Skip to content

[grace-hopper-day] Update Permission Model documentation to include resource field #1111

Description

@RafaelGSS

Currently the documentation shows

When starting Node.js with --experimental-permission, the ability to access the file system through the fs module, spawn processes, use node:worker_threads and enable the runtime inspector will be restricted.

$ node --experimental-permission index.js
node:internal/modules/cjs/loader:171
  const result = internalModuleStat(filename);
                 ^

Error: Access to this API has been restricted
    at stat (node:internal/modules/cjs/loader:171:18)
    at Module._findPath (node:internal/modules/cjs/loader:627:16)
    at resolveMainPath (node:internal/modules/run_main:19:25)
    at Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:76:24)
    at node:internal/main/run_main_module:23:47 {
  code: 'ERR_ACCESS_DENIED',
  permission: 'FileSystemRead'
} 

However, we've added the resource as one of the parameters sent whenever an ERR_ACCESS_DENIED is thrown. Example:

Error: Access to this API has been restricted
    at stat (node:internal/modules/cjs/loader:178:18)
    at Module._findPath (node:internal/modules/cjs/loader:629:16)
    at resolveMainPath (node:internal/modules/run_main:15:25)
    at Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:76:24)
    at node:internal/main/run_main_module:23:47 {
  code: 'ERR_ACCESS_DENIED',
  permission: 'FileSystemRead',
  resource: '/Users/rafaelgss/repos/os/node/index.js'
}

We should update the Node.js permissions documentation (https://github.com/nodejs/node/blob/e9ff81016dfcf183f4fcc2640497cb8b3365fdd7/doc/api/permissions.md?plain=1#L501) to include the resource field. We can use a generic path such as /home/user/index.js.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions