googleapis / googleapis/google-cloud-node
Unable to use the library with Node Permission Model
- Dominant language
- TypeScript
- Stars
- 3.2k
- Forks
- 712
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 99
Description
### Please make sure you have searched for information in the following guides.
- [x] Search the issues already opened: https://github.com/GoogleCloudPlatform/google-cloud-node/issues
- [x] Search StackOverflow: http://stackoverflow.com/questions/tagged/google-cloud-platform+node.js
- [x] Check our Troubleshooting guide: https://github.com/googleapis/google-cloud-node/blob/main/docs/troubleshooting.md
- [x] Check our FAQ: https://github.com/googleapis/google-cloud-node/blob/main/docs/faq.md
- [x] Check our libraries HOW-TO: https://github.com/googleapis/gax-nodejs/blob/main/client-libraries.md
- [x] Check out our authentication guide: https://github.com/googleapis/google-auth-library-nodejs
- [x] Check out handwritten samples for many of our APIs: https://github.com/GoogleCloudPlatform/nodejs-docs-samples
### A screenshot that you have tested with "Try this API".
Currently the library makes use of [`exec` which will spawn a child process](https://github.com/googleapis/google-auth-library-nodejs/blob/main/src/auth/googleauth.ts#L973). This will not work in a node process with [permissions enforced](https://nodejs.org/api/cli.html#--permission).
Would it be possible to reconsider the use of `exec` so that the authentication does not require to spawn processes? The permission model will be eventually opted in by many to reduce risks of running malicious executables in case of any dependency was compromised.
```
> node --permission --allow-fs-read=node_modules ./main.js
node:internal/child_process:395
const err = this._handle.spawn(options);
^
Error: Access to this API has been restricted. Use --allow-child-process to manage permissions.
at ChildProcess.spawn (node:internal/child_process:395:28)
at spawn (node:child_process:786:9)
at Object.execFile (node:child_process:349:17)
at exec (node:child_process:236:25)
at /Users/x/google-auth-library-nodejs/google-auth-library-nodejs-with-permission/node_modules/google-auth-library/build/src/auth/googleauth.js:606:38
at new Promise ()
at GoogleAuth.getDefaultServiceProjectId (/Users/x/google-auth-library-nodejs/google-auth-library-nodejs-with-permission/node_modules/google-auth-library/build/src/auth/googleauth.js:605:16)
at GoogleAuth.findAndCacheProjectId (/Users/x/google-auth-library-nodejs/google-auth-library-nodejs-with-permission/node_modules/google-auth-library/build/src/auth/googleauth.js:160:34)
at async file:///Users/x/google-auth-library-nodejs/google-auth-library-nodejs-with-permission/main.js:5:1 {
code: 'ERR_ACCESS_DENIED',
permission: 'ChildProcess',
resource: '/bin/sh'
}
Node.js v22.18.0
```
### Link to the code that reproduces this issue. A link to a **public** Github Repository or gist with a minimal reproduction.
https://github.com/ik-southpole/google-auth-library-nodejs
### A step-by-step description of how to reproduce the issue, based on the linked reproduction.
```
git clone git@github.com:ik-southpole/google-auth-library-nodejs.git google-auth-library-nodejs-with-permission
cd google-auth-library-nodejs-with-permission
npm i
npm start
```
### A clear and concise description of what the bug is, and what you expected to happen.
Expected google-auth-library to work in more restricted node environment.
### A clear and concise description WHY you expect this behavior, i.e., was it a recent change, there is documentation that points to this behavior, etc. **
The lib should not require spawning processes unless there is a reason.
Contributor guide
Assessment
This issue has not been assessed yet.