Digital Credentials: implement digital-credentials-get permission policy

https://bugs.webkit.org/show_bug.cgi?id=275783
rdar://130821690

Reviewed by NOBODY (OOPS!).

Implements the digital-credentials-get permission policy directive.
This directive allows a site to control whether the .get() method
can be used in the Digital Credential API.

Related spec change:
WICG/digital-credentials#132

* LayoutTests/http/tests/identity/allow-attribute.https-expected.txt: Added.
* LayoutTests/http/tests/identity/allow-attribute.https.html: Added.
* LayoutTests/http/tests/identity/resources/iframe.html: Added.
* LayoutTests/imported/w3c/web-platform-tests/digital-credentials/default-permissions-policy.https.sub-expected.txt: Added.
* LayoutTests/imported/w3c/web-platform-tests/digital-credentials/default-permissions-policy.https.sub.html: Added.
* LayoutTests/imported/w3c/web-platform-tests/digital-credentials/disabled-by-permissions-policy.https.sub-expected.txt: Added.
* LayoutTests/imported/w3c/web-platform-tests/digital-credentials/disabled-by-permissions-policy.https.sub.html: Added.
* LayoutTests/imported/w3c/web-platform-tests/digital-credentials/disabled-by-permissions-policy.https.sub.html.headers: Added.
* LayoutTests/imported/w3c/web-platform-tests/digital-credentials/enabled-on-self-origin-by-permissions-policy.https.sub-expected.txt: Added.
* LayoutTests/imported/w3c/web-platform-tests/digital-credentials/enabled-on-self-origin-by-permissions-policy.https.sub.html: Added.
* LayoutTests/imported/w3c/web-platform-tests/digital-credentials/enabled-on-self-origin-by-permissions-policy.https.sub.html.headers: Added.
* LayoutTests/imported/w3c/web-platform-tests/permissions-policy/resources/digital-credentials-get.html: Added.
* LayoutTests/platform/glib/TestExpectations:
* LayoutTests/platform/mac-site-isolation/TestExpectations:
* LayoutTests/platform/mac-wk1/TestExpectations:
* Source/WebCore/Modules/credentialmanagement/CredentialsContainer.h:
(WebCore::CredentialsContainer::document const):
* Source/WebCore/Modules/identity/IdentityCredentialsContainer.cpp:
(WebCore::IdentityCredentialsContainer::get):
* Source/WebCore/html/PermissionsPolicy.cpp:
(WebCore::toFeatureNameForLogging):
(WebCore::readFeatureIdentifier):
(WebCore::defaultAllowlistValue):
* Source/WebCore/html/PermissionsPolicy.h:

LayoutTests/http/tests/identity/allow-attribute.https-expected.txt

@@ -0,0 +1,13 @@
+PASS <iframe src="https://127.0.0.1:8443/identity/resources/iframe.html" data-is-allowed="true"></iframe> is allowed to call get()
+PASS <iframe src="https://localhost:8443/identity/resources/iframe.html" data-is-allowed="false"></iframe> is not allowed to call get()
+PASS <iframe allow="digital-credentials-get" src="https://127.0.0.1:8443/identity/resources/iframe.html" data-is-allowed="true"></iframe> is allowed to call get()
+PASS <iframe allow="digital-credentials-get" src="https://localhost:8443/identity/resources/iframe.html" data-is-allowed="true"></iframe> is allowed to call get()
+PASS <iframe allow="digital-credentials-get *" src="https://localhost:8443/identity/resources/iframe.html" data-is-allowed="true"></iframe> is allowed to call get()
+PASS <iframe allow="digital-credentials-get *" src="https://127.0.0.1:8443/identity/resources/iframe.html" data-is-allowed="true"></iframe> is allowed to call get()
+PASS <iframe allow="digital-credentials-get 'none'" src="https://localhost:8443/identity/resources/iframe.html" data-is-allowed="false"></iframe> is not allowed to call get()
+PASS <iframe allow="digital-credentials-get 'none'" src="https://127.0.0.1:8443/identity/resources/iframe.html" data-is-allowed="false"></iframe> is not allowed to call get()
+PASS <iframe allow="digital-credentials-get 'self'" src="https://localhost:8443/identity/resources/iframe.html" data-is-allowed="false"></iframe> is not allowed to call get()
+PASS <iframe allow="digital-credentials-get 'self'" src="https://127.0.0.1:8443/identity/resources/iframe.html" data-is-allowed="true"></iframe> is allowed to call get()
+PASS <iframe allow="digital-credentials-get https://localhost:8443" src="https://localhost:8443/identity/resources/iframe.html" data-is-allowed="true"></iframe> is allowed to call get()
+PASS <iframe allow="digital-credentials-get https://localhost:8443" src="https://127.0.0.1:8443/identity/resources/iframe.html" data-is-allowed="false"></iframe> is not allowed to call get()
+

LayoutTests/http/tests/identity/allow-attribute.https.html

@@ -0,0 +1,133 @@
+<!DOCTYPE html>
+<html>
+    <head>
+        <title>
+            Test allow attribute with "digital-credentials-get" and
+            CredentialsContainer's .get() method
+        </title>
+        <script src="/resources/js-test-pre.js"></script>
+        <script>
+            testRunner?.dumpAsText();
+            testRunner?.waitUntilDone();
+
+            function waitFor(target, eventName) {
+                return new Promise((resolve) => {
+                    target.addEventListener(eventName, resolve, { once: true });
+                });
+            }
+            const crossorigin = `https://localhost:8443`;
+
+            const iframeDetails = [
+                {
+                    policy: null,
+                    crossOrigin: false,
+                    isAllowed: true,
+                },
+                {
+                    policy: null,
+                    crossOrigin: true,
+                    isAllowed: false,
+                },
+                {
+                    policy: "digital-credentials-get",
+                    crossOrigin: false,
+                    isAllowed: true,
+                },
+                {
+                    policy: "digital-credentials-get",
+                    crossOrigin: true,
+                    isAllowed: true,
+                },
+                {
+                    policy: "digital-credentials-get *",
+                    crossOrigin: true,
+                    isAllowed: true,
+                },
+                {
+                    policy: "digital-credentials-get *",
+                    crossOrigin: false,
+                    isAllowed: true,
+                },
+                {
+                    policy: "digital-credentials-get 'none'",
+                    crossOrigin: true,
+                    isAllowed: false,
+                },
+                {
+                    policy: "digital-credentials-get 'none'",
+                    crossOrigin: false,
+                    isAllowed: false,
+                },
+                {
+                    policy: "digital-credentials-get 'self'",
+                    crossOrigin: true,
+                    isAllowed: false,
+                },
+                {
+                    policy: "digital-credentials-get 'self'",
+                    crossOrigin: false,
+                    isAllowed: true,
+                },
+                {
+                    policy: `digital-credentials-get ${crossorigin}`,
+                    crossOrigin: true,
+                    isAllowed: true,
+                },
+                {
+                    policy: `digital-credentials-get ${crossorigin}`,
+                    crossOrigin: false,
+                    isAllowed: false,
+                },
+            ];
+
+            async function loadIframe({ policy, crossOrigin, isAllowed }) {
+                const origin = crossOrigin ? crossorigin : location.origin;
+                return new Promise((resolve) => {
+                    const iframe = document.createElement("iframe");
+                    if (policy !== null) {
+                        iframe.allow = policy;
+                    }
+
+                    iframe.src = new URL(
+                        "/identity/resources/iframe.html",
+                        origin
+                    ).href;
+                    iframe.onload = () => resolve(iframe);
+                    iframe.dataset.isAllowed = isAllowed;
+                    document.body.appendChild(iframe);
+                });
+            }
+
+            async function runTests() {
+                for (const details of iframeDetails) {
+                    const iframe = await loadIframe(details);
+                    const { isAllowed } = details;
+                    const action = "call get()";
+                    iframe.contentWindow.postMessage({ action }, "*");
+                    const {
+                        data: { exceptionMessage, exceptionName, result },
+                    } = await waitFor(window, "message");
+                    switch (true) {
+                        case isAllowed && exceptionName === "TypeError":
+                            testPassed(
+                                `${iframe.outerHTML} is allowed to ${action}`
+                            );
+                            break;
+                        case exceptionName === "NotAllowedError" && !isAllowed:
+                            testPassed(
+                                `${iframe.outerHTML} is not allowed to ${action}`
+                            );
+                            break;
+                        default:
+                            testFailed(
+                                `${iframe.outerHTML}. ${exceptionName} ${exceptionMessage} - was allowed? ${isAllowed}`
+                            );
+                    }
+                    iframe.remove();
+                }
+                testRunner.notifyDone();
+            }
+        </script>
+    </head>
+    <body onload="runTests()"></body>
+</html>

LayoutTests/http/tests/identity/resources/iframe.html

@@ -0,0 +1,33 @@
+<!DOCTYPE html>
+<meta charset="utf-8" />
+<meta viewport="width=device-width, initial-scale=1.0" />
+<h1>Digital Credentials API</h1>
+<script>
+    window.addEventListener("message", async (event) => {
+        const { action } = event.data;
+        let result = null;
+        let exceptionMessage = "";
+        let exceptionName = "";
+        try {
+            switch (action) {
+                case "call get()":
+                    // Resutls in TypeError
+                    await navigator.identity.get({
+                        digital: { providers: [] },
+                    });
+                    break;
+                default:
+                    throw new Error(`Unknown action: ${action}`);
+            }
+        } catch (e) {
+            exceptionMessage = e.message;
+            exceptionName = e.name;
+            result = "exception";
+        } finally {
+            event.source.postMessage(
+                { action, exceptionMessage, exceptionName },
+                event.origin
+            );
+        }
+    });
+</script>

LayoutTests/imported/w3c/web-platform-tests/digital-credentials/default-permissions-policy.https.sub-expected.txt

@@ -0,0 +1,3 @@
+
+PASS Permissions-Policy is by default 'self'.
+

LayoutTests/imported/w3c/web-platform-tests/digital-credentials/default-permissions-policy.https.sub.html

@@ -0,0 +1,42 @@
+<!DOCTYPE html>
+<meta charset="utf-8" />
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<script src="/permissions-policy/resources/permissions-policy.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<body></body>
+<script>
+    "use strict";
+    const { HTTPS_REMOTE_ORIGIN } = get_host_info();
+    const same_origin_src =
+        "/permissions-policy/resources/digital-credentials-get.html";
+    const cross_origin_src = new URL(same_origin_src, HTTPS_REMOTE_ORIGIN).href;
+
+    promise_test(async (test) => {
+        await test_driver.bless("use activation");
+        await promise_rejects_js(
+            test,
+            TypeError,
+            navigator.identity.get({ digital: { providers: [] } })
+        );
+
+        await test_feature_availability({
+            feature_description: "Digital Credential API",
+            test,
+            src: same_origin_src,
+            expect_feature_available: expect_feature_available_default,
+            is_promise_test: true,
+        });
+
+        await test_feature_availability({
+            feature_description: "Digital Credential API",
+            test,
+            src: cross_origin_src,
+            expect_feature_available: expect_feature_unavailable_default,
+            feature_name: "digital-credentials-get",
+            is_promise_test: true,
+        });
+    }, "Permissions-Policy is by default 'self'.");
+</script>

LayoutTests/imported/w3c/web-platform-tests/digital-credentials/disabled-by-permissions-policy.https.sub-expected.txt

@@ -0,0 +1,6 @@
+
+
+FAIL Permissions-Policy header digital-credentials-get=() disallows the top-level document. promise_rejects_dom: function "function() { throw e }" threw object "TypeError: At least one provider must be specified." that is not a DOMException NotAllowedError: property "code" is equal to undefined, expected 0
+FAIL Permissions-Policy header digital-credentials-get=() disallows same-origin iframes. assert_false: Digital Credential API expected false got true
+PASS Overriden in cross-origin iframes.
+

LayoutTests/imported/w3c/web-platform-tests/digital-credentials/disabled-by-permissions-policy.https.sub.html

@@ -0,0 +1,46 @@
+<!DOCTYPE html>
+<meta charset="utf-8" />
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<script src="/permissions-policy/resources/permissions-policy.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<body></body>
+<script>
+    "use strict";
+    const { HTTPS_REMOTE_ORIGIN } = get_host_info();
+    const same_origin_src =
+        "/permissions-policy/resources/digital-credentials-get.html";
+    const cross_origin_src = new URL(same_origin_src, HTTPS_REMOTE_ORIGIN).href;
+
+    promise_test(async (test) => {
+        await test_driver.bless("use activation");
+        await promise_rejects_dom(
+            test,
+            "NotAllowedError",
+            navigator.identity.get({ digital: { providers: [] } })
+        );
+    }, "Permissions-Policy header digital-credentials-get=() disallows the top-level document.");
+
+    promise_test(async (test) => {
+        await test_feature_availability({
+            feature_description: "Digital Credential API",
+            test,
+            src: same_origin_src,
+            expect_feature_available: expect_feature_unavailable_default,
+            is_promise_test: true,
+        });
+    }, "Permissions-Policy header digital-credentials-get=() disallows same-origin iframes.");
+
+    promise_test(async (test) => {
+        await test_feature_availability({
+            feature_description: "Digital Credential API",
+            test,
+            src: cross_origin_src,
+            expect_feature_available: expect_feature_available_default,
+            feature_name: "digital-credentials-get",
+            is_promise_test: true,
+        });
+    }, "Overridden in cross-origin iframes.");
+</script>

LayoutTests/imported/w3c/web-platform-tests/digital-credentials/disabled-by-permissions-policy.https.sub.html.headers

@@ -0,0 +1 @@
+Permissions-Policy: digital-credentials-get=()

LayoutTests/imported/w3c/web-platform-tests/digital-credentials/enabled-on-self-origin-by-permissions-policy.https.sub-expected.txt

@@ -0,0 +1,6 @@
+
+PASS Permissions-Policy header digital-credentials-get=(self) allows the top-level document.
+PASS Permissions-Policy header digital-credentials-get=(self) allows same-origin iframes.
+PASS Permissions-Policy header digital-credentials-get=(self) disallows cross-origin iframes.
+PASS Permissions-Policy header digital-credentials-get=(self) get overriden by allow attribute.
+

LayoutTests/imported/w3c/web-platform-tests/digital-credentials/enabled-on-self-origin-by-permissions-policy.https.sub.html

@@ -0,0 +1,56 @@
+<!DOCTYPE html>
+<meta charset="utf-8" />
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<script src="/permissions-policy/resources/permissions-policy.js"></script>
+<script src="/common/get-host-info.sub.js"></script>
+<body></body>
+<script>
+    "use strict";
+    const { HTTPS_REMOTE_ORIGIN } = get_host_info();
+    const same_origin_src =
+        "/permissions-policy/resources/digital-credentials-get.html";
+    const cross_origin_src = new URL(same_origin_src, HTTPS_REMOTE_ORIGIN).href;
+
+    promise_test(async (test) => {
+        await test_driver.bless("use activation");
+        await promise_rejects_js(
+            test,
+            TypeError,
+            navigator.identity.get({ digital: { providers: [] } })
+        );
+    }, "Permissions-Policy header digital-credentials-get=(self) allows the top-level document.");
+
+    promise_test(async (test) => {
+        await test_feature_availability({
+            feature_description: "Digital Credential API",
+            test,
+            src: same_origin_src,
+            expect_feature_available: expect_feature_available_default,
+            is_promise_test: true,
+        });
+    }, "Permissions-Policy header digital-credentials-get=(self) allows same-origin iframes.");
+
+    promise_test(async (test) => {
+        await test_feature_availability({
+            feature_description: "Digital Credential API",
+            test,
+            src: cross_origin_src,
+            expect_feature_available: expect_feature_unavailable_default,
+            is_promise_test: true,
+        });
+    }, "Permissions-Policy header digital-credentials-get=(self) disallows cross-origin iframes.");
+
+    promise_test(async (test) => {
+        await test_feature_availability({
+            feature_description: "Digital Credential API",
+            test,
+            src: cross_origin_src,
+            expect_feature_available: expect_feature_available_default,
+            feature_name: "digital-credentials-get",
+            is_promise_test: true,
+        });
+    }, "Permissions-Policy header digital-credentials-get=(self) get overriden by allow attribute.");
+</script>

LayoutTests/imported/w3c/web-platform-tests/digital-credentials/enabled-on-self-origin-by-permissions-policy.https.sub.html.headers

@@ -0,0 +1 @@
+Permissions-Policy: digital-credentials-get=(self)

LayoutTests/imported/w3c/web-platform-tests/permissions-policy/resources/digital-credentials-get.html

@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<meta charset="utf-8" />
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<body></body>
+<script>
+    const type = "availability-result";
+    async function notify() {
+        await test_driver.bless("use activation", null, window);
+        let enabled = undefined;
+        try {
+            await navigator.identity.get({ digital: { providers: [] } });
+        } catch (e) {
+            switch (e.name) {
+                case "NotAllowedError":
+                    enabled = false;
+                    break;
+                case "TypeError":
+                    enabled = true;
+                    break;
+                default:
+                    throw e;
+            }
+        } finally {
+            window.parent.postMessage({ type, enabled }, "*");
+        }
+    }
+</script>
+<body onload="notify()">
+    <h1>Digital Credentials iframe</h1>
+</body>

LayoutTests/platform/glib/TestExpectations

@@ -2771,6 +2771,7 @@ imported/w3c/web-platform-tests/credential-management/ [ Skip ]
 
 # Digital Crendentials API
 http/wpt/identity/ [ Skip ]
+http/tests/identity/ [ Skip ]
 imported/w3c/web-platform-tests/digital-credentials/ [ Skip ]
 
 # WebGL2

LayoutTests/platform/mac-site-isolation/TestExpectations

@@ -5195,6 +5195,7 @@ http/wpt/html/semantics/scripting-1/the-script-element/module/module-meta-url-re
 http/wpt/html/semantics/scripting-1/the-script-element/module/module-meta-url-with-fragment.html [ Skip ]
 http/wpt/html/semantics/text-level-semantics/the-a-element/a-download-click-404.html [ Skip ]
 http/wpt/identity/identitycredentialscontainer-create-basics.https.html [ Skip ]
+http/tests/identity/allow-attribute.https.html [ Skip ]
 http/wpt/identity/identitycredentialscontainer-get-basics.https.html [ Skip ]
 http/wpt/identity/identitycredentialscontainer-store-basics.https.html [ Skip ]
 http/wpt/identity/idl.https.html [ Skip ]