<!DOCTYPE html>
<html>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<body></body>
<script>

const createDataUrlIframe = (url, cors) => {
  const iframe = document.createElement("iframe");
  const fetchURL = new URL(url, location.href) +
      `${cors === 'null-origin'
           ? '?pipe=header(Access-Control-Allow-Origin, null)' : ''}`;
  const tag_name = 'script';
  iframe.src =
      `data:text/html, <${tag_name}>` +
      `async function test() {` +
      `  let allowed = true;` +
      `  try {` +
      `    await fetch('${fetchURL}');` +
      `  } catch (e) {` +
      `    allowed = false;` +
      `  }` +
      `  parent.postMessage({allowed}, '*');` +
      `}` +
      `test(); </${tag_name}>`;
  return iframe;
};

const fetch_from_data_url_iframe_test =
    (url, cors, expectation, description) => {
  promise_test(async () => {
    const iframe = createDataUrlIframe(url, cors);
    document.body.appendChild(iframe);
    const msgEvent = await new Promise(resolve => window.onmessage = resolve);
    assert_equals(msgEvent.data.allowed ? 'allowed' : 'rejected', expectation);
  }, description);
};

fetch_from_data_url_iframe_test(
  '../resources/top.txt',
  'acao-omitted',
  'rejected',
  'fetching "top.txt" without ACAO should be rejected.'
);
fetch_from_data_url_iframe_test(
  '../resources/top.txt',
  'null-origin',
  'allowed',
  'fetching "top.txt" with CORS allowing null origin should be allowed.'
);
fetch_from_data_url_iframe_test(
  'data:text/plain, top',
  'acao-omitted',
  'allowed',
  'fetching data url script should be allowed.'
);

</script>
