feat: server.fs.deny support

[antfu]

Description

Support excluding files to be served by Vite. .env, .pem, .crt will been excluded by default.

Additional context

Open for discussion, will do documentation later.

Related:

• feat!: server fs strict by default #5341
• feat: fs-serve import graph awareness #3784

---

What is the purpose of this pull request?

• Bug fix
• New Feature
• Documentation update
• Other

Before submitting the PR, please make sure you do the following

• Read the Contributing Guidelines.
• Read the Pull Request Guidelines and follow the Commit Convention.
• Check that there isn't already a PR that solves the problem the same way to avoid creating a duplicate.
• Provide a description in this PR that addresses what the PR is solving, or reference the issue that it solves (e.g. fixes #123).
• Ideally, include relevant tests that fail without this PR but pass with it.

[benmccann]

I think it should be called deny to be consistent with allow (if it were called denied then it should also be allowed)

But I'm rather hesitant about this. Blacklisting seems like a dangerous approach for anything security-related because there's always some file you could forget or overlook. Much safer to go with a whitelist approach, which I think would be solved by #5361

[patak-dev]

But I'm rather hesitant about this. Blacklisting seems like a dangerous approach for anything security-related because there's always some file you could forget or overlook. Much safer to go with a whitelist approach, which I think would be solved by #5361

#5361 would still be merged, this PR is complementary. Whitelisting is also quite hard for Vite in general, as we would need to not only filter by folder like you do in SvelteKit but also by file type. So something like /index.html + /src/ + /public/ could work but maybe users have a different folder structure.

I think both options need to be available, and then frameworks can decide how to use them. The current defaults look good to me too.

[Shinigami92]

I think docs are missing

Nice feature :)

[patak-dev]

We didn't manage to discuss this one with Evan, but I think it should be safe to include it in the beta release this week as is marked experimental and it is an extension that was already discussed as a possibility in the past.

One detail, we are allowing files that are directly imported by allowed files to be served even if they aren't in an allowed folder. Maybe we should do the same for deny? At this point, I'm leaning towards a hard deny. We could leave the PR as is an only do a soft deny using the module graph if an use case justifies it (that I don't think it would be the case)

Damnd, GitHub notifications redirects me directly to the diff and then I didn't saw tests are failing :D