fix: actually don't inherit runtime permissions (#14024)

1 files changed, 62 insertions, 0 deletions

diff --git a/cli/tests/testdata/workers/test.ts b/cli/tests/testdata/workers/test.ts
index b9204adee..d75ca499b 100644
--- a/cli/tests/testdata/workers/test.ts
+++ b/cli/tests/testdata/workers/test.ts
@@ -584,6 +584,68 @@ Deno.test("Worker with disabled permissions", async function () {
   worker.terminate();
 });
 
+Deno.test("Worker permissions are not inherited with empty permission object", async function () {
+  const worker = new Worker(
+    new URL("./permission_echo.js", import.meta.url).href,
+    {
+      type: "module",
+      deno: {
+        namespace: true,
+        permissions: {},
+      },
+    },
+  );
+
+  const promise = deferred();
+  worker.onmessage = (e) => {
+    promise.resolve(e.data);
+  };
+
+  worker.postMessage(null);
+  assertEquals(await promise, {
+    env: "prompt",
+    hrtime: "prompt",
+    net: "prompt",
+    ffi: "prompt",
+    read: "prompt",
+    run: "prompt",
+    write: "prompt",
+  });
+  worker.terminate();
+});
+
+Deno.test("Worker permissions are not inherited with single specified permission", async function () {
+  const worker = new Worker(
+    new URL("./permission_echo.js", import.meta.url).href,
+    {
+      type: "module",
+      deno: {
+        namespace: true,
+        permissions: {
+          net: true,
+        },
+      },
+    },
+  );
+
+  const promise = deferred();
+  worker.onmessage = (e) => {
+    promise.resolve(e.data);
+  };
+
+  worker.postMessage(null);
+  assertEquals(await promise, {
+    env: "prompt",
+    hrtime: "prompt",
+    net: "granted",
+    ffi: "prompt",
+    read: "prompt",
+    run: "prompt",
+    write: "prompt",
+  });
+  worker.terminate();
+});
+
 Deno.test("Worker with invalid permission arg", function () {
   assertThrows(
     () =>