Add OAuth2 scopes to the ExtensionPermissionSet and granted permissions.

chrome/common/extensions/extension_permission_set_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/extensions/extension_permission_set.h"
 
+#include "base/command_line.h"
 #include "base/json/json_file_value_serializer.h"
 #include "base/logging.h"
 #include "base/path_service.h"
 #include "base/utf_string_conversions.h"
 #include "chrome/common/chrome_paths.h"
+#include "chrome/common/chrome_switches.h"
 #include "chrome/common/extensions/extension.h"
 #include "chrome/common/extensions/extension_manifest_constants.h"
 #include "chrome/common/extensions/extension_error_utils.h"
 #include "chrome/common/extensions/extension_permission_set.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace errors = extension_manifest_errors;
 namespace keys = extension_manifest_keys;
 namespace values = extension_manifest_values;
 namespace {
@@ skipping 224 matching lines @@
   ExtensionAPIPermissionSet expected_apis;
 
   URLPatternSet explicit_hosts1;
   URLPatternSet explicit_hosts2;
   URLPatternSet expected_explicit_hosts;
 
   URLPatternSet scriptable_hosts1;
   URLPatternSet scriptable_hosts2;
   URLPatternSet expected_scriptable_hosts;
 
+  ExtensionOAuth2Scopes scopes1;
+  ExtensionOAuth2Scopes scopes2;
+  ExtensionOAuth2Scopes expected_scopes;
+
   URLPatternSet effective_hosts;
 
   scoped_refptr<ExtensionPermissionSet> set1;
   scoped_refptr<ExtensionPermissionSet> set2;
   scoped_refptr<ExtensionPermissionSet> union_set;
 
   // Union with an empty set.
   apis1.insert(ExtensionAPIPermission::kTab);
   apis1.insert(ExtensionAPIPermission::kBackground);
   expected_apis.insert(ExtensionAPIPermission::kTab);
   expected_apis.insert(ExtensionAPIPermission::kBackground);
 
   AddPattern(&explicit_hosts1, "http://*.google.com/*");
   AddPattern(&expected_explicit_hosts, "http://*.google.com/*");
   AddPattern(&effective_hosts, "http://*.google.com/*");
 
-  set1 = new ExtensionPermissionSet(apis1, explicit_hosts1, scriptable_hosts1);
-  set2 = new ExtensionPermissionSet(apis2, explicit_hosts2, scriptable_hosts2);
+  scopes1.insert("first-scope");
+  scopes1.insert("second-scope");
+  expected_scopes.insert("first-scope");
+  expected_scopes.insert("second-scope");
+
+  set1 = new ExtensionPermissionSet(
+      apis1, explicit_hosts1, scriptable_hosts1, scopes1);
+  set2 = new ExtensionPermissionSet(
+      apis2, explicit_hosts2, scriptable_hosts2, scopes2);
   union_set = ExtensionPermissionSet::CreateUnion(set1.get(), set2.get());
   EXPECT_TRUE(set1->Contains(*set2));
   EXPECT_TRUE(set1->Contains(*union_set));
   EXPECT_FALSE(set2->Contains(*set1));
   EXPECT_FALSE(set2->Contains(*union_set));
   EXPECT_TRUE(union_set->Contains(*set1));
   EXPECT_TRUE(union_set->Contains(*set2));
 
   EXPECT_FALSE(union_set->HasEffectiveFullAccess());
   EXPECT_EQ(expected_apis, union_set->apis());
   EXPECT_EQ(expected_explicit_hosts, union_set->explicit_hosts());
   EXPECT_EQ(expected_scriptable_hosts, union_set->scriptable_hosts());
   EXPECT_EQ(expected_explicit_hosts, union_set->effective_hosts());
+  EXPECT_EQ(expected_scopes, union_set->scopes());
 
   // Now use a real second set.
   apis2.insert(ExtensionAPIPermission::kTab);
   apis2.insert(ExtensionAPIPermission::kProxy);
   apis2.insert(ExtensionAPIPermission::kClipboardWrite);
   apis2.insert(ExtensionAPIPermission::kPlugin);
   expected_apis.insert(ExtensionAPIPermission::kTab);
   expected_apis.insert(ExtensionAPIPermission::kProxy);
   expected_apis.insert(ExtensionAPIPermission::kClipboardWrite);
   expected_apis.insert(ExtensionAPIPermission::kPlugin);
 
   AddPattern(&explicit_hosts2, "http://*.example.com/*");
   AddPattern(&scriptable_hosts2, "http://*.google.com/*");
   AddPattern(&expected_explicit_hosts, "http://*.example.com/*");
   AddPattern(&expected_scriptable_hosts, "http://*.google.com/*");
 
+  scopes2.insert("real-scope");
+  scopes2.insert("anotherscope");
+  expected_scopes.insert("real-scope");
+  expected_scopes.insert("anotherscope");
+
   URLPatternSet::CreateUnion(
       explicit_hosts2, scriptable_hosts2, &effective_hosts);
 
-  set2 = new ExtensionPermissionSet(apis2, explicit_hosts2, scriptable_hosts2);
+  set2 = new ExtensionPermissionSet(
+      apis2, explicit_hosts2, scriptable_hosts2, scopes2);
   union_set = ExtensionPermissionSet::CreateUnion(set1.get(), set2.get());
 
   EXPECT_FALSE(set1->Contains(*set2));
   EXPECT_FALSE(set1->Contains(*union_set));
   EXPECT_FALSE(set2->Contains(*set1));
   EXPECT_FALSE(set2->Contains(*union_set));
   EXPECT_TRUE(union_set->Contains(*set1));
   EXPECT_TRUE(union_set->Contains(*set2));
 
   EXPECT_TRUE(union_set->HasEffectiveFullAccess());
   EXPECT_TRUE(union_set->HasEffectiveAccessToAllHosts());
   EXPECT_EQ(expected_apis, union_set->apis());
   EXPECT_EQ(expected_explicit_hosts, union_set->explicit_hosts());
   EXPECT_EQ(expected_scriptable_hosts, union_set->scriptable_hosts());
+  EXPECT_EQ(expected_scopes, union_set->scopes());
   EXPECT_EQ(effective_hosts, union_set->effective_hosts());
 }
 
 TEST(ExtensionPermissionsTest, CreateIntersection) {
   ExtensionAPIPermissionSet apis1;
   ExtensionAPIPermissionSet apis2;
   ExtensionAPIPermissionSet expected_apis;
 
   URLPatternSet explicit_hosts1;
   URLPatternSet explicit_hosts2;
@@ skipping 72 matching lines @@
   ExtensionAPIPermissionSet expected_apis;
 
   URLPatternSet explicit_hosts1;
   URLPatternSet explicit_hosts2;
   URLPatternSet expected_explicit_hosts;
 
   URLPatternSet scriptable_hosts1;
   URLPatternSet scriptable_hosts2;
   URLPatternSet expected_scriptable_hosts;
 
+  ExtensionOAuth2Scopes scopes1;
+  ExtensionOAuth2Scopes scopes2;
+  ExtensionOAuth2Scopes expected_scopes;
+
   URLPatternSet effective_hosts;
 
   scoped_refptr<ExtensionPermissionSet> set1;
   scoped_refptr<ExtensionPermissionSet> set2;
   scoped_refptr<ExtensionPermissionSet> new_set;
 
   // Difference with an empty set.
   apis1.insert(ExtensionAPIPermission::kTab);
   apis1.insert(ExtensionAPIPermission::kBackground);
 
   AddPattern(&explicit_hosts1, "http://*.google.com/*");
   AddPattern(&scriptable_hosts1, "http://www.reddit.com/*");
 
-  set1 = new ExtensionPermissionSet(apis1, explicit_hosts1, scriptable_hosts1);
-  set2 = new ExtensionPermissionSet(apis2, explicit_hosts2, scriptable_hosts2);
+  scopes1.insert("my-scope");
+  scopes1.insert("other-scope");
+
+  set1 = new ExtensionPermissionSet(
+      apis1, explicit_hosts1, scriptable_hosts1, scopes1);
+  set2 = new ExtensionPermissionSet(
+      apis2, explicit_hosts2, scriptable_hosts2, scopes2);
   new_set = ExtensionPermissionSet::CreateDifference(set1.get(), set2.get());
   EXPECT_EQ(*set1, *new_set);
 
   // Now use a real second set.
   apis2.insert(ExtensionAPIPermission::kTab);
   apis2.insert(ExtensionAPIPermission::kProxy);
   apis2.insert(ExtensionAPIPermission::kClipboardWrite);
   apis2.insert(ExtensionAPIPermission::kPlugin);
   expected_apis.insert(ExtensionAPIPermission::kBackground);
 
   AddPattern(&explicit_hosts2, "http://*.example.com/*");
   AddPattern(&explicit_hosts2, "http://*.google.com/*");
   AddPattern(&scriptable_hosts2, "http://*.google.com/*");
   AddPattern(&expected_scriptable_hosts, "http://www.reddit.com/*");
 
+  scopes2.insert("other-scope");
+  expected_scopes.insert("my-scope");
+
   effective_hosts.ClearPatterns();
   AddPattern(&effective_hosts, "http://www.reddit.com/*");
 
-  set2 = new ExtensionPermissionSet(apis2, explicit_hosts2, scriptable_hosts2);
+  set2 = new ExtensionPermissionSet(
+      apis2, explicit_hosts2, scriptable_hosts2, scopes2);
   new_set = ExtensionPermissionSet::CreateDifference(set1.get(), set2.get());
 
   EXPECT_TRUE(set1->Contains(*new_set));
   EXPECT_FALSE(set2->Contains(*new_set));
 
   EXPECT_FALSE(new_set->HasEffectiveFullAccess());
   EXPECT_FALSE(new_set->HasEffectiveAccessToAllHosts());
   EXPECT_EQ(expected_apis, new_set->apis());
   EXPECT_EQ(expected_explicit_hosts, new_set->explicit_hosts());
   EXPECT_EQ(expected_scriptable_hosts, new_set->scriptable_hosts());
+  EXPECT_EQ(expected_scopes, new_set->scopes());
   EXPECT_EQ(effective_hosts, new_set->effective_hosts());
 
   // |set3| = |set1| - |set2| --> |set3| intersect |set2| == empty_set
   set1 = ExtensionPermissionSet::CreateIntersection(new_set.get(), set2.get());
   EXPECT_TRUE(set1->IsEmpty());
 }
 
 TEST(ExtensionPermissionsTest, HasLessPrivilegesThan) {
   const struct {
     const char* base_name;
-    // Increase these sizes if you have more than 10.
-    const char* granted_apis[10];

[Yoyo Zhou, 2012/04/24 23:16:36]

You pruned these because they were getting unmaintainable?

[jstritar, 2012/04/24 23:33:34]

They were no longer being used in the actual test case below for some reason. We
created a list of granted APIs and hosts, but didn't do anything with them.

-    const char* granted_hosts[10];
-    bool full_access;
     bool expect_increase;
   } kTests[] = {
-    { "allhosts1", {NULL}, {"http://*/", NULL}, false,
-      false },  // all -> all
-    { "allhosts2", {NULL}, {"http://*/", NULL}, false,
-      false },  // all -> one
-    { "allhosts3", {NULL}, {NULL}, false, true },  // one -> all
-    { "hosts1", {NULL},
-      {"http://www.google.com/", "http://www.reddit.com/", NULL}, false,
-      false },  // http://a,http://b -> http://a,http://b
-    { "hosts2", {NULL},
-      {"http://www.google.com/", "http://www.reddit.com/", NULL}, false,
-      true },  // http://a,http://b -> https://a,http://*.b
-    { "hosts3", {NULL},
-      {"http://www.google.com/", "http://www.reddit.com/", NULL}, false,
-      false },  // http://a,http://b -> http://a
-    { "hosts4", {NULL},
-      {"http://www.google.com/", NULL}, false,
-      true },  // http://a -> http://a,http://b
-    { "hosts5", {"tabs", "notifications", NULL},
-      {"http://*.example.com/", "http://*.example.com/*",
-       "http://*.example.co.uk/*", "http://*.example.com.au/*",
-       NULL}, false,
-      false },  // http://a,b,c -> http://a,b,c + https://a,b,c
-    { "hosts6", {"tabs", "notifications", NULL},
-      {"http://*.example.com/", "http://*.example.com/*", NULL}, false,
-      false },  // http://a.com -> http://a.com + http://a.co.uk
-    { "permissions1", {"tabs", NULL},
-      {NULL}, false, false },  // tabs -> tabs
-    { "permissions2", {"tabs", NULL},
-      {NULL}, false, true },  // tabs -> tabs,bookmarks
-    { "permissions3", {NULL},
-      {"http://*/*", NULL},
-      false, true },  // http://a -> http://a,tabs
-    { "permissions5", {"bookmarks", NULL},
-      {NULL}, false, true },  // bookmarks -> bookmarks,history
-    { "equivalent_warnings", {NULL}, {NULL},
-      false, false },  // tabs --> tabs, webNavigation
+    { "allhosts1", false },  // all -> all
+    { "allhosts2", false },  // all -> one
+    { "allhosts3", true },  // one -> all
+    { "hosts1", false },  // http://a,http://b -> http://a,http://b
+    { "hosts2", true },  // http://a,http://b -> https://a,http://*.b
+    { "hosts3", false },  // http://a,http://b -> http://a
+    { "hosts4", true },  // http://a -> http://a,http://b
+    { "hosts5", false },  // http://a,b,c -> http://a,b,c + https://a,b,c
+    { "hosts6", false },  // http://a.com -> http://a.com + http://a.co.uk
+    { "permissions1", false },  // tabs -> tabs
+    { "permissions2", true },  // tabs -> tabs,bookmarks
+    { "permissions3", true },  // http://a -> http://a,tabs
+    { "permissions5", true },  // bookmarks -> bookmarks,history
+    { "equivalent_warnings", false },  // tabs --> tabs, webNavigation
 #if !defined(OS_CHROMEOS)  // plugins aren't allowed in ChromeOS
-    { "permissions4", {NULL},
-      {NULL}, true, false },  // plugin -> plugin,tabs
-    { "plugin1", {NULL},
-      {NULL}, true, false },  // plugin -> plugin
-    { "plugin2", {NULL},
-      {NULL}, true, false },  // plugin -> none
-    { "plugin3", {NULL},
-      {NULL}, false, true },  // none -> plugin
+    { "permissions4", false },  // plugin -> plugin,tabs
+    { "plugin1", false },  // plugin -> plugin
+    { "plugin2", false },  // plugin -> none
+    { "plugin3", true },  // none -> plugin
 #endif
-    { "storage", {NULL},
-      {NULL}, false, false },  // none -> storage
-    { "notifications", {NULL},
-      {NULL}, false, false }  // none -> notifications
+    { "storage", false },  // none -> storage
+    { "notifications", false },  // none -> notifications
+    { "scopes1", true },  // scope1 -> scope1,scope2
+    { "scopes2", false },  // scope1,scope2 -> scope1
+    { "scopes3", true },  // none -> scope1
   };
 
-  ExtensionPermissionsInfo* info = ExtensionPermissionsInfo::GetInstance();
+  CommandLine::ForCurrentProcess()->AppendSwitch(switches::kEnablePlatformApps);
   for (size_t i = 0; i < ARRAYSIZE_UNSAFE(kTests); ++i) {
     scoped_refptr<Extension> old_extension(
         LoadManifest("allow_silent_upgrade",
                      std::string(kTests[i].base_name) + "_old.json"));
     scoped_refptr<Extension> new_extension(
         LoadManifest("allow_silent_upgrade",
                      std::string(kTests[i].base_name) + "_new.json"));
 
-    ExtensionAPIPermissionSet granted_apis;
-    for (size_t j = 0; kTests[i].granted_apis[j] != NULL; ++j) {
-      granted_apis.insert(info->GetByName(kTests[i].granted_apis[j])->id());
-    }
-
-    URLPatternSet granted_hosts;
-    for (size_t j = 0; kTests[i].granted_hosts[j] != NULL; ++j)
-      AddPattern(&granted_hosts, kTests[i].granted_hosts[j]);
-
     EXPECT_TRUE(new_extension.get()) << kTests[i].base_name << "_new.json";
     if (!new_extension.get())
       continue;
 
     scoped_refptr<const ExtensionPermissionSet> old_p(
         old_extension->GetActivePermissions());
     scoped_refptr<const ExtensionPermissionSet> new_p(
         new_extension->GetActivePermissions());
 
     EXPECT_EQ(kTests[i].expect_increase,
@@ skipping 541 matching lines @@
   AddPattern(&non_empty_extent, "http://www.google.com/*");
 
   perm_set = new ExtensionPermissionSet(
       empty_apis, non_empty_extent, empty_extent);
   EXPECT_FALSE(perm_set->IsEmpty());
 
   perm_set = new ExtensionPermissionSet(
       empty_apis, empty_extent, non_empty_extent);
   EXPECT_FALSE(perm_set->IsEmpty());
 }