Permission allow-fs-* to resolve env variables

Commencez par retracer comment Node.js analyse --allow-fs-read et --allow-fs-write depuis les arguments directs, NODE_OPTIONS et les fichiers de configuration. Vérifiez les tests existants de permission-option et ajoutez une couverture pour les valeurs exactes de environment-variable sous forme de chaîne et de tableau. Le travail est terminé lorsque les entrées de permission prises en charge résolvent les variables d’environnement de manière cohérente, y compris le comportement lorsqu’une variable n’est pas définie.

What is the problem this feature will solve?

While it is possible to pass values of env variables when calling node directly

node --permission --allow-fs-read=$HOME

there are other ways to set permissions (in config file or via NODE_OPTIONS) that don't go through the shell first.

I'd like to make it possible for all methods of passing in permissions to support using environment variables.

{
  "nodeOptions": {
    "--permission": true,
    "--allow-fs-read": [
      "$HOME"
    ]
  }
}

What is the feature you are proposing to solve the problem?

Pseudocode:

    const replaceEnvVar = (value) => {
      const envVarMatch = value.match(/^\$([A-Z_][A-Z0-9_]*)$/i)
      if (envVarMatch) {
        const envVarName = envVarMatch[1]
        if (process.env[envVarName] !== undefined) {
          return process.env[envVarName]
        } else {
          console.error(
            `[LavaMoat] Environment variable "${envVarName}" referenced in config but not found in environment`
          )
        }
      }
      return value
    }

    for (const key of ['--allow-fs-read', '--allow-fs-write']) {
      if (Array.isArray(configOptions[key])) {
        configOptions[key] = configOptions[key].map(replaceEnvVar)
      } else if (typeof configOptions[key] === 'string') {
        configOptions[key] = replaceEnvVar(configOptions[key])
      }
    }

What alternatives have you considered?

I've considered more advanced support where this would also work:

{
  "nodeOptions": {
    "--permission": true,
    "--allow-fs-read": [
      "/home/${MY_USER}/some/place/else"
    ]
  }
}

but it seems unnecessarily complex and error prone to be worth it IMHO.