<!doctype html>
<html>
<meta name="timeout" content="long">
<body>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="/common/utils.js"></script>
<script src="/common/get-host-info.sub.js"></script>
<script>
// This file consists of tests for COEP reporting. The tests make COEP
// violations and see whether reports are sent to the network as specified.
// We only have basic tests in this file - one for each kind of reports,
// because we can also test the reporting functionality with ReportingObserver,
// and that way is faster, easier to debug, and less flaky.
//
// For more detailed tests and tests with workers, see tests in other files
// such as
//  - reporting-navigation.https.html
//  - reporting-subresource-corp.https.html
//  - cache-storage-reporting*.https.html
// .

const { REMOTE_ORIGIN } = get_host_info();
const BASE = new URL("resources", location).pathname
const FRAME_URL = `resources/reporting-empty-frame.html` +
  `?pipe=header(cross-origin-embedder-policy,require-corp;report-to="endpoint")` +
  `|header(cross-origin-embedder-policy-report-only,require-corp;report-to="report-only-endpoint")`;
const WORKER_URL = `resources/shared-worker.js` +
  '?pipe=header(cross-origin-embedder-policy,require-corp;report-to="endpoint")' +
  `|header(cross-origin-embedder-policy-report-only,require-corp;report-to="report-only-endpoint")`;
const REPORT_UUID = "4d8b6d86-c9a8-47c1-871b-111169a8f79c";
const REPORT_ONLY_UUID = "5d7c1e33-ef88-43c2-9ca3-c67ff300b8c2";

function wait(ms) {
  return new Promise(resolve => step_timeout(resolve, ms));
}

async function fetchReports(endpoint) {
  const res = await fetch(`resources/report.py?key=${endpoint}`, {cache: 'no-store'});
  if (res.status == 200) {
    return await res.json();
  }
  return [];
}

async function checkCorpReportExistence(endpoint, blockedUrl, contextUrl, destination, disposition) {
  blockedUrl = new URL(blockedUrl, location).href;
  contextUrl = new URL(contextUrl, location).href;

  const timeout = 3000;
  const retryDelay = 200;
  for (let i = 0; i * retryDelay < timeout; i++) {
    const reports = await fetchReports(endpoint);
    for (const report of reports) {
      if (report.type !== 'coep' || report.url !== contextUrl ||
          report.body.type !== 'corp') {
        continue;
      }
      if (report.body.blockedURL === blockedUrl &&
          report.body.disposition === disposition) {
        assert_equals(report.body.destination, destination);
        return;
      }
    }
    await wait(retryDelay);
  }
  assert_unreached(`A report whose blockedURL is ${blockedUrl.split("?")[0]} and url is ${contextUrl} is not found.`);
}

async function checkNavigationReportExistence(endpoint, blockedUrl, contextUrl, disposition) {
  blockedUrl = new URL(blockedUrl, location).href;
  contextUrl = new URL(contextUrl, location).href;
  const timeout = 3000;
  const retryDelay = 200;
  for (let i = 0; i * retryDelay < timeout; i++) {
    const reports = await fetchReports(endpoint);
    for (const report of reports) {
      if (report.type !== 'coep' || report.url !== contextUrl ||
          report.body.type !== 'navigation') {
        continue;
      }
      if (report.body.blockedURL === blockedUrl &&
          report.body.disposition === disposition) {
        return;
      }
    }
    await wait(retryDelay);
  }
  assert_unreached(`A report whose blockedURL is ${blockedUrl.split("?")[0]} and url is ${contextUrl} is not found.`);
}

promise_test(async t => {
  const iframe = document.createElement('iframe');
  t.add_cleanup(() => iframe.remove());

  iframe.src = FRAME_URL
  document.body.appendChild(iframe);
  await new Promise(resolve => {
    iframe.addEventListener('load', resolve, {once: true});
  });

  const url = `${REMOTE_ORIGIN}/common/text-plain.txt?${token()}`;
  const init = { mode: 'no-cors', cache: 'no-store' };
  // The response comes from cross-origin, and doesn't have a CORP
  // header, so it is blocked.
  iframe.contentWindow.fetch(url, init).catch(() => {});

  await checkCorpReportExistence(REPORT_UUID, url, iframe.src, '', 'enforce');
  await checkCorpReportExistence(
      REPORT_ONLY_UUID, url, iframe.src, '', 'reporting');
}, 'subresource CORP');

promise_test(async t => {
  const iframe = document.createElement('iframe');
  t.add_cleanup(() => iframe.remove());

  iframe.src = FRAME_URL
  document.body.appendChild(iframe);
  await new Promise(resolve => {
    iframe.addEventListener('load', resolve, {once: true});
  });

  const w = iframe.contentWindow;

  function attachFrame(url) {
    const frame = w.document.createElement('iframe');
    frame.src = url;
    w.document.body.appendChild(frame);
  }

  const url = `${REMOTE_ORIGIN}/common/blank.html?${token()}`;
  // The nested frame comes from cross-origin and doesn't have a CORP
  // header, so it is blocked.
  attachFrame(url);

  await checkCorpReportExistence(
      REPORT_UUID, url, iframe.src, 'iframe', 'enforce');
  await checkCorpReportExistence(
      REPORT_ONLY_UUID, url, iframe.src, 'iframe', 'reporting');
}, 'navigation CORP');

promise_test(async (t) => {
  const iframe = document.createElement('iframe');
  t.add_cleanup(() => iframe.remove());

  iframe.src = FRAME_URL;
  const targetUrl = `/common/blank.html?${token()}`;
  iframe.addEventListener('load', t.step_func(() => {
    const nested = iframe.contentDocument.createElement('iframe');
    nested.src = targetUrl;
    // |nested| doesn't have COEP whereas |iframe| has, so it is blocked.
    iframe.contentDocument.body.appendChild(nested);
  }), {once: true});

  document.body.appendChild(iframe);

  await checkNavigationReportExistence(
      REPORT_UUID, targetUrl, iframe.src, 'enforce');
  await checkNavigationReportExistence(
      REPORT_ONLY_UUID, targetUrl, iframe.src, 'reporting');
}, 'COEP violation on nested frame navigation');

promise_test(async (t) => {
  const iframe = document.createElement('iframe');
  t.add_cleanup(() => iframe.remove());

  iframe.src = 'resources/reporting-empty-frame-multiple-headers.html.asis';
  const targetUrl = `/common/blank.html?${token()}`;

  iframe.addEventListener('load', t.step_func(() => {
    const nested = iframe.contentDocument.createElement('iframe');
    nested.src = targetUrl;
    // |nested| doesn't have COEP whereas |iframe| has, so it is blocked.
    iframe.contentDocument.body.appendChild(nested);
  }), {once: true});

  document.body.appendChild(iframe);

  await checkNavigationReportExistence(
      REPORT_UUID, targetUrl, iframe.src, 'enforce');
  await checkNavigationReportExistence(
      REPORT_ONLY_UUID, targetUrl, iframe.src, 'reporting');

}, 'Two COEP headers, split inside report-to value');

// Shared worker do not support observer currently, so add test for endpoint
// here.
promise_test(async (t) => {
  const iframe = document.createElement('iframe');
  t.add_cleanup(() => iframe.remove());

  iframe.src = FRAME_URL;
  const targetUrl = `${REMOTE_ORIGIN}/common/blank.html?${token()}`;
  document.body.appendChild(iframe);

  const worker = new iframe.contentWindow.SharedWorker(WORKER_URL);
  worker.port.start();
  const script =
    `fetch('${targetUrl}', {mode: 'no-cors', cache: 'no-store'}).catch(e => {});`;
  worker.addEventListener('error', t.unreached_func('Worker.onerror'));
  worker.port.postMessage(script);

  await checkCorpReportExistence(
      REPORT_UUID, targetUrl, WORKER_URL, 'iframe', 'enforce');
  await checkCorpReportExistence(
      REPORT_ONLY_UUID, targetUrl, WORKER_URL, 'iframe', 'reporting');
}, 'Shared worker fetch');

</script>
