Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft: dotenv: don't crash when permission is not granted to an env file #3516

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

alexgleason
Copy link

I'm having a problem with using --allow-read=.env

It wants to read .env.defaults and .env.example, which I don't care about.

I think if you don't grant permission to those files, the application should not crash. It should continue on without them. For now, the only way around it is with --allow-read=.env,.env.defaults,.env.example (too verbose), or to call loadSync({ export: true, examplePath: null, defaultsPath: null }) (also too verbose)

So I have made it not crash when the files are denied permission.

But there's another problem. Deno.errors.PermissionDenied can occur both for Deno permissions AND for OS file permissions.

That seems like a flaw in Deno itself. You should be able to tell whether PermissionDenied is due to OS permissions or Deno permissions.

The only way around that is a verbose check of the file against the permissions API.

It seems wrong. I wouldn't merge this code as-is. But I'm wondering if someone has ideas about what to do.

@alexgleason alexgleason requested a review from kt3k as a code owner August 4, 2023 18:52
@CLAassistant
Copy link

CLAassistant commented Aug 4, 2023

CLA assistant check
All committers have signed the CLA.

@github-actions github-actions bot added the dotenv label Aug 4, 2023
@kt3k
Copy link
Member

kt3k commented Aug 14, 2023

I'm having a problem with using --allow-read=.env
It wants to read .env.defaults and .env.example, which I don't care about.

I understand this motivation, but I don't think it's a good idea to change the behavior based on given permission.

Maybe we can create an alternative endpoint (like dotenv/load_simple.ts (or whatever name)) that only loads .env to explicitly opt out from .env.defaults and .env.example behaviors. What do you think?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants