/* globals catcher, callBackground */
/** This is a content script added to all screenshots.firefox.com pages, and allows the site to
    communicate with the add-on */

"use strict";

this.sitehelper = (function() {

  // This gives us the content's copy of XMLHttpRequest, instead of the wrapped
  // copy that this content script gets:
  let ContentXMLHttpRequest = window.wrappedJSObject.XMLHttpRequest;

  catcher.registerHandler((errorObj) => {
    callBackground("reportError", errorObj);
  });


  function sendCustomEvent(name, detail) {
    if (typeof detail == "object") {
      // Note sending an object can lead to security problems, while a string
      // is safe to transfer:
      detail = JSON.stringify(detail);
    }
    document.dispatchEvent(new CustomEvent(name, {detail}));
  }

  /** Set the cookie, even if third-party cookies are disabled in this browser
      (when they are disabled, login from the background page won't set cookies) */
  function sendBackupCookieRequest(authHeaders) {
    // See https://bugzilla.mozilla.org/show_bug.cgi?id=1295660
    //   This bug would allow us to access window.content.XMLHttpRequest, and get
    //   a safer (not overridable by content) version of the object.

    // This is a very minimal attempt to verify that the XMLHttpRequest object we got
    // is legitimate. It is not a good test.
    if (Object.toString.apply(ContentXMLHttpRequest) != "function XMLHttpRequest() {\n    [native code]\n}") {
      console.warn("Insecure copy of XMLHttpRequest");
      return;
    }
    let req = new ContentXMLHttpRequest();
    req.open("POST", "/api/set-login-cookie");
    for (let name in authHeaders) {
      req.setRequestHeader(name, authHeaders[name]);
    }
    req.send("");
    req.onload = () => {
      if (req.status != 200) {
        console.warn("Attempt to set Screenshots cookie via /api/set-login-cookie failed:", req.status, req.statusText, req.responseText);
      }
    };
  }

  document.addEventListener("delete-everything", catcher.watchFunction((event) => {
    // FIXME: reset some data in the add-on
  }, false));

  document.addEventListener("request-login", catcher.watchFunction((event) => {
    let shotId = event.detail;
    catcher.watchPromise(callBackground("getAuthInfo", shotId || null).then((info) => {
      sendBackupCookieRequest(info.authHeaders);
      sendCustomEvent("login-successful", {deviceId: info.deviceId, isOwner: info.isOwner});
    }));
  }));

  document.addEventListener("request-onboarding", catcher.watchFunction((event) => {
    callBackground("requestOnboarding");
  }));

  // Depending on the script loading order, the site might get the addon-present event,
  // but probably won't - instead the site will ask for that event after it has loaded
  document.addEventListener("request-addon-present", catcher.watchFunction(() => {
    sendCustomEvent("addon-present");
  }));

  sendCustomEvent("addon-present");

})();
null;

@@ -27,16 +27,25 @@
 ckground
+, content
  */%0A/** 
@@ -375,29 +375,14 @@
 t = 
-window.wrappedJSObjec
+conten
 t.XM

Fix #3626, use content.XMLHttpRequest instead of wrappedJSObject.XMLHttpRequest (#3755)