11cb0ef41Sopenharmony_ci<!DOCTYPE html> 21cb0ef41Sopenharmony_ci<html lang="en"> 31cb0ef41Sopenharmony_ci<head> 41cb0ef41Sopenharmony_ci <meta charset="utf-8"> 51cb0ef41Sopenharmony_ci <meta name="viewport" content="width=device-width"> 61cb0ef41Sopenharmony_ci <meta name="nodejs.org:node-version" content="v18.20.1"> 71cb0ef41Sopenharmony_ci <title>Permissions | Node.js v18.20.1 Documentation</title> 81cb0ef41Sopenharmony_ci <link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Lato:400,700,400italic&display=fallback"> 91cb0ef41Sopenharmony_ci <link rel="stylesheet" href="assets/style.css"> 101cb0ef41Sopenharmony_ci <link rel="stylesheet" href="assets/hljs.css"> 111cb0ef41Sopenharmony_ci <link rel="canonical" href="https://nodejs.org/api/permissions.html"> 121cb0ef41Sopenharmony_ci <script async defer src="assets/api.js" type="text/javascript"></script> 131cb0ef41Sopenharmony_ci 141cb0ef41Sopenharmony_ci</head> 151cb0ef41Sopenharmony_ci<body class="alt apidoc" id="api-section-permissions"> 161cb0ef41Sopenharmony_ci <div id="content" class="clearfix"> 171cb0ef41Sopenharmony_ci <div id="column2" class="interior"> 181cb0ef41Sopenharmony_ci <div id="intro" class="interior"> 191cb0ef41Sopenharmony_ci <a href="/" title="Go back to the home page"> 201cb0ef41Sopenharmony_ci Node.js 211cb0ef41Sopenharmony_ci </a> 221cb0ef41Sopenharmony_ci </div> 231cb0ef41Sopenharmony_ci <ul> 241cb0ef41Sopenharmony_ci<li><a href="documentation.html" class="nav-documentation">About this documentation</a></li> 251cb0ef41Sopenharmony_ci<li><a href="synopsis.html" class="nav-synopsis">Usage and example</a></li> 261cb0ef41Sopenharmony_ci</ul> 271cb0ef41Sopenharmony_ci<hr class="line"> 281cb0ef41Sopenharmony_ci<ul> 291cb0ef41Sopenharmony_ci<li><a href="assert.html" class="nav-assert">Assertion testing</a></li> 301cb0ef41Sopenharmony_ci<li><a href="async_context.html" class="nav-async_context">Asynchronous context tracking</a></li> 311cb0ef41Sopenharmony_ci<li><a href="async_hooks.html" class="nav-async_hooks">Async hooks</a></li> 321cb0ef41Sopenharmony_ci<li><a href="buffer.html" class="nav-buffer">Buffer</a></li> 331cb0ef41Sopenharmony_ci<li><a href="addons.html" class="nav-addons">C++ addons</a></li> 341cb0ef41Sopenharmony_ci<li><a href="n-api.html" class="nav-n-api">C/C++ addons with Node-API</a></li> 351cb0ef41Sopenharmony_ci<li><a href="embedding.html" class="nav-embedding">C++ embedder API</a></li> 361cb0ef41Sopenharmony_ci<li><a href="child_process.html" class="nav-child_process">Child processes</a></li> 371cb0ef41Sopenharmony_ci<li><a href="cluster.html" class="nav-cluster">Cluster</a></li> 381cb0ef41Sopenharmony_ci<li><a href="cli.html" class="nav-cli">Command-line options</a></li> 391cb0ef41Sopenharmony_ci<li><a href="console.html" class="nav-console">Console</a></li> 401cb0ef41Sopenharmony_ci<li><a href="corepack.html" class="nav-corepack">Corepack</a></li> 411cb0ef41Sopenharmony_ci<li><a href="crypto.html" class="nav-crypto">Crypto</a></li> 421cb0ef41Sopenharmony_ci<li><a href="debugger.html" class="nav-debugger">Debugger</a></li> 431cb0ef41Sopenharmony_ci<li><a href="deprecations.html" class="nav-deprecations">Deprecated APIs</a></li> 441cb0ef41Sopenharmony_ci<li><a href="diagnostics_channel.html" class="nav-diagnostics_channel">Diagnostics Channel</a></li> 451cb0ef41Sopenharmony_ci<li><a href="dns.html" class="nav-dns">DNS</a></li> 461cb0ef41Sopenharmony_ci<li><a href="domain.html" class="nav-domain">Domain</a></li> 471cb0ef41Sopenharmony_ci<li><a href="errors.html" class="nav-errors">Errors</a></li> 481cb0ef41Sopenharmony_ci<li><a href="events.html" class="nav-events">Events</a></li> 491cb0ef41Sopenharmony_ci<li><a href="fs.html" class="nav-fs">File system</a></li> 501cb0ef41Sopenharmony_ci<li><a href="globals.html" class="nav-globals">Globals</a></li> 511cb0ef41Sopenharmony_ci<li><a href="http.html" class="nav-http">HTTP</a></li> 521cb0ef41Sopenharmony_ci<li><a href="http2.html" class="nav-http2">HTTP/2</a></li> 531cb0ef41Sopenharmony_ci<li><a href="https.html" class="nav-https">HTTPS</a></li> 541cb0ef41Sopenharmony_ci<li><a href="inspector.html" class="nav-inspector">Inspector</a></li> 551cb0ef41Sopenharmony_ci<li><a href="intl.html" class="nav-intl">Internationalization</a></li> 561cb0ef41Sopenharmony_ci<li><a href="modules.html" class="nav-modules">Modules: CommonJS modules</a></li> 571cb0ef41Sopenharmony_ci<li><a href="esm.html" class="nav-esm">Modules: ECMAScript modules</a></li> 581cb0ef41Sopenharmony_ci<li><a href="module.html" class="nav-module">Modules: <code>node:module</code> API</a></li> 591cb0ef41Sopenharmony_ci<li><a href="packages.html" class="nav-packages">Modules: Packages</a></li> 601cb0ef41Sopenharmony_ci<li><a href="net.html" class="nav-net">Net</a></li> 611cb0ef41Sopenharmony_ci<li><a href="os.html" class="nav-os">OS</a></li> 621cb0ef41Sopenharmony_ci<li><a href="path.html" class="nav-path">Path</a></li> 631cb0ef41Sopenharmony_ci<li><a href="perf_hooks.html" class="nav-perf_hooks">Performance hooks</a></li> 641cb0ef41Sopenharmony_ci<li><a href="permissions.html" class="nav-permissions active">Permissions</a></li> 651cb0ef41Sopenharmony_ci<li><a href="process.html" class="nav-process">Process</a></li> 661cb0ef41Sopenharmony_ci<li><a href="punycode.html" class="nav-punycode">Punycode</a></li> 671cb0ef41Sopenharmony_ci<li><a href="querystring.html" class="nav-querystring">Query strings</a></li> 681cb0ef41Sopenharmony_ci<li><a href="readline.html" class="nav-readline">Readline</a></li> 691cb0ef41Sopenharmony_ci<li><a href="repl.html" class="nav-repl">REPL</a></li> 701cb0ef41Sopenharmony_ci<li><a href="report.html" class="nav-report">Report</a></li> 711cb0ef41Sopenharmony_ci<li><a href="single-executable-applications.html" class="nav-single-executable-applications">Single executable applications</a></li> 721cb0ef41Sopenharmony_ci<li><a href="stream.html" class="nav-stream">Stream</a></li> 731cb0ef41Sopenharmony_ci<li><a href="string_decoder.html" class="nav-string_decoder">String decoder</a></li> 741cb0ef41Sopenharmony_ci<li><a href="test.html" class="nav-test">Test runner</a></li> 751cb0ef41Sopenharmony_ci<li><a href="timers.html" class="nav-timers">Timers</a></li> 761cb0ef41Sopenharmony_ci<li><a href="tls.html" class="nav-tls">TLS/SSL</a></li> 771cb0ef41Sopenharmony_ci<li><a href="tracing.html" class="nav-tracing">Trace events</a></li> 781cb0ef41Sopenharmony_ci<li><a href="tty.html" class="nav-tty">TTY</a></li> 791cb0ef41Sopenharmony_ci<li><a href="dgram.html" class="nav-dgram">UDP/datagram</a></li> 801cb0ef41Sopenharmony_ci<li><a href="url.html" class="nav-url">URL</a></li> 811cb0ef41Sopenharmony_ci<li><a href="util.html" class="nav-util">Utilities</a></li> 821cb0ef41Sopenharmony_ci<li><a href="v8.html" class="nav-v8">V8</a></li> 831cb0ef41Sopenharmony_ci<li><a href="vm.html" class="nav-vm">VM</a></li> 841cb0ef41Sopenharmony_ci<li><a href="wasi.html" class="nav-wasi">WASI</a></li> 851cb0ef41Sopenharmony_ci<li><a href="webcrypto.html" class="nav-webcrypto">Web Crypto API</a></li> 861cb0ef41Sopenharmony_ci<li><a href="webstreams.html" class="nav-webstreams">Web Streams API</a></li> 871cb0ef41Sopenharmony_ci<li><a href="worker_threads.html" class="nav-worker_threads">Worker threads</a></li> 881cb0ef41Sopenharmony_ci<li><a href="zlib.html" class="nav-zlib">Zlib</a></li> 891cb0ef41Sopenharmony_ci</ul> 901cb0ef41Sopenharmony_ci<hr class="line"> 911cb0ef41Sopenharmony_ci<ul> 921cb0ef41Sopenharmony_ci<li><a href="https://github.com/nodejs/node" class="nav-https-github-com-nodejs-node">Code repository and issue tracker</a></li> 931cb0ef41Sopenharmony_ci</ul> 941cb0ef41Sopenharmony_ci </div> 951cb0ef41Sopenharmony_ci 961cb0ef41Sopenharmony_ci <div id="column1" data-id="permissions" class="interior"> 971cb0ef41Sopenharmony_ci <header class="header"> 981cb0ef41Sopenharmony_ci <div class="header-container"> 991cb0ef41Sopenharmony_ci <h1>Node.js v18.20.1 documentation</h1> 1001cb0ef41Sopenharmony_ci <button class="theme-toggle-btn" id="theme-toggle-btn" title="Toggle dark mode/light mode" aria-label="Toggle dark mode/light mode" hidden> 1011cb0ef41Sopenharmony_ci <svg xmlns="http://www.w3.org/2000/svg" class="icon dark-icon" height="24" width="24"> 1021cb0ef41Sopenharmony_ci <path fill="none" d="M0 0h24v24H0z" /> 1031cb0ef41Sopenharmony_ci <path d="M11.1 12.08c-2.33-4.51-.5-8.48.53-10.07C6.27 2.2 1.98 6.59 1.98 12c0 .14.02.28.02.42.62-.27 1.29-.42 2-.42 1.66 0 3.18.83 4.1 2.15A4.01 4.01 0 0111 18c0 1.52-.87 2.83-2.12 3.51.98.32 2.03.5 3.11.5 3.5 0 6.58-1.8 8.37-4.52-2.36.23-6.98-.97-9.26-5.41z"/> 1041cb0ef41Sopenharmony_ci <path d="M7 16h-.18C6.4 14.84 5.3 14 4 14c-1.66 0-3 1.34-3 3s1.34 3 3 3h3c1.1 0 2-.9 2-2s-.9-2-2-2z"/> 1051cb0ef41Sopenharmony_ci </svg> 1061cb0ef41Sopenharmony_ci <svg xmlns="http://www.w3.org/2000/svg" class="icon light-icon" height="24" width="24"> 1071cb0ef41Sopenharmony_ci <path d="M0 0h24v24H0z" fill="none" /> 1081cb0ef41Sopenharmony_ci <path d="M6.76 4.84l-1.8-1.79-1.41 1.41 1.79 1.79 1.42-1.41zM4 10.5H1v2h3v-2zm9-9.95h-2V3.5h2V.55zm7.45 3.91l-1.41-1.41-1.79 1.79 1.41 1.41 1.79-1.79zm-3.21 13.7l1.79 1.8 1.41-1.41-1.8-1.79-1.4 1.4zM20 10.5v2h3v-2h-3zm-8-5c-3.31 0-6 2.69-6 6s2.69 6 6 6 6-2.69 6-6-2.69-6-6-6zm-1 16.95h2V19.5h-2v2.95zm-7.45-3.91l1.41 1.41 1.79-1.8-1.41-1.41-1.79 1.8z"/> 1091cb0ef41Sopenharmony_ci </svg> 1101cb0ef41Sopenharmony_ci </button> 1111cb0ef41Sopenharmony_ci </div> 1121cb0ef41Sopenharmony_ci <div id="gtoc"> 1131cb0ef41Sopenharmony_ci <ul> 1141cb0ef41Sopenharmony_ci <li class="pinned-header">Node.js v18.20.1</li> 1151cb0ef41Sopenharmony_ci 1161cb0ef41Sopenharmony_ci <li class="picker-header"> 1171cb0ef41Sopenharmony_ci <a href="#"> 1181cb0ef41Sopenharmony_ci <span class="collapsed-arrow">►</span><span class="expanded-arrow">▼</span> 1191cb0ef41Sopenharmony_ci Table of contents 1201cb0ef41Sopenharmony_ci </a> 1211cb0ef41Sopenharmony_ci 1221cb0ef41Sopenharmony_ci <div class="picker"><div class="toc"><ul> 1231cb0ef41Sopenharmony_ci<li><a href="#permissions">Permissions</a> 1241cb0ef41Sopenharmony_ci<ul> 1251cb0ef41Sopenharmony_ci<li><a href="#module-based-permissions">Module-based permissions</a> 1261cb0ef41Sopenharmony_ci<ul> 1271cb0ef41Sopenharmony_ci<li><span class="stability_1"><a href="#policies">Policies</a></span> 1281cb0ef41Sopenharmony_ci<ul> 1291cb0ef41Sopenharmony_ci<li><a href="#enabling">Enabling</a></li> 1301cb0ef41Sopenharmony_ci<li><a href="#features">Features</a> 1311cb0ef41Sopenharmony_ci<ul> 1321cb0ef41Sopenharmony_ci<li><a href="#error-behavior">Error behavior</a></li> 1331cb0ef41Sopenharmony_ci<li><a href="#integrity-checks">Integrity checks</a></li> 1341cb0ef41Sopenharmony_ci<li><a href="#dependency-redirection">Dependency redirection</a></li> 1351cb0ef41Sopenharmony_ci<li><a href="#example-patched-dependency">Example: Patched dependency</a></li> 1361cb0ef41Sopenharmony_ci</ul> 1371cb0ef41Sopenharmony_ci</li> 1381cb0ef41Sopenharmony_ci<li><a href="#scopes">Scopes</a> 1391cb0ef41Sopenharmony_ci<ul> 1401cb0ef41Sopenharmony_ci<li><a href="#example">Example</a></li> 1411cb0ef41Sopenharmony_ci<li><a href="#integrity-using-scopes">Integrity using scopes</a></li> 1421cb0ef41Sopenharmony_ci<li><a href="#dependency-redirection-using-scopes">Dependency redirection using scopes</a></li> 1431cb0ef41Sopenharmony_ci<li><a href="#example-import-maps-emulation">Example: import maps emulation</a></li> 1441cb0ef41Sopenharmony_ci</ul> 1451cb0ef41Sopenharmony_ci</li> 1461cb0ef41Sopenharmony_ci</ul> 1471cb0ef41Sopenharmony_ci</li> 1481cb0ef41Sopenharmony_ci</ul> 1491cb0ef41Sopenharmony_ci</li> 1501cb0ef41Sopenharmony_ci</ul> 1511cb0ef41Sopenharmony_ci</li> 1521cb0ef41Sopenharmony_ci</ul></div></div> 1531cb0ef41Sopenharmony_ci </li> 1541cb0ef41Sopenharmony_ci 1551cb0ef41Sopenharmony_ci 1561cb0ef41Sopenharmony_ci <li class="picker-header"> 1571cb0ef41Sopenharmony_ci <a href="#"> 1581cb0ef41Sopenharmony_ci <span class="collapsed-arrow">►</span><span class="expanded-arrow">▼</span> 1591cb0ef41Sopenharmony_ci Index 1601cb0ef41Sopenharmony_ci </a> 1611cb0ef41Sopenharmony_ci 1621cb0ef41Sopenharmony_ci <div class="picker"><ul> 1631cb0ef41Sopenharmony_ci<li><a href="documentation.html" class="nav-documentation">About this documentation</a></li> 1641cb0ef41Sopenharmony_ci<li><a href="synopsis.html" class="nav-synopsis">Usage and example</a></li> 1651cb0ef41Sopenharmony_ci 1661cb0ef41Sopenharmony_ci <li> 1671cb0ef41Sopenharmony_ci <a href="index.html">Index</a> 1681cb0ef41Sopenharmony_ci </li> 1691cb0ef41Sopenharmony_ci </ul> 1701cb0ef41Sopenharmony_ci 1711cb0ef41Sopenharmony_ci<hr class="line"> 1721cb0ef41Sopenharmony_ci<ul> 1731cb0ef41Sopenharmony_ci<li><a href="assert.html" class="nav-assert">Assertion testing</a></li> 1741cb0ef41Sopenharmony_ci<li><a href="async_context.html" class="nav-async_context">Asynchronous context tracking</a></li> 1751cb0ef41Sopenharmony_ci<li><a href="async_hooks.html" class="nav-async_hooks">Async hooks</a></li> 1761cb0ef41Sopenharmony_ci<li><a href="buffer.html" class="nav-buffer">Buffer</a></li> 1771cb0ef41Sopenharmony_ci<li><a href="addons.html" class="nav-addons">C++ addons</a></li> 1781cb0ef41Sopenharmony_ci<li><a href="n-api.html" class="nav-n-api">C/C++ addons with Node-API</a></li> 1791cb0ef41Sopenharmony_ci<li><a href="embedding.html" class="nav-embedding">C++ embedder API</a></li> 1801cb0ef41Sopenharmony_ci<li><a href="child_process.html" class="nav-child_process">Child processes</a></li> 1811cb0ef41Sopenharmony_ci<li><a href="cluster.html" class="nav-cluster">Cluster</a></li> 1821cb0ef41Sopenharmony_ci<li><a href="cli.html" class="nav-cli">Command-line options</a></li> 1831cb0ef41Sopenharmony_ci<li><a href="console.html" class="nav-console">Console</a></li> 1841cb0ef41Sopenharmony_ci<li><a href="corepack.html" class="nav-corepack">Corepack</a></li> 1851cb0ef41Sopenharmony_ci<li><a href="crypto.html" class="nav-crypto">Crypto</a></li> 1861cb0ef41Sopenharmony_ci<li><a href="debugger.html" class="nav-debugger">Debugger</a></li> 1871cb0ef41Sopenharmony_ci<li><a href="deprecations.html" class="nav-deprecations">Deprecated APIs</a></li> 1881cb0ef41Sopenharmony_ci<li><a href="diagnostics_channel.html" class="nav-diagnostics_channel">Diagnostics Channel</a></li> 1891cb0ef41Sopenharmony_ci<li><a href="dns.html" class="nav-dns">DNS</a></li> 1901cb0ef41Sopenharmony_ci<li><a href="domain.html" class="nav-domain">Domain</a></li> 1911cb0ef41Sopenharmony_ci<li><a href="errors.html" class="nav-errors">Errors</a></li> 1921cb0ef41Sopenharmony_ci<li><a href="events.html" class="nav-events">Events</a></li> 1931cb0ef41Sopenharmony_ci<li><a href="fs.html" class="nav-fs">File system</a></li> 1941cb0ef41Sopenharmony_ci<li><a href="globals.html" class="nav-globals">Globals</a></li> 1951cb0ef41Sopenharmony_ci<li><a href="http.html" class="nav-http">HTTP</a></li> 1961cb0ef41Sopenharmony_ci<li><a href="http2.html" class="nav-http2">HTTP/2</a></li> 1971cb0ef41Sopenharmony_ci<li><a href="https.html" class="nav-https">HTTPS</a></li> 1981cb0ef41Sopenharmony_ci<li><a href="inspector.html" class="nav-inspector">Inspector</a></li> 1991cb0ef41Sopenharmony_ci<li><a href="intl.html" class="nav-intl">Internationalization</a></li> 2001cb0ef41Sopenharmony_ci<li><a href="modules.html" class="nav-modules">Modules: CommonJS modules</a></li> 2011cb0ef41Sopenharmony_ci<li><a href="esm.html" class="nav-esm">Modules: ECMAScript modules</a></li> 2021cb0ef41Sopenharmony_ci<li><a href="module.html" class="nav-module">Modules: <code>node:module</code> API</a></li> 2031cb0ef41Sopenharmony_ci<li><a href="packages.html" class="nav-packages">Modules: Packages</a></li> 2041cb0ef41Sopenharmony_ci<li><a href="net.html" class="nav-net">Net</a></li> 2051cb0ef41Sopenharmony_ci<li><a href="os.html" class="nav-os">OS</a></li> 2061cb0ef41Sopenharmony_ci<li><a href="path.html" class="nav-path">Path</a></li> 2071cb0ef41Sopenharmony_ci<li><a href="perf_hooks.html" class="nav-perf_hooks">Performance hooks</a></li> 2081cb0ef41Sopenharmony_ci<li><a href="permissions.html" class="nav-permissions active">Permissions</a></li> 2091cb0ef41Sopenharmony_ci<li><a href="process.html" class="nav-process">Process</a></li> 2101cb0ef41Sopenharmony_ci<li><a href="punycode.html" class="nav-punycode">Punycode</a></li> 2111cb0ef41Sopenharmony_ci<li><a href="querystring.html" class="nav-querystring">Query strings</a></li> 2121cb0ef41Sopenharmony_ci<li><a href="readline.html" class="nav-readline">Readline</a></li> 2131cb0ef41Sopenharmony_ci<li><a href="repl.html" class="nav-repl">REPL</a></li> 2141cb0ef41Sopenharmony_ci<li><a href="report.html" class="nav-report">Report</a></li> 2151cb0ef41Sopenharmony_ci<li><a href="single-executable-applications.html" class="nav-single-executable-applications">Single executable applications</a></li> 2161cb0ef41Sopenharmony_ci<li><a href="stream.html" class="nav-stream">Stream</a></li> 2171cb0ef41Sopenharmony_ci<li><a href="string_decoder.html" class="nav-string_decoder">String decoder</a></li> 2181cb0ef41Sopenharmony_ci<li><a href="test.html" class="nav-test">Test runner</a></li> 2191cb0ef41Sopenharmony_ci<li><a href="timers.html" class="nav-timers">Timers</a></li> 2201cb0ef41Sopenharmony_ci<li><a href="tls.html" class="nav-tls">TLS/SSL</a></li> 2211cb0ef41Sopenharmony_ci<li><a href="tracing.html" class="nav-tracing">Trace events</a></li> 2221cb0ef41Sopenharmony_ci<li><a href="tty.html" class="nav-tty">TTY</a></li> 2231cb0ef41Sopenharmony_ci<li><a href="dgram.html" class="nav-dgram">UDP/datagram</a></li> 2241cb0ef41Sopenharmony_ci<li><a href="url.html" class="nav-url">URL</a></li> 2251cb0ef41Sopenharmony_ci<li><a href="util.html" class="nav-util">Utilities</a></li> 2261cb0ef41Sopenharmony_ci<li><a href="v8.html" class="nav-v8">V8</a></li> 2271cb0ef41Sopenharmony_ci<li><a href="vm.html" class="nav-vm">VM</a></li> 2281cb0ef41Sopenharmony_ci<li><a href="wasi.html" class="nav-wasi">WASI</a></li> 2291cb0ef41Sopenharmony_ci<li><a href="webcrypto.html" class="nav-webcrypto">Web Crypto API</a></li> 2301cb0ef41Sopenharmony_ci<li><a href="webstreams.html" class="nav-webstreams">Web Streams API</a></li> 2311cb0ef41Sopenharmony_ci<li><a href="worker_threads.html" class="nav-worker_threads">Worker threads</a></li> 2321cb0ef41Sopenharmony_ci<li><a href="zlib.html" class="nav-zlib">Zlib</a></li> 2331cb0ef41Sopenharmony_ci</ul> 2341cb0ef41Sopenharmony_ci<hr class="line"> 2351cb0ef41Sopenharmony_ci<ul> 2361cb0ef41Sopenharmony_ci<li><a href="https://github.com/nodejs/node" class="nav-https-github-com-nodejs-node">Code repository and issue tracker</a></li> 2371cb0ef41Sopenharmony_ci</ul></div> 2381cb0ef41Sopenharmony_ci </li> 2391cb0ef41Sopenharmony_ci 2401cb0ef41Sopenharmony_ci 2411cb0ef41Sopenharmony_ci <li class="picker-header"> 2421cb0ef41Sopenharmony_ci <a href="#"> 2431cb0ef41Sopenharmony_ci <span class="collapsed-arrow">►</span><span class="expanded-arrow">▼</span> 2441cb0ef41Sopenharmony_ci Other versions 2451cb0ef41Sopenharmony_ci </a> 2461cb0ef41Sopenharmony_ci <div class="picker"><ol id="alt-docs"><li><a href="https://nodejs.org/docs/latest-v21.x/api/permissions.html">21.x</a></li> 2471cb0ef41Sopenharmony_ci<li><a href="https://nodejs.org/docs/latest-v20.x/api/permissions.html">20.x <b>LTS</b></a></li> 2481cb0ef41Sopenharmony_ci<li><a href="https://nodejs.org/docs/latest-v19.x/api/permissions.html">19.x</a></li> 2491cb0ef41Sopenharmony_ci<li><a href="https://nodejs.org/docs/latest-v18.x/api/permissions.html">18.x <b>LTS</b></a></li> 2501cb0ef41Sopenharmony_ci<li><a href="https://nodejs.org/docs/latest-v17.x/api/permissions.html">17.x</a></li> 2511cb0ef41Sopenharmony_ci<li><a href="https://nodejs.org/docs/latest-v16.x/api/permissions.html">16.x</a></li> 2521cb0ef41Sopenharmony_ci<li><a href="https://nodejs.org/docs/latest-v15.x/api/permissions.html">15.x</a></li> 2531cb0ef41Sopenharmony_ci<li><a href="https://nodejs.org/docs/latest-v14.x/api/permissions.html">14.x</a></li> 2541cb0ef41Sopenharmony_ci<li><a href="https://nodejs.org/docs/latest-v13.x/api/permissions.html">13.x</a></li> 2551cb0ef41Sopenharmony_ci<li><a href="https://nodejs.org/docs/latest-v12.x/api/permissions.html">12.x</a></li> 2561cb0ef41Sopenharmony_ci<li><a href="https://nodejs.org/docs/latest-v11.x/api/permissions.html">11.x</a></li></ol></div> 2571cb0ef41Sopenharmony_ci </li> 2581cb0ef41Sopenharmony_ci 2591cb0ef41Sopenharmony_ci <li class="picker-header"> 2601cb0ef41Sopenharmony_ci <a href="#"> 2611cb0ef41Sopenharmony_ci <span class="collapsed-arrow">►</span><span class="expanded-arrow">▼</span> 2621cb0ef41Sopenharmony_ci Options 2631cb0ef41Sopenharmony_ci </a> 2641cb0ef41Sopenharmony_ci 2651cb0ef41Sopenharmony_ci <div class="picker"> 2661cb0ef41Sopenharmony_ci <ul> 2671cb0ef41Sopenharmony_ci <li> 2681cb0ef41Sopenharmony_ci <a href="all.html">View on single page</a> 2691cb0ef41Sopenharmony_ci </li> 2701cb0ef41Sopenharmony_ci <li> 2711cb0ef41Sopenharmony_ci <a href="permissions.json">View as JSON</a> 2721cb0ef41Sopenharmony_ci </li> 2731cb0ef41Sopenharmony_ci <li class="edit_on_github"><a href="https://github.com/nodejs/node/edit/main/doc/api/permissions.md">Edit on GitHub</a></li> 2741cb0ef41Sopenharmony_ci </ul> 2751cb0ef41Sopenharmony_ci </div> 2761cb0ef41Sopenharmony_ci </li> 2771cb0ef41Sopenharmony_ci </ul> 2781cb0ef41Sopenharmony_ci </div> 2791cb0ef41Sopenharmony_ci <hr> 2801cb0ef41Sopenharmony_ci </header> 2811cb0ef41Sopenharmony_ci 2821cb0ef41Sopenharmony_ci <details id="toc" open><summary>Table of contents</summary><ul> 2831cb0ef41Sopenharmony_ci<li><a href="#permissions">Permissions</a> 2841cb0ef41Sopenharmony_ci<ul> 2851cb0ef41Sopenharmony_ci<li><a href="#module-based-permissions">Module-based permissions</a> 2861cb0ef41Sopenharmony_ci<ul> 2871cb0ef41Sopenharmony_ci<li><span class="stability_1"><a href="#policies">Policies</a></span> 2881cb0ef41Sopenharmony_ci<ul> 2891cb0ef41Sopenharmony_ci<li><a href="#enabling">Enabling</a></li> 2901cb0ef41Sopenharmony_ci<li><a href="#features">Features</a> 2911cb0ef41Sopenharmony_ci<ul> 2921cb0ef41Sopenharmony_ci<li><a href="#error-behavior">Error behavior</a></li> 2931cb0ef41Sopenharmony_ci<li><a href="#integrity-checks">Integrity checks</a></li> 2941cb0ef41Sopenharmony_ci<li><a href="#dependency-redirection">Dependency redirection</a></li> 2951cb0ef41Sopenharmony_ci<li><a href="#example-patched-dependency">Example: Patched dependency</a></li> 2961cb0ef41Sopenharmony_ci</ul> 2971cb0ef41Sopenharmony_ci</li> 2981cb0ef41Sopenharmony_ci<li><a href="#scopes">Scopes</a> 2991cb0ef41Sopenharmony_ci<ul> 3001cb0ef41Sopenharmony_ci<li><a href="#example">Example</a></li> 3011cb0ef41Sopenharmony_ci<li><a href="#integrity-using-scopes">Integrity using scopes</a></li> 3021cb0ef41Sopenharmony_ci<li><a href="#dependency-redirection-using-scopes">Dependency redirection using scopes</a></li> 3031cb0ef41Sopenharmony_ci<li><a href="#example-import-maps-emulation">Example: import maps emulation</a></li> 3041cb0ef41Sopenharmony_ci</ul> 3051cb0ef41Sopenharmony_ci</li> 3061cb0ef41Sopenharmony_ci</ul> 3071cb0ef41Sopenharmony_ci</li> 3081cb0ef41Sopenharmony_ci</ul> 3091cb0ef41Sopenharmony_ci</li> 3101cb0ef41Sopenharmony_ci</ul> 3111cb0ef41Sopenharmony_ci</li> 3121cb0ef41Sopenharmony_ci</ul></details> 3131cb0ef41Sopenharmony_ci 3141cb0ef41Sopenharmony_ci <div id="apicontent"> 3151cb0ef41Sopenharmony_ci <h2>Permissions<span><a class="mark" href="#permissions" id="permissions">#</a></span><a aria-hidden="true" class="legacy" id="permissions_permissions"></a></h2> 3161cb0ef41Sopenharmony_ci<p>Permissions can be used to control what system resources the 3171cb0ef41Sopenharmony_ciNode.js process has access to or what actions the process can take 3181cb0ef41Sopenharmony_ciwith those resources. Permissions can also control what modules can 3191cb0ef41Sopenharmony_cibe accessed by other modules.</p> 3201cb0ef41Sopenharmony_ci<ul> 3211cb0ef41Sopenharmony_ci<li><a href="#module-based-permissions">Module-based permissions</a> control which files 3221cb0ef41Sopenharmony_cior URLs are available to other modules during application execution. 3231cb0ef41Sopenharmony_ciThis can be used to control what modules can be accessed by third-party 3241cb0ef41Sopenharmony_cidependencies, for example.</li> 3251cb0ef41Sopenharmony_ci</ul> 3261cb0ef41Sopenharmony_ci<p>If you find a potential security vulnerability, please refer to our 3271cb0ef41Sopenharmony_ci<a href="https://github.com/nodejs/node/blob/main/SECURITY.md">Security Policy</a>.</p> 3281cb0ef41Sopenharmony_ci<section><h3>Module-based permissions<span><a class="mark" href="#module-based-permissions" id="module-based-permissions">#</a></span><a aria-hidden="true" class="legacy" id="permissions_module_based_permissions"></a></h3> 3291cb0ef41Sopenharmony_ci<h4>Policies<span><a class="mark" href="#policies" id="policies">#</a></span><a aria-hidden="true" class="legacy" id="permissions_policies"></a></h4> 3301cb0ef41Sopenharmony_ci 3311cb0ef41Sopenharmony_ci 3321cb0ef41Sopenharmony_ci<p></p><div class="api_stability api_stability_1"><a href="documentation.html#stability-index">Stability: 1</a> - Experimental</div><p></p> 3331cb0ef41Sopenharmony_ci 3341cb0ef41Sopenharmony_ci<p>Node.js contains experimental support for creating policies on loading code.</p> 3351cb0ef41Sopenharmony_ci<p>Policies are a security feature intended to allow guarantees 3361cb0ef41Sopenharmony_ciabout what code Node.js is able to load. The use of policies assumes 3371cb0ef41Sopenharmony_cisafe practices for the policy files such as ensuring that policy 3381cb0ef41Sopenharmony_cifiles cannot be overwritten by the Node.js application by using 3391cb0ef41Sopenharmony_cifile permissions.</p> 3401cb0ef41Sopenharmony_ci<p>A best practice would be to ensure that the policy manifest is read-only for 3411cb0ef41Sopenharmony_cithe running Node.js application and that the file cannot be changed 3421cb0ef41Sopenharmony_ciby the running Node.js application in any way. A typical setup would be to 3431cb0ef41Sopenharmony_cicreate the policy file as a different user id than the one running Node.js 3441cb0ef41Sopenharmony_ciand granting read permissions to the user id running Node.js.</p> 3451cb0ef41Sopenharmony_ci<h5>Enabling<span><a class="mark" href="#enabling" id="enabling">#</a></span><a aria-hidden="true" class="legacy" id="permissions_enabling"></a></h5> 3461cb0ef41Sopenharmony_ci 3471cb0ef41Sopenharmony_ci<p>The <code>--experimental-policy</code> flag can be used to enable features for policies 3481cb0ef41Sopenharmony_ciwhen loading modules.</p> 3491cb0ef41Sopenharmony_ci<p>Once this has been set, all modules must conform to a policy manifest file 3501cb0ef41Sopenharmony_cipassed to the flag:</p> 3511cb0ef41Sopenharmony_ci<pre><code class="language-bash">node --experimental-policy=policy.json app.js</code> <button class="copy-button">copy</button></pre> 3521cb0ef41Sopenharmony_ci<p>The policy manifest will be used to enforce constraints on code loaded by 3531cb0ef41Sopenharmony_ciNode.js.</p> 3541cb0ef41Sopenharmony_ci<p>To mitigate tampering with policy files on disk, an integrity for 3551cb0ef41Sopenharmony_cithe policy file itself may be provided via <code>--policy-integrity</code>. 3561cb0ef41Sopenharmony_ciThis allows running <code>node</code> and asserting the policy file contents 3571cb0ef41Sopenharmony_cieven if the file is changed on disk.</p> 3581cb0ef41Sopenharmony_ci<pre><code class="language-bash">node --experimental-policy=policy.json --policy-integrity=<span class="hljs-string">"sha384-SggXRQHwCG8g+DktYYzxkXRIkTiEYWBHqev0xnpCxYlqMBufKZHAHQM3/boDaI/0"</span> app.js</code> <button class="copy-button">copy</button></pre> 3591cb0ef41Sopenharmony_ci<h5>Features<span><a class="mark" href="#features" id="features">#</a></span><a aria-hidden="true" class="legacy" id="permissions_features"></a></h5> 3601cb0ef41Sopenharmony_ci<h6>Error behavior<span><a class="mark" href="#error-behavior" id="error-behavior">#</a></span><a aria-hidden="true" class="legacy" id="permissions_error_behavior"></a></h6> 3611cb0ef41Sopenharmony_ci<p>When a policy check fails, Node.js by default will throw an error. 3621cb0ef41Sopenharmony_ciIt is possible to change the error behavior to one of a few possibilities 3631cb0ef41Sopenharmony_ciby defining an "onerror" field in a policy manifest. The following values are 3641cb0ef41Sopenharmony_ciavailable to change the behavior:</p> 3651cb0ef41Sopenharmony_ci<ul> 3661cb0ef41Sopenharmony_ci<li><code>"exit"</code>: will exit the process immediately. 3671cb0ef41Sopenharmony_ciNo cleanup code will be allowed to run.</li> 3681cb0ef41Sopenharmony_ci<li><code>"log"</code>: will log the error at the site of the failure.</li> 3691cb0ef41Sopenharmony_ci<li><code>"throw"</code>: will throw a JS error at the site of the failure. This is the 3701cb0ef41Sopenharmony_cidefault.</li> 3711cb0ef41Sopenharmony_ci</ul> 3721cb0ef41Sopenharmony_ci<pre><code class="language-json"><span class="hljs-punctuation">{</span> 3731cb0ef41Sopenharmony_ci <span class="hljs-attr">"onerror"</span><span class="hljs-punctuation">:</span> <span class="hljs-string">"log"</span><span class="hljs-punctuation">,</span> 3741cb0ef41Sopenharmony_ci <span class="hljs-attr">"resources"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span> 3751cb0ef41Sopenharmony_ci <span class="hljs-attr">"./app/checked.js"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span> 3761cb0ef41Sopenharmony_ci <span class="hljs-attr">"integrity"</span><span class="hljs-punctuation">:</span> <span class="hljs-string">"sha384-SggXRQHwCG8g+DktYYzxkXRIkTiEYWBHqev0xnpCxYlqMBufKZHAHQM3/boDaI/0"</span> 3771cb0ef41Sopenharmony_ci <span class="hljs-punctuation">}</span> 3781cb0ef41Sopenharmony_ci <span class="hljs-punctuation">}</span> 3791cb0ef41Sopenharmony_ci<span class="hljs-punctuation">}</span></code> <button class="copy-button">copy</button></pre> 3801cb0ef41Sopenharmony_ci<h6>Integrity checks<span><a class="mark" href="#integrity-checks" id="integrity-checks">#</a></span><a aria-hidden="true" class="legacy" id="permissions_integrity_checks"></a></h6> 3811cb0ef41Sopenharmony_ci<p>Policy files must use integrity checks with Subresource Integrity strings 3821cb0ef41Sopenharmony_cicompatible with the browser 3831cb0ef41Sopenharmony_ci<a href="https://www.w3.org/TR/SRI/#the-integrity-attribute">integrity attribute</a> 3841cb0ef41Sopenharmony_ciassociated with absolute URLs.</p> 3851cb0ef41Sopenharmony_ci<p>When using <code>require()</code> or <code>import</code> all resources involved in loading are checked 3861cb0ef41Sopenharmony_cifor integrity if a policy manifest has been specified. If a resource does not 3871cb0ef41Sopenharmony_cimatch the integrity listed in the manifest, an error will be thrown.</p> 3881cb0ef41Sopenharmony_ci<p>An example policy file that would allow loading a file <code>checked.js</code>:</p> 3891cb0ef41Sopenharmony_ci<pre><code class="language-json"><span class="hljs-punctuation">{</span> 3901cb0ef41Sopenharmony_ci <span class="hljs-attr">"resources"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span> 3911cb0ef41Sopenharmony_ci <span class="hljs-attr">"./app/checked.js"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span> 3921cb0ef41Sopenharmony_ci <span class="hljs-attr">"integrity"</span><span class="hljs-punctuation">:</span> <span class="hljs-string">"sha384-SggXRQHwCG8g+DktYYzxkXRIkTiEYWBHqev0xnpCxYlqMBufKZHAHQM3/boDaI/0"</span> 3931cb0ef41Sopenharmony_ci <span class="hljs-punctuation">}</span> 3941cb0ef41Sopenharmony_ci <span class="hljs-punctuation">}</span> 3951cb0ef41Sopenharmony_ci<span class="hljs-punctuation">}</span></code> <button class="copy-button">copy</button></pre> 3961cb0ef41Sopenharmony_ci<p>Each resource listed in the policy manifest can be of one the following 3971cb0ef41Sopenharmony_ciformats to determine its location:</p> 3981cb0ef41Sopenharmony_ci<ol> 3991cb0ef41Sopenharmony_ci<li>A <a href="https://url.spec.whatwg.org/#relative-url-with-fragment-string">relative-URL string</a> to a resource from the manifest such as <code>./resource.js</code>, <code>../resource.js</code>, or <code>/resource.js</code>.</li> 4001cb0ef41Sopenharmony_ci<li>A complete URL string to a resource such as <code>file:///resource.js</code>.</li> 4011cb0ef41Sopenharmony_ci</ol> 4021cb0ef41Sopenharmony_ci<p>When loading resources the entire URL must match including search parameters 4031cb0ef41Sopenharmony_ciand hash fragment. <code>./a.js?b</code> will not be used when attempting to load 4041cb0ef41Sopenharmony_ci<code>./a.js</code> and vice versa.</p> 4051cb0ef41Sopenharmony_ci<p>To generate integrity strings, a script such as 4061cb0ef41Sopenharmony_ci<code>node -e 'process.stdout.write("sha256-");process.stdin.pipe(crypto.createHash("sha256").setEncoding("base64")).pipe(process.stdout)' < FILE</code> 4071cb0ef41Sopenharmony_cican be used.</p> 4081cb0ef41Sopenharmony_ci<p>Integrity can be specified as the boolean value <code>true</code> to accept any 4091cb0ef41Sopenharmony_cibody for the resource which can be useful for local development. It is not 4101cb0ef41Sopenharmony_cirecommended in production since it would allow unexpected alteration of 4111cb0ef41Sopenharmony_ciresources to be considered valid.</p> 4121cb0ef41Sopenharmony_ci<h6>Dependency redirection<span><a class="mark" href="#dependency-redirection" id="dependency-redirection">#</a></span><a aria-hidden="true" class="legacy" id="permissions_dependency_redirection"></a></h6> 4131cb0ef41Sopenharmony_ci<p>An application may need to ship patched versions of modules or to prevent 4141cb0ef41Sopenharmony_cimodules from allowing all modules access to all other modules. Redirection 4151cb0ef41Sopenharmony_cican be used by intercepting attempts to load the modules wishing to be 4161cb0ef41Sopenharmony_cireplaced.</p> 4171cb0ef41Sopenharmony_ci<pre><code class="language-json"><span class="hljs-punctuation">{</span> 4181cb0ef41Sopenharmony_ci <span class="hljs-attr">"resources"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span> 4191cb0ef41Sopenharmony_ci <span class="hljs-attr">"./app/checked.js"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span> 4201cb0ef41Sopenharmony_ci <span class="hljs-attr">"dependencies"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span> 4211cb0ef41Sopenharmony_ci <span class="hljs-attr">"fs"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">true</span></span><span class="hljs-punctuation">,</span> 4221cb0ef41Sopenharmony_ci <span class="hljs-attr">"os"</span><span class="hljs-punctuation">:</span> <span class="hljs-string">"./app/node_modules/alt-os"</span><span class="hljs-punctuation">,</span> 4231cb0ef41Sopenharmony_ci <span class="hljs-attr">"http"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span> <span class="hljs-attr">"import"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">true</span></span> <span class="hljs-punctuation">}</span> 4241cb0ef41Sopenharmony_ci <span class="hljs-punctuation">}</span> 4251cb0ef41Sopenharmony_ci <span class="hljs-punctuation">}</span> 4261cb0ef41Sopenharmony_ci <span class="hljs-punctuation">}</span> 4271cb0ef41Sopenharmony_ci<span class="hljs-punctuation">}</span></code> <button class="copy-button">copy</button></pre> 4281cb0ef41Sopenharmony_ci<p>The dependencies are keyed by the requested specifier string and have values 4291cb0ef41Sopenharmony_ciof either <code>true</code>, <code>null</code>, a string pointing to a module to be resolved, 4301cb0ef41Sopenharmony_cior a conditions object.</p> 4311cb0ef41Sopenharmony_ci<p>The specifier string does not perform any searching and must match exactly what 4321cb0ef41Sopenharmony_ciis provided to the <code>require()</code> or <code>import</code> except for a canonicalization step. 4331cb0ef41Sopenharmony_ciTherefore, multiple specifiers may be needed in the policy if it uses multiple 4341cb0ef41Sopenharmony_cidifferent strings to point to the same module (such as excluding the extension).</p> 4351cb0ef41Sopenharmony_ci<p>Specifier strings are canonicalized but not resolved prior to be used for 4361cb0ef41Sopenharmony_cimatching in order to have some compatibility with import maps, for example if a 4371cb0ef41Sopenharmony_ciresource <code>file:///C:/app/server.js</code> was given the following redirection from a 4381cb0ef41Sopenharmony_cipolicy located at <code>file:///C:/app/policy.json</code>:</p> 4391cb0ef41Sopenharmony_ci<pre><code class="language-json"><span class="hljs-punctuation">{</span> 4401cb0ef41Sopenharmony_ci <span class="hljs-attr">"resources"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span> 4411cb0ef41Sopenharmony_ci <span class="hljs-attr">"file:///C:/app/utils.js"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span> 4421cb0ef41Sopenharmony_ci <span class="hljs-attr">"dependencies"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span> 4431cb0ef41Sopenharmony_ci <span class="hljs-attr">"./utils.js"</span><span class="hljs-punctuation">:</span> <span class="hljs-string">"./utils-v2.js"</span> 4441cb0ef41Sopenharmony_ci <span class="hljs-punctuation">}</span> 4451cb0ef41Sopenharmony_ci <span class="hljs-punctuation">}</span> 4461cb0ef41Sopenharmony_ci <span class="hljs-punctuation">}</span> 4471cb0ef41Sopenharmony_ci<span class="hljs-punctuation">}</span></code> <button class="copy-button">copy</button></pre> 4481cb0ef41Sopenharmony_ci<p>Any specifier used to load <code>file:///C:/app/utils.js</code> would then be intercepted 4491cb0ef41Sopenharmony_ciand redirected to <code>file:///C:/app/utils-v2.js</code> instead regardless of using an 4501cb0ef41Sopenharmony_ciabsolute or relative specifier. However, if a specifier that is not an absolute 4511cb0ef41Sopenharmony_cior relative URL string is used, it would not be intercepted. So, if an import 4521cb0ef41Sopenharmony_cisuch as <code>import('#utils')</code> was used, it would not be intercepted.</p> 4531cb0ef41Sopenharmony_ci<p>If the value of the redirection is <code>true</code>, a "dependencies" field at the top of 4541cb0ef41Sopenharmony_cithe policy file will be used. If that field at the top of the policy file is 4551cb0ef41Sopenharmony_ci<code>true</code> the default node searching algorithms are used to find the module.</p> 4561cb0ef41Sopenharmony_ci<p>If the value of the redirection is a string, it is resolved relative to 4571cb0ef41Sopenharmony_cithe manifest and then immediately used without searching.</p> 4581cb0ef41Sopenharmony_ci<p>Any specifier string for which resolution is attempted and that is not listed in 4591cb0ef41Sopenharmony_cithe dependencies results in an error according to the policy.</p> 4601cb0ef41Sopenharmony_ci<p>Redirection does not prevent access to APIs through means such as direct access 4611cb0ef41Sopenharmony_cito <code>require.cache</code> or through <code>module.constructor</code> which allow access to 4621cb0ef41Sopenharmony_ciloading modules. Policy redirection only affects specifiers to <code>require()</code> and 4631cb0ef41Sopenharmony_ci<code>import</code>. Other means, such as to prevent undesired access to APIs through 4641cb0ef41Sopenharmony_civariables, are necessary to lock down that path of loading modules.</p> 4651cb0ef41Sopenharmony_ci<p>A boolean value of <code>true</code> for the dependencies map can be specified to allow a 4661cb0ef41Sopenharmony_cimodule to load any specifier without redirection. This can be useful for local 4671cb0ef41Sopenharmony_cidevelopment and may have some valid usage in production, but should be used 4681cb0ef41Sopenharmony_cionly with care after auditing a module to ensure its behavior is valid.</p> 4691cb0ef41Sopenharmony_ci<p>Similar to <code>"exports"</code> in <code>package.json</code>, dependencies can also be specified to 4701cb0ef41Sopenharmony_cibe objects containing conditions which branch how dependencies are loaded. In 4711cb0ef41Sopenharmony_cithe preceding example, <code>"http"</code> is allowed when the <code>"import"</code> condition is 4721cb0ef41Sopenharmony_cipart of loading it.</p> 4731cb0ef41Sopenharmony_ci<p>A value of <code>null</code> for the resolved value causes the resolution to fail. This 4741cb0ef41Sopenharmony_cican be used to ensure some kinds of dynamic access are explicitly prevented.</p> 4751cb0ef41Sopenharmony_ci<p>Unknown values for the resolved module location cause failures but are 4761cb0ef41Sopenharmony_cinot guaranteed to be forward compatible.</p> 4771cb0ef41Sopenharmony_ci<h6>Example: Patched dependency<span><a class="mark" href="#example-patched-dependency" id="example-patched-dependency">#</a></span><a aria-hidden="true" class="legacy" id="permissions_example_patched_dependency"></a></h6> 4781cb0ef41Sopenharmony_ci<p>Redirected dependencies can provide attenuated or modified functionality as fits 4791cb0ef41Sopenharmony_cithe application. For example, log data about timing of function durations by 4801cb0ef41Sopenharmony_ciwrapping the original:</p> 4811cb0ef41Sopenharmony_ci<pre><code class="language-js"><span class="hljs-keyword">const</span> original = <span class="hljs-built_in">require</span>(<span class="hljs-string">'fn'</span>); 4821cb0ef41Sopenharmony_ci<span class="hljs-variable language_">module</span>.<span class="hljs-property">exports</span> = <span class="hljs-keyword">function</span> <span class="hljs-title function_">fn</span>(<span class="hljs-params">...args</span>) { 4831cb0ef41Sopenharmony_ci <span class="hljs-variable language_">console</span>.<span class="hljs-title function_">time</span>(); 4841cb0ef41Sopenharmony_ci <span class="hljs-keyword">try</span> { 4851cb0ef41Sopenharmony_ci <span class="hljs-keyword">return</span> <span class="hljs-keyword">new</span>.<span class="hljs-property">target</span> ? 4861cb0ef41Sopenharmony_ci <span class="hljs-title class_">Reflect</span>.<span class="hljs-title function_">construct</span>(original, args) : 4871cb0ef41Sopenharmony_ci <span class="hljs-title class_">Reflect</span>.<span class="hljs-title function_">apply</span>(original, <span class="hljs-variable language_">this</span>, args); 4881cb0ef41Sopenharmony_ci } <span class="hljs-keyword">finally</span> { 4891cb0ef41Sopenharmony_ci <span class="hljs-variable language_">console</span>.<span class="hljs-title function_">timeEnd</span>(); 4901cb0ef41Sopenharmony_ci } 4911cb0ef41Sopenharmony_ci};</code> <button class="copy-button">copy</button></pre> 4921cb0ef41Sopenharmony_ci<h5>Scopes<span><a class="mark" href="#scopes" id="scopes">#</a></span><a aria-hidden="true" class="legacy" id="permissions_scopes"></a></h5> 4931cb0ef41Sopenharmony_ci<p>Use the <code>"scopes"</code> field of a manifest to set configuration for many resources 4941cb0ef41Sopenharmony_ciat once. The <code>"scopes"</code> field works by matching resources by their segments. 4951cb0ef41Sopenharmony_ciIf a scope or resource includes <code>"cascade": true</code>, unknown specifiers will 4961cb0ef41Sopenharmony_cibe searched for in their containing scope. The containing scope for cascading 4971cb0ef41Sopenharmony_ciis found by recursively reducing the resource URL by removing segments for 4981cb0ef41Sopenharmony_ci<a href="https://url.spec.whatwg.org/#special-scheme">special schemes</a>, keeping trailing <code>"/"</code> suffixes, and removing the query and 4991cb0ef41Sopenharmony_cihash fragment. This leads to the eventual reduction of the URL to its origin. 5001cb0ef41Sopenharmony_ciIf the URL is non-special the scope will be located by the URL's origin. If no 5011cb0ef41Sopenharmony_ciscope is found for the origin or in the case of opaque origins, a protocol 5021cb0ef41Sopenharmony_cistring can be used as a scope. If no scope is found for the URL's protocol, a 5031cb0ef41Sopenharmony_cifinal empty string <code>""</code> scope will be used.</p> 5041cb0ef41Sopenharmony_ci<p>Note, <code>blob:</code> URLs adopt their origin from the path they contain, and so a scope 5051cb0ef41Sopenharmony_ciof <code>"blob:https://nodejs.org"</code> will have no effect since no URL can have an 5061cb0ef41Sopenharmony_ciorigin of <code>blob:https://nodejs.org</code>; URLs starting with 5071cb0ef41Sopenharmony_ci<code>blob:https://nodejs.org/</code> will use <code>https://nodejs.org</code> for its origin and 5081cb0ef41Sopenharmony_cithus <code>https:</code> for its protocol scope. For opaque origin <code>blob:</code> URLs they will 5091cb0ef41Sopenharmony_cihave <code>blob:</code> for their protocol scope since they do not adopt origins.</p> 5101cb0ef41Sopenharmony_ci<h6>Example<span><a class="mark" href="#example" id="example">#</a></span><a aria-hidden="true" class="legacy" id="permissions_example"></a></h6> 5111cb0ef41Sopenharmony_ci<pre><code class="language-json"><span class="hljs-punctuation">{</span> 5121cb0ef41Sopenharmony_ci <span class="hljs-attr">"scopes"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span> 5131cb0ef41Sopenharmony_ci <span class="hljs-attr">"file:///C:/app/"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span><span class="hljs-punctuation">}</span><span class="hljs-punctuation">,</span> 5141cb0ef41Sopenharmony_ci <span class="hljs-attr">"file:"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span><span class="hljs-punctuation">}</span><span class="hljs-punctuation">,</span> 5151cb0ef41Sopenharmony_ci <span class="hljs-attr">""</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span><span class="hljs-punctuation">}</span> 5161cb0ef41Sopenharmony_ci <span class="hljs-punctuation">}</span> 5171cb0ef41Sopenharmony_ci<span class="hljs-punctuation">}</span></code> <button class="copy-button">copy</button></pre> 5181cb0ef41Sopenharmony_ci<p>Given a file located at <code>file:///C:/app/bin/main.js</code>, the following scopes would 5191cb0ef41Sopenharmony_cibe checked in order:</p> 5201cb0ef41Sopenharmony_ci<ol> 5211cb0ef41Sopenharmony_ci<li><code>"file:///C:/app/bin/"</code></li> 5221cb0ef41Sopenharmony_ci</ol> 5231cb0ef41Sopenharmony_ci<p>This determines the policy for all file based resources within 5241cb0ef41Sopenharmony_ci<code>"file:///C:/app/bin/"</code>. This is not in the <code>"scopes"</code> field of the policy and 5251cb0ef41Sopenharmony_ciwould be skipped. Adding this scope to the policy would cause it to be used 5261cb0ef41Sopenharmony_ciprior to the <code>"file:///C:/app/"</code> scope.</p> 5271cb0ef41Sopenharmony_ci<ol start="2"> 5281cb0ef41Sopenharmony_ci<li><code>"file:///C:/app/"</code></li> 5291cb0ef41Sopenharmony_ci</ol> 5301cb0ef41Sopenharmony_ci<p>This determines the policy for all file based resources within 5311cb0ef41Sopenharmony_ci<code>"file:///C:/app/"</code>. This is in the <code>"scopes"</code> field of the policy and it would 5321cb0ef41Sopenharmony_cidetermine the policy for the resource at <code>file:///C:/app/bin/main.js</code>. If the 5331cb0ef41Sopenharmony_ciscope has <code>"cascade": true</code>, any unsatisfied queries about the resource would 5341cb0ef41Sopenharmony_cidelegate to the next relevant scope for <code>file:///C:/app/bin/main.js</code>, <code>"file:"</code>.</p> 5351cb0ef41Sopenharmony_ci<ol start="3"> 5361cb0ef41Sopenharmony_ci<li><code>"file:///C:/"</code></li> 5371cb0ef41Sopenharmony_ci</ol> 5381cb0ef41Sopenharmony_ci<p>This determines the policy for all file based resources within <code>"file:///C:/"</code>. 5391cb0ef41Sopenharmony_ciThis is not in the <code>"scopes"</code> field of the policy and would be skipped. It would 5401cb0ef41Sopenharmony_cinot be used for <code>file:///C:/app/bin/main.js</code> unless <code>"file:///"</code> is set to 5411cb0ef41Sopenharmony_cicascade or is not in the <code>"scopes"</code> of the policy.</p> 5421cb0ef41Sopenharmony_ci<ol start="4"> 5431cb0ef41Sopenharmony_ci<li><code>"file:///"</code></li> 5441cb0ef41Sopenharmony_ci</ol> 5451cb0ef41Sopenharmony_ci<p>This determines the policy for all file based resources on the <code>localhost</code>. This 5461cb0ef41Sopenharmony_ciis not in the <code>"scopes"</code> field of the policy and would be skipped. It would not 5471cb0ef41Sopenharmony_cibe used for <code>file:///C:/app/bin/main.js</code> unless <code>"file:///"</code> is set to cascade 5481cb0ef41Sopenharmony_cior is not in the <code>"scopes"</code> of the policy.</p> 5491cb0ef41Sopenharmony_ci<ol start="5"> 5501cb0ef41Sopenharmony_ci<li><code>"file:"</code></li> 5511cb0ef41Sopenharmony_ci</ol> 5521cb0ef41Sopenharmony_ci<p>This determines the policy for all file based resources. It would not be used 5531cb0ef41Sopenharmony_cifor <code>file:///C:/app/bin/main.js</code> unless <code>"file:///"</code> is set to cascade or is not 5541cb0ef41Sopenharmony_ciin the <code>"scopes"</code> of the policy.</p> 5551cb0ef41Sopenharmony_ci<ol start="6"> 5561cb0ef41Sopenharmony_ci<li><code>""</code></li> 5571cb0ef41Sopenharmony_ci</ol> 5581cb0ef41Sopenharmony_ci<p>This determines the policy for all resources. It would not be used for 5591cb0ef41Sopenharmony_ci<code>file:///C:/app/bin/main.js</code> unless <code>"file:"</code> is set to cascade.</p> 5601cb0ef41Sopenharmony_ci<h6>Integrity using scopes<span><a class="mark" href="#integrity-using-scopes" id="integrity-using-scopes">#</a></span><a aria-hidden="true" class="legacy" id="permissions_integrity_using_scopes"></a></h6> 5611cb0ef41Sopenharmony_ci<p>Setting an integrity to <code>true</code> on a scope will set the integrity for any 5621cb0ef41Sopenharmony_ciresource not found in the manifest to <code>true</code>.</p> 5631cb0ef41Sopenharmony_ci<p>Setting an integrity to <code>null</code> on a scope will set the integrity for any 5641cb0ef41Sopenharmony_ciresource not found in the manifest to fail matching.</p> 5651cb0ef41Sopenharmony_ci<p>Not including an integrity is the same as setting the integrity to <code>null</code>.</p> 5661cb0ef41Sopenharmony_ci<p><code>"cascade"</code> for integrity checks will be ignored if <code>"integrity"</code> is explicitly 5671cb0ef41Sopenharmony_ciset.</p> 5681cb0ef41Sopenharmony_ci<p>The following example allows loading any file:</p> 5691cb0ef41Sopenharmony_ci<pre><code class="language-json"><span class="hljs-punctuation">{</span> 5701cb0ef41Sopenharmony_ci <span class="hljs-attr">"scopes"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span> 5711cb0ef41Sopenharmony_ci <span class="hljs-attr">"file:"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span> 5721cb0ef41Sopenharmony_ci <span class="hljs-attr">"integrity"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">true</span></span> 5731cb0ef41Sopenharmony_ci <span class="hljs-punctuation">}</span> 5741cb0ef41Sopenharmony_ci <span class="hljs-punctuation">}</span> 5751cb0ef41Sopenharmony_ci<span class="hljs-punctuation">}</span></code> <button class="copy-button">copy</button></pre> 5761cb0ef41Sopenharmony_ci<h6>Dependency redirection using scopes<span><a class="mark" href="#dependency-redirection-using-scopes" id="dependency-redirection-using-scopes">#</a></span><a aria-hidden="true" class="legacy" id="permissions_dependency_redirection_using_scopes"></a></h6> 5771cb0ef41Sopenharmony_ci<p>The following example, would allow access to <code>fs</code> for all resources within 5781cb0ef41Sopenharmony_ci<code>./app/</code>:</p> 5791cb0ef41Sopenharmony_ci<pre><code class="language-json"><span class="hljs-punctuation">{</span> 5801cb0ef41Sopenharmony_ci <span class="hljs-attr">"resources"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span> 5811cb0ef41Sopenharmony_ci <span class="hljs-attr">"./app/checked.js"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span> 5821cb0ef41Sopenharmony_ci <span class="hljs-attr">"cascade"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">true</span></span><span class="hljs-punctuation">,</span> 5831cb0ef41Sopenharmony_ci <span class="hljs-attr">"integrity"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">true</span></span> 5841cb0ef41Sopenharmony_ci <span class="hljs-punctuation">}</span> 5851cb0ef41Sopenharmony_ci <span class="hljs-punctuation">}</span><span class="hljs-punctuation">,</span> 5861cb0ef41Sopenharmony_ci <span class="hljs-attr">"scopes"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span> 5871cb0ef41Sopenharmony_ci <span class="hljs-attr">"./app/"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span> 5881cb0ef41Sopenharmony_ci <span class="hljs-attr">"dependencies"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span> 5891cb0ef41Sopenharmony_ci <span class="hljs-attr">"fs"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">true</span></span> 5901cb0ef41Sopenharmony_ci <span class="hljs-punctuation">}</span> 5911cb0ef41Sopenharmony_ci <span class="hljs-punctuation">}</span> 5921cb0ef41Sopenharmony_ci <span class="hljs-punctuation">}</span> 5931cb0ef41Sopenharmony_ci<span class="hljs-punctuation">}</span></code> <button class="copy-button">copy</button></pre> 5941cb0ef41Sopenharmony_ci<p>The following example, would allow access to <code>fs</code> for all <code>data:</code> resources:</p> 5951cb0ef41Sopenharmony_ci<pre><code class="language-json"><span class="hljs-punctuation">{</span> 5961cb0ef41Sopenharmony_ci <span class="hljs-attr">"resources"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span> 5971cb0ef41Sopenharmony_ci <span class="hljs-attr">"data:text/javascript,import('node:fs');"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span> 5981cb0ef41Sopenharmony_ci <span class="hljs-attr">"cascade"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">true</span></span><span class="hljs-punctuation">,</span> 5991cb0ef41Sopenharmony_ci <span class="hljs-attr">"integrity"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">true</span></span> 6001cb0ef41Sopenharmony_ci <span class="hljs-punctuation">}</span> 6011cb0ef41Sopenharmony_ci <span class="hljs-punctuation">}</span><span class="hljs-punctuation">,</span> 6021cb0ef41Sopenharmony_ci <span class="hljs-attr">"scopes"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span> 6031cb0ef41Sopenharmony_ci <span class="hljs-attr">"data:"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span> 6041cb0ef41Sopenharmony_ci <span class="hljs-attr">"dependencies"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span> 6051cb0ef41Sopenharmony_ci <span class="hljs-attr">"fs"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">true</span></span> 6061cb0ef41Sopenharmony_ci <span class="hljs-punctuation">}</span> 6071cb0ef41Sopenharmony_ci <span class="hljs-punctuation">}</span> 6081cb0ef41Sopenharmony_ci <span class="hljs-punctuation">}</span> 6091cb0ef41Sopenharmony_ci<span class="hljs-punctuation">}</span></code> <button class="copy-button">copy</button></pre> 6101cb0ef41Sopenharmony_ci<h6>Example: import maps emulation<span><a class="mark" href="#example-import-maps-emulation" id="example-import-maps-emulation">#</a></span><a aria-hidden="true" class="legacy" id="permissions_example_import_maps_emulation"></a></h6> 6111cb0ef41Sopenharmony_ci<p>Given an import map:</p> 6121cb0ef41Sopenharmony_ci<pre><code class="language-json"><span class="hljs-punctuation">{</span> 6131cb0ef41Sopenharmony_ci <span class="hljs-attr">"imports"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span> 6141cb0ef41Sopenharmony_ci <span class="hljs-attr">"react"</span><span class="hljs-punctuation">:</span> <span class="hljs-string">"./app/node_modules/react/index.js"</span> 6151cb0ef41Sopenharmony_ci <span class="hljs-punctuation">}</span><span class="hljs-punctuation">,</span> 6161cb0ef41Sopenharmony_ci <span class="hljs-attr">"scopes"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span> 6171cb0ef41Sopenharmony_ci <span class="hljs-attr">"./ssr/"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span> 6181cb0ef41Sopenharmony_ci <span class="hljs-attr">"react"</span><span class="hljs-punctuation">:</span> <span class="hljs-string">"./app/node_modules/server-side-react/index.js"</span> 6191cb0ef41Sopenharmony_ci <span class="hljs-punctuation">}</span> 6201cb0ef41Sopenharmony_ci <span class="hljs-punctuation">}</span> 6211cb0ef41Sopenharmony_ci<span class="hljs-punctuation">}</span></code> <button class="copy-button">copy</button></pre> 6221cb0ef41Sopenharmony_ci<pre><code class="language-json"><span class="hljs-punctuation">{</span> 6231cb0ef41Sopenharmony_ci <span class="hljs-attr">"dependencies"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">true</span></span><span class="hljs-punctuation">,</span> 6241cb0ef41Sopenharmony_ci <span class="hljs-attr">"scopes"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span> 6251cb0ef41Sopenharmony_ci <span class="hljs-attr">""</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span> 6261cb0ef41Sopenharmony_ci <span class="hljs-attr">"cascade"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">true</span></span><span class="hljs-punctuation">,</span> 6271cb0ef41Sopenharmony_ci <span class="hljs-attr">"dependencies"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span> 6281cb0ef41Sopenharmony_ci <span class="hljs-attr">"react"</span><span class="hljs-punctuation">:</span> <span class="hljs-string">"./app/node_modules/react/index.js"</span> 6291cb0ef41Sopenharmony_ci <span class="hljs-punctuation">}</span> 6301cb0ef41Sopenharmony_ci <span class="hljs-punctuation">}</span><span class="hljs-punctuation">,</span> 6311cb0ef41Sopenharmony_ci <span class="hljs-attr">"./ssr/"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span> 6321cb0ef41Sopenharmony_ci <span class="hljs-attr">"cascade"</span><span class="hljs-punctuation">:</span> <span class="hljs-literal"><span class="hljs-keyword">true</span></span><span class="hljs-punctuation">,</span> 6331cb0ef41Sopenharmony_ci <span class="hljs-attr">"dependencies"</span><span class="hljs-punctuation">:</span> <span class="hljs-punctuation">{</span> 6341cb0ef41Sopenharmony_ci <span class="hljs-attr">"react"</span><span class="hljs-punctuation">:</span> <span class="hljs-string">"./app/node_modules/server-side-react/index.js"</span> 6351cb0ef41Sopenharmony_ci <span class="hljs-punctuation">}</span> 6361cb0ef41Sopenharmony_ci <span class="hljs-punctuation">}</span> 6371cb0ef41Sopenharmony_ci <span class="hljs-punctuation">}</span> 6381cb0ef41Sopenharmony_ci<span class="hljs-punctuation">}</span></code> <button class="copy-button">copy</button></pre> 6391cb0ef41Sopenharmony_ci<p><a href="https://url.spec.whatwg.org/#relative-url-with-fragment-string">Import maps</a> assume you can get any resource by default. This means 6401cb0ef41Sopenharmony_ci<code>"dependencies"</code> at the top level of the policy should be set to <code>true</code>. 6411cb0ef41Sopenharmony_ciPolicies require this to be opt-in since it enables all resources of the 6421cb0ef41Sopenharmony_ciapplication cross linkage which doesn't make sense for many scenarios. They also 6431cb0ef41Sopenharmony_ciassume any given scope has access to any scope above its allowed dependencies; 6441cb0ef41Sopenharmony_ciall scopes emulating import maps must set <code>"cascade": true</code>.</p> 6451cb0ef41Sopenharmony_ci<p>Import maps only have a single top level scope for their "imports". So for 6461cb0ef41Sopenharmony_ciemulating <code>"imports"</code> use the <code>""</code> scope. For emulating <code>"scopes"</code> use the 6471cb0ef41Sopenharmony_ci<code>"scopes"</code> in a similar manner to how <code>"scopes"</code> works in import maps.</p> 6481cb0ef41Sopenharmony_ci<p>Caveats: Policies do not use string matching for various finding of scope. They 6491cb0ef41Sopenharmony_cido URL traversals. This means things like <code>blob:</code> and <code>data:</code> URLs might not be 6501cb0ef41Sopenharmony_cientirely interoperable between the two systems. For example import maps can 6511cb0ef41Sopenharmony_cipartially match a <code>data:</code> or <code>blob:</code> URL by partitioning the URL on a <code>/</code> 6521cb0ef41Sopenharmony_cicharacter, policies intentionally cannot. For <code>blob:</code> URLs import map scopes do 6531cb0ef41Sopenharmony_cinot adopt the origin of the <code>blob:</code> URL.</p> 6541cb0ef41Sopenharmony_ci<p>Additionally, import maps only work on <code>import</code> so it may be desirable to add a 6551cb0ef41Sopenharmony_ci<code>"import"</code> condition to all dependency mappings.</p></section> 6561cb0ef41Sopenharmony_ci <!-- API END --> 6571cb0ef41Sopenharmony_ci </div> 6581cb0ef41Sopenharmony_ci </div> 6591cb0ef41Sopenharmony_ci </div> 6601cb0ef41Sopenharmony_ci</body> 6611cb0ef41Sopenharmony_ci</html> 662