fix(cli): Check permissions for Deno.emit() (#9139)

5 files changed, 45 insertions, 29 deletions

diff --git a/cli/module_graph.rs b/cli/module_graph.rs
index 7281e67f1..d726e21a0 100644
--- a/cli/module_graph.rs
+++ b/cli/module_graph.rs
@@ -29,6 +29,7 @@ use deno_core::error::AnyError;
 
 use deno_core::error::anyhow;
 use deno_core::error::custom_error;
+use deno_core::error::get_custom_error_class;
 use deno_core::error::Context;
 use deno_core::futures::stream::FuturesUnordered;
 use deno_core::futures::stream::StreamExt;
@@ -848,7 +849,7 @@ impl Graph {
       info!("{} {}", colors::green("Check"), specifier);
     }
 
-    let root_names = self.get_root_names(!config.get_check_js());
+    let root_names = self.get_root_names(!config.get_check_js())?;
     let maybe_tsbuildinfo = self.maybe_tsbuildinfo.clone();
     let hash_data =
       vec![config.as_bytes(), version::deno().as_bytes().to_owned()];
@@ -975,7 +976,7 @@ impl Graph {
 
     let mut emitted_files = HashMap::new();
     if options.check {
-      let root_names = self.get_root_names(!config.get_check_js());
+      let root_names = self.get_root_names(!config.get_check_js())?;
       let hash_data =
         vec![config.as_bytes(), version::deno().as_bytes().to_owned()];
       let graph = Arc::new(Mutex::new(self));
@@ -1329,7 +1330,7 @@ impl Graph {
   fn get_root_names(
     &self,
     include_emittable: bool,
-  ) -> Vec<(ModuleSpecifier, MediaType)> {
+  ) -> Result<Vec<(ModuleSpecifier, MediaType)>, AnyError> {
     let root_names: Vec<ModuleSpecifier> = if include_emittable {
       // in situations where there is `allowJs` with tsc, but not `checkJs`,
       // then tsc will not parse the whole module graph, meaning that any
@@ -1355,32 +1356,38 @@ impl Graph {
     } else {
       self.roots.clone()
     };
-    root_names
-      .iter()
-      .map(|ms| {
-        // if the root module has a types specifier, we should be sending that
-        // to tsc instead of the original specifier
-        let specifier = self.resolve_specifier(ms);
-        let module =
-          if let ModuleSlot::Module(module) = self.get_module(specifier) {
-            module
+    let mut root_types = vec![];
+    for ms in root_names {
+      // if the root module has a types specifier, we should be sending that
+      // to tsc instead of the original specifier
+      let specifier = self.resolve_specifier(&ms);
+      let module = match self.get_module(specifier) {
+        ModuleSlot::Module(module) => module,
+        ModuleSlot::Err(error) => {
+          // It would be great if we could just clone the error here...
+          if let Some(class) = get_custom_error_class(error) {
+            return Err(custom_error(class, error.to_string()));
           } else {
-            panic!("missing module");
-          };
-        let specifier = if let Some((_, types_specifier)) = &module.maybe_types
-        {
-          self.resolve_specifier(types_specifier)
-        } else {
-          specifier
-        };
-        (
-          // root modules can be redirects, so before we pass it to tsc we need
-          // to resolve the redirect
-          specifier.clone(),
-          self.get_media_type(specifier).unwrap(),
-        )
-      })
-      .collect()
+            panic!("unsupported ModuleSlot error");
+          }
+        }
+        _ => {
+          panic!("missing module");
+        }
+      };
+      let specifier = if let Some((_, types_specifier)) = &module.maybe_types {
+        self.resolve_specifier(types_specifier)
+      } else {
+        specifier
+      };
+      root_types.push((
+        // root modules can be redirects, so before we pass it to tsc we need
+        // to resolve the redirect
+        specifier.clone(),
+        self.get_media_type(specifier).unwrap(),
+      ));
+    }
+    Ok(root_types)
   }
 
   /// Get the source for a given module specifier.  If the module is not part
diff --git a/cli/ops/runtime_compiler.rs b/cli/ops/runtime_compiler.rs
index a75a80fdf..481b29a11 100644
--- a/cli/ops/runtime_compiler.rs
+++ b/cli/ops/runtime_compiler.rs
@@ -66,9 +66,9 @@ async fn op_emit(
   let mut is_dynamic = false;
   let handler: Arc<Mutex<dyn SpecifierHandler>> =
     if let Some(sources) = args.sources {
-      is_dynamic = true;
       Arc::new(Mutex::new(MemoryHandler::new(sources)))
     } else {
+      is_dynamic = true;
       Arc::new(Mutex::new(FetchHandler::new(
         &program_state,
         runtime_permissions,
diff --git a/cli/tests/080_deno_emit_permissions.ts b/cli/tests/080_deno_emit_permissions.ts
new file mode 100644
index 000000000..dc550cffb
--- /dev/null
+++ b/cli/tests/080_deno_emit_permissions.ts
@@ -0,0 +1 @@
+await Deno.emit(new URL("001_hello.js", import.meta.url).href);
diff --git a/cli/tests/080_deno_emit_permissions.ts.out b/cli/tests/080_deno_emit_permissions.ts.out
new file mode 100644
index 000000000..cc8d13af9
--- /dev/null
+++ b/cli/tests/080_deno_emit_permissions.ts.out
@@ -0,0 +1,2 @@
+[WILDCARD]error: Uncaught (in promise) PermissionDenied: read access to "[WILDCARD]001_hello.js", run again with the --allow-read flag
+[WILDCARD]
diff --git a/cli/tests/integration_tests.rs b/cli/tests/integration_tests.rs
index 9c64a9e07..226bf9b9b 100644
--- a/cli/tests/integration_tests.rs
+++ b/cli/tests/integration_tests.rs
@@ -2656,6 +2656,12 @@ itest!(_079_location_authentication {
   output: "079_location_authentication.ts.out",
 });
 
+itest!(_080_deno_emit_permissions {
+  args: "run --unstable 080_deno_emit_permissions.ts",
+  output: "080_deno_emit_permissions.ts.out",
+  exit_code: 1,
+});
+
 itest!(js_import_detect {
   args: "run --quiet --reload js_import_detect.ts",
   output: "js_import_detect.ts.out",