stamp: lkg (partial golden, flakey in unit tests)

.gitignore

@@ -13,4 +13,6 @@ scripts/debug.sh
 node_modules/
 .DS_Store
 eszip.bin
-deno.lock
+
+deno.lock
+package-lock.json

Cargo.toml

@@ -199,7 +199,7 @@ windows-sys = { version = "0.59.0", features = ["Win32_Foundation", "Win32_Media
 
 [patch.crates-io]
 # If the PR is merged upstream, remove the line below.
-# deno_core = { git = "https://github.com/supabase/deno_core", branch = "293-supabase" }
+deno_core = { git = "https://github.com/supabase/deno_core", branch = "324-supabase" }
 eszip = { git = "https://github.com/supabase/eszip", branch = "fix-pub-vis-0-80-0" }
 
 [profile.dind]

cli/src/main.rs

@@ -309,7 +309,7 @@ fn main() -> Result<ExitCode, anyhow::Error> {
           .and_then(EszipV2ChecksumKind::into);
 
         emitter_factory.set_permissions_options(Some(
-          base::get_default_permisisons(WorkerKind::MainWorker),
+          base::get_default_permissions(WorkerKind::MainWorker),
         ));
         emitter_factory.set_deno_options(
           DenoOptionsBuilder::new()

crates/base/src/lib.rs

@@ -13,7 +13,7 @@ pub mod worker;
 pub use deno::args::CacheSetting;
 pub use ext_workers::context::WorkerKind;
 pub use inspector_server::InspectorOption;
-pub use runtime::permissions::get_default_permisisons;
+pub use runtime::permissions::get_default_permissions;
 
 #[cfg(any(test, feature = "tracing"))]
 mod tracing_subscriber;

crates/base/src/runtime/mod.rs

@@ -91,7 +91,7 @@ use futures_util::FutureExt;
 use log::error;
 use once_cell::sync::Lazy;
 use once_cell::sync::OnceCell;
-use permissions::get_default_permisisons;
+use permissions::get_default_permissions;
 use scopeguard::ScopeGuard;
 use serde::Serialize;
 use strum::IntoStaticStr;
@@ -495,7 +495,7 @@ where
 
     let permissions_options = maybe_user_conf
       .and_then(|it| it.permissions.clone())
-      .unwrap_or_else(|| get_default_permisisons(conf.to_worker_kind()));
+      .unwrap_or_else(|| get_default_permissions(conf.to_worker_kind()));
 
     let only_module_code = maybe_module_code.is_some()
       && maybe_eszip.is_none()
@@ -605,22 +605,25 @@ where
       permissions,
       metadata,
       static_files,
-      vfs_path,
       vfs,
+      vfs_path,
+      base_url,
     } = rt_provider;
 
     let entrypoint = metadata
       .entrypoint
       .as_ref()
       .with_context(|| "could not find entrypoint from metadata")?;
 
-    let main_module_url = Url::parse(match entrypoint {
-      Entrypoint::Key(key) => key,
-      Entrypoint::ModuleCode(_) => user_context
-        .get("entrypoint")
-        .and_then(|it| it.as_str())
-        .with_context(|| "could not find entrypoint key")?,
-    })?;
+    let main_module_url = match entrypoint {
+      Entrypoint::Key(key) => base_url.join(&key)?,
+      Entrypoint::ModuleCode(_) => Url::parse(
+        user_context
+          .get("entrypoint")
+          .and_then(|it| it.as_str())
+          .with_context(|| "could not find entrypoint key")?,
+      )?,
+    };
 
     let build_file_system_fn = |base_fs: Arc<dyn deno_fs::FileSystem>| -> Result<
       (Arc<dyn deno_fs::FileSystem>, Option<S3Fs>),
@@ -957,8 +960,7 @@ where
 
     let main_module_id = {
       match entrypoint {
-        Entrypoint::Key(key) => {
-          debug_assert_eq!(main_module_url.as_str(), key);
+        Entrypoint::Key(_) => {
           js_runtime.load_main_es_module(&main_module_url).await?
         }
         Entrypoint::ModuleCode(module_code) => {
@@ -2426,7 +2428,7 @@ mod test {
       .to_value_mut::<serde_json::Value>(&global_value_deno_read_file_script);
     assert_eq!(
       fs_read_result.unwrap().as_str().unwrap(),
-      "{\n  \"hello\": \"world\"\n}"
+      "{\n  \"hello\": \"world\"\n}\n"
     );
   }
 

crates/base/src/runtime/permissions.rs

@@ -1,7 +1,7 @@
 use deno::deno_permissions::PermissionsOptions;
 use ext_workers::context::WorkerKind;
 
-pub fn get_default_permisisons(kind: WorkerKind) -> PermissionsOptions {
+pub fn get_default_permissions(kind: WorkerKind) -> PermissionsOptions {
   match kind {
     WorkerKind::MainWorker | WorkerKind::EventsWorker => PermissionsOptions {
       allow_all: true,

crates/base/src/server.rs

@@ -462,10 +462,7 @@ impl Server {
     let mut secure_listener = if let Some(tls) = self.tls.take() {
       let addr = SocketAddr::new(self.addr.ip(), tls.port);
       Some((
-        TlsListener::new(
-          tls.into_acceptor()?,
-          TcpListener::bind(self.addr).await?,
-        ),
+        TlsListener::new(tls.into_acceptor()?, TcpListener::bind(addr).await?),
         addr,
       ))
     } else {

crates/base/test_cases/decorator_typescript_with_metadata/deno.json

@@ -0,0 +1,6 @@
+{
+  "workspace": [],
+  "compilerOptions": {
+    "experimentalDecorators": true
+  }
+}

crates/base/test_cases/eszip-various-ext/npm-supabase/deno.json

@@ -0,0 +1,7 @@
+{
+  "workspace": [],
+  "compilerOptions": {
+    "jsx": "react-jsx",
+    "jsxImportSource": "https://esm.sh/preact"
+  }
+}

crates/base/test_cases/eszip-various-ext/serve/deno.json

@@ -0,0 +1,7 @@
+{
+  "workspace": [],
+  "compilerOptions": {
+    "jsx": "react-jsx",
+    "jsxImportSource": "https://esm.sh/preact"
+  }
+}

crates/base/test_cases/main_with_allow_net/index.ts

@@ -18,11 +18,14 @@ Deno.serve({
 
 		const servicePath = `./test_cases/${service_name}`;
 
-		let allowNet: string[] | null | undefined;
+		let allow_net: string[] | null | undefined;
+		let deny_net: string[] | null;
 
 		try {
 			const payload = await req.clone().json();
-			allowNet = payload.allowNet;
+
+			allow_net = payload.allowNet;
+			deny_net = payload.allowNet === null ? [] : null;
 		} catch {}
 
 		console.error(`serving the request with ${servicePath}`);
@@ -44,7 +47,16 @@ Deno.serve({
 				cpuTimeHardLimitMs,
 				noModuleCache,
 				envVars,
-				allowNet,
+				permissions: {
+					allow_all: false,
+					allow_env: [],
+					allow_net,
+					deny_net,
+					allow_read: [],
+					allow_write: [],
+					allow_import: [],
+					allow_sys: ['hostname'],
+				},
 			});
 		};
 

crates/base/test_cases/private-npm-package-import-2/deno.json

@@ -0,0 +1,3 @@
+{
+  "workspace": []
+}

crates/base/test_cases/private-npm-package-import/deno.json

@@ -0,0 +1 @@
+{ "workspace": [] }

crates/base/tests/integration_tests.rs

@@ -16,6 +16,7 @@ use std::time::Duration;
 
 use anyhow::Context;
 use async_tungstenite::WebSocketStream;
+use base::get_default_permissions;
 use base::integration_test;
 use base::integration_test_listen_fut;
 use base::integration_test_with_server_flag;
@@ -31,6 +32,7 @@ use base::utils::test_utils::TestBedBuilder;
 use base::utils::test_utils::{self};
 use base::worker;
 use base::worker::TerminationToken;
+use base::WorkerKind;
 use deno::DenoOptionsBuilder;
 use deno_core::serde_json::json;
 use deno_core::serde_json::{self};
@@ -1465,7 +1467,7 @@ async fn test_websocket_upgrade_node_secure() {
   test_websocket_upgrade(new_localhost_tls(true), true).await;
 }
 
-async fn test_decorators(suffix: &str, should_error: bool) {
+async fn test_decorators(suffix: &str) {
   let client = Client::new();
   let req = client
     .request(
@@ -1485,38 +1487,23 @@ async fn test_decorators(suffix: &str, should_error: bool) {
     (|resp| async {
       let resp = resp.unwrap();
 
-      if should_error {
-        assert_eq!(resp.status(), StatusCode::INTERNAL_SERVER_ERROR);
-        assert!(resp
-          .text()
-          .await
-          .unwrap()
-          .starts_with("{\"msg\":\"InvalidWorkerCreation: worker boot error: Uncaught SyntaxError: Invalid or unexpected token"),);
-      } else {
-        assert_eq!(resp.status(), StatusCode::OK);
-        assert_eq!(resp.text().await.unwrap().as_str(), "meow?");
-      }
+      assert_eq!(resp.status(), StatusCode::OK);
+      assert_eq!(resp.text().await.unwrap().as_str(), "meow?");
     }),
     TerminationToken::new()
   );
 }
 
-#[tokio::test]
-#[serial]
-async fn test_decorator_should_be_syntax_error() {
-  test_decorators("decorator_tc39_no_decorator_opt", true).await;
-}
-
 #[tokio::test]
 #[serial]
 async fn test_decorator_parse_tc39() {
-  test_decorators("tc39", false).await;
+  test_decorators("tc39").await;
 }
 
 #[tokio::test]
 #[serial]
 async fn test_decorator_parse_typescript_experimental_with_metadata() {
-  test_decorators("typescript_with_metadata", false).await;
+  test_decorators("typescript_with_metadata").await;
 }
 
 #[tokio::test]
@@ -2202,26 +2189,26 @@ async fn test_allow_net_fetch_google_com() {
 
   // 2. allow only specific host (but not considering the redirected host)
   test_allow_net(
-        Some(vec!["google.com"]),
-        "https://google.com",
-        |resp| async move {
-            let resp = resp.unwrap();
+      Some(vec!["google.com"]),
+      "https://google.com",
+      |resp| async move {
+        let resp = resp.unwrap();
 
-            assert_eq!(resp.status().as_u16(), StatusCode::INTERNAL_SERVER_ERROR);
+        assert_eq!(resp.status().as_u16(), StatusCode::INTERNAL_SERVER_ERROR);
 
-            let msg = resp.text().await.unwrap();
+        let msg = resp.text().await.unwrap();
 
-            assert_eq!(
-                msg.as_str(),
-                // google.com redirects to www.google.com, but we didn't allow it
-                "PermissionDenied: Access to www.google.com is not allowed for user worker"
-            );
-        },
+        assert_eq!(
+          msg.as_str(),
+          // google.com redirects to www.google.com, but we didn't allow it
+          "NotCapable: Requires net access to \"www.google.com:443\", run again with the --allow-net flag"
+        );
+      },
     )
     .await;
 
   // 3. deny all hosts
-  test_allow_net(Some(vec![]), "https://google.com", |resp| async move {
+  test_allow_net(None, "https://google.com", |resp| async move {
     let resp = resp.unwrap();
 
     assert_eq!(resp.status().as_u16(), StatusCode::INTERNAL_SERVER_ERROR);
@@ -2230,13 +2217,13 @@ async fn test_allow_net_fetch_google_com() {
 
     assert_eq!(
       msg.as_str(),
-      "PermissionDenied: Access to google.com is not allowed for user worker"
+      "NotCapable: Requires net access to \"google.com:443\", run again with the --allow-net flag"
     );
   })
   .await;
 
   // 4. allow all hosts
-  test_allow_net(None, "https://google.com", |resp| async move {
+  test_allow_net(Some(vec![]), "https://google.com", |resp| async move {
     let resp = resp.unwrap();
 
     assert_eq!(resp.status().as_u16(), StatusCode::OK);
@@ -2435,13 +2422,9 @@ async fn test_should_be_able_to_bundle_against_various_exts() {
     let path = path.to_string();
     let mut emitter_factory = EmitterFactory::new();
 
-    // emitter_factory.set_jsx_import_source(Some(JsxImportSourceConfig {
-    //   default_specifier: Some("https://esm.sh/preact".to_string()),
-    //   default_types_specifier: None,
-    //   module: "jsx-runtime".to_string(),
-    //   base_url: Url::from_file_path(std::env::current_dir().unwrap()).unwrap(),
-    // }));
-
+    emitter_factory.set_permissions_options(Some(get_default_permissions(
+      WorkerKind::UserWorker,
+    )));
     emitter_factory.set_deno_options(
       DenoOptionsBuilder::new()
         .entrypoint(PathBuf::from(path))
@@ -2542,7 +2525,7 @@ async fn test_should_be_able_to_bundle_against_various_exts() {
   test_serve_simple_fn("tsx", REACT_RESULT.as_bytes()).await;
 }
 
-// #[tokio::test]
+#[tokio::test]
 #[serial]
 async fn test_private_npm_package_import() {
   // Required because test_cases/main_with_registry/registry/registry-handler.ts:58
@@ -3306,7 +3289,7 @@ async fn test_should_be_able_to_trigger_early_drop_with_mem() {
   let resp = tb
     .request(|b| {
       b.uri("/early-drop-mem")
-        .header("x-memory-limit-mb", HeaderValue::from_static("20"))
+        .header("x-memory-limit-mb", HeaderValue::from_static("22"))
         .body(Body::empty())
         .context("can't make request")
     })