From 1e246af26ec9420c800f7457712afa0faa614d1f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A2u=20Cao?= <raucao@kosmos.org>
Date: Tue, 28 Oct 2025 13:22:13 +0100
Subject: [PATCH 1/2] Use new config-based permission sets

https://deno.com/blog/v2.5#permission-sets-in-config
---
 deno.json | 35 +++++++++++++++++++++++++++++++----
 1 file changed, 31 insertions(+), 4 deletions(-)

diff --git a/deno.json b/deno.json
index 863d35c..40a1547 100644
--- a/deno.json
+++ b/deno.json
@@ -1,9 +1,9 @@
 {
   "tasks": {
-    "dev": "deno run --allow-all --watch server.ts",
-    "server": "deno run --allow-all server.ts",
-    "compile": "deno compile --allow-all --include ./assets/ --exclude ./tests/ --output ./build/substr_x86_64-unknown-linux-gnu server.ts",
-    "test": "DENO_ENV=test deno test --allow-read --allow-env"
+    "dev": "deno run -P --watch server.ts",
+    "server": "deno run -P server.ts",
+    "compile": "deno compile -P --include ./assets/ --exclude ./tests/ --output ./build/substr_x86_64-unknown-linux-gnu server.ts",
+    "test": "DENO_ENV=test deno test -P=test"
   },
   "imports": {
     "@deno/gfm": "jsr:@deno/gfm@^0.10.0",
@@ -22,5 +22,32 @@
       "assets/css/prism.css",
       "tests/fixtures/"
     ]
+  },
+  "permissions": {
+    "default": {
+      "read": [
+        ".env",
+        ".env.test",
+        "users.yaml",
+        "users.yaml.test",
+        "/etc/substr/users.yaml",
+        "/etc/substr/users.yaml.test",
+        "/tmp/substr/",
+        "assets/"
+      ],
+      "write": ["/tmp/substr/"],
+      "run": ["which", "magick", "convert"],
+      "env": true,
+      "net": true
+    },
+    "test": {
+      "read": [
+        "tests/",
+        ".env.test",
+        "users.yaml.test",
+        "/etc/substr/users.yaml.test"
+      ],
+      "env": true
+    }
   }
 }
-- 
2.25.1


From 1c37d2dc99e472cc147052ce8f9b32dcb21cb9ee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?R=C3=A2u=20Cao?= <raucao@kosmos.org>
Date: Tue, 28 Oct 2025 13:23:55 +0100
Subject: [PATCH 2/2] Upgrade Deno in CI

---
 .gitea/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index be253c4..2880d2f 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -13,6 +13,6 @@ jobs:
           node-version: 18
       - uses: denoland/setup-deno@v2
         with:
-          deno-version: v2.1.x
+          deno-version: v2.5.x
       - run: "deno task test"
       - run: "deno lint"
-- 
2.25.1