Add --allow-read (#1689)

Co-authored-by: Greg Altman <g.s.altman@gmail.com>

5 files changed, 30 insertions, 14 deletions

diff --git a/tools/fmt_test.py b/tools/fmt_test.py
index 95733dc20..c8eb83399 100755
--- a/tools/fmt_test.py
+++ b/tools/fmt_test.py
@@ -18,7 +18,9 @@ def fmt_test(deno_exe):
         # Set DENO_DIR to //js/ so we don't have to rely on an intenet
         # connection to download https://deno.land/x/std/prettier/main.ts
         deno_dir = os.path.join(root_path, "js")
-        run([deno_exe, dst, "--fmt"], merge_env={"DENO_DIR": deno_dir})
+        run(
+            [deno_exe, dst, "--fmt", "--allow-read"],
+            merge_env={"DENO_DIR": deno_dir})
         with open(fixed_filename) as f:
             expected = f.read()
         with open(dst) as f:
@@ -31,4 +33,3 @@ def fmt_test(deno_exe):
 
 if __name__ == "__main__":
     fmt_test(sys.argv[1])
-
diff --git a/tools/test_format.py b/tools/test_format.py
index 69c050501..2e26f2199 100755
--- a/tools/test_format.py
+++ b/tools/test_format.py
@@ -30,7 +30,7 @@ def main():
         print "No available deno executable."
         sys.exit(1)
 
-    util.run([deno_path, "--allow-run", "tools/format.ts"])
+    util.run([deno_path, "--allow-read", "--allow-run", "tools/format.ts"])
     output = util.run_output(
         ["git", "status", "-uno", "--porcelain", "--ignore-submodules"])
     if len(output) > 0:
diff --git a/tools/throughput_benchmark.py b/tools/throughput_benchmark.py
index 4f1c02449..9048d3582 100755
--- a/tools/throughput_benchmark.py
+++ b/tools/throughput_benchmark.py
@@ -19,7 +19,7 @@ ADDR = "127.0.0.1:4544"
 def cat(deno_exe, megs):
     size = megs * MB
     start = time.time()
-    cmd = deno_exe + " tests/cat.ts /dev/zero | head -c %s " % size
+    cmd = deno_exe + " tests/cat.ts --allow-read /dev/zero | head -c %s " % size
     print cmd
     subprocess.check_output(cmd, shell=True)
     end = time.time()
diff --git a/tools/unit_tests.py b/tools/unit_tests.py
index 3f9956d43..542db4642 100755
--- a/tools/unit_tests.py
+++ b/tools/unit_tests.py
@@ -43,12 +43,14 @@ def run_unit_test(deno_exe, permStr, flags=None):
 # tests by the special string. permW0N0 means allow-write but not allow-net.
 # See js/test_util.ts for more details.
 def unit_tests(deno_exe):
-    run_unit_test(deno_exe, "permW0N0E0R0")
-    run_unit_test(deno_exe, "permW1N0E0R0", ["--allow-write"])
-    run_unit_test(deno_exe, "permW0N1E0R0", ["--allow-net"])
-    run_unit_test(deno_exe, "permW0N0E1R0", ["--allow-env"])
-    run_unit_test(deno_exe, "permW0N0E0R1", ["--allow-run"])
-    run_unit_test(deno_exe, "permW1N0E0R1", ["--allow-run", "--allow-write"])
+    run_unit_test(deno_exe, "permR0W0N0E0U0")
+    run_unit_test(deno_exe, "permR1W0N0E0U0", ["--allow-read"])
+    run_unit_test(deno_exe, "permR0W1N0E0U0", ["--allow-write"])
+    run_unit_test(deno_exe, "permR1W1N0E0U0", ["--allow-read", "--allow-write"])
+    run_unit_test(deno_exe, "permR1W0N1E0U0", ["--allow-read", "--allow-net"])
+    run_unit_test(deno_exe, "permR0W0N0E1U0", ["--allow-env"])
+    run_unit_test(deno_exe, "permR0W0N0E0U1", ["--allow-run"])
+    run_unit_test(deno_exe, "permR0W1N0E0U1", ["--allow-run", "--allow-write"])
     # TODO We might accidentally miss some. We should be smarter about which we
     # run. Maybe we can use the "filtered out" number to check this.
 
diff --git a/tools/util_test.ts b/tools/util_test.ts
index 79868b440..5a1d33617 100644
--- a/tools/util_test.ts
+++ b/tools/util_test.ts
@@ -1,5 +1,6 @@
 // Copyright 2018-2019 the Deno authors. All rights reserved. MIT license.
-import { test, assertEqual } from "../js/test_util.ts";
+import * as deno from "deno";
+import { assert, testPerm, assertEqual } from "../js/test_util.ts";
 import { findFiles } from "./util.ts";
 
 const testDir = "tools/testdata/find_files_testdata";
@@ -7,7 +8,7 @@ const testDir = "tools/testdata/find_files_testdata";
 // Sorts and replace backslashes with slashes.
 const normalize = files => files.map(f => f.replace(/\\/g, "/")).sort();
 
-test(function testFindFiles() {
+testPerm({ read: true }, function testFindFiles() {
   const files = findFiles([testDir], [".ts", ".md"]);
   assertEqual(normalize(files), [
     `${testDir}/bar.md`,
@@ -23,7 +24,7 @@ test(function testFindFiles() {
   ]);
 });
 
-test(function testFindFilesDepth() {
+testPerm({ read: true }, function testFindFilesDepth() {
   const files = findFiles([testDir], [".ts", ".md"], { depth: 1 });
   assertEqual(normalize(files), [
     `${testDir}/bar.md`,
@@ -33,7 +34,7 @@ test(function testFindFilesDepth() {
   ]);
 });
 
-test(function testFindFilesSkip() {
+testPerm({ read: true }, function testFindFilesSkip() {
   const files = findFiles([testDir], [".ts", ".md"], {
     skip: ["foo.md", "subdir1"]
   });
@@ -47,3 +48,15 @@ test(function testFindFilesSkip() {
     `${testDir}/subdir0/subdir0/foo.ts`
   ]);
 });
+
+testPerm({ read: false }, function testFindFilesPerm() {
+  let caughtError = false;
+  try {
+    const files = findFiles([testDir], [".ts", ".md"]);
+  } catch (e) {
+    caughtError = true;
+    assertEqual(e.kind, deno.ErrorKind.PermissionDenied);
+    assertEqual(e.name, "PermissionDenied");
+  }
+  assert(caughtError);
+});