permission,doc: fix --allow-env docs and expand test coverage

Signed-off-by: nabeel378 <[email protected]>

Author: nabeel378

doc/api/cli.md

@@ -218,7 +218,7 @@ process.env.FOO = 'bar';       // ERR_ACCESS_DENIED (throws)
 ```
 
 ```console
-$ node --permission --allow-fs-read=* index.js
+$ node --permission index.js
 node:internal/process/per_thread:12
   throw new ERR_ACCESS_DENIED('EnvVar', name);
   ^

src/permission/permission.cc

@@ -143,6 +143,8 @@ Permission::Permission() : enabled_(false), warning_only_(false) {
 #define V(Name, _, __, ___)                                                    \
   nodes_.insert(std::make_pair(PermissionScope::k##Name, ffi));
   FFI_PERMISSIONS(V)
+#undef V
+#define V(Name, _, __, ___)                                                    \
   nodes_.insert(std::make_pair(PermissionScope::k##Name, env_var));
   ENV_VAR_PERMISSIONS(V)
 #undef V

test/parallel/test-permission-env-cli.js

@@ -10,26 +10,21 @@ if (!isMainThread) {
 
 const assert = require('assert');
 
-// Guarantee the initial state
 {
   assert.ok(!process.permission.has('env'));
 }
 
-// Allowed env vars should be accessible
 {
-  // Reading allowed env vars should not throw
   const home = process.env.HOME;
   const path = process.env.PATH;
   assert.ok(process.permission.has('env', 'HOME'));
   assert.ok(process.permission.has('env', 'PATH'));
 }
 
-// Disallowed env vars should return undefined (silently denied)
 {
   assert.strictEqual(process.env.SECRET_KEY, undefined);
 }
 
-// Setting a disallowed env var should throw
 {
   assert.throws(() => {
     process.env.NEW_VAR = 'value';
@@ -40,7 +35,6 @@ const assert = require('assert');
   }));
 }
 
-// Deleting a disallowed env var should throw
 {
   assert.throws(() => {
     delete process.env.SECRET_KEY;
@@ -51,12 +45,10 @@ const assert = require('assert');
   }));
 }
 
-// Querying a disallowed env var should return false (not found)
 {
   assert.strictEqual('SECRET_KEY' in process.env, false);
 }
 
-// Enumerating should only return allowed env vars
 {
   const keys = Object.keys(process.env);
   for (const key of keys) {
@@ -66,3 +58,38 @@ const assert = require('assert');
     );
   }
 }
+
+{
+  const keys = [];
+  for (const key in process.env) {
+    keys.push(key);
+  }
+  for (const key of keys) {
+    assert.ok(
+      key === 'HOME' || key === 'PATH',
+      `Unexpected env var in for...in: ${key}`
+    );
+  }
+}
+
+{
+  const copy = Object.assign({}, process.env);
+  const keys = Object.keys(copy);
+  for (const key of keys) {
+    assert.ok(
+      key === 'HOME' || key === 'PATH',
+      `Unexpected env var in Object.assign: ${key}`
+    );
+  }
+}
+
+{
+  const parsed = JSON.parse(JSON.stringify(process.env));
+  const keys = Object.keys(parsed);
+  for (const key of keys) {
+    assert.ok(
+      key === 'HOME' || key === 'PATH',
+      `Unexpected env var in JSON.stringify: ${key}`
+    );
+  }
+}

test/parallel/test-permission-env-deny-all.js

@@ -10,18 +10,15 @@ if (!isMainThread) {
 
 const assert = require('assert');
 
-// When --permission is set without --allow-env, all env access is denied
 {
   assert.ok(!process.permission.has('env'));
 }
 
-// Reading any env var should return undefined (silently denied)
 {
   assert.strictEqual(process.env.HOME, undefined);
   assert.strictEqual(process.env.PATH, undefined);
 }
 
-// Setting any env var should throw
 {
   assert.throws(() => {
     process.env.TEST_VAR = 'value';
@@ -31,7 +28,6 @@ const assert = require('assert');
   }));
 }
 
-// Enumerating should return empty
 {
   const keys = Object.keys(process.env);
   assert.strictEqual(keys.length, 0);