Granular permission scoping in Deno - Step-by-Step Execution

Concept Flow - Granular permission scoping

Start Program

↓

Request Permissions

↓

Check Requested Permissions

↓

Grant Allowed Permissions

↓

Run Code with Permissions

↓

Deny Disallowed Permissions

↓

Handle Permission Denial

↓

End or Retry

The program starts by requesting specific permissions. It checks which are allowed, grants those, denies others, then runs code accordingly.

Execution Sample

Deno

const granted = await Deno.permissions.request({ name: "read", path: "/data" });
if (granted.state === "granted") {
  const data = await Deno.readTextFile("/data/info.txt");
  console.log(data);
} else {
  console.log("Permission denied.");
}

This code requests read permission for a specific path, reads a file if allowed, or logs denial.

Execution Table

Step	Action	Permission Requested	Permission State	Code Path Taken	Output
1	Request permission	read /data	prompt	Waiting for user decision
2	User grants permission	read /data	granted	Read file and log content
3	Read file	read /data	granted	Read /data/info.txt	File content logged
4	End	-	-	-	Program ends successfully

💡 Permission granted, file read, program ends normally

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	Final
granted.state	undefined	prompt	granted	granted	granted
data	undefined	undefined	undefined	"File content string"	"File content string"

Key Moments - 2 Insights

Why does the program wait after requesting permission?

Because the permission state is initially 'prompt' (see Step 1 in execution_table), the program waits for user input before proceeding.

What happens if permission is denied?

If permission is denied, the state would be 'denied' and the else branch runs, logging 'Permission denied.' (not shown in this trace but implied).

Visual Quiz - 3 Questions

Look at the execution_table at Step 2, what is the permission state?

A prompt

B denied

C granted

D unknown

💡 Hint

Check the 'Permission State' column at Step 2 in execution_table

At which step does the program read the file?

A Step 1

B Step 3

C Step 2

D Step 4

💡 Hint

Look at the 'Action' and 'Code Path Taken' columns in execution_table

If the user denied permission, which output would you expect?

A "Permission denied."

B No output

C "File content logged"

D Error thrown

💡 Hint

Consider the else branch in the code sample and what happens when permission.state is not 'granted'

Concept Snapshot

Granular permission scoping in Deno:
- Request specific permission with Deno.permissions.request({name, path})
- Permission state: 'granted', 'denied', or 'prompt'
- Run code only if permission is 'granted'
- Handle denial gracefully
- Enables secure, minimal access control

Full Transcript

This visual trace shows how Deno handles granular permission scoping. The program requests read permission for a specific folder. Initially, the permission state is 'prompt' while waiting for user input. When the user grants permission, the state changes to 'granted'. The program then reads a file and logs its content. If permission was denied, the program would log 'Permission denied.' instead. Variables like 'granted.state' and 'data' change as the program runs. This approach helps keep programs secure by only allowing access to resources explicitly permitted by the user.

Practice

1. What does the --allow-read=./data flag do when running a Deno script?

easy

A. Allows the script to read any file on the system

B. Allows the script to read files only inside the ./data directory

C. Blocks all file reading operations

D. Allows the script to write files inside the ./data directory

Solution

1. Step 1: Understand the --allow-read flag

   The --allow-read flag grants permission to read files. When given a path, it limits reading to that path.

2. Step 2: Analyze the given path ./data

   Since the flag is --allow-read=./data, the script can only read files inside the ./data directory, not outside.

3. Final Answer:

   Allows the script to read files only inside the ./data directory -> Option B

4. Quick Check:

   --allow-read=path limits read to that path [OK]

Hint: Remember: --allow-read=path restricts reading to that path only [OK]

Common Mistakes:

• Thinking it allows reading all files
• Confusing read permission with write permission
• Assuming it blocks all reading

2. Which of the following is the correct syntax to allow network access only to example.com in Deno?

easy

A. deno run --allow-net=example.com script.ts

B. deno run --allow-net example.com script.ts

C. deno run --allow-net:example.com script.ts

D. deno run --allow-net[example.com] script.ts

Solution

1. Step 1: Recall the correct flag format for network permission

   The correct syntax to allow network access to a specific host is --allow-net=host.

2. Step 2: Match the options with the correct syntax

   deno run --allow-net=example.com script.ts uses --allow-net=example.com, which is correct. Other options use incorrect separators or missing equals sign.

3. Final Answer:

   deno run --allow-net=example.com script.ts -> Option A

4. Quick Check:

   Use --allow-net=host for specific network access [OK]

Hint: Use equals sign (=) to specify hosts in --allow-net flag [OK]

Common Mistakes:

• Using space instead of equals sign
• Using colon or brackets instead of equals
• Omitting the host after --allow-net

3. Consider this command: deno run --allow-read=./files --allow-net=api.example.com script.ts. What will happen if script.ts tries to read ./files/data.txt and fetch from api.example.com?

medium

A. Both reading the file and fetching will fail

B. Reading the file will fail, fetching will succeed

C. Reading the file will succeed, fetching will fail

D. Both reading the file and fetching from the API will succeed

Solution

1. Step 1: Check read permission for ./files/data.txt

   The flag --allow-read=./files allows reading any file inside ./files, so reading data.txt is allowed.

2. Step 2: Check network permission for api.example.com

   The flag --allow-net=api.example.com allows network requests only to api.example.com, so fetching from that API is allowed.

3. Final Answer:

   Both reading the file and fetching from the API will succeed -> Option D

4. Quick Check:

   Permissions match actions, so both succeed [OK]

Hint: Match file path and host exactly with permission flags [OK]

Common Mistakes:

• Assuming read permission covers all files
• Assuming --allow-net allows all hosts
• Confusing read and write permissions

4. You run deno run --allow-read=./data script.ts but your script tries to read ./config/settings.json and fails. What is the most likely cause?

medium

A. The script has no network permission

B. The script has no permission to write to ./config

C. The script has no permission to read outside the ./data directory

D. The script has a syntax error in reading files

Solution

1. Step 1: Understand the --allow-read=./data scope

   This flag only allows reading files inside the ./data directory, not outside.

2. Step 2: Analyze the attempted file path ./config/settings.json

   The script tries to read a file outside the allowed ./data directory, so permission is denied.

3. Final Answer:

   The script has no permission to read outside the ./data directory -> Option C

4. Quick Check:

   Permission scope limits file access [OK]

Hint: Check if file path is inside allowed read directory [OK]

Common Mistakes:

• Confusing read and write permissions
• Assuming network permission affects file reading
• Blaming syntax errors for permission issues

5. You want to run a Deno script that reads files only from ./logs and ./configs directories and fetches data only from api.service.com and cdn.service.com. Which command correctly grants these permissions?

hard

A. deno run --allow-read=./logs,./configs --allow-net=api.service.com,cdn.service.com script.ts

B. deno run --allow-read=./logs --allow-read ./configs --allow-net=api.service.com --allow-net=cdn.service.com script.ts

C. deno run --allow-read=./logs ./configs --allow-net=api.service.com cdn.service.com script.ts

D. deno run --allow-read=./logs --allow-net=api.service.com,cdn.service.com script.ts

Solution

1. Step 1: Understand how to specify multiple paths or hosts

   Deno allows multiple paths or hosts in a single flag separated by commas, e.g., --allow-read=path1,path2.

2. Step 2: Analyze each option for correct syntax

   deno run --allow-read=./logs,./configs --allow-net=api.service.com,cdn.service.com script.ts correctly uses commas to list multiple directories and hosts in one flag. deno run --allow-read=./logs --allow-read ./configs --allow-net=api.service.com --allow-net=cdn.service.com script.ts has incorrect syntax (missing = after second --allow-read). Options C and D have incorrect syntax or missing permissions.

3. Final Answer:

   deno run --allow-read=./logs,./configs --allow-net=api.service.com,cdn.service.com script.ts -> Option A

4. Quick Check:

   Use commas to list multiple paths or hosts in one flag [OK]

Hint: Use commas to separate multiple paths or hosts in permission flags [OK]

Common Mistakes:

• Missing the equals sign (=) in permission flags
• Using spaces instead of commas to separate paths
• Omitting one of the required permissions