<p dir="auto">It would be useful to have a permission option to limit the imports to a certain domain or directory.</p>
<p dir="auto">Context: Currently loading dynamic imports or worker code requires <code class="notranslate">--allow-read</code> and/or <code class="notranslate">--allow-net</code> flags. Appropriate permissions are checked for entry point as well as all dependent modules. This leads to a situation where even quite simple scenarios require to grant a lot of permissions.</p>
<p dir="auto">Example 1:</p>
<div class="highlight highlight-source-ts notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="// main.ts

console.log(&quot;hello&quot;);
const a = await import(&quot;./dyn_import.ts&quot;);
console.log(a);"><pre class="notranslate"><span class="pl-c">// main.ts</span>

<span class="pl-smi">console</span><span class="pl-kos">.</span><span class="pl-en">log</span><span class="pl-kos">(</span><span class="pl-s">"hello"</span><span class="pl-kos">)</span><span class="pl-kos">;</span>
<span class="pl-k">const</span> <span class="pl-s1">a</span> <span class="pl-c1">=</span> <span class="pl-k">await</span> <span class="pl-k">import</span><span class="pl-kos">(</span><span class="pl-s">"./dyn_import.ts"</span><span class="pl-kos">)</span><span class="pl-kos">;</span>
<span class="pl-smi">console</span><span class="pl-kos">.</span><span class="pl-en">log</span><span class="pl-kos">(</span><span class="pl-s1">a</span><span class="pl-kos">)</span><span class="pl-kos">;</span></pre></div>
<div class="highlight highlight-source-ts notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="// dyn_import.ts
import &quot;./subdir/a.ts&quot;;
import &quot;./subdir/b.ts&quot;;
import { join } from &quot;https://deno.land/std@0.75.0/path/mod.ts&quot;;

export ..."><pre class="notranslate"><span class="pl-c">// dyn_import.ts</span>
<span class="pl-k">import</span> <span class="pl-s">"./subdir/a.ts"</span><span class="pl-kos">;</span>
<span class="pl-k">import</span> <span class="pl-s">"./subdir/b.ts"</span><span class="pl-kos">;</span>
<span class="pl-k">import</span> <span class="pl-kos">{</span> <span class="pl-s1">join</span> <span class="pl-kos">}</span> <span class="pl-k">from</span> <span class="pl-s">"https://deno.land/std@0.75.0/path/mod.ts"</span><span class="pl-kos">;</span>

<span class="pl-k">export</span> ...</pre></div>
<p dir="auto">I above example one needs to run with following flags:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="deno run --allow-read=dyn_import.ts,subdir/ --allow-net=deno.land main.ts"><pre class="notranslate"><code class="notranslate">deno run --allow-read=dyn_import.ts,subdir/ --allow-net=deno.land main.ts
</code></pre></div>
<p dir="auto">Similarly for workers, example 2:</p>
<div class="highlight highlight-source-ts notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="// main.ts

console.log(&quot;hello&quot;);
const worker = new Worker(new URL(&quot;./worker.ts&quot;, import.meta.url), { type: &quot;module&quot; });
worker.postMessage(&quot;foo&quot;)"><pre class="notranslate"><span class="pl-c">// main.ts</span>

<span class="pl-smi">console</span><span class="pl-kos">.</span><span class="pl-en">log</span><span class="pl-kos">(</span><span class="pl-s">"hello"</span><span class="pl-kos">)</span><span class="pl-kos">;</span>
<span class="pl-k">const</span> <span class="pl-s1">worker</span> <span class="pl-c1">=</span> <span class="pl-k">new</span> <span class="pl-smi">Worker</span><span class="pl-kos">(</span><span class="pl-k">new</span> <span class="pl-smi">URL</span><span class="pl-kos">(</span><span class="pl-s">"./worker.ts"</span><span class="pl-kos">,</span> <span class="pl-k">import</span><span class="pl-kos">.</span><span class="pl-c1">meta</span><span class="pl-kos">.</span><span class="pl-c1">url</span><span class="pl-kos">)</span><span class="pl-kos">,</span> <span class="pl-kos">{</span> <span class="pl-c1">type</span>: <span class="pl-s">"module"</span> <span class="pl-kos">}</span><span class="pl-kos">)</span><span class="pl-kos">;</span>
<span class="pl-s1">worker</span><span class="pl-kos">.</span><span class="pl-en">postMessage</span><span class="pl-kos">(</span><span class="pl-s">"foo"</span><span class="pl-kos">)</span></pre></div>
<div class="highlight highlight-source-ts notranslate position-relative overflow-auto" dir="auto" data-snippet-clipboard-copy-content="// worker.ts
import &quot;./subdir/a.ts&quot;;
import &quot;./subdir/b.ts&quot;;
import { join } from &quot;https://deno.land/std@0.75.0/path/mod.ts&quot;;

export ..."><pre class="notranslate"><span class="pl-c">// worker.ts</span>
<span class="pl-k">import</span> <span class="pl-s">"./subdir/a.ts"</span><span class="pl-kos">;</span>
<span class="pl-k">import</span> <span class="pl-s">"./subdir/b.ts"</span><span class="pl-kos">;</span>
<span class="pl-k">import</span> <span class="pl-kos">{</span> <span class="pl-s1">join</span> <span class="pl-kos">}</span> <span class="pl-k">from</span> <span class="pl-s">"https://deno.land/std@0.75.0/path/mod.ts"</span><span class="pl-kos">;</span>

<span class="pl-k">export</span> ...</pre></div>
<p dir="auto">I above example one needs to run with following flags:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="deno run --allow-read=worker.ts,subdir/ --allow-net=deno.land main.ts"><pre class="notranslate"><code class="notranslate">deno run --allow-read=worker.ts,subdir/ --allow-net=deno.land main.ts
</code></pre></div>
<p dir="auto">In other words, doing dynamic imports or using workers requires to open up the sandbox by providing <code class="notranslate">read</code> and/or <code class="notranslate">net</code> permissions to load ES modules that will be executed. Of course one could revoke those permissions after the load is done, but with top-level-await this becomes quite tricky.</p>
<p dir="auto">My proposal:<br>
Introduce new flag <code class="notranslate">--allow-import=&lt;allow_list&gt;</code> and change semantics of permission check for loading modules. Instead of verifying permissions for each static import we should only check permission of entry point. User could specify <code class="notranslate">--allow-import</code> to allow all dynamic imports and workers. So invocations for above examples would look as follows:</p>
<p dir="auto">Example 1:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="deno run --allow-import=dyn_import.ts main.ts"><pre class="notranslate"><code class="notranslate">deno run --allow-import=dyn_import.ts main.ts
</code></pre></div>
<p dir="auto">Example 2:</p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="deno run --allow-import=worker.ts main.ts"><pre class="notranslate"><code class="notranslate">deno run --allow-import=worker.ts main.ts
</code></pre></div>
<p dir="auto">Notice that no runtime permissions were given (no <code class="notranslate">--allow-read</code>, nor <code class="notranslate">--allow-net</code>).</p>
<p dir="auto">Going forward with this proposal would be a huge breaking change in semantics and require profound refactors. IMO we could start by introducing <code class="notranslate">--allow-import</code> and its semantics in next minor release, while keeping old semantics working (and showing warnings about it being deprecated). Then after one or two minor releases completely remove old semantics. Alternatively it could be 2.0 material.</p>
<p dir="auto">This issue is directly related to <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="728863126" data-permission-text="Title is private" data-url="https://github.com/denoland/deno/issues/8109" data-hovercard-type="issue" data-hovercard-url="/denoland/deno/issues/8109/hovercard" href="https://github.com/denoland/deno/issues/8109">#8109</a> and <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="733830494" data-permission-text="Title is private" data-url="https://github.com/denoland/deno/issues/8215" data-hovercard-type="pull_request" data-hovercard-url="/denoland/deno/pull/8215/hovercard" href="https://github.com/denoland/deno/pull/8215">#8215</a></p>
<p dir="auto">CC <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/kitsonk/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/kitsonk">@kitsonk</a> <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/ry/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/ry">@ry</a> <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/lucacasonato/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/lucacasonato">@lucacasonato</a> <a class="user-mention notranslate" data-hovercard-type="user" data-hovercard-url="/users/piscisaureus/hovercard" data-octo-click="hovercard-link-click" data-octo-dimensions="link_type:self" href="https://github.com/piscisaureus">@piscisaureus</a></p>