permission: do not throw on denied access in audit mode

[edsadr]

Summary

--permission-audit is intended to be an observe-only mode: it publishes
denial events to the node:permission-model:* diagnostics channels without
blocking the operation. Only --permission (enforce mode) should throw
ERR_ACCESS_DENIED.

The two C++ macros that gate every denied call site
(THROW_IF_INSUFFICIENT_PERMISSIONS for sync paths,
ASYNC_THROW_IF_INSUFFICIENT_PERMISSIONS for async paths) in
src/permission/permission.h were structured as:

Permission::ThrowAccessDenied(env__, perm__, resource__);   // runs ALWAYS
if (!warning_only()) return __VA_ARGS__;                     // only return is guarded

ThrowAccessDenied raises the V8 exception unconditionally — before the
warning_only() check. So in --permission-audit mode (where
warning_only_=true, set in src/env.cc) the exception is still thrown,
defeating the audit-only purpose of the flag. The diagnostics message is
published correctly (that happens inside Permission::is_scope_granted), but
then the API call wrongly throws instead of continuing.

This moves the throw/reject inside the !warning_only() branch for both macros.
In audit mode, the diagnostics-channel message is published and execution
continues; in enforce mode (--permission), behavior is unchanged.

Repro

echo hello > /tmp/aa.txt
cat > t.js <<'EOF'
const dc = require("node:diagnostics_channel");
dc.subscribe("node:permission-model:fs", (msg) => { console.log("LISTENED", msg); });
eval('require("fs").readFileSync("/tmp/aa.txt")');
EOF

node --permission-audit t.js   # before: LISTENED then ERR_ACCESS_DENIED throw
                               # after:  LISTENED only, exit 0
node --permission t.js         # unchanged: LISTENED then ERR_ACCESS_DENIED throw

Affected scopes

Every permission scope, both sync and async call sites — fs read/write, net,
child_process, worker, addon, ffi, inspector, wasi.

Refs: 9ddd1a9

[nodejs-github-bot]

Review requested:

• @nodejs/security-wg

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 90.25%. Comparing base (8fec65d) to head (d7ba2ac).

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #64398   +/-   ##
=======================================
  Coverage   90.25%   90.25%           
=======================================
  Files         741      741           
  Lines      241207   241207           
  Branches    45430    45424    -6     
=======================================
+ Hits       217698   217704    +6     
+ Misses      15084    15068   -16     
- Partials     8425     8435   +10     

Files with missing lines	Coverage Δ
src/permission/permission.h	100.00% <ø> (ø)

... and 34 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.