fs: do not treat EPERM as ENOTEMPTY on Windows

Fixes: #56433
Signed-off-by: PickBas <sayed.kirill@gmail.com>
PR-URL: #63709Fixes: #56433
Reviewed-By: Jason Zhang <xzha4350@gmail.com>
Reviewed-By: Stefan Stojanovic <stefan.stojanovic@janeasystems.com>

Author: PickBas

lib/internal/fs/rimraf.js

@@ -24,7 +24,9 @@ const {
 const{ sep }=require('path');
 const{ setTimeout }=require('timers');
 const{ isWindows }=require('internal/util');
-constnotEmptyErrorCodes=newSafeSet(['ENOTEMPTY','EEXIST','EPERM']);
+constnotEmptyErrorCodes=isWindows ?
+newSafeSet(['ENOTEMPTY','EEXIST']) :
+newSafeSet(['ENOTEMPTY','EEXIST','EPERM']);
 constretryErrorCodes=newSafeSet(
 ['EBUSY','EMFILE','ENFILE','ENOTEMPTY','EPERM']);
 constepermHandler=isWindows ? fixWinEPERM : _rmdir;

test/parallel/test-fs-rm.js

@@ -567,5 +567,67 @@ if (isGitPresent) {
 makeDirectoryWritable(middle);
 }
 }
+
+if(common.isWindows){
+// On Windows, EPERM from rmdir on a directory that cannot be deleted
+// due to permissions must not be treated as ENOTEMPTY (which would
+// cause rimraf to recurse into and delete the directory's children).
+constdirname=nextDirPath();
+constparent=path.join(dirname,'parent');
+constchild=path.join(parent,'child');
+constchildFile=path.join(child,'childFile.txt');
+fs.mkdirSync(child,common.mustNotMutateObjectDeep({recursive: true}));
+fs.writeFileSync(childFile,'hello');
+
+// (DC) denies deleting children; (DE) denies deleting the directory
+// itself. Combined denies on each layer guarantee rmdir returns EPERM.
+execSync(`icacls "${dirname}" /deny "everyone:(DC)"`);
+execSync(`icacls "${parent}" /deny "everyone:(DE,DC)"`);
+execSync(`icacls "${child}" /deny "everyone:(DE)"`);
+
+constcleanup=()=>{
+try{
+execSync(`icacls "${child}" /remove:d "everyone"`);
+}catch{
+// Best-effort cleanup; ignore failures (e.g. already cleared).
+}
+try{
+execSync(`icacls "${parent}" /remove:d "everyone"`);
+}catch{
+// Best-effort cleanup; ignore failures.
+}
+try{
+execSync(`icacls "${dirname}" /remove:d "everyone"`);
+}catch{
+// Best-effort cleanup; ignore failures.
+}
+try{
+fs.rmSync(dirname,common.mustNotMutateObjectDeep({
+recursive: true,
+force: true,
+}));
+}catch{
+// Best-effort cleanup; ignore failures.
+}
+};
+process.on('exit',cleanup);
+
+fs.rm(dirname,common.mustNotMutateObjectDeep({recursive: true}),
+common.mustCall((err)=>{
+try{
+assert.ok(err,'expected EPERM error');
+assert.strictEqual(err.code,'EPERM');
+assert.strictEqual(err.syscall,'rmdir');
+assert.ok(err.path.endsWith('\\parent'));
+assert.ok(
+fs.existsSync(child),
+'EPERM from rmdir must propagate without recursing into children',
+);
+}finally{
+process.removeListener('exit',cleanup);
+cleanup();
+}
+}));
+}
 }
 }