File system permissions (--allow-read, --allow-write) in Deno - Step-by-Step Execution

Concept Flow - File system permissions (--allow-read, --allow-write)

Start Deno Script

↓

Check --allow-read flag

Yes↓

Allow reading files

No↓

Deny reading files -> Error

↓

Check --allow-write flag

Yes↓

Allow writing files

No↓

Deny writing files -> Error

↓

Script continues or exits

Deno checks if the script has permission to read or write files based on flags. If allowed, it proceeds; if not, it throws an error.

Execution Sample

Deno

const data = await Deno.readTextFile("file.txt");
await Deno.writeTextFile("file.txt", data + " updated");

This code reads a file and writes updated content back, requiring read and write permissions.

Execution Table

Step	Action	Permission Check	Result	Effect
1	Attempt to read 'file.txt'	--allow-read present	Allowed	File content read successfully
2	Attempt to write to 'file.txt'	--allow-write present	Allowed	File updated successfully
3	Run script without --allow-read	No --allow-read	Denied	Error: Permission denied for reading
4	Run script without --allow-write	No --allow-write	Denied	Error: Permission denied for writing

💡 Execution stops with error if required permission flag is missing

Variable Tracker

Variable	Start	After Read	After Write	Final
data	undefined	"file content"	"file content updated"	"file content updated"

Key Moments - 2 Insights

Why does the script fail when trying to read a file without --allow-read?

Because Deno enforces security by default, it blocks file reading unless the --allow-read flag is given, as shown in execution_table row 3.

What happens if you have --allow-read but not --allow-write and try to write a file?

The script throws a permission denied error on writing, as shown in execution_table row 4, because --allow-write is required separately.

Visual Quiz - 3 Questions

Look at the execution table, what is the result of step 1 when --allow-read is present?

A Allowed

B Denied

C Error thrown

D No effect

💡 Hint

Check the 'Permission Check' and 'Result' columns in row 1 of the execution_table

At which step does the script stop due to missing permission?

A Step 2

B Step 3

C Step 1

D Step 4

💡 Hint

Look for 'Denied' and 'Error' in the execution_table rows 3 and 4

If you add --allow-write but remove --allow-read, what will happen at step 1?

A Read allowed

B Write allowed

C Read denied

D No error

💡 Hint

Refer to execution_table row 3 where missing --allow-read causes denial

Concept Snapshot

Deno requires explicit flags for file access:
--allow-read lets scripts read files
--allow-write lets scripts write files
Without these, Deno blocks access and throws errors
Use flags when running scripts to grant permissions
Example: deno run --allow-read --allow-write script.ts

Full Transcript

Deno is a secure runtime that blocks file system access by default. To read files, you must run your script with the --allow-read flag. To write files, you need the --allow-write flag. If these flags are missing, Deno stops the script and shows a permission error. This example reads a file and writes updated content back. The execution table shows what happens step-by-step when permissions are present or missing. Variables like 'data' hold the file content and update after writing. Remember, each permission is checked separately, so missing one causes an error at that step.

Practice

1. What does the --allow-read flag do when running a Deno program?

easy

A. Allows the program to read files or folders specified.

B. Allows the program to write or modify files.

C. Blocks the program from accessing the network.

D. Runs the program without any permissions.

Solution

1. Step 1: Understand the purpose of --allow-read

   This flag grants permission to read files or folders.

2. Step 2: Compare with other flags

   --allow-write is for writing, not reading. Network access is unrelated.

3. Final Answer:

   Allows the program to read files or folders specified. -> Option A

4. Quick Check:

   --allow-read = read permission [OK]

Hint: Read permission means accessing files, not changing them [OK]

Common Mistakes:

• Confusing read permission with write permission
• Thinking it controls network access
• Assuming it grants all permissions

2. Which of the following is the correct way to run a Deno script app.ts with permission to write files?

easy

A. deno run app.ts --allow-write

B. deno run app.ts --allow-read

C. deno --allow-write run app.ts

D. deno run --allow-write app.ts

Solution

1. Step 1: Recall Deno command syntax

   The flags come immediately after deno run and before the script name.

2. Step 2: Identify correct flag placement

   deno run --allow-write app.ts is correct; options A and C have wrong order, D uses wrong flag.

3. Final Answer:

   deno run --allow-write app.ts -> Option D

4. Quick Check:

   Flags go after deno run [OK]

Hint: Flags come right after 'deno run', before script name [OK]

Common Mistakes:

• Placing flags after the script name
• Mixing up --allow-read and --allow-write
• Putting flags before 'run'

3. Consider this Deno script readfile.ts that reads data.txt and prints its content. What happens if you run deno run readfile.ts without any flags?

medium

A. The script creates data.txt if missing.

B. The script runs and prints the file content.

C. The script throws a permission error.

D. The script runs but prints nothing.

Solution

1. Step 1: Understand default permissions

   Without --allow-read, Deno denies file reading for safety.

2. Step 2: Predict script behavior

   Trying to read data.txt without permission causes a runtime error.

3. Final Answer:

   The script throws a permission error. -> Option C

4. Quick Check:

   No --allow-read means no file reading [OK]

Hint: No read flag means reading files causes error [OK]

Common Mistakes:

• Assuming Deno allows reading by default
• Thinking the file is created automatically
• Believing the script prints empty content silently

4. You have a Deno script that writes to log.txt. Running deno run --allow-read write.ts causes a permission error when writing. What is the fix?

medium

A. Add --allow-write flag when running the script.

B. Remove --allow-read flag and run without flags.

C. Change the script to read instead of write.

D. Run the script with --allow-net flag.

Solution

1. Step 1: Identify the permission needed

   Writing files requires --allow-write, not just --allow-read.

2. Step 2: Apply correct flag

   Run the script with --allow-write to allow file writing.

3. Final Answer:

   Add --allow-write flag when running the script. -> Option A

4. Quick Check:

   Write permission needs --allow-write [OK]

Hint: Write needs --allow-write, not --allow-read [OK]

Common Mistakes:

• Using only --allow-read for writing
• Removing flags thinking it grants all permissions
• Confusing network permission with file permission

5. You want to run a Deno script that reads from input.txt and writes to output.txt. Which command correctly grants the minimum permissions needed?

hard

A. deno run --allow-net script.ts

B. deno run --allow-read=./input.txt --allow-write=./output.txt script.ts

C. deno run --allow-write=./input.txt --allow-read=./output.txt script.ts

D. deno run --allow-read --allow-write script.ts

Solution

1. Step 1: Understand fine-grained permissions

   Using --allow-read=path and --allow-write=path limits access to specific files.

2. Step 2: Match permissions to files

   Read permission for input.txt and write permission for output.txt is needed.

3. Step 3: Check options

   deno run --allow-read=./input.txt --allow-write=./output.txt script.ts correctly assigns read to input and write to output. deno run --allow-read --allow-write script.ts grants full access, which is more than needed. deno run --allow-write=./input.txt --allow-read=./output.txt script.ts swaps permissions. deno run --allow-net script.ts is unrelated.

4. Final Answer:

   deno run --allow-read=./input.txt --allow-write=./output.txt script.ts -> Option B

5. Quick Check:

   Grant only needed file permissions [OK]

Hint: Use path-limited flags to grant minimal permissions [OK]

Common Mistakes:

• Granting full read/write when only specific files needed
• Swapping read and write paths
• Using unrelated flags like --allow-net