fix(compile): implicit read permission to npm vfs (#19281)

Closes #19280

1 files changed, 24 insertions, 6 deletions

diff --git a/cli/standalone/mod.rs b/cli/standalone/mod.rs
index 14d4ad533..16f4c9e65 100644
--- a/cli/standalone/mod.rs
+++ b/cli/standalone/mod.rs
@@ -311,7 +311,7 @@ pub async fn run(
     http_client.clone(),
     progress_bar.clone(),
   ));
-  let (fs, node_modules_path, snapshot) = if let Some(snapshot) =
+  let (fs, vfs_root, node_modules_path, snapshot) = if let Some(snapshot) =
     metadata.npm_snapshot
   {
     let vfs_root_dir_path = if metadata.node_modules_dir {
@@ -319,8 +319,8 @@ pub async fn run(
     } else {
       npm_cache.registry_folder(&npm_registry_url)
     };
-    let vfs =
-      load_npm_vfs(vfs_root_dir_path).context("Failed to load npm vfs.")?;
+    let vfs = load_npm_vfs(vfs_root_dir_path.clone())
+      .context("Failed to load npm vfs.")?;
     let node_modules_path = if metadata.node_modules_dir {
       Some(vfs.root().to_path_buf())
     } else {
@@ -328,6 +328,7 @@ pub async fn run(
     };
     (
       Arc::new(DenoCompileFileSystem::new(vfs)) as Arc<dyn deno_fs::FileSystem>,
+      Some(vfs_root_dir_path),
       node_modules_path,
       Some(snapshot.into_valid()?),
     )
@@ -336,6 +337,7 @@ pub async fn run(
       Arc::new(deno_fs::RealFs) as Arc<dyn deno_fs::FileSystem>,
       None,
       None,
+      None,
     )
   };
   let npm_resolution = Arc::new(NpmResolution::from_serialized(
@@ -395,9 +397,25 @@ pub async fn run(
     }),
   };
 
-  let permissions = PermissionsContainer::new(Permissions::from_options(
-    &metadata.permissions,
-  )?);
+  let permissions = {
+    let mut permissions = metadata.permissions;
+    // if running with an npm vfs, grant read access to it
+    if let Some(vfs_root) = vfs_root {
+      match &mut permissions.allow_read {
+        Some(vec) if vec.is_empty() => {
+          // do nothing, already granted
+        }
+        Some(vec) => {
+          vec.push(vfs_root);
+        }
+        None => {
+          permissions.allow_read = Some(vec![vfs_root]);
+        }
+      }
+    }
+
+    PermissionsContainer::new(Permissions::from_options(&permissions)?)
+  };
   let worker_factory = CliMainWorkerFactory::new(
     StorageKeyResolver::empty(),
     npm_resolver.clone(),