[v24.x] Backport permission updates to v24 - #65354
Open
RafaelGSS wants to merge 8 commits into
Open
Conversation
RafaelGSS
added
the
semver-minor
Collaborator
|
Review requested:
|
nodejs-github-bot
added
c++
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## v24.x-staging #65354 +/- ##
=================================================
- Coverage 90.31% 90.28% -0.03%
=================================================
Files 711 711
Lines 228425 228644 +219
Branches 43160 43200 +40
=================================================
+ Hits 206293 206425 +132
- Misses 14090 14100 +10
- Partials 8042 8119 +77
🚀 New features to boost your workflow:
|
RafaelGSS
force-pushed
the
backport-permission-updates-to-v24
branch
from
August 17, 2026 19:57
3b93be2 to
01e422d
Compare
aduh95
approved these changes
Aug 17, 2026
aduh95
added
author ready
github-actions
Bot
removed
the
request-ci
Collaborator
Add --permission-audit flag that enables the permission model in warning-only mode. Instead of throwing ERR_ACCESS_DENIED, it emits a message via diagnostics channel and allows the operation to continue. Publish permission check results to per-scope diagnostics channels (e.g., node:permission-model:fs) so users can observe permission decisions at runtime via diagnostics_channel. Refs: nodejs#59935
Signed-off-by: RafaelGSS <rafael.nunu@hotmail.com> PR-URL: nodejs#62672 Refs: nodejs#62223 Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Signed-off-by: Martin <martin@asymmetric.re> PR-URL: nodejs#64007 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>
The THROW_IF_INSUFFICIENT_PERMISSIONS and ASYNC_THROW_IF_INSUFFICIENT_PERMISSIONS macros called ThrowAccessDenied/AsyncThrowAccessDenied unconditionally and only guarded the `return` with `warning_only()`. ERR_ACCESS_DENIED_IF_INSUFFICIENT_PERMISSIONS had no `warning_only()` guard at all — it always set the access-denied error and returned. As a result, running with `--permission-audit` still produced ERR_ACCESS_DENIED on any denied operation (fs, net, child_process, worker, addon, ffi, inspector, wasi), defeating the audit-only purpose of the flag. Guard the denied-error path behind `!warning_only()` in all three macros. In audit mode, the diagnostics-channel message is published (already done in Permission::is_scope_granted) and execution continues; in enforce mode (`--permission`), behavior is unchanged — the error is raised and the call returns. The tests cover both the direct (top-level) call and an `eval()`-wrapped call: the direct call exercises the normal script path, and the `eval()`-wrapped call exercises the V8 script-context boundary (the diagnostics subscriber is registered in the outer module context while the denied operation runs inside an eval'd string). Refs: nodejs@9ddd1a9 Signed-off-by: Adrian Estrada <edsadr@gmail.com> PR-URL: nodejs#64426 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Expand the documentation for the --permission-audit flag, which was fixed in 51c09ea to no longer throw ERR_ACCESS_DENIED on denied operations. The previous docs only had a two-sentence description in cli.md and no mention in the permissions guide or process.permission API docs. - permissions.md: add enforce vs audit mode overview, a new "Audit Mode" subsection listing the diagnostics channel names (node:permission-model:*) and the { permission, resource } message shape, and a usage example. Update the Runtime API section to mention both --permission and --permission-audit. - cli.md: expand the --permission-audit section to clarify that --permission is not required, --allow-* flags are not needed, errors are not thrown, and --permission takes precedence when both are set. Add a cross-reference from --permission to --permission-audit. - process.md: note that process.permission is available under both flags, and clarify permission.has() and permission.drop() behavior in audit mode. - node.1: regenerated via `make node.1`. Refs: nodejs#64426 Signed-off-by: Adrian Estrada <edsadr@gmail.com> PR-URL: nodejs#64791 Reviewed-By: Aviv Keller <me@aviv.sh> Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Marco Ippolito <marcoippolito54@gmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
Adds unique warning codes of the form PERM0000 for all permissions related SecurityWarnings, so that they can be individually silenced if required. Fixes: nodejs#59818 Signed-off-by: David Evans <davidje13@users.noreply.github.com> PR-URL: nodejs#64414 Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com> Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com> Reviewed-By: James M Snell <jasnell@gmail.com>
RafaelGSS
force-pushed
the
backport-permission-updates-to-v24
branch
from
August 17, 2026 22:56
01e422d to
499c38a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of