refactor(permissions): split up Descriptor into Allow, Deny, and Query (#25508)

This makes the permission system more versatile.

3 files changed, 71 insertions, 0 deletions

diff --git a/tests/specs/permission/make_temp_write_perm/056_make_temp_file_write_perm.out b/tests/specs/permission/make_temp_write_perm/056_make_temp_file_write_perm.out
new file mode 100644
index 000000000..7144e088c
--- /dev/null
+++ b/tests/specs/permission/make_temp_write_perm/056_make_temp_file_write_perm.out
@@ -0,0 +1,4 @@
+good [WILDCARD]subdir[WILDCARD]
+good [WILDCARD]subdir[WILDCARD]
+good [WILDCARD]subdir[WILDCARD]
+good [WILDCARD]subdir[WILDCARD]
diff --git a/tests/specs/permission/make_temp_write_perm/056_make_temp_file_write_perm.ts b/tests/specs/permission/make_temp_write_perm/056_make_temp_file_write_perm.ts
new file mode 100644
index 000000000..28661973c
--- /dev/null
+++ b/tests/specs/permission/make_temp_write_perm/056_make_temp_file_write_perm.ts
@@ -0,0 +1,52 @@
+Deno.mkdirSync("subdir");
+
+// async file
+{
+  const path = await Deno.makeTempFile({ dir: `subdir` });
+  try {
+    if (!path.match(/^subdir[/\\][^/\\]+/)) {
+      throw Error("bad " + path);
+    }
+    console.log("good", path);
+  } finally {
+    await Deno.remove(path);
+  }
+}
+// sync file
+{
+  const path = Deno.makeTempFileSync({ dir: `subdir` });
+  try {
+    if (!path.match(/^subdir[/\\][^/\\]+/)) {
+      throw Error("bad " + path);
+    }
+    console.log("good", path);
+  } finally {
+    await Deno.remove(path);
+  }
+}
+
+// async dir
+{
+  const path = await Deno.makeTempDir({ dir: `subdir` });
+  try {
+    if (!path.match(/^subdir[/\\][^/\\]+/)) {
+      throw Error("bad " + path);
+    }
+    console.log("good", path);
+  } finally {
+    await Deno.remove(path);
+  }
+}
+
+// sync dir
+{
+  const path = Deno.makeTempDirSync({ dir: `subdir` });
+  try {
+    if (!path.match(/^subdir[/\\][^/\\]+/)) {
+      throw Error("bad " + path);
+    }
+    console.log("good", path);
+  } finally {
+    await Deno.remove(path);
+  }
+}
diff --git a/tests/specs/permission/make_temp_write_perm/__test__.jsonc b/tests/specs/permission/make_temp_write_perm/__test__.jsonc
new file mode 100644
index 000000000..80a503215
--- /dev/null
+++ b/tests/specs/permission/make_temp_write_perm/__test__.jsonc
@@ -0,0 +1,15 @@
+{
+  "tempDir": true,
+  "tests": {
+    "reduced_perms": {
+      // this should not expose the full directory
+      "args": "run --quiet --allow-read --allow-write=./subdir/ 056_make_temp_file_write_perm.ts",
+      "output": "056_make_temp_file_write_perm.out"
+    },
+    "all_perms": {
+      // this will work the same as above
+      "args": "run --quiet -A 056_make_temp_file_write_perm.ts",
+      "output": "056_make_temp_file_write_perm.out"
+    }
+  }
+}