lib,permission: fix addon permission drop

Signed-off-by: Martin <martin@asymmetric.re>
PR-URL: #64007
Reviewed-By: Rafael Gonzaga <rafael.nunu@hotmail.com>
Reviewed-By: Edy Silva <edigleyssonsilva@gmail.com>

Author: mawalu

src/node_binding.cc

@@ -5,6 +5,7 @@
 #include"node_errors.h"
 #include"node_external_reference.h"
 #include"node_url_pattern.h"
+#include"permission/permission.h"
 #include"util.h"
 
 #include<string>
@@ -449,6 +450,8 @@ void DLOpen(const FunctionCallbackInfo<Value>& args) {
 returnTHROW_ERR_DLOPEN_DISABLED(
  env, "Cannot load native addon because loading addons is disabled.");
  }
+THROW_IF_INSUFFICIENT_PERMISSIONS(
+ env, permission::PermissionScope::kAddon, "");
 
 auto context = env->context();
 

test/parallel/test-permission-drop-addons.js

@@ -0,0 +1,38 @@
+// Flags: --permission --allow-addons --allow-fs-read=*
+'use strict';
+
+constcommon=require('../common');
+const{ isMainThread }=require('worker_threads');
+
+if(!isMainThread){
+common.skip('This test only works on a main thread');
+}
+
+constassert=require('assert');
+
+letbindingPath;
+try{
+bindingPath=require.resolve(
+`../addons/hello-world/build/${common.buildType}/binding`);
+}catch(err){
+if(err.code!=='MODULE_NOT_FOUND'){
+throwerr;
+}
+common.skip('addon not found');
+}
+
+functionopenAddon(){
+process.dlopen({exports: {}},bindingPath);
+}
+
+assert.ok(process.permission.has('addon'));
+openAddon();
+
+process.permission.drop('addon');
+assert.ok(!process.permission.has('addon'));
+assert.throws(()=>{
+openAddon();
+},common.expectsError({
+code: 'ERR_ACCESS_DENIED',
+permission: 'Addon',
+}));