Steve
Steve•4w ago

How to use permissions with node scripts

I wanted to setup an Angular project with deno and i noticed that if i run deno task ng or deno task serve it just runs those commands from the package.json without using the deno permission system. I guess that makes sense for compatibility reasons but I want to run ng with only the permissions it needs e.g. --allow-read=. --allow-net or something like that. Is there any way of doing that? Are other people doing Angular 19 projects with deno and have a working setup with minimal permissions?
6 Replies
bartlomieju
bartlomieju•4w ago
What do these script look like?
Steve
SteveOP•3w ago
The scripts would just be something like 
 "scripts": {
    "ng": "ng",
    "start": "ng serve",
    "build": "ng build",
    "test": "ng test",
  },
 "scripts": {
    "ng": "ng",
    "start": "ng serve",
    "build": "ng build",
    "test": "ng test",
  },
louislam
louislam•3w ago
You have to check ng is pointing to which js file in the angular's package.json. In this case, it should be @angular/cli/bin/ng.js https://www.npmjs.com/package/@angular/cli?activeTab=code So I guess you can run by 
deno run --allow-all ./node_modules/@angular/cli/bin/ng.js serve
deno run --allow-all ./node_modules/@angular/cli/bin/ng.js serve
bartlomieju
bartlomieju•3w ago
Yeah, the above is the correct invocation, you can then tweak the permissions you want to use
Mrcool 🇵🇸
Mrcool 🇵🇸•3w ago
This seems to only place where using all permissions is hidden, at least starting deno repl (with deno) warns about using all permissions, and running post install scripts makes the user use --allow-scripts, but this one which is of frequent usage have no indication at all But I guess scripts are just shell commands, its not only js, so its understandable why it is the way it is
Steve
SteveOP•3w ago
@Mrcool 🇵🇸 yes that's what i was thinking when using package.json you can run javascript with full permissions without an opt in. i was hoping to be able to set some flag in the config to reduce the permissions of all package.json scripts

Did you find this page helpful?