From f64751956ab73eb10d4d78c4e05a7fb9a80717be Mon Sep 17 00:00:00 2001
From: Erin of Yukis <erin-dev@ninetailed.ninja>
Date: Mon, 29 Dec 2025 11:07:42 +0000
Subject: [PATCH] Declare `deno task run-with-perms` task specifying all the
 permissions actually needed and alias all other tasks through that (#136)

* Declare `deno task execute-with-permissions` task specifying all the permissions actually needed and alias all other tasks through that

Also add `migrate-db` task to the Deno configuration and use that in the
`Makefile`, so that the Makefile is fully optional, and swap the meanings of
the `start` and `preview` tasks, so that `start` is for production while
`preview` is for development.

* Keep task names consistent (no breaking changes)

* Reorder tasks

* Remove empty lines

* Use correct task in Dockerfile

* Bring back start (no breaking changes)

* Update readme with preview command

* Update necessary permissions for running locally and in docker

---------

Co-authored-by: Bruno Bernardino <me@brunobernardino.com>
---
 Dockerfile |  2 +-
 Makefile   |  6 +++++-
 README.md  |  3 ++-
 deno.json  | 10 ++++++----
 4 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/Dockerfile b/Dockerfile
index ce471d6..7320f29 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -20,4 +20,4 @@ USER deno
 # Compile the main app so that it doesn't need to be compiled each startup/entry.
 RUN deno cache --reload main.ts
 
-CMD ["run", "--allow-all", "main.ts"]
+CMD ["task", "preview"]
diff --git a/Makefile b/Makefile
index cc6dc94..665a55b 100644
--- a/Makefile
+++ b/Makefile
@@ -19,8 +19,12 @@ build:
 
 .PHONY: migrate-db
 migrate-db:
-	deno run --allow-net --allow-read --allow-env migrate-db.ts
+	deno task migrate-db
 
 .PHONY: exec-db
 exec-db:
 	docker exec -it -u postgres $(shell basename $(CURDIR))-postgresql-1 psql
+
+.PHONY: preview
+preview:
+	deno task preview
diff --git a/README.md b/README.md
index be34959..728ca58 100644
--- a/README.md
+++ b/README.md
@@ -72,7 +72,7 @@ These are the amazing entities or individuals who are sponsoring this project fo
 ```sh
 docker compose -f docker-compose.dev.yml up # (optional) runs docker with postgres, locally
 make migrate-db # runs any missing database migrations
-make start # runs the app
+make start # runs the app in development mode (watches for file changes and recompiles the app)
 make format # (optional) formats the code (if you're interested in contributing)
 make test # (optional) runs tests (if you're interested in contributing)
 ```
@@ -80,6 +80,7 @@ make test # (optional) runs tests (if you're interested in contributing)
 ### Other less-used commands (mostly for development)
 
 ```sh
+make preview # runs the app in production mode (serves the app from the built files)
 make exec-db # runs psql inside the postgres container, useful for running direct development queries like `DROP DATABASE "bewcloud"; CREATE DATABASE "bewcloud";`
 make build # generates all static files for production deploy
 ```
diff --git a/deno.json b/deno.json
index 45c3ed1..dd2ad20 100644
--- a/deno.json
+++ b/deno.json
@@ -1,13 +1,15 @@
 {
   "lock": true,
   "tasks": {
+    "execute-with-permissions": "deno run --allow-env --allow-net --allow-sys=networkInterfaces,hostname,cpus,homedir --allow-read=.,/ --allow-write=data-files,/ --allow-run",
     "check": "deno fmt --check && deno lint && deno check .",
     "cli": "echo \"import '\\$fresh/src/dev/cli.ts'\" | deno run --unstable -A -",
     "manifest": "deno task cli manifest $(pwd)",
-    "start": "deno run -A --watch=static/,routes/,lib/,components/,islands/ dev.ts",
-    "build": "deno run -A dev.ts build",
-    "preview": "deno run -A main.ts",
-    "test": "deno test -A --check"
+    "start": "deno task execute-with-permissions --watch=static/,routes/,lib/,components/,islands/ ./dev.ts",
+    "build": "deno task execute-with-permissions ./dev.ts build",
+    "preview": "deno task execute-with-permissions ./main.ts",
+    "test": "deno test --allow-all --check",
+    "migrate-db": "deno task execute-with-permissions ./migrate-db.ts"
   },
   "fmt": {
     "useTabs": false,