permission.drop(scope[, reference])

API 调用以在运行时删除权限。此操作不可逆。

🌐 API call to drop permissions at runtime. This operation is irreversible.

当不带引用调用时，整个作用域都会被丢弃。带引用调用时，仅撤销那个特定资源的权限。丢弃权限只会影响未来的访问检查，它不会关闭或撤销已经打开的资源访问，例如文件描述符、子进程或工作线程。应用需要在资源不再需要时自行关闭或终止这些资源。

🌐 When called without a reference, the entire scope is dropped. When called with a reference, only the permission for that specific resource is revoked. Dropping a permission only affects future access checks. It does not close or revoke access to resources that are already open, such as file descriptors, child processes, or worker threads. Applications are responsible for closing or terminating those resources when they are no longer needed.

你只能放掉明确授予的那个具体资源。传给 drop() 的引用必须与最初授予的相匹配。如果一个权限是用通配符 (*) 授予的，那只能放掉整个范围（通过调用 drop() 不带引用来实现）。如果授予的是一个目录（例如 --allow-fs-read=/my/folder），你不能单独放掉里面的文件——你必须放掉最初授予的那个目录。

🌐 You can only drop the exact resource that was explicitly granted. The reference passed to drop() must match the original grant. If a permission was granted using a wildcard (*), only the entire scope can be dropped (by calling drop() without a reference). If a directory was granted (e.g. --allow-fs-read=/my/folder), you cannot drop individual files inside it - you must drop the same directory that was originally granted.

const fs = require('node:fs');

// Read config at startup while we still have permission
const config = fs.readFileSync('/etc/myapp/config.json', 'utf8');

// Drop read access to /etc/myapp after initialization
process.permission.drop('fs.read', '/etc/myapp');

// This will now throw ERR_ACCESS_DENIED
process.permission.has('fs.read', '/etc/myapp/config.json'); // false

// Drop child process permission entirely
process.permission.drop('child'); 拷贝