About checking directory permissions

[KazukiSugiyama107]

What is the problem this feature will solve?

This is a little different from a feature request, but since there has been no progress on the issue I have set up in nodejs/help, I will ask here, and if the feature does not exist, I will make a feature request.
The following is the issue created in nodejs/help.
nodejs/help#3871

We wanted to check the permissions of a directory and were trying to use fs.accessSync.
We have confirmed that the results are correct on macOS, but not on Windows OS.

I have confirmed that using fs.openSync produces the correct results for Windows OS, but why do these differences occur?
Also, there is no mention in the node.js documentation that the behavior changes for each OS, but is using fs.openSync the correct way to check directory permissions on Windows OS?

• Result of fs.accessSync check

Mac OS

Parameter	Permission	result
constants.R_OK	Readable	Success
constants.R_OK	Writable	Failure
constants.R_OK	Executable	Failure
constants.W_OK	Readable	Failure
constants.W_OK	Writable	Success
constants.W_OK	Executable	Failure
constants.X_OK	Readable	Failure
constants.X_OK	Writable	Failure
constants.X_OK	Executable	Success

Windows OS

Parameter	Permission	result
constants.R_OK	Read	Success
constants.R_OK	Write	Success
constants.R_OK	List folder contens	Success
constants.W_OK	Read	Success
constants.W_OK	Write	Success
constants.W_OK	List folder contens	Success
constants.X_OK	Read	Success
constants.X_OK	Write	Success
constants.X_OK	List folder contens	Success

What is the feature you are proposing to solve the problem?

A method that does not return different results on macOS and Windows OS.
Or, we think it would be easier to add an explanation on the documentation to show that the results are different depending on the OS.

What alternatives have you considered?

No response

[bnoordhuis]

I'm moving this to a discussion. The bug tracker is not a support forum.

To answer your question: fs.access() isn't (and can't be) aware of ACLs. When ACLs are active, you don't know if reading or writing works until you try it.

[KazukiSugiyama107]

Thanks for the transition.

I was thinking that if I try~catch around fs.accessSync or fs.openSync and enter the branch of catch, I could determine that the permissions do not exist.
Should I assume that an fs module that is not ACL aware in the first place cannot get the correct permissions?

[bnoordhuis]

The problem with ACLs is time-of-check-time-of-use (TOCTOU) bugs.

Writing code that first checks the file's permissions before opening it is defective because permissions can change between checking and opening.

Basically, you should always just open the file and be prepared to get back a "no permission" error.