test: add coverage for custom loader hooks with permission model

PR-URL: https://github.com/nodejs/node/pull/46977
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Jacob Smith <jacob@frende.me>
Reviewed-By: Geoffrey Booth <webadmin@geoffreybooth.com>

1 files changed, 52 insertions, 0 deletions

diff --git a/test/es-module/test-esm-loader-hooks.mjs b/test/es-module/test-esm-loader-hooks.mjs
index ce8085bbaf..5c6bf16323 100644
--- a/test/es-module/test-esm-loader-hooks.mjs
+++ b/test/es-module/test-esm-loader-hooks.mjs
@@ -113,4 +113,56 @@ describe('Loader hooks', { concurrency: true }, () => {
       assert.strictEqual(signal, null);
     });
   });
+
+  it('should work without worker permission', async () => {
+    const { code, signal, stdout, stderr } = await spawnPromisified(execPath, [
+      '--no-warnings',
+      '--experimental-permission',
+      '--allow-fs-read',
+      '*',
+      '--experimental-loader',
+      fixtures.fileURL('empty.js'),
+      fixtures.path('es-modules/esm-top-level-await.mjs'),
+    ]);
+
+    assert.strictEqual(stderr, '');
+    assert.match(stdout, /^1\r?\n2\r?\n$/);
+    assert.strictEqual(code, 0);
+    assert.strictEqual(signal, null);
+  });
+
+  it('should allow loader hooks to spawn workers when allowed by the CLI flags', async () => {
+    const { code, signal, stdout, stderr } = await spawnPromisified(execPath, [
+      '--no-warnings',
+      '--experimental-permission',
+      '--allow-worker',
+      '--allow-fs-read',
+      '*',
+      '--experimental-loader',
+      `data:text/javascript,import{Worker}from"worker_threads";new Worker(${encodeURIComponent(JSON.stringify(fixtures.path('empty.js')))}).unref()`,
+      fixtures.path('es-modules/esm-top-level-await.mjs'),
+    ]);
+
+    assert.strictEqual(stderr, '');
+    assert.match(stdout, /^1\r?\n2\r?\n$/);
+    assert.strictEqual(code, 0);
+    assert.strictEqual(signal, null);
+  });
+
+  it('should not allow loader hooks to spawn workers if restricted by the CLI flags', async () => {
+    const { code, signal, stdout, stderr } = await spawnPromisified(execPath, [
+      '--no-warnings',
+      '--experimental-permission',
+      '--allow-fs-read',
+      '*',
+      '--experimental-loader',
+      `data:text/javascript,import{Worker}from"worker_threads";new Worker(${encodeURIComponent(JSON.stringify(fixtures.path('empty.js')))}).unref()`,
+      fixtures.path('es-modules/esm-top-level-await.mjs'),
+    ]);
+
+    assert.match(stderr, /code: 'ERR_ACCESS_DENIED'/);
+    assert.strictEqual(stdout, '');
+    assert.strictEqual(code, 1);
+    assert.strictEqual(signal, null);
+  });
 });