permission: intersect when Worker execArgv asks for grants

Detect permission-related tokens from the original execArgv so an
explicit `--permission` without fs allows stays on the intersect path
instead of the parent ceiling (which re-widened the allowlist).

Signed-off-by: NG YUN SHING <yunshingng25@gmail.com>

Author: yunshingng

src/node_worker.cc

@@ -645,24 +645,6 @@ void IntersectPermissionGrants(Environment* env,
   FilterPathListToParentSubset(env, &w->allow_fs_write, parent->allow_fs_write);
 }
 
-void ClampWorkerPermissionToParent(Environment* env,
-                                   PerIsolateOptions* worker_opts) {
-  if (worker_opts == nullptr || env == nullptr ||
-      !env->permission()->enabled()) {
-    return;
-  }
-  EnvironmentOptions* parent =
-      env->isolate_data()->options()->get_per_env_options();
-  EnvironmentOptions* w = worker_opts->get_per_env_options();
-  if (parent == nullptr || w == nullptr) return;
-
-  if (!WorkerConfiguredPermission(w)) {
-    ApplyParentPermissionCeiling(w, parent);
-  } else {
-    IntersectPermissionGrants(env, w, parent);
-  }
-}
-
 bool IsPermissionCliToken(const std::string& a) {
   if (a == "--permission" || a == "--permission-audit") return true;
   if (a == "--allow-fs-read" || a == "--allow-fs-write") return true;
@@ -680,6 +662,43 @@ bool IsPermissionCliToken(const std::string& a) {
   return false;
 }
 
+bool ExecArgvHasPermissionToken(const std::vector<std::string>& argv) {
+  for (const std::string& tok : argv) {
+    if (IsPermissionCliToken(tok)) return true;
+  }
+  return false;
+}
+
+void ClampWorkerPermissionToParent(
+    Environment* env,
+    PerIsolateOptions* worker_opts,
+    const std::vector<std::string>& exec_argv_out) {
+  if (worker_opts == nullptr || env == nullptr ||
+      !env->permission()->enabled()) {
+    return;
+  }
+  EnvironmentOptions* parent =
+      env->isolate_data()->options()->get_per_env_options();
+  EnvironmentOptions* w = worker_opts->get_per_env_options();
+  if (parent == nullptr || w == nullptr) return;
+
+  // Ceiling (inherit parent grants) only when the worker did not ask for any
+  // permission-related configuration. If execArgv contains permission tokens
+  // (or options already reflect them), intersect so an explicit
+  // `--permission` without fs grants stays restrictive instead of being
+  // widened back to the parent allowlist.
+  const bool permission_requested =
+      WorkerConfiguredPermission(w) || ExecArgvHasPermissionToken(exec_argv_out);
+  if (!permission_requested) {
+    ApplyParentPermissionCeiling(w, parent);
+  } else {
+    if (!w->permission && !w->permission_audit) {
+      w->permission = true;
+    }
+    IntersectPermissionGrants(env, w, parent);
+  }
+}
+
 bool PermissionFlagTakesNextArg(const std::string& a) {
   return a == "--allow-fs-read" || a == "--allow-fs-write";
 }
@@ -930,7 +949,30 @@ void Worker::New(const FunctionCallbackInfo<Value>& args) {
   // parent. [] stays on the fresh-parse path above so NODE_OPTIONS still
   // applies; the ceiling then re-attaches parent permission grants.
   if (env->permission()->enabled() && per_isolate_opts && explicit_exec_argv) {
-    ClampWorkerPermissionToParent(env, per_isolate_opts.get());
+    // Prefer the original JS execArgv strings for "did the caller ask for
+    // permission flags?" — Parse may consume known tokens out of
+    // exec_argv_out, which would otherwise make a restrictive
+    // `--permission` (no fs grants) look unconfigured and hit the ceiling.
+    std::vector<std::string> permission_argv_probe = exec_argv_out;
+    if (args[2]->IsArray()) {
+      Local<Array> array = args[2].As<Array>();
+      uint32_t length = array->Length();
+      for (uint32_t i = 0; i < length; i++) {
+        Local<Value> arg;
+        if (!array->Get(env->context(), i).ToLocal(&arg)) {
+          return;
+        }
+        Local<String> arg_v8;
+        if (!arg->ToString(env->context()).ToLocal(&arg_v8)) {
+          return;
+        }
+        Utf8Value arg_utf8_value(args.GetIsolate(), arg_v8);
+        permission_argv_probe.emplace_back(arg_utf8_value.out(),
+                                           arg_utf8_value.length());
+      }
+    }
+    ClampWorkerPermissionToParent(
+        env, per_isolate_opts.get(), permission_argv_probe);
     RebuildExecArgvOutFromPermissionOptions(per_isolate_opts.get(),
                                             &exec_argv_out);
   }