<!DOCTYPE html>
<meta charset=utf-8>
<meta name="timeout" content="long">
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="/common/get-host-info.sub.js"></script>
<script src="/common/utils.js"></script>
<script src="/common/dispatcher/dispatcher.js"></script>
<!-- Pull in executor_path needed by newPopup / newIframe -->
<script src="/html/cross-origin-embedder-policy/credentialless/resources/common.js"></script>
<!-- Pull in importScript / newPopup / newIframe -->
<script src="/html/anonymous-iframe/resources/common.js"></script>
<body>
<script>

const did_revoke_response = "URL.revokeObjectURL did revoke";
const did_not_revoke_response = "URL.revokeObjectURL did not revoke";

const can_blob_url_be_revoked_js = (blob_url, response_queue_name) => `
  async function test() {
    if (!('revokeObjectURL' in URL)) {
      return send("${response_queue_name}", "URL.revokeObjectURL is not exposed");
    }
    try {
      var blob = await fetch("${blob_url}").then(response => response.blob());
      await blob.text();
    } catch {
      return send("${response_queue_name}", "Blob URL invalid");
    }
    try {
      URL.revokeObjectURL("${blob_url}");
    } catch(e) {
      return send("${response_queue_name}", e.toString());
    }
    try {
      const blob = await fetch("${blob_url}").then(response => response.blob());
    } catch(e) {
      return send("${response_queue_name}", "${did_revoke_response}");
    }
    return send("${response_queue_name}", "${did_not_revoke_response}");
  }
  await test();
`;

const add_iframe_js = (iframe_origin, response_queue_uuid) => `
  const importScript = ${importScript};
  await importScript("/html/cross-origin-embedder-policy/credentialless" +
                   "/resources/common.js");
  await importScript("/html/anonymous-iframe/resources/common.js");
  await importScript("/common/utils.js");
  await send("${response_queue_uuid}", newIframe("${iframe_origin}"));
`;

const same_site_origin = get_host_info().HTTPS_ORIGIN;
const cross_site_origin = get_host_info().HTTPS_NOTSAMESITE_ORIGIN;

async function create_test_iframes(t, response_queue_uuid) {

  // Create a same-origin iframe in a cross-site popup.
  const not_same_site_popup_uuid = newPopup(t, cross_site_origin);
  await send(not_same_site_popup_uuid,
       add_iframe_js(same_site_origin, response_queue_uuid));
  const iframe_1_uuid = await receive(response_queue_uuid);

  // Create a same-origin iframe in a same-site popup.
  const same_origin_popup_uuid = newPopup(t, same_site_origin);
  await send(same_origin_popup_uuid,
       add_iframe_js(same_site_origin, response_queue_uuid));
  const iframe_2_uuid = await receive(response_queue_uuid);

  return [iframe_1_uuid, iframe_2_uuid];
}

promise_test(t => {
  return new Promise(async (resolve, reject) => {
    try {
      const response_queue_uuid = token();

      const [iframe_1_uuid, iframe_2_uuid] =
        await create_test_iframes(t, response_queue_uuid);

      const blob = new Blob(["blob data"], {type : "text/plain"});
      const blob_url = window.URL.createObjectURL(blob);
      t.add_cleanup(() => window.URL.revokeObjectURL(blob_url));

      await send(iframe_1_uuid,
           can_blob_url_be_revoked_js(blob_url, response_queue_uuid));
      var response = await receive(response_queue_uuid);
      if (response !== did_not_revoke_response) {
        reject(`Blob URL was revoked in not-same-top-level-site iframe: ${response}`);
      }

      await send(iframe_2_uuid,
           can_blob_url_be_revoked_js(blob_url, response_queue_uuid));
      response = await receive(response_queue_uuid);
      if (response !== did_revoke_response) {
        reject(`Blob URL wasn't revoked in same-top-level-site iframe: ${response}`);
      }

      resolve();
    } catch (e) {
      reject(e);
    }
  });
}, "Blob URL shouldn't be revocable from a cross-partition iframe");

const newWorker = (origin) => {
  const worker_token = token();
  const worker_url = origin + executor_worker_path + `&uuid=${worker_token}`;
  const worker = new Worker(worker_url);
  return worker_token;
}

promise_test(t => {
  return new Promise(async (resolve, reject) => {
    try {
      const response_queue_uuid = token();

      const create_worker_js = (origin) => `
        const importScript = ${importScript};
        await importScript("/html/cross-origin-embedder-policy/credentialless" +
                         "/resources/common.js");
        await importScript("/html/anonymous-iframe/resources/common.js");
        await importScript("/common/utils.js");
        const newWorker = ${newWorker};
        await send("${response_queue_uuid}", newWorker("${origin}"));
      `;

      const [iframe_1_uuid, iframe_2_uuid] =
        await create_test_iframes(t, response_queue_uuid);

      // Create a dedicated worker in the cross-top-level-site iframe.
      await send(iframe_1_uuid, create_worker_js(same_site_origin));
      const worker_1_uuid = await receive(response_queue_uuid);

      // Create a dedicated worker in the same-top-level-site iframe.
      await send(iframe_2_uuid, create_worker_js(same_site_origin));
      const worker_2_uuid = await receive(response_queue_uuid);

      const blob = new Blob(["blob data"], {type : "text/plain"});
      const blob_url = window.URL.createObjectURL(blob);
      t.add_cleanup(() => window.URL.revokeObjectURL(blob_url));

      await send(worker_1_uuid,
           can_blob_url_be_revoked_js(blob_url, response_queue_uuid));
      var response = await receive(response_queue_uuid);
      if (response !== did_not_revoke_response) {
        reject(`Blob URL was revoked in not-same-top-level-site dedicated worker: ${response}`);
      }

      await send(worker_2_uuid,
           can_blob_url_be_revoked_js(blob_url, response_queue_uuid));
      response = await receive(response_queue_uuid);
      if (response !== did_revoke_response) {
        reject(`Blob URL wasn't revoked in same-top-level-site dedicated worker: ${response}`);
      }

      resolve();
    } catch (e) {
      reject(e);
    }
  });
}, "Blob URL shouldn't be revocable from a cross-partition dedicated worker");

const newSharedWorker = (origin) => {
  const worker_token = token();
  const worker_url = origin + executor_worker_path + `&uuid=${worker_token}`;
  const worker = new SharedWorker(worker_url, worker_token);
  return worker_token;
}

promise_test(t => {
  return new Promise(async (resolve, reject) => {
    try {
      const response_queue_uuid = token();

      const create_worker_js = (origin) => `
        const importScript = ${importScript};
        await importScript("/html/cross-origin-embedder-policy/credentialless" +
                         "/resources/common.js");
        await importScript("/html/anonymous-iframe/resources/common.js");
        await importScript("/common/utils.js");
        const newSharedWorker = ${newSharedWorker};
        await send("${response_queue_uuid}", newSharedWorker("${origin}"));
      `;

      const [iframe_1_uuid, iframe_2_uuid] =
        await create_test_iframes(t, response_queue_uuid);

      // Create a shared worker in the cross-top-level-site iframe.
      await send(iframe_1_uuid, create_worker_js(same_site_origin));
      const worker_1_uuid = await receive(response_queue_uuid);

      // Create a shared worker in the same-top-level-site iframe.
      await send(iframe_2_uuid, create_worker_js(same_site_origin));
      const worker_2_uuid = await receive(response_queue_uuid);

      const blob = new Blob(["blob data"], {type : "text/plain"});
      const blob_url = window.URL.createObjectURL(blob);
      t.add_cleanup(() => window.URL.revokeObjectURL(blob_url));

      await send(worker_1_uuid,
           can_blob_url_be_revoked_js(blob_url, response_queue_uuid));
      var response = await receive(response_queue_uuid);
      if (response !== did_not_revoke_response) {
        reject(`Blob URL was revoked in not-same-top-level-site shared worker: ${response}`);
      }

      await send(worker_2_uuid,
           can_blob_url_be_revoked_js(blob_url, response_queue_uuid));
      response = await receive(response_queue_uuid);
      if (response !== did_revoke_response) {
        reject(`Blob URL wasn't revoked in same-top-level-site shared worker: ${response}`);
      }

      resolve();
    } catch (e) {
      reject(e);
    }
  });
}, "Blob URL shouldn't be revocable from a cross-partition shared worker");

const newServiceWorker = async (origin) => {
  const worker_token = token();
  const worker_url = origin + executor_service_worker_path +
                     `&uuid=${worker_token}`;
  const worker_url_path = executor_service_worker_path.substring(0,
                              executor_service_worker_path.lastIndexOf('/'));
  const scope = worker_url_path + "/not-used/";
  const reg = await navigator.serviceWorker.register(worker_url,
                                                     {'scope': scope});
  return worker_token;
}

promise_test(t => {
  return new Promise(async (resolve, reject) => {
    try {
      const response_queue_uuid = token();

      const create_worker_js = (origin) => `
        const importScript = ${importScript};
        await importScript("/html/cross-origin-embedder-policy/credentialless" +
                         "/resources/common.js");
        await importScript("/html/anonymous-iframe/resources/common.js");
        await importScript("/common/utils.js");
        const newServiceWorker = ${newServiceWorker};
        await send("${response_queue_uuid}", await newServiceWorker("${origin}"));
      `;

      const [iframe_1_uuid, iframe_2_uuid] =
        await create_test_iframes(t, response_queue_uuid);

      // Create a service worker in either iframe.
      await send(iframe_1_uuid, create_worker_js(same_site_origin));
      var worker_1_uuid = await receive(response_queue_uuid);
      t.add_cleanup(() =>
        send(worker_1_uuid, "self.registration.unregister();"));

      const blob = new Blob(["blob data"], {type : "text/plain"});
      const blob_url = window.URL.createObjectURL(blob);
      t.add_cleanup(() => window.URL.revokeObjectURL(blob_url));

      await send(worker_1_uuid,
           can_blob_url_be_revoked_js(blob_url, response_queue_uuid));
      const response = await receive(response_queue_uuid);
      if (response !== "URL.revokeObjectURL is not exposed") {
        reject(`URL.revokeObjectURL is exposed in a Service Worker context: ${response}`);
      }
      resolve();
    } catch (e) {
      reject(e);
    }
  });
}, "Blob URL shouldn't be revocable from a service worker");
</script>
</body>