permission sets in deno.json

[nathanwhit]

POC

{
  "permissionSets": {
    "default": {
      "read": [
        "./deno.jsonc"
      ],
      "env": ["NOCOLOR"],
      "run": [
        "deno"
      ]
    }
  },
  "tasks": {
    "dev": "deno run -P main.ts"
  }
}

deno run -P main.ts

(uses default permission set, you can specify -P=other or --permission-set=other to use another)

[bartlomieju]

Looking good, one thing I'd like to see early in this PR is change for the FS operations that try to modify the deno.json(c) file to require -A permission instead of regular -R/-W.

[dsherret]

Looking good, one thing I'd like to see early in this PR is change for the FS operations that try to modify the deno.json(c) file to require -A permission instead of regular -R/-W.

I'm not sure we should have this functionality. I think maybe as part of the risk of using the -P flag, it should be up to the user to inspect or know the state of the deno.json file first (similar to the current risk with deno task). Then someone could add --deny-write=deno.json if they want to mitigate that risk.

[dsherret]

I think we shouldn't error if someone does -P and the default set doesn't exist. That way someone can run something like deno test -P unconditionally.