feat(permissions): allow run permission to take values (#9833)

This commit adds allowlist support to `--allow-run` flag.

Additionally `Deno.permissions.query()` allows to query for specific
programs within allowlist.

5 files changed, 43 insertions, 0 deletions

diff --git a/cli/tests/089_run_allow_list.ts b/cli/tests/089_run_allow_list.ts
new file mode 100644
index 000000000..85c1730a1
--- /dev/null
+++ b/cli/tests/089_run_allow_list.ts
@@ -0,0 +1,13 @@
+try {
+  Deno.run({
+    cmd: ["ls"],
+  });
+} catch (e) {
+  console.log(e);
+}
+
+const proc = Deno.run({
+  cmd: ["cat", "089_run_allow_list.ts"],
+  stdout: "null",
+});
+console.log((await proc.status()).success);
diff --git a/cli/tests/089_run_allow_list.ts.out b/cli/tests/089_run_allow_list.ts.out
new file mode 100644
index 000000000..68a4a2ac5
--- /dev/null
+++ b/cli/tests/089_run_allow_list.ts.out
@@ -0,0 +1,3 @@
+[WILDCARD]PermissionDenied: Requires run access to "ls", run again with the --allow-run flag
+[WILDCARD]
+true
diff --git a/cli/tests/090_run_permissions_request.ts b/cli/tests/090_run_permissions_request.ts
new file mode 100644
index 000000000..044bc6e8e
--- /dev/null
+++ b/cli/tests/090_run_permissions_request.ts
@@ -0,0 +1,9 @@
+const status1 =
+  (await Deno.permissions.request({ name: "run", command: "ls" })).state;
+const status2 =
+  (await Deno.permissions.query({ name: "run", command: "cat" })).state;
+const status3 =
+  (await Deno.permissions.request({ name: "run", command: "cat" })).state;
+console.log(status1);
+console.log(status2);
+console.log(status3);
diff --git a/cli/tests/090_run_permissions_request.ts.out b/cli/tests/090_run_permissions_request.ts.out
new file mode 100644
index 000000000..362425876
--- /dev/null
+++ b/cli/tests/090_run_permissions_request.ts.out
@@ -0,0 +1,3 @@
+[WILDCARD]granted
+prompt
+denied
diff --git a/cli/tests/integration_tests.rs b/cli/tests/integration_tests.rs
index 310cb3289..2d4d8995e 100644
--- a/cli/tests/integration_tests.rs
+++ b/cli/tests/integration_tests.rs
@@ -2846,6 +2846,21 @@ console.log("finish");
     output: "088_dynamic_import_already_evaluating.ts.out",
   });
 
+  itest!(_089_run_allow_list {
+    args: "run --allow-run=cat 089_run_allow_list.ts",
+    output: "089_run_allow_list.ts.out",
+  });
+
+  #[cfg(unix)]
+  #[test]
+  fn _090_run_permissions_request() {
+    let args = "run 090_run_permissions_request.ts";
+    let output = "090_run_permissions_request.ts.out";
+    let input = b"g\nd\n";
+
+    util::test_pty(args, output, input);
+  }
+
   itest!(js_import_detect {
     args: "run --quiet --reload js_import_detect.ts",
     output: "js_import_detect.ts.out",