feat(cli): add test permissions to Deno.test (#10188)

This commits adds adds "permissions" option to the test definitions 
which allows tests to run with different permission sets than 
the process's permission.

The change will only be in effect within the test function, once the 
test has completed the original process permission set is restored.

Test permissions cannot exceed the process's permission.
You can only narrow or drop permissions, failure to acquire a 
permission results in an error being thrown and the test case will fail.

5 files changed, 139 insertions, 0 deletions

diff --git a/cli/tests/integration_tests.rs b/cli/tests/integration_tests.rs
index 28d2dc7c6..770e87244 100644
--- a/cli/tests/integration_tests.rs
+++ b/cli/tests/integration_tests.rs
@@ -2395,6 +2395,18 @@ mod integration {
       output: "test/deno_test.out",
     });
 
+    itest!(allow_all {
+      args: "test --unstable --allow-all test/allow_all.ts",
+      exit_code: 0,
+      output: "test/allow_all.out",
+    });
+
+    itest!(allow_none {
+      args: "test --unstable test/allow_none.ts",
+      exit_code: 1,
+      output: "test/allow_none.out",
+    });
+
     itest!(fail_fast {
       args: "test --fail-fast test/test_runner_test.ts",
       exit_code: 1,
diff --git a/cli/tests/test/allow_all.out b/cli/tests/test/allow_all.out
new file mode 100644
index 000000000..3edb88d0f
--- /dev/null
+++ b/cli/tests/test/allow_all.out
@@ -0,0 +1,18 @@
+[WILDCARD]
+running 14 tests
+test read false ... ok [WILDCARD]
+test read true ... ok [WILDCARD]
+test write false ... ok [WILDCARD]
+test write true ... ok [WILDCARD]
+test net false ... ok [WILDCARD]
+test net true ... ok [WILDCARD]
+test env false ... ok [WILDCARD]
+test env true ... ok [WILDCARD]
+test run false ... ok [WILDCARD]
+test run true ... ok [WILDCARD]
+test plugin false ... ok [WILDCARD]
+test plugin true ... ok [WILDCARD]
+test hrtime false ... ok [WILDCARD]
+test hrtime true ... ok [WILDCARD]
+
+test result: ok. 14 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out [WILDCARD]
diff --git a/cli/tests/test/allow_all.ts b/cli/tests/test/allow_all.ts
new file mode 100644
index 000000000..e4e12144e
--- /dev/null
+++ b/cli/tests/test/allow_all.ts
@@ -0,0 +1,35 @@
+import { assertEquals } from "../../../test_util/std/testing/asserts.ts";
+
+const permissions: Deno.PermissionName[] = [
+  "read",
+  "write",
+  "net",
+  "env",
+  "run",
+  "plugin",
+  "hrtime",
+];
+
+for (const name of permissions) {
+  Deno.test({
+    name: `${name} false`,
+    permissions: {
+      [name]: false,
+    },
+    async fn() {
+      const status = await Deno.permissions.query({ name });
+      assertEquals(status.state, "denied");
+    },
+  });
+
+  Deno.test({
+    name: `${name} true`,
+    permissions: {
+      [name]: true,
+    },
+    async fn() {
+      const status = await Deno.permissions.query({ name });
+      assertEquals(status.state, "granted");
+    },
+  });
+}
diff --git a/cli/tests/test/allow_none.out b/cli/tests/test/allow_none.out
new file mode 100644
index 000000000..6565a0800
--- /dev/null
+++ b/cli/tests/test/allow_none.out
@@ -0,0 +1,51 @@
+[WILDCARD]
+running 7 tests
+test read ... FAILED [WILDCARD]
+test write ... FAILED [WILDCARD]
+test net ... FAILED [WILDCARD]
+test env ... FAILED [WILDCARD]
+test run ... FAILED [WILDCARD]
+test plugin ... FAILED [WILDCARD]
+test hrtime ... FAILED [WILDCARD]
+
+failures:
+
+read
+PermissionDenied: Can't escalate parent thread permissions
+[WILDCARD]
+
+write
+PermissionDenied: Can't escalate parent thread permissions
+[WILDCARD]
+
+net
+PermissionDenied: Can't escalate parent thread permissions
+[WILDCARD]
+
+env
+PermissionDenied: Can't escalate parent thread permissions
+[WILDCARD]
+
+run
+PermissionDenied: Can't escalate parent thread permissions
+[WILDCARD]
+
+plugin
+PermissionDenied: Can't escalate parent thread permissions
+[WILDCARD]
+
+hrtime
+PermissionDenied: Can't escalate parent thread permissions
+[WILDCARD]
+
+failures:
+
+	read
+	write
+	net
+	env
+	run
+	plugin
+	hrtime
+
+test result: FAILED. 0 passed; 7 failed; 0 ignored; 0 measured; 0 filtered out [WILDCARD]
diff --git a/cli/tests/test/allow_none.ts b/cli/tests/test/allow_none.ts
new file mode 100644
index 000000000..c0a930eb1
--- /dev/null
+++ b/cli/tests/test/allow_none.ts
@@ -0,0 +1,23 @@
+import { unreachable } from "../../../test_util/std/testing/asserts.ts";
+
+const permissions: Deno.PermissionName[] = [
+  "read",
+  "write",
+  "net",
+  "env",
+  "run",
+  "plugin",
+  "hrtime",
+];
+
+for (const name of permissions) {
+  Deno.test({
+    name,
+    permissions: {
+      [name]: true,
+    },
+    fn() {
+      unreachable();
+    },
+  });
+}