refactor(permissions): split up Descriptor into Allow, Deny, and Query (#25508)

This makes the permission system more versatile.

3 files changed, 16 insertions, 12 deletions

diff --git a/tests/testdata/run/056_make_temp_file_write_perm.out b/tests/testdata/run/056_make_temp_file_write_perm.out
deleted file mode 100644
index c56aae43f..000000000
--- a/tests/testdata/run/056_make_temp_file_write_perm.out
+++ /dev/null
@@ -1 +0,0 @@
-good [WILDCARD]subdir[WILDCARD]
diff --git a/tests/testdata/run/056_make_temp_file_write_perm.ts b/tests/testdata/run/056_make_temp_file_write_perm.ts
deleted file mode 100644
index c0deda8a2..000000000
--- a/tests/testdata/run/056_make_temp_file_write_perm.ts
+++ /dev/null
@@ -1,9 +0,0 @@
-const path = await Deno.makeTempFile({ dir: `subdir` });
-try {
-  if (!path.match(/^subdir[/\\][^/\\]+/)) {
-    throw Error("bad " + path);
-  }
-  console.log("good", path);
-} finally {
-  await Deno.remove(path);
-}
diff --git a/tests/testdata/workers/read_check_granular_worker.js b/tests/testdata/workers/read_check_granular_worker.js
index 7f2d0f717..01df8ca97 100644
--- a/tests/testdata/workers/read_check_granular_worker.js
+++ b/tests/testdata/workers/read_check_granular_worker.js
@@ -1,4 +1,16 @@
 // deno-fmt-ignore-file
+import { toFileUrl } from "@std/path/to-file-url";
+
+function tryGetCwd() {
+  // will throw in one test but not the other
+  try {
+    return Deno.cwd()
+  } catch {
+    return import.meta.dirname;
+  }
+}
+
+const fooExePath = tryGetCwd() + "/foo" + (Deno.build.os === "windows" ? ".exe" : "");
 postMessage({
   envGlobal: (await Deno.permissions.query({ name: "env" })).state,
   envFoo: (await Deno.permissions.query({ name: "env", variable: "foo" })).state,
@@ -15,11 +27,13 @@ postMessage({
   readGlobal: (await Deno.permissions.query({ name: "read" })).state,
   readFoo: (await Deno.permissions.query({ name: "read", path: new URL("foo", import.meta.url) })).state,
   readBar: (await Deno.permissions.query({ name: "read", path: "bar" })).state,
-  readAbsent: (await Deno.permissions.query({ name: "read", path: "absent" })).state,
+  readAbsent: (await Deno.permissions.query({ name: "read", path: "../absent" })).state,
   runGlobal: (await Deno.permissions.query({ name: "run" })).state,
-  runFoo: (await Deno.permissions.query({ name: "run", command: new URL("foo", import.meta.url) })).state,
+  runFoo: (await Deno.permissions.query({ name: "run", command: toFileUrl(fooExePath) })).state,
+  runFooPath: (await Deno.permissions.query({ name: "run", command: fooExePath })).state,
   runBar: (await Deno.permissions.query({ name: "run", command: "bar" })).state,
   runBaz: (await Deno.permissions.query({ name: "run", command: "./baz" })).state,
+  runUnresolved: (await Deno.permissions.query({ name: "run", command: "unresolved-exec" })).state,
   runAbsent: (await Deno.permissions.query({ name: "run", command: "absent" })).state,
   writeGlobal: (await Deno.permissions.query({ name: "write" })).state,
   writeFoo: (await Deno.permissions.query({ name: "write", path: new URL("foo", import.meta.url) })).state,