   export enum SeekMode {
     Start = 0,
     Current = 1,
diff --git a/cli/js/lib.deno.unstable.d.ts b/cli/js/lib.deno.unstable.d.ts
index 88b9f002c..a523300cc 100644
--- a/cli/js/lib.deno.unstable.d.ts
+++ b/cli/js/lib.deno.unstable.d.ts
@@ -1024,21 +1024,6 @@ declare namespace Deno {
     options: ConnectOptions | UnixConnectOptions
   ): Promise<Conn>;
 
-  /**
-   * **UNSTABLE**: Currently under evaluation to decide if explicit permission is
-   * required to get the value of the current working directory.
-   *
-   * Return a string representing the current working directory.
-   *
-   * If the current directory can be reached via multiple paths (due to symbolic
-   * links), `cwd()` may return any one of them.
-   *
-   *       const currentWorkingDirectory = Deno.cwd();
-   *
-   * Throws `Deno.errors.NotFound` if directory not available.
-   */
-  export function cwd(): string;
-
   export interface StartTlsOptions {
     /** A literal IP address or host name that can be resolved to an IP address.
      * If not specified, defaults to `127.0.0.1`. */
diff --git a/cli/js/tests/dir_test.ts b/cli/js/tests/dir_test.ts
index 3686471f1..dc05d9564 100644
--- a/cli/js/tests/dir_test.ts
+++ b/cli/js/tests/dir_test.ts
@@ -1,7 +1,7 @@
 // Copyright 2018-2020 the Deno authors. All rights reserved. MIT license.
 import { unitTest, assert, assertEquals } from "./test_util.ts";
 
-unitTest(function dirCwdNotNull(): void {
+unitTest({ perms: { read: true } }, function dirCwdNotNull(): void {
   assert(Deno.cwd() != null);
 });
 
diff --git a/cli/ops/fs.rs b/cli/ops/fs.rs
index cccf32c12..573058d70 100644
--- a/cli/ops/fs.rs
+++ b/cli/ops/fs.rs
@@ -905,11 +905,12 @@ fn op_utime(
 }
 
 fn op_cwd(
-  _state: &State,
+  state: &State,
   _args: Value,
   _zero_copy: Option<ZeroCopyBuf>,
 ) -> Result<JsonOp, OpError> {
   let path = current_dir()?;
+  state.check_read(&path)?;
   let path_str = into_string(path.into_os_string())?;
   Ok(JsonOp::Sync(json!(path_str)))
 }
diff --git a/cli/tests/integration_tests.rs b/cli/tests/integration_tests.rs
index 456c6eece..0847c1806 100644
--- a/cli/tests/integration_tests.rs
+++ b/cli/tests/integration_tests.rs
@@ -1146,10 +1146,9 @@ itest!(_055_import_wasm_via_network {
   http_server: true,
 });
 
-// TODO(lucacasonato): remove --unstable when cwd goes stable
 itest!(_056_make_temp_file_write_perm {
   args:
-    "run --allow-write=./subdir/ --unstable 056_make_temp_file_write_perm.ts",
+    "run --allow-read --allow-write=./subdir/ 056_make_temp_file_write_perm.ts",
   output: "056_make_temp_file_write_perm.out",
 });
 
diff --git a/std/http/file_server_test.ts b/std/http/file_server_test.ts
index d471c1519..7a3699337 100644
--- a/std/http/file_server_test.ts
+++ b/std/http/file_server_test.ts
@@ -1,5 +1,5 @@
 // Copyright 2018-2020 the Deno authors. All rights reserved. MIT license.
-import { assert, assertEquals, assertStrContains } from "../testing/asserts.ts";
+import { assert, assertEquals } from "../testing/asserts.ts";
 import { BufReader } from "../io/bufio.ts";
 import { TextProtoReader } from "../textproto/mod.ts";
 import { ServerRequest } from "./server.ts";
@@ -12,7 +12,6 @@ async function startFileServer(): Promise<void> {
     cmd: [
       Deno.execPath(),
       "run",
-      "--unstable",
       "--allow-read",
       "--allow-net",
       "http/file_server.ts",
@@ -104,47 +103,14 @@ test("serveWithUnorthodoxFilename", async function (): Promise<void> {
   }
 });
 
-test("servePermissionDenied", async function (): Promise<void> {
-  const deniedServer = Deno.run({
-    // TODO(lucacasonato): remove unstable when stabilized
-    cmd: [
-      Deno.execPath(),
-      "run",
-      "--unstable",
-      "--allow-net",
-      "http/file_server.ts",
-    ],
-    stdout: "piped",
-    stderr: "piped",
-  });
-  assert(deniedServer.stdout != null);
-  const reader = new TextProtoReader(new BufReader(deniedServer.stdout));
-  assert(deniedServer.stderr != null);
-  const errReader = new TextProtoReader(new BufReader(deniedServer.stderr));
-  const s = await reader.readLine();
-  assert(s !== null && s.includes("server listening"));
-
-  try {
-    const res = await fetch("http://localhost:4500/");
-    const _ = await res.text();
-    assertStrContains(
-      (await errReader.readLine()) as string,
-      "run again with the --allow-read flag"
-    );
-  } finally {
-    deniedServer.close();
-    deniedServer.stdout.close();
-    deniedServer.stderr.close();
-  }
-});
-
 test("printHelp", async function (): Promise<void> {
   const helpProcess = Deno.run({
-    // TODO(lucacasonato): remove unstable when stabilized
     cmd: [
       Deno.execPath(),
       "run",
-      "--unstable",
+      // TODO(ry) It ought to be possible to get the help output without
+      // --allow-read.
+      "--allow-read",
       "http/file_server.ts",
       "--help",
     ],