feat(permission): Enhance --allow-env to Support Prefix, Suffix Wildcard Matching

cli/args/flags.rs

@@ -1,5 +1,8 @@
 // Copyright 2018-2024 the Deno authors. All rights reserved. MIT license.
 
+use crate::args::flags_net;
+use crate::args::resolve_no_prompt;
+use crate::util::fs::canonicalize_path;
 use std::collections::HashSet;
 use std::env;
 use std::ffi::OsString;
@@ -40,11 +43,6 @@ use log::Level;
 use serde::Deserialize;
 use serde::Serialize;
 
-use crate::args::resolve_no_prompt;
-use crate::util::fs::canonicalize_path;
-
-use super::flags_net;
-
 #[derive(Clone, Debug, Default, Eq, PartialEq)]
 pub enum ConfigFlag {
   #[default]

runtime/permissions/lib.rs

@@ -969,6 +969,20 @@ impl EnvDescriptor {
   pub fn new(env: impl AsRef<str>) -> Self {
     Self(EnvVarName::new(env))
   }
+  pub fn matches(&self, env: &str) -> bool {
+    let pattern = self.0.as_ref();
+    if let Some(prefix) = pattern.strip_suffix('*') {
+      if env.starts_with(prefix) {
+        return true;
+      }
+    }
+    if let Some(suffix) = pattern.strip_prefix('*') {
+      if env.ends_with(suffix) {
+        return true;
+      }
+    }
+    env == pattern
+  }
 }
 
 impl QueryDescriptor for EnvDescriptor {
@@ -1558,6 +1572,21 @@ impl UnaryPermission<EnvDescriptor> {
     api_name: Option<&str>,
   ) -> Result<(), AnyError> {
     skip_check_if_is_permission_fully_granted!(self);
+
+    let env_desc = EnvDescriptor::new(env);
+    let mut matched = false;
+
+    for desc in &self.granted_list {
+      if desc.matches(env) {
+        matched = true;
+        break;
+      }
+    }
+
+    if matched {
+      self.granted_list.insert(env_desc);
+    }
+
     self.check_desc(Some(&EnvDescriptor::new(env)), false, api_name)
   }
 

tests/specs/permission/process_env_permissions/__test__.jsonc

@@ -0,0 +1,30 @@
+{
+  "tempDir": true,
+  "tests": {
+    "deno_env_wildcard_tests": {
+      "envs": {
+        "MYAPP_HELLO": "Hello\tworld,",
+        "MYAPP_GOODBYE": "farewell",
+        "OTHER_VAR": "ignore"
+      },
+      "steps": [
+        {
+          "args": "run --allow-env=MYAPP_* main.js",
+          "output": "Hello\tworld,\nfarewell\ndone\n"
+        },
+        {
+          "args": "run --allow-env=*_HELLO,*_GOODBYE,*_DONE,*_TEST main.js",
+          "output": "Hello\tworld,\nfarewell\ndone\n"
+        },
+        {
+          "args": "run --allow-env main.js",
+          "output": "Hello\tworld,\nfarewell\ndone\n"
+        },
+        {
+          "args": "run --allow-env=MYAPP_HELLO,MYAPP_GOODBYE,MYAPP_TEST,MYAPP_DONE main.js",
+          "output": "Hello\tworld,\nfarewell\ndone\n"
+        }
+      ]
+    }
+  }
+}

tests/specs/permission/process_env_permissions/main.js

@@ -0,0 +1,5 @@
+console.log(Deno.env.get("MYAPP_HELLO"));
+console.log(Deno.env.get("MYAPP_GOODBYE"));
+Deno.env.set("MYAPP_TEST", "done");
+Deno.env.set("MYAPP_DONE", "done");
+console.log(Deno.env.get("MYAPP_DONE"));