refactor: remove `PermissionsContainer` in deno_runtime (#24119)

Also removes permissions being passed in for node resolution. It was
completely useless because we only checked it for reading package.json
files, but Deno reading package.json files for resolution is perfectly
fine.

My guess is this is also a perf improvement because Deno is doing less
work.

7 files changed, 118 insertions, 131 deletions

diff --git a/ext/node/analyze.rs b/ext/node/analyze.rs
index b7adfd5ce..df68cb0fc 100644
--- a/ext/node/analyze.rs
+++ b/ext/node/analyze.rs
@@ -17,8 +17,8 @@ use deno_core::error::AnyError;
 
 use crate::path::to_file_specifier;
 use crate::resolution::NodeResolverRc;
+use crate::AllowAllNodePermissions;
 use crate::NodeModuleKind;
-use crate::NodePermissions;
 use crate::NodeResolutionMode;
 use crate::NpmResolverRc;
 use crate::PackageJson;
@@ -87,7 +87,6 @@ impl<TCjsCodeAnalyzer: CjsCodeAnalyzer> NodeCodeTranslator<TCjsCodeAnalyzer> {
     &self,
     entry_specifier: &ModuleSpecifier,
     source: Option<String>,
-    permissions: &dyn NodePermissions,
   ) -> Result<String, AnyError> {
     let mut temp_var_count = 0;
 
@@ -115,7 +114,6 @@ impl<TCjsCodeAnalyzer: CjsCodeAnalyzer> NodeCodeTranslator<TCjsCodeAnalyzer> {
         .analyze_reexports(
           entry_specifier,
           analysis.reexports,
-          permissions,
           &mut all_exports,
           &mut errors,
         )
@@ -161,7 +159,6 @@ impl<TCjsCodeAnalyzer: CjsCodeAnalyzer> NodeCodeTranslator<TCjsCodeAnalyzer> {
     &'a self,
     entry_specifier: &url::Url,
     reexports: Vec<String>,
-    permissions: &dyn NodePermissions,
     all_exports: &mut HashSet<String>,
     // this goes through the modules concurrently, so collect
     // the errors in order to be deterministic
@@ -194,7 +191,6 @@ impl<TCjsCodeAnalyzer: CjsCodeAnalyzer> NodeCodeTranslator<TCjsCodeAnalyzer> {
             // should be `deno-require`, because `deno` is already used in `esm_resolver.rs`
             &["deno", "require", "default"],
             NodeResolutionMode::Execution,
-            permissions,
           );
           let reexport_specifier = match result {
             Ok(specifier) => specifier,
@@ -287,7 +283,6 @@ impl<TCjsCodeAnalyzer: CjsCodeAnalyzer> NodeCodeTranslator<TCjsCodeAnalyzer> {
     referrer: &ModuleSpecifier,
     conditions: &[&str],
     mode: NodeResolutionMode,
-    permissions: &dyn NodePermissions,
   ) -> Result<ModuleSpecifier, AnyError> {
     if specifier.starts_with('/') {
       todo!();
@@ -319,7 +314,7 @@ impl<TCjsCodeAnalyzer: CjsCodeAnalyzer> NodeCodeTranslator<TCjsCodeAnalyzer> {
     let package_json = PackageJson::load(
       &*self.fs,
       &*self.npm_resolver,
-      permissions,
+      &mut AllowAllNodePermissions,
       package_json_path.clone(),
     )?;
     if package_json.exists {
@@ -332,7 +327,6 @@ impl<TCjsCodeAnalyzer: CjsCodeAnalyzer> NodeCodeTranslator<TCjsCodeAnalyzer> {
           NodeModuleKind::Esm,
           conditions,
           mode,
-          permissions,
         );
       }
 
@@ -345,7 +339,7 @@ impl<TCjsCodeAnalyzer: CjsCodeAnalyzer> NodeCodeTranslator<TCjsCodeAnalyzer> {
           let package_json = PackageJson::load(
             &*self.fs,
             &*self.npm_resolver,
-            permissions,
+            &mut AllowAllNodePermissions,
             package_json_path,
           )?;
           if package_json.exists {
diff --git a/ext/node/global.rs b/ext/node/global.rs
index 0aaa6ed8b..d2fe7a1e5 100644
--- a/ext/node/global.rs
+++ b/ext/node/global.rs
@@ -1,13 +1,12 @@
 // Copyright 2018-2024 the Deno authors. All rights reserved. MIT license.
 
 use std::mem::MaybeUninit;
-use std::rc::Rc;
 
 use deno_core::v8;
 use deno_core::v8::GetPropertyNamesArgs;
 use deno_core::v8::MapFnTo;
 
-use crate::NodeResolver;
+use crate::resolution::NodeResolverRc;
 
 // NOTE(bartlomieju): somehow calling `.map_fn_to()` multiple times on a function
 // returns two different pointers. That shouldn't be the case as `.map_fn_to()`
@@ -271,7 +270,7 @@ fn current_mode(scope: &mut v8::HandleScope) -> Mode {
   };
   let op_state = deno_core::JsRuntime::op_state_from(scope);
   let op_state = op_state.borrow();
-  let Some(node_resolver) = op_state.try_borrow::<Rc<NodeResolver>>() else {
+  let Some(node_resolver) = op_state.try_borrow::<NodeResolverRc>() else {
     return Mode::Deno;
   };
   let mut buffer = [MaybeUninit::uninit(); 2048];
diff --git a/ext/node/lib.rs b/ext/node/lib.rs
index 2b31f704f..a15125f60 100644
--- a/ext/node/lib.rs
+++ b/ext/node/lib.rs
@@ -6,7 +6,6 @@
 use std::collections::HashSet;
 use std::path::Path;
 use std::path::PathBuf;
-use std::rc::Rc;
 
 use deno_core::error::AnyError;
 use deno_core::located_script_name;
@@ -46,6 +45,7 @@ pub use resolution::NodeModuleKind;
 pub use resolution::NodeResolution;
 pub use resolution::NodeResolutionMode;
 pub use resolution::NodeResolver;
+use resolution::NodeResolverRc;
 
 use crate::global::global_object_middleware;
 use crate::global::global_template_middleware;
@@ -57,23 +57,23 @@ pub trait NodePermissions {
     api_name: &str,
   ) -> Result<(), AnyError>;
   #[inline(always)]
-  fn check_read(&self, path: &Path) -> Result<(), AnyError> {
+  fn check_read(&mut self, path: &Path) -> Result<(), AnyError> {
     self.check_read_with_api_name(path, None)
   }
   fn check_read_with_api_name(
-    &self,
+    &mut self,
     path: &Path,
     api_name: Option<&str>,
   ) -> Result<(), AnyError>;
-  fn check_sys(&self, kind: &str, api_name: &str) -> Result<(), AnyError>;
+  fn check_sys(&mut self, kind: &str, api_name: &str) -> Result<(), AnyError>;
   fn check_write_with_api_name(
-    &self,
+    &mut self,
     path: &Path,
     api_name: Option<&str>,
   ) -> Result<(), AnyError>;
 }
 
-pub(crate) struct AllowAllNodePermissions;
+pub struct AllowAllNodePermissions;
 
 impl NodePermissions for AllowAllNodePermissions {
   fn check_net_url(
@@ -84,24 +84,65 @@ impl NodePermissions for AllowAllNodePermissions {
     Ok(())
   }
   fn check_read_with_api_name(
-    &self,
+    &mut self,
     _path: &Path,
     _api_name: Option<&str>,
   ) -> Result<(), AnyError> {
     Ok(())
   }
   fn check_write_with_api_name(
-    &self,
+    &mut self,
     _path: &Path,
     _api_name: Option<&str>,
   ) -> Result<(), AnyError> {
     Ok(())
   }
-  fn check_sys(&self, _kind: &str, _api_name: &str) -> Result<(), AnyError> {
+  fn check_sys(
+    &mut self,
+    _kind: &str,
+    _api_name: &str,
+  ) -> Result<(), AnyError> {
     Ok(())
   }
 }
 
+impl NodePermissions for deno_permissions::PermissionsContainer {
+  #[inline(always)]
+  fn check_net_url(
+    &mut self,
+    url: &Url,
+    api_name: &str,
+  ) -> Result<(), AnyError> {
+    deno_permissions::PermissionsContainer::check_net_url(self, url, api_name)
+  }
+
+  #[inline(always)]
+  fn check_read_with_api_name(
+    &mut self,
+    path: &Path,
+    api_name: Option<&str>,
+  ) -> Result<(), AnyError> {
+    deno_permissions::PermissionsContainer::check_read_with_api_name(
+      self, path, api_name,
+    )
+  }
+
+  #[inline(always)]
+  fn check_write_with_api_name(
+    &mut self,
+    path: &Path,
+    api_name: Option<&str>,
+  ) -> Result<(), AnyError> {
+    deno_permissions::PermissionsContainer::check_write_with_api_name(
+      self, path, api_name,
+    )
+  }
+
+  fn check_sys(&mut self, kind: &str, api_name: &str) -> Result<(), AnyError> {
+    deno_permissions::PermissionsContainer::check_sys(self, kind, api_name)
+  }
+}
+
 #[allow(clippy::disallowed_types)]
 pub type NpmResolverRc = deno_fs::sync::MaybeArc<dyn NpmResolver>;
 
@@ -146,7 +187,7 @@ pub trait NpmResolver: std::fmt::Debug + MaybeSend + MaybeSync {
 
   fn ensure_read_permission(
     &self,
-    permissions: &dyn NodePermissions,
+    permissions: &mut dyn NodePermissions,
     path: &Path,
   ) -> Result<(), AnyError>;
 }
@@ -582,18 +623,21 @@ deno_core::extension!(deno_node,
     "node:zlib" = "zlib.ts",
   ],
   options = {
+    maybe_node_resolver: Option<NodeResolverRc>,
     maybe_npm_resolver: Option<NpmResolverRc>,
     fs: deno_fs::FileSystemRc,
   },
   state = |state, options| {
-    let fs = options.fs;
-    state.put(fs.clone());
-    if let Some(npm_resolver) = options.maybe_npm_resolver {
+    // you should provide both of these or neither
+    debug_assert_eq!(options.maybe_node_resolver.is_some(), options.maybe_npm_resolver.is_some());
+
+    state.put(options.fs.clone());
+
+    if let Some(node_resolver) = &options.maybe_node_resolver {
+      state.put(node_resolver.clone());
+    }
+    if let Some(npm_resolver) = &options.maybe_npm_resolver {
       state.put(npm_resolver.clone());
-      state.put(Rc::new(NodeResolver::new(
-        fs,
-        npm_resolver,
-      )))
     }
   },
   global_template_middleware = global_template_middleware,
diff --git a/ext/node/ops/require.rs b/ext/node/ops/require.rs
index 176d64e56..de2687001 100644
--- a/ext/node/ops/require.rs
+++ b/ext/node/ops/require.rs
@@ -16,10 +16,11 @@ use std::path::PathBuf;
 use std::rc::Rc;
 
 use crate::resolution;
+use crate::resolution::NodeResolverRc;
+use crate::AllowAllNodePermissions;
 use crate::NodeModuleKind;
 use crate::NodePermissions;
 use crate::NodeResolutionMode;
-use crate::NodeResolver;
 use crate::NpmResolverRc;
 use crate::PackageJson;
 
@@ -30,8 +31,8 @@ fn ensure_read_permission<P>(
 where
   P: NodePermissions + 'static,
 {
-  let resolver = state.borrow::<NpmResolverRc>();
-  let permissions = state.borrow::<P>();
+  let resolver = state.borrow::<NpmResolverRc>().clone();
+  let permissions = state.borrow_mut::<P>();
   resolver.ensure_read_permission(permissions, file_path)
 }
 
@@ -386,12 +387,11 @@ where
     return Ok(None);
   }
 
-  let node_resolver = state.borrow::<Rc<NodeResolver>>();
-  let permissions = state.borrow::<P>();
+  let node_resolver = state.borrow::<NodeResolverRc>();
   let pkg = node_resolver
     .get_closest_package_json(
       &Url::from_file_path(parent_path.unwrap()).unwrap(),
-      permissions,
+      &mut AllowAllNodePermissions,
     )
     .ok()
     .flatten();
@@ -428,7 +428,6 @@ where
       NodeModuleKind::Cjs,
       resolution::REQUIRE_CONDITIONS,
       NodeResolutionMode::Execution,
-      permissions,
     )?;
     Ok(Some(if r.scheme() == "file" {
       url_to_file_path_string(&r)?
@@ -483,8 +482,7 @@ where
 {
   let fs = state.borrow::<FileSystemRc>();
   let npm_resolver = state.borrow::<NpmResolverRc>();
-  let node_resolver = state.borrow::<Rc<NodeResolver>>();
-  let permissions = state.borrow::<P>();
+  let node_resolver = state.borrow::<NodeResolverRc>();
 
   let pkg_path = if npm_resolver
     .in_npm_package_at_file_path(&PathBuf::from(&modules_path))
@@ -501,7 +499,7 @@ where
     }
   };
   let pkg = node_resolver.load_package_json(
-    permissions,
+    &mut AllowAllNodePermissions,
     PathBuf::from(&pkg_path).join("package.json"),
   )?;
 
@@ -515,7 +513,6 @@ where
       NodeModuleKind::Cjs,
       resolution::REQUIRE_CONDITIONS,
       NodeResolutionMode::Execution,
-      permissions,
     )?;
     Ok(Some(if r.scheme() == "file" {
       url_to_file_path_string(&r)?
@@ -540,8 +537,8 @@ where
     state,
     PathBuf::from(&filename).parent().unwrap(),
   )?;
-  let node_resolver = state.borrow::<Rc<NodeResolver>>();
-  let permissions = state.borrow::<P>();
+  let node_resolver = state.borrow::<NodeResolverRc>().clone();
+  let permissions = state.borrow_mut::<P>();
   node_resolver
     .get_closest_package_json(
       &Url::from_file_path(filename).unwrap(),
@@ -559,8 +556,8 @@ pub fn op_require_read_package_scope<P>(
 where
   P: NodePermissions + 'static,
 {
-  let node_resolver = state.borrow::<Rc<NodeResolver>>();
-  let permissions = state.borrow::<P>();
+  let node_resolver = state.borrow::<NodeResolverRc>().clone();
+  let permissions = state.borrow_mut::<P>();
   let package_json_path = PathBuf::from(package_json_path);
   node_resolver
     .load_package_json(permissions, package_json_path)
@@ -580,10 +577,11 @@ where
 {
   let referrer_path = PathBuf::from(&referrer_filename);
   ensure_read_permission::<P>(state, &referrer_path)?;
-  let node_resolver = state.borrow::<Rc<NodeResolver>>();
-  let permissions = state.borrow::<P>();
-  let Some(pkg) = node_resolver
-    .get_closest_package_json_from_path(&referrer_path, permissions)?
+  let node_resolver = state.borrow::<NodeResolverRc>();
+  let Some(pkg) = node_resolver.get_closest_package_json_from_path(
+    &referrer_path,
+    &mut AllowAllNodePermissions,
+  )?
   else {
     return Ok(None);
   };
@@ -598,7 +596,6 @@ where
       Some(&pkg),
       resolution::REQUIRE_CONDITIONS,
       NodeResolutionMode::Execution,
-      permissions,
     )?;
     Ok(Some(url_to_file_path_string(&url)?))
   } else {
diff --git a/ext/node/ops/worker_threads.rs b/ext/node/ops/worker_threads.rs
index 18a4157d4..182ba0118 100644
--- a/ext/node/ops/worker_threads.rs
+++ b/ext/node/ops/worker_threads.rs
@@ -8,11 +8,10 @@ use deno_core::OpState;
 use deno_fs::FileSystemRc;
 use std::path::Path;
 use std::path::PathBuf;
-use std::rc::Rc;
 
 use crate::resolution;
+use crate::resolution::NodeResolverRc;
 use crate::NodePermissions;
-use crate::NodeResolver;
 use crate::NpmResolverRc;
 
 fn ensure_read_permission<P>(
@@ -22,8 +21,8 @@ fn ensure_read_permission<P>(
 where
   P: NodePermissions + 'static,
 {
-  let resolver = state.borrow::<NpmResolverRc>();
-  let permissions = state.borrow::<P>();
+  let resolver = state.borrow::<NpmResolverRc>().clone();
+  let permissions = state.borrow_mut::<P>();
   resolver.ensure_read_permission(permissions, file_path)
 }
 
@@ -63,7 +62,7 @@ where
   if !fs.exists_sync(&url_path) {
     return Err(generic_error(format!("File not found [{:?}]", url_path)));
   }
-  let node_resolver = state.borrow::<Rc<NodeResolver>>();
+  let node_resolver = state.borrow::<NodeResolverRc>();
   match node_resolver.url_to_node_resolution(url)? {
     resolution::NodeResolution::Esm(u) => Ok(u.to_string()),
     resolution::NodeResolution::CommonJs(u) => wrap_cjs(u),
diff --git a/ext/node/package_json.rs b/ext/node/package_json.rs
index d4ffc80d6..adae7d634 100644
--- a/ext/node/package_json.rs
+++ b/ext/node/package_json.rs
@@ -65,7 +65,7 @@ impl PackageJson {
   pub fn load(
     fs: &dyn deno_fs::FileSystem,
     resolver: &dyn NpmResolver,
-    permissions: &dyn NodePermissions,
+    permissions: &mut dyn NodePermissions,
     path: PathBuf,
   ) -> Result<Rc<PackageJson>, AnyError> {
     resolver.ensure_read_permission(permissions, &path)?;
diff --git a/ext/node/resolution.rs b/ext/node/resolution.rs
index 37598810d..834b465cd 100644
--- a/ext/node/resolution.rs
+++ b/ext/node/resolution.rs
@@ -154,7 +154,6 @@ impl NodeResolver {
     specifier: &str,
     referrer: &ModuleSpecifier,
     mode: NodeResolutionMode,
-    permissions: &dyn NodePermissions,
   ) -> Result<Option<NodeResolution>, AnyError> {
     // Note: if we are here, then the referrer is an esm module
     // TODO(bartlomieju): skipped "policy" part as we don't plan to support it
@@ -187,13 +186,8 @@ impl NodeResolver {
       }
     }
 
-    let url = self.module_resolve(
-      specifier,
-      referrer,
-      DEFAULT_CONDITIONS,
-      mode,
-      permissions,
-    )?;
+    let url =
+      self.module_resolve(specifier, referrer, DEFAULT_CONDITIONS, mode)?;
     let url = match url {
       Some(url) => url,
       None => return Ok(None),
@@ -204,12 +198,8 @@ impl NodeResolver {
         let path = url.to_file_path().unwrap();
         // todo(16370): the module kind is not correct here. I think we need
         // typescript to tell us if the referrer is esm or cjs
-        let maybe_decl_url = self.path_to_declaration_url(
-          path,
-          referrer,
-          NodeModuleKind::Esm,
-          permissions,
-        )?;
+        let maybe_decl_url =
+          self.path_to_declaration_url(path, referrer, NodeModuleKind::Esm)?;
         match maybe_decl_url {
           Some(url) => url,
           None => return Ok(None),
@@ -229,7 +219,6 @@ impl NodeResolver {
     referrer: &ModuleSpecifier,
     conditions: &[&str],
     mode: NodeResolutionMode,
-    permissions: &dyn NodePermissions,
   ) -> Result<Option<ModuleSpecifier>, AnyError> {
     // note: if we're here, the referrer is an esm module
     let url = if should_be_treated_as_relative_or_absolute_path(specifier) {
@@ -242,13 +231,13 @@ impl NodeResolver {
           file_path,
           referrer,
           NodeModuleKind::Esm,
-          permissions,
         )?
       } else {
         Some(resolved_specifier)
       }
     } else if specifier.starts_with('#') {
-      let pkg_config = self.get_closest_package_json(referrer, permissions)?;
+      let pkg_config = self
+        .get_closest_package_json(referrer, &mut AllowAllNodePermissions)?;
       Some(self.package_imports_resolve(
         specifier,
         referrer,
@@ -256,7 +245,6 @@ impl NodeResolver {
         pkg_config.as_deref(),
         conditions,
         mode,
-        permissions,
       )?)
     } else if let Ok(resolved) = Url::parse(specifier) {
       Some(resolved)
@@ -267,7 +255,6 @@ impl NodeResolver {
         NodeModuleKind::Esm,
         conditions,
         mode,
-        permissions,
       )?
     };
     Ok(match url {
@@ -337,11 +324,12 @@ impl NodeResolver {
     package_subpath: Option<&str>,
     referrer: &ModuleSpecifier,
     mode: NodeResolutionMode,
-    permissions: &dyn NodePermissions,
   ) -> Result<Option<NodeResolution>, AnyError> {
     let package_json_path = package_dir.join("package.json");
-    let package_json =
-      self.load_package_json(permissions, package_json_path.clone())?;
+    let package_json = self.load_package_json(
+      &mut AllowAllNodePermissions,
+      package_json_path.clone(),
+    )?;
     let node_module_kind = NodeModuleKind::Esm;
     let package_subpath = package_subpath
       .map(|s| format!("./{s}"))
@@ -354,7 +342,6 @@ impl NodeResolver {
         node_module_kind,
         DEFAULT_CONDITIONS,
         mode,
-        permissions,
       )
       .with_context(|| {
         format!(
@@ -376,7 +363,6 @@ impl NodeResolver {
             path,
             referrer,
             node_module_kind,
-            permissions,
           )? {
             Some(url) => url,
             None => return Ok(None),
@@ -397,8 +383,10 @@ impl NodeResolver {
     package_folder: &Path,
   ) -> Result<Vec<String>, AnyError> {
     let package_json_path = package_folder.join("package.json");
-    let package_json = self
-      .load_package_json(&AllowAllNodePermissions, package_json_path.clone())?;
+    let package_json = self.load_package_json(
+      &mut AllowAllNodePermissions,
+      package_json_path.clone(),
+    )?;
 
     Ok(match &package_json.bin {
       Some(Value::String(_)) => {
@@ -420,8 +408,10 @@ impl NodeResolver {
     sub_path: Option<&str>,
   ) -> Result<NodeResolution, AnyError> {
     let package_json_path = package_folder.join("package.json");
-    let package_json = self
-      .load_package_json(&AllowAllNodePermissions, package_json_path.clone())?;
+    let package_json = self.load_package_json(
+      &mut AllowAllNodePermissions,
+      package_json_path.clone(),
+    )?;
     let bin_entry = resolve_bin_entry_value(&package_json, sub_path)?;
     let url = to_file_specifier(&package_folder.join(bin_entry));
 
@@ -440,7 +430,7 @@ impl NodeResolver {
       Ok(NodeResolution::Esm(url))
     } else if url_str.ends_with(".js") || url_str.ends_with(".d.ts") {
       let maybe_package_config =
-        self.get_closest_package_json(&url, &AllowAllNodePermissions)?;
+        self.get_closest_package_json(&url, &mut AllowAllNodePermissions)?;
       match maybe_package_config {
         Some(c) if c.typ == "module" => Ok(NodeResolution::Esm(url)),
         Some(_) => Ok(NodeResolution::CommonJs(url)),
@@ -467,7 +457,6 @@ impl NodeResolver {
     path: PathBuf,
     referrer: &ModuleSpecifier,
     referrer_kind: NodeModuleKind,
-    permissions: &dyn NodePermissions,
   ) -> Result<Option<ModuleSpecifier>, AnyError> {
     fn probe_extensions(
       fs: &dyn deno_fs::FileSystem,
@@ -528,7 +517,7 @@ impl NodeResolver {
     if self.fs.is_dir_sync(&path) {
       let package_json_path = path.join("package.json");
       if let Ok(pkg_json) =
-        self.load_package_json(permissions, package_json_path)
+        self.load_package_json(&mut AllowAllNodePermissions, package_json_path)
       {
         let maybe_resolution = self.resolve_package_subpath(
           &pkg_json,
@@ -540,7 +529,6 @@ impl NodeResolver {
             NodeModuleKind::Cjs => REQUIRE_CONDITIONS,
           },
           NodeResolutionMode::Types,
-          permissions,
         )?;
         if let Some(resolution) = maybe_resolution {
           return Ok(Some(resolution));
@@ -572,7 +560,6 @@ impl NodeResolver {
     referrer_pkg_json: Option<&PackageJson>,
     conditions: &[&str],
     mode: NodeResolutionMode,
-    permissions: &dyn NodePermissions,
   ) -> Result<ModuleSpecifier, AnyError> {
     if name == "#" || name.starts_with("#/") || name.ends_with('/') {
       let reason = "is not a valid internal imports specifier name";
@@ -601,7 +588,6 @@ impl NodeResolver {
               true,
               conditions,
               mode,
-              permissions,
             )?;
             if let Some(resolved) = maybe_resolved {
               return Ok(resolved);
@@ -644,7 +630,6 @@ impl NodeResolver {
                 true,
                 conditions,
                 mode,
-                permissions,
               )?;
               if let Some(resolved) = maybe_resolved {
                 return Ok(resolved);
@@ -675,7 +660,6 @@ impl NodeResolver {
     internal: bool,
     conditions: &[&str],
     mode: NodeResolutionMode,
-    permissions: &dyn NodePermissions,
   ) -> Result<ModuleSpecifier, AnyError> {
     if !subpath.is_empty() && !pattern && !target.ends_with('/') {
       return Err(throw_invalid_package_target(
@@ -715,7 +699,6 @@ impl NodeResolver {
               referrer_kind,
               conditions,
               mode,
-              permissions,
             ) {
               Ok(Some(url)) => Ok(url),
               Ok(None) => Err(generic_error("not found")),
@@ -804,7 +787,6 @@ impl NodeResolver {
     internal: bool,
     conditions: &[&str],
     mode: NodeResolutionMode,
-    permissions: &dyn NodePermissions,
   ) -> Result<Option<ModuleSpecifier>, AnyError> {
     if let Some(target) = target.as_str() {
       let url = self.resolve_package_target_string(
@@ -818,16 +800,10 @@ impl NodeResolver {
         internal,
         conditions,
         mode,
-        permissions,
       )?;
       if mode.is_types() && url.scheme() == "file" {
         let path = url.to_file_path().unwrap();
-        return self.path_to_declaration_url(
-          path,
-          referrer,
-          referrer_kind,
-          permissions,
-        );
+        return self.path_to_declaration_url(path, referrer, referrer_kind);
       } else {
         return Ok(Some(url));
       }
@@ -849,7 +825,6 @@ impl NodeResolver {
           internal,
           conditions,
           mode,
-          permissions,
         );
 
         match resolved_result {
@@ -898,7 +873,6 @@ impl NodeResolver {
             internal,
             conditions,
             mode,
-            permissions,
           )?;
           match resolved {
             Some(resolved) => return Ok(Some(resolved)),
@@ -931,7 +905,6 @@ impl NodeResolver {
     referrer_kind: NodeModuleKind,
     conditions: &[&str],
     mode: NodeResolutionMode,
-    permissions: &dyn NodePermissions,
   ) -> Result<ModuleSpecifier, AnyError> {
     if package_exports.contains_key(package_subpath)
       && package_subpath.find('*').is_none()
@@ -949,7 +922,6 @@ impl NodeResolver {
         false,
         conditions,
         mode,
-        permissions,
       )?;
       return match resolved {
         Some(resolved) => Ok(resolved),
@@ -1009,7 +981,6 @@ impl NodeResolver {
         false,
         conditions,
         mode,
-        permissions,
       )?;
       if let Some(resolved) = maybe_resolved {
         return Ok(resolved);
@@ -1038,13 +1009,12 @@ impl NodeResolver {
     referrer_kind: NodeModuleKind,
     conditions: &[&str],
     mode: NodeResolutionMode,
-    permissions: &dyn NodePermissions,
   ) -> Result<Option<ModuleSpecifier>, AnyError> {
     let (package_name, package_subpath, _is_scoped) =
       parse_npm_pkg_name(specifier, referrer)?;
 
     let Some(package_config) =
-      self.get_closest_package_json(referrer, permissions)?
+      self.get_closest_package_json(referrer, &mut AllowAllNodePermissions)?
     else {
       return Ok(None);
     };
@@ -1062,7 +1032,6 @@ impl NodeResolver {
             referrer_kind,
             conditions,
             mode,
-            permissions,
           )
           .map(Some);
       }
@@ -1087,8 +1056,8 @@ impl NodeResolver {
     // ))
 
     // Package match.
-    let package_json =
-      self.load_package_json(permissions, package_json_path)?;
+    let package_json = self
+      .load_package_json(&mut AllowAllNodePermissions, package_json_path)?;
     self.resolve_package_subpath(
       &package_json,
       &package_subpath,
@@ -1096,7 +1065,6 @@ impl NodeResolver {
       referrer_kind,
       conditions,
       mode,
-      permissions,
     )
   }
 
@@ -1109,7 +1077,6 @@ impl NodeResolver {
     referrer_kind: NodeModuleKind,
     conditions: &[&str],
     mode: NodeResolutionMode,
-    permissions: &dyn NodePermissions,
   ) -> Result<Option<ModuleSpecifier>, AnyError> {
     if let Some(exports) = &package_json.exports {
       let result = self.package_exports_resolve(
@@ -1120,7 +1087,6 @@ impl NodeResolver {
         referrer_kind,
         conditions,
         mode,
-        permissions,
       );
       match result {
         Ok(found) => return Ok(Some(found)),
@@ -1131,7 +1097,6 @@ impl NodeResolver {
               referrer,
               referrer_kind,
               mode,
-              permissions,
             );
           }
           return Err(exports_err);
@@ -1144,18 +1109,12 @@ impl NodeResolver {
         referrer,
         referrer_kind,
         mode,
-        permissions,
       );
     }
 
     let file_path = package_json.path.parent().unwrap().join(package_subpath);
     if mode.is_types() {
-      self.path_to_declaration_url(
-        file_path,
-        referrer,
-        referrer_kind,
-        permissions,
-      )
+      self.path_to_declaration_url(file_path, referrer, referrer_kind)
     } else {
       Ok(Some(to_file_specifier(&file_path)))
     }
@@ -1164,7 +1123,7 @@ impl NodeResolver {
   pub fn get_closest_package_json(
     &self,
     url: &ModuleSpecifier,
-    permissions: &dyn NodePermissions,
+    permissions: &mut dyn NodePermissions,
   ) -> Result<Option<Rc<PackageJson>>, AnyError> {
     let Ok(file_path) = url.to_file_path() else {
       return Ok(None);
@@ -1175,7 +1134,7 @@ impl NodeResolver {
   pub fn get_closest_package_json_from_path(
     &self,
     file_path: &Path,
-    permissions: &dyn NodePermissions,
+    permissions: &mut dyn NodePermissions,
   ) -> Result<Option<Rc<PackageJson>>, AnyError> {
     let Some(package_json_path) =
       self.get_closest_package_json_path(file_path)?
@@ -1212,7 +1171,7 @@ impl NodeResolver {
 
   pub(super) fn load_package_json(
     &self,
-    permissions: &dyn NodePermissions,
+    permissions: &mut dyn NodePermissions,
     package_json_path: PathBuf,
   ) -> Result<Rc<PackageJson>, AnyError> {
     PackageJson::load(
@@ -1229,7 +1188,6 @@ impl NodeResolver {
     referrer: &ModuleSpecifier,
     referrer_kind: NodeModuleKind,
     mode: NodeResolutionMode,
-    permissions: &dyn NodePermissions,
   ) -> Result<Option<ModuleSpecifier>, AnyError> {
     let maybe_main = if mode.is_types() {
       match package_json.types.as_ref() {
@@ -1239,12 +1197,8 @@ impl NodeResolver {
           // a corresponding declaration file
           if let Some(main) = package_json.main(referrer_kind) {
             let main = package_json.path.parent().unwrap().join(main).clean();
-            let maybe_decl_url = self.path_to_declaration_url(
-              main,
-              referrer,
-              referrer_kind,
-              permissions,
-            )?;
+            let maybe_decl_url =
+              self.path_to_declaration_url(main, referrer, referrer_kind)?;
             if let Some(path) = maybe_decl_url {
               return Ok(Some(path));
             }