feat: add `--allow-import` flag (#25469)

This replaces `--allow-net` for import permissions and makes the
security sandbox stricter by also checking permissions for statically
analyzable imports.

By default, this has a value of
`--allow-import=deno.land:443,jsr.io:443,esm.sh:443,raw.githubusercontent.com:443,gist.githubusercontent.com:443`,
but that can be overridden by providing a different set of hosts.

Additionally, when no value is provided, import permissions are inferred
from the CLI arguments so the following works because
`fresh.deno.dev:443` will be added to the list of allowed imports:

```ts
deno run -A -r https://fresh.deno.dev
```

---------

Co-authored-by: David Sherret <dsherret@gmail.com>

17 files changed, 20 insertions, 35 deletions

diff --git a/tests/testdata/add.ts b/tests/testdata/add.ts
new file mode 100644
index 000000000..8d9b8a22a
--- /dev/null
+++ b/tests/testdata/add.ts
@@ -0,0 +1,3 @@
+export function add(a: number, b: number): number {
+  return a + b;
+}
diff --git a/tests/testdata/dynamic_import/permissions_blob_local.ts b/tests/testdata/dynamic_import/permissions_blob_local.ts
index 9ef4158ce..865c1777a 100644
--- a/tests/testdata/dynamic_import/permissions_blob_local.ts
+++ b/tests/testdata/dynamic_import/permissions_blob_local.ts
@@ -1,4 +1,4 @@
-// This file doesn't really exist, but it doesn't matter, a "PermissionsDenied" error should be thrown.
+// This file doesn't really exist, but it doesn't matter, a "NotCapable" error should be thrown.
 const code = `import "file:///${
   Deno.build.os == "windows" ? "C:/" : ""
 }local_file.ts";`;
diff --git a/tests/testdata/dynamic_import/permissions_blob_remote.ts b/tests/testdata/dynamic_import/permissions_blob_remote.ts
index 1e2c8c21a..569b1f84c 100644
--- a/tests/testdata/dynamic_import/permissions_blob_remote.ts
+++ b/tests/testdata/dynamic_import/permissions_blob_remote.ts
@@ -1,4 +1,3 @@
-// This file doesn't really exist, but it doesn't matter, a "PermissionsDenied" error should be thrown.
 const code = `import "https://example.com/some/file.ts";`;
 const blob = new Blob([code]);
 await import(URL.createObjectURL(blob));
diff --git a/tests/testdata/dynamic_import/permissions_blob_remote.ts.out b/tests/testdata/dynamic_import/permissions_blob_remote.ts.out
index f436a5eb8..20b6839e4 100644
--- a/tests/testdata/dynamic_import/permissions_blob_remote.ts.out
+++ b/tests/testdata/dynamic_import/permissions_blob_remote.ts.out
@@ -1,5 +1,5 @@
-error: Uncaught (in promise) TypeError: Requires net access to "example.com:443", run again with the --allow-net flag
+error: Uncaught (in promise) TypeError: Requires import access to "example.com:443", run again with the --allow-import flag
     at blob:null/[WILDCARD]:1:8
 await import(URL.createObjectURL(blob));
 ^
-    at async file:///[WILDCARD]/dynamic_import/permissions_blob_remote.ts:4:1
+    at async file:///[WILDCARD]/dynamic_import/permissions_blob_remote.ts:3:1
diff --git a/tests/testdata/dynamic_import/permissions_data_local.ts b/tests/testdata/dynamic_import/permissions_data_local.ts
index be4fc1c34..01bff7d7a 100644
--- a/tests/testdata/dynamic_import/permissions_data_local.ts
+++ b/tests/testdata/dynamic_import/permissions_data_local.ts
@@ -1,4 +1,4 @@
-// This file doesn't really exist, but it doesn't matter, a "PermissionsDenied" error should be thrown.
+// This file doesn't really exist, but it doesn't matter, a "NotCapable" error should be thrown.
 const code = `import "file:///${
   Deno.build.os == "windows" ? "C:/" : ""
 }local_file.ts";`;
diff --git a/tests/testdata/dynamic_import/permissions_data_remote.ts.out b/tests/testdata/dynamic_import/permissions_data_remote.ts.out
index 00248e277..67c851205 100644
--- a/tests/testdata/dynamic_import/permissions_data_remote.ts.out
+++ b/tests/testdata/dynamic_import/permissions_data_remote.ts.out
@@ -1,4 +1,4 @@
-error: Uncaught (in promise) TypeError: Requires net access to "example.com:443", run again with the --allow-net flag
+error: Uncaught (in promise) TypeError: Requires import access to "example.com:443", run again with the --allow-import flag
     at data:application/javascript;base64,aW1wb3J0ICJodHRwczovL2V4YW1wbGUuY29tL3NvbWUvZmlsZS50cyI7:1:8
 await import(`data:application/javascript;base64,${btoa(code)}`);
 ^
diff --git a/tests/testdata/dynamic_import/permissions_remote_remote.ts.out b/tests/testdata/dynamic_import/permissions_remote_remote.ts.out
index 0e8b0fc1f..2676d7551 100644
--- a/tests/testdata/dynamic_import/permissions_remote_remote.ts.out
+++ b/tests/testdata/dynamic_import/permissions_remote_remote.ts.out
@@ -1,4 +1,4 @@
-error: Uncaught (in promise) TypeError: Requires net access to "example.com:443", run again with the --allow-net flag
+error: Uncaught (in promise) TypeError: Requires import access to "example.com:443", run again with the --allow-import flag
     at http://localhost:4545/dynamic_import/static_remote.ts:2:8
 await import(
 ^
diff --git a/tests/testdata/run/error_015_dynamic_import_permissions.js b/tests/testdata/run/error_015_dynamic_import_permissions.js
index 47961cf63..bdf423b59 100644
--- a/tests/testdata/run/error_015_dynamic_import_permissions.js
+++ b/tests/testdata/run/error_015_dynamic_import_permissions.js
@@ -1,3 +1,3 @@
 (async () => {
-  await import("" + "http://localhost:4545/subdir/mod4.js");
+  await import("" + "http://example.com/subdir/mod4.js");
 })();
diff --git a/tests/testdata/run/error_015_dynamic_import_permissions.out b/tests/testdata/run/error_015_dynamic_import_permissions.out
index 87ce43e9c..15c26b425 100644
--- a/tests/testdata/run/error_015_dynamic_import_permissions.out
+++ b/tests/testdata/run/error_015_dynamic_import_permissions.out
@@ -1,4 +1,4 @@
-error: Uncaught (in promise) TypeError: Requires net access to "localhost:4545", run again with the --allow-net flag
-  await import("" + "http://localhost:4545/subdir/mod4.js");
+error: Uncaught (in promise) TypeError: Requires import access to "example.com:80", run again with the --allow-import flag
+  await import("" + "http://example.com/subdir/mod4.js");
   ^
     at async file://[WILDCARD]/error_015_dynamic_import_permissions.js:2:3
diff --git a/tests/testdata/run/lock_write_fetch/main.ts b/tests/testdata/run/lock_write_fetch/main.ts
index 4ce631311..d8a50a9aa 100644
--- a/tests/testdata/run/lock_write_fetch/main.ts
+++ b/tests/testdata/run/lock_write_fetch/main.ts
@@ -9,6 +9,7 @@ const fetchProc = await new Deno.Command(Deno.execPath(), {
   stderr: "null",
   args: [
     "cache",
+    "--allow-import",
     "--reload",
     "--lock=lock_write_fetch.json",
     "--cert=tls/RootCA.pem",
@@ -23,6 +24,7 @@ const fetchCheckProc = await new Deno.Command(Deno.execPath(), {
   stderr: "null",
   args: [
     "cache",
+    "--allow-import",
     "--lock=lock_write_fetch.json",
     "--cert=tls/RootCA.pem",
     "run/https_import.ts",
@@ -38,6 +40,7 @@ const runProc = await new Deno.Command(Deno.execPath(), {
   stderr: "null",
   args: [
     "run",
+    "--allow-import",
     "--lock=lock_write_fetch.json",
     "--allow-read",
     "--cert=tls/RootCA.pem",
diff --git a/tests/testdata/run/type_directives_01.ts b/tests/testdata/run/type_directives_01.ts
index 71305824c..2129d90b4 100644
--- a/tests/testdata/run/type_directives_01.ts
+++ b/tests/testdata/run/type_directives_01.ts
@@ -1,3 +1,3 @@
-import * as foo from "http://127.0.0.1:4545/xTypeScriptTypes.js";
+import * as foo from "http://localhost:4545/xTypeScriptTypes.js";
 
 console.log(foo.foo);
diff --git a/tests/testdata/run/type_directives_01.ts.out b/tests/testdata/run/type_directives_01.ts.out
index 77ed3ae26..466218a96 100644
--- a/tests/testdata/run/type_directives_01.ts.out
+++ b/tests/testdata/run/type_directives_01.ts.out
@@ -1,3 +1,3 @@
 [WILDCARD]
-DEBUG TS - host.getSourceFile("http://127.0.0.1:4545/xTypeScriptTypes.d.ts", Latest)
+DEBUG TS - host.getSourceFile("http://localhost:4545/xTypeScriptTypes.d.ts", Latest)
 [WILDCARD]
\ No newline at end of file
diff --git a/tests/testdata/run/type_headers_deno_types.ts b/tests/testdata/run/type_headers_deno_types.ts
index 9670f68cd..197ac1801 100644
--- a/tests/testdata/run/type_headers_deno_types.ts
+++ b/tests/testdata/run/type_headers_deno_types.ts
@@ -12,7 +12,7 @@
  * header.
  */
 
-// @deno-types="http://127.0.0.1:4545/run/type_headers_deno_types.foo.d.ts"
-import { foo } from "http://127.0.0.1:4545/run/type_headers_deno_types.foo.js";
+// @deno-types="http://localhost:4545/run/type_headers_deno_types.foo.d.ts"
+import { foo } from "http://localhost:4545/run/type_headers_deno_types.foo.js";
 
 foo("hello");
diff --git a/tests/testdata/workers/permissions_dynamic_remote.ts b/tests/testdata/workers/permissions_dynamic_remote.ts
deleted file mode 100644
index 54a361bc0..000000000
--- a/tests/testdata/workers/permissions_dynamic_remote.ts
+++ /dev/null
@@ -1,11 +0,0 @@
-new Worker(
-  "http://localhost:4545/workers/dynamic_remote.ts",
-  {
-    type: "module",
-    deno: {
-      permissions: {
-        net: false,
-      },
-    },
-  },
-);
diff --git a/tests/testdata/workers/permissions_dynamic_remote.ts.out b/tests/testdata/workers/permissions_dynamic_remote.ts.out
deleted file mode 100644
index 4fb2c2234..000000000
--- a/tests/testdata/workers/permissions_dynamic_remote.ts.out
+++ /dev/null
@@ -1,6 +0,0 @@
-error: Uncaught (in worker "") (in promise) TypeError: Requires net access to "example.com:443", run again with the --allow-net flag
-await import("" + "https://example.com/some/file.ts");
-^
-    at async http://localhost:4545/workers/dynamic_remote.ts:2:1
-[WILDCARD]error: Uncaught (in promise) Error: Unhandled error in child worker.
-    at Worker.#pollControl [WILDCARD]
diff --git a/tests/testdata/workers/permissions_remote_remote.ts b/tests/testdata/workers/permissions_remote_remote.ts
deleted file mode 100644
index 4df2a8a5d..000000000
--- a/tests/testdata/workers/permissions_remote_remote.ts
+++ /dev/null
@@ -1,3 +0,0 @@
-new Worker("http://localhost:4545/workers/static_remote.ts", {
-  type: "module",
-});
diff --git a/tests/testdata/workers/static_remote.ts b/tests/testdata/workers/static_remote.ts
index 2d6e820fd..6bb64eccd 100644
--- a/tests/testdata/workers/static_remote.ts
+++ b/tests/testdata/workers/static_remote.ts
@@ -1,2 +1,2 @@
-// This file doesn't really exist, but it doesn't matter, a "PermissionsDenied" error should be thrown.
+// This file doesn't really exist, but it doesn't matter, a "NotCapable" error should be thrown.
 import "https://example.com/some/file.ts";