Node.js 实验性权限模型使用指南：安全控制文件访问

// app.js
console.log(process.permission.has("fs.read"));

node app.js

console.log(process.permission.has("fs.read"));
                               ^

TypeError: Cannot read properties of undefined (reading 'has')
    at file:///path/to/your/app.js:1:32
    # ... (其他堆栈信息)

// app.js
console.log(process.permission.has("fs.read"));

node --experimental-permission app.js

node:internal/modules/cjs/loader:179
  const result = internalModuleStat(filename);
                 ^

Error: Access to this API has been restricted
    at stat (node:internal/modules/cjs/loader:179:18)
    at Module._findPath (node:internal/modules/cjs/loader:651:16)
    # ... (其他堆栈信息)
{
  code: 'ERR_ACCESS_DENIED',
  permission: 'FileSystemRead',
  resource: '/path/to/your/app/app.js'
}

your-app/
├── index.js
└── a.json

{
  "name": "lin"
}

// index.js
const fs = require('fs');
const path = require('path');

const aJsonPath = path.resolve(__dirname, './a.json');
const bJsonPath = path.resolve(__dirname, './b.json'); // 假设会创建一个b.json

console.log('Has fs.read permission?', process.permission.has("fs.read"));
console.log('Has fs.write permission?', process.permission.has("fs.write"));

// 尝试读取文件
try {
  const content = fs.readFileSync(aJsonPath, 'utf-8');
  console.log(`JSON content of ${path.basename(aJsonPath)}:`, content);
} catch (error) {
  if (error.code === 'ERR_ACCESS_DENIED') {
    console.error(`Error reading ${path.basename(aJsonPath)}: Access denied.`);
  } else {
    console.error(`Error reading ${path.basename(aJsonPath)}:`, error.message);
  }
}

// 尝试写入文件
try {
  fs.writeFileSync(bJsonPath, JSON.stringify({ status: 'ok' }));
  console.log(`Successfully wrote to ${path.basename(bJsonPath)}`);
} catch (error) {
  if (error.code === 'ERR_ACCESS_DENIED') {
    console.error(`Error writing to ${path.basename(bJsonPath)}: Access denied.`);
  } else {
    console.error(`Error writing to ${path.basename(bJsonPath)}:`, error.message);
  }
}

node --experimental-permission --allow-fs-read=* --allow-fs-write=* index.js

Has fs.read permission? true
Has fs.write permission? true
JSON content of a.json: {
  "name": "lin"
}
Successfully wrote to b.json

node --experimental-permission \
     --allow-fs-read=/home/user/my-app/a.json,/home/user/my-app/index.js \
     --allow-fs-write=/home/user/my-app/b.json \
     /home/user/my-app/index.js

node --experimental-permission \
     --allow-fs-read=/home/user/my-app/a.json,/home/user/my-app/index.js \
     /home/user/my-app/index.js

Has fs.read permission? true
Has fs.write permission? false
JSON content of a.json: {
  "name": "lin"
}
Error writing to b.json: Access denied.