feat: Add configurable permissions for Workers (#8215)

This commit adds new option to "Worker" Web API that allows to 
configure permissions.

New "Worker.deno.permissions" option can be used to define limited
permissions to the worker thread by either:
- inherit set of parent thread permissions
- use limited subset of parent thread permissions
- revoke all permissions (full sandbox)

In order to achieve this functionality "CliModuleLoader"
was modified to accept "initial permissions", which are used
for top module loading (ie. uses parent thread permission set
to load top level module of a worker).

16 files changed, 0 insertions, 189 deletions

diff --git a/cli/tests/subdir/bench_worker.ts b/cli/tests/subdir/bench_worker.ts
deleted file mode 100644
index 7e85eed03..000000000
--- a/cli/tests/subdir/bench_worker.ts
+++ /dev/null
@@ -1,21 +0,0 @@
-onmessage = function (e): void {
-  const { cmdId, action, data } = e.data;
-  switch (action) {
-    case 0: // Static response
-      postMessage({
-        cmdId,
-        data: "HTTP/1.1 200 OK\r\nContent-Length: 12\r\n\r\nHello World\n",
-      });
-      break;
-    case 1: // Respond with request data
-      postMessage({ cmdId, data });
-      break;
-    case 2: // Ping
-      postMessage({ cmdId });
-      break;
-    case 3: // Close
-      postMessage({ cmdId: 3 });
-      close();
-      break;
-  }
-};
diff --git a/cli/tests/subdir/busy_worker.js b/cli/tests/subdir/busy_worker.js
deleted file mode 100644
index 7deba0321..000000000
--- a/cli/tests/subdir/busy_worker.js
+++ /dev/null
@@ -1,8 +0,0 @@
-self.onmessage = function (_evt) {
-  // infinite loop
-  for (let i = 0; true; i++) {
-    if (i % 1000 == 0) {
-      postMessage(i);
-    }
-  }
-};
diff --git a/cli/tests/subdir/deno_worker.ts b/cli/tests/subdir/deno_worker.ts
deleted file mode 100644
index 6a57c47f0..000000000
--- a/cli/tests/subdir/deno_worker.ts
+++ /dev/null
@@ -1,7 +0,0 @@
-onmessage = function (e): void {
-  if (typeof self.Deno === "undefined") {
-    throw new Error("Deno namespace not available in worker");
-  }
-
-  postMessage(e.data);
-};
diff --git a/cli/tests/subdir/event_worker.js b/cli/tests/subdir/event_worker.js
deleted file mode 100644
index 849b6026c..000000000
--- a/cli/tests/subdir/event_worker.js
+++ /dev/null
@@ -1,7 +0,0 @@
-onmessage = function (e) {
-  if (e.data === "boom") {
-    throw new Error("boom error!");
-  }
-
-  postMessage(e.data);
-};
diff --git a/cli/tests/subdir/event_worker_scope.js b/cli/tests/subdir/event_worker_scope.js
deleted file mode 100644
index 0381801a8..000000000
--- a/cli/tests/subdir/event_worker_scope.js
+++ /dev/null
@@ -1,43 +0,0 @@
-let messageHandlersCalled = 0;
-let errorHandlersCalled = 0;
-
-onmessage = function (e) {
-  if (e.data === "boom") {
-    throw new Error("boom error!");
-  }
-  messageHandlersCalled++;
-};
-
-self.addEventListener("message", (_e) => {
-  messageHandlersCalled++;
-});
-
-self.addEventListener("message", (_e) => {
-  messageHandlersCalled++;
-});
-
-self.addEventListener("message", (_e) => {
-  messageHandlersCalled++;
-
-  postMessage({
-    messageHandlersCalled,
-    errorHandlersCalled,
-  });
-});
-
-onerror = function (_e) {
-  errorHandlersCalled++;
-};
-
-self.addEventListener("error", (_e) => {
-  errorHandlersCalled++;
-});
-
-self.addEventListener("error", (_e) => {
-  errorHandlersCalled++;
-});
-
-self.addEventListener("error", (e) => {
-  errorHandlersCalled++;
-  e.preventDefault();
-});
diff --git a/cli/tests/subdir/fetching_worker.js b/cli/tests/subdir/fetching_worker.js
deleted file mode 100644
index 3e33d1c9e..000000000
--- a/cli/tests/subdir/fetching_worker.js
+++ /dev/null
@@ -1,6 +0,0 @@
-const r = await fetch(
-  "http://localhost:4545/cli/tests/subdir/fetching_worker.js",
-);
-await r.text();
-postMessage("Done!");
-close();
diff --git a/cli/tests/subdir/nested_worker.js b/cli/tests/subdir/nested_worker.js
deleted file mode 100644
index 4b51b8763..000000000
--- a/cli/tests/subdir/nested_worker.js
+++ /dev/null
@@ -1,18 +0,0 @@
-// Specifier should be resolved relative to current file
-const jsWorker = new Worker(
-  new URL("sibling_worker.js", import.meta.url).href,
-  { type: "module", name: "sibling" },
-);
-
-jsWorker.onerror = (_e) => {
-  postMessage({ type: "error" });
-};
-
-jsWorker.onmessage = (e) => {
-  postMessage({ type: "msg", text: e });
-  close();
-};
-
-onmessage = function (e) {
-  jsWorker.postMessage(e.data);
-};
diff --git a/cli/tests/subdir/non_deno_worker.js b/cli/tests/subdir/non_deno_worker.js
deleted file mode 100644
index 773721560..000000000
--- a/cli/tests/subdir/non_deno_worker.js
+++ /dev/null
@@ -1,7 +0,0 @@
-onmessage = function (e) {
-  if (typeof self.Deno !== "undefined") {
-    throw new Error("Deno namespace unexpectedly available in worker");
-  }
-
-  postMessage(e.data);
-};
diff --git a/cli/tests/subdir/racy_worker.js b/cli/tests/subdir/racy_worker.js
deleted file mode 100644
index 83756b791..000000000
--- a/cli/tests/subdir/racy_worker.js
+++ /dev/null
@@ -1,21 +0,0 @@
-// See issue for details
-// https://github.com/denoland/deno/issues/4080
-//
-// After first call to `postMessage() this worker schedules
-// [close(), postMessage()] ops on the same turn of microtask queue
-// (because message is rather big).
-// Only single `postMessage()` call should make it
-// to host, ie. after calling `close()` no more code should be run.
-
-setTimeout(() => {
-  close();
-}, 50);
-
-while (true) {
-  await new Promise((done) => {
-    setTimeout(() => {
-      postMessage({ buf: new Array(999999) });
-      done();
-    });
-  });
-}
diff --git a/cli/tests/subdir/sibling_worker.js b/cli/tests/subdir/sibling_worker.js
deleted file mode 100644
index 99707e5d6..000000000
--- a/cli/tests/subdir/sibling_worker.js
+++ /dev/null
@@ -1,4 +0,0 @@
-onmessage = (e) => {
-  postMessage(e.data);
-  close();
-};
diff --git a/cli/tests/subdir/test_worker.js b/cli/tests/subdir/test_worker.js
deleted file mode 100644
index 4260975a6..000000000
--- a/cli/tests/subdir/test_worker.js
+++ /dev/null
@@ -1,19 +0,0 @@
-let thrown = false;
-
-if (self.name !== "") {
-  throw Error(`Bad worker name: ${self.name}, expected empty string.`);
-}
-
-onmessage = function (e) {
-  if (thrown === false) {
-    thrown = true;
-    throw new SyntaxError("[test error]");
-  }
-
-  postMessage(e.data);
-  close();
-};
-
-onerror = function () {
-  return false;
-};
diff --git a/cli/tests/subdir/test_worker.ts b/cli/tests/subdir/test_worker.ts
deleted file mode 100644
index ca79dcfe4..000000000
--- a/cli/tests/subdir/test_worker.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-if (self.name !== "tsWorker") {
-  throw Error(`Invalid worker name: ${self.name}, expected tsWorker`);
-}
-
-onmessage = function (e): void {
-  postMessage(e.data);
-  close();
-};
diff --git a/cli/tests/subdir/throwing_worker.js b/cli/tests/subdir/throwing_worker.js
deleted file mode 100644
index 56ee4ff88..000000000
--- a/cli/tests/subdir/throwing_worker.js
+++ /dev/null
@@ -1,2 +0,0 @@
-// This worker just throws error when it's being executed
-throw Error("Thrown error");
diff --git a/cli/tests/subdir/worker_crypto.js b/cli/tests/subdir/worker_crypto.js
deleted file mode 100644
index a86340005..000000000
--- a/cli/tests/subdir/worker_crypto.js
+++ /dev/null
@@ -1,3 +0,0 @@
-onmessage = function () {
-  postMessage(!!self.crypto);
-};
diff --git a/cli/tests/subdir/worker_globals.ts b/cli/tests/subdir/worker_globals.ts
deleted file mode 100644
index a9e7efd85..000000000
--- a/cli/tests/subdir/worker_globals.ts
+++ /dev/null
@@ -1,10 +0,0 @@
-onmessage = function (): void {
-  postMessage(
-    [
-      self instanceof DedicatedWorkerGlobalScope,
-      self instanceof WorkerGlobalScope,
-      self instanceof EventTarget,
-    ].join(", "),
-  );
-  close();
-};
diff --git a/cli/tests/subdir/worker_unstable.ts b/cli/tests/subdir/worker_unstable.ts
deleted file mode 100644
index a5b5f7ba2..000000000
--- a/cli/tests/subdir/worker_unstable.ts
+++ /dev/null
@@ -1,5 +0,0 @@
-console.log(Deno.permissions.query);
-console.log(Deno.emit);
-self.onmessage = () => {
-  self.close();
-};