Unable to use the library with Node Permission Model #845
Description
Please make sure you have searched for information in the following guides.
- Search the issues already opened: https://github.com/GoogleCloudPlatform/google-cloud-node/issues
- Search StackOverflow: http://stackoverflow.com/questions/tagged/google-cloud-platform+node.js
- Check our Troubleshooting guide: https://github.com/googleapis/google-cloud-node/blob/main/docs/troubleshooting.md
- Check our FAQ: https://github.com/googleapis/google-cloud-node/blob/main/docs/faq.md
- Check our libraries HOW-TO: https://github.com/googleapis/gax-nodejs/blob/main/client-libraries.md
- Check out our authentication guide: https://github.com/googleapis/google-auth-library-nodejs
- Check out handwritten samples for many of our APIs: https://github.com/GoogleCloudPlatform/nodejs-docs-samples
A screenshot that you have tested with "Try this API".
Currently the library makes use of exec which will spawn a child process. This will not work in a node process with permissions enforced.
Would it be possible to reconsider the use of exec so that the authentication does not require to spawn processes? The permission model will be eventually opted in by many to reduce risks of running malicious executables in case of any dependency was compromised.
> node --permission --allow-fs-read=node_modules ./main.js
node:internal/child_process:395
const err = this._handle.spawn(options);
^
Error: Access to this API has been restricted. Use --allow-child-process to manage permissions.
at ChildProcess.spawn (node:internal/child_process:395:28)
at spawn (node:child_process:786:9)
at Object.execFile (node:child_process:349:17)
at exec (node:child_process:236:25)
at /Users/x/google-auth-library-nodejs/google-auth-library-nodejs-with-permission/node_modules/google-auth-library/build/src/auth/googleauth.js:606:38
at new Promise (<anonymous>)
at GoogleAuth.getDefaultServiceProjectId (/Users/x/google-auth-library-nodejs/google-auth-library-nodejs-with-permission/node_modules/google-auth-library/build/src/auth/googleauth.js:605:16)
at GoogleAuth.findAndCacheProjectId (/Users/x/google-auth-library-nodejs/google-auth-library-nodejs-with-permission/node_modules/google-auth-library/build/src/auth/googleauth.js:160:34)
at async file:///Users/x/google-auth-library-nodejs/google-auth-library-nodejs-with-permission/main.js:5:1 {
code: 'ERR_ACCESS_DENIED',
permission: 'ChildProcess',
resource: '/bin/sh'
}
Node.js v22.18.0
Link to the code that reproduces this issue. A link to a public Github Repository or gist with a minimal reproduction.
https://github.com/ik-southpole/google-auth-library-nodejs
A step-by-step description of how to reproduce the issue, based on the linked reproduction.
git clone [email protected]:ik-southpole/google-auth-library-nodejs.git google-auth-library-nodejs-with-permission
cd google-auth-library-nodejs-with-permission
npm i
npm start
A clear and concise description of what the bug is, and what you expected to happen.
Expected google-auth-library to work in more restricted node environment.
A clear and concise description WHY you expect this behavior, i.e., was it a recent change, there is documentation that points to this behavior, etc. **
The lib should not require spawning processes unless there is a reason.