permission.drop(scope[, reference])

API 调用以在运行时删除权限。此操作不可逆。

🌐 API call to drop permissions at runtime. This operation is irreversible.

当没有引用调用时，整个作用域会被丢弃。带有引用调用时，只有针对特定资源的权限会被撤销。丢弃权限只会影响未来的访问检查。它不会关闭或撤销已经打开的资源，比如文件描述符、网络套接字、子进程或工作线程。应用需要在不再需要这些资源时负责关闭或终止它们。

🌐 When called without a reference, the entire scope is dropped. When called with a reference, only the permission for that specific resource is revoked. Dropping a permission only affects future access checks. It does not close or revoke access to resources that are already open, such as file descriptors, network sockets, child processes, or worker threads. Applications are responsible for closing or terminating those resources when they are no longer needed.

你只能放掉明确授予的那个具体资源。传给 drop() 的引用必须与最初授予的相匹配。如果一个权限是用通配符 (*) 授予的，那只能放掉整个范围（通过调用 drop() 不带引用来实现）。如果授予的是一个目录（例如 --allow-fs-read=/my/folder），你不能单独放掉里面的文件——你必须放掉最初授予的那个目录。

🌐 You can only drop the exact resource that was explicitly granted. The reference passed to drop() must match the original grant. If a permission was granted using a wildcard (*), only the entire scope can be dropped (by calling drop() without a reference). If a directory was granted (e.g. --allow-fs-read=/my/folder), you cannot drop individual files inside it - you must drop the same directory that was originally granted.

const fs = require('node:fs');

// Read config at startup while we still have permission
const config = fs.readFileSync('/etc/myapp/config.json', 'utf8');

// Drop read access to /etc/myapp after initialization
process.permission.drop('fs.read', '/etc/myapp');

// This will now return false
process.permission.has('fs.read', '/etc/myapp/config.json'); // false

// Drop child process permission entirely
process.permission.drop('child'); 拷贝