Support socket endpoint permissions for AppsV2 Socket API.

chrome/common/extensions/permissions/permission_set.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/extensions/permissions/permission_set.h"
 
 #include <algorithm>
 #include <iterator>
 #include <string>
 
@@ skipping 110 matching lines @@
 
 // static
 PermissionSet* PermissionSet::CreateDifference(
     const PermissionSet* set1,
     const PermissionSet* set2) {
   scoped_refptr<PermissionSet> empty = new PermissionSet();
   const PermissionSet* set1_safe = (set1 == NULL) ? empty : set1;
   const PermissionSet* set2_safe = (set2 == NULL) ? empty : set2;
 
   APIPermissionSet apis;
-  std::set_difference(set1_safe->apis().begin(), set1_safe->apis().end(),
-                      set2_safe->apis().begin(), set2_safe->apis().end(),
-                      std::insert_iterator<APIPermissionSet>(
-                          apis, apis.begin()));
+  APIPermissionSet::Difference(set1_safe->apis(), set2_safe->apis(), &apis);
 
   URLPatternSet explicit_hosts;
   URLPatternSet::CreateDifference(set1_safe->explicit_hosts(),
                                   set2_safe->explicit_hosts(),
                                   &explicit_hosts);
 
   URLPatternSet scriptable_hosts;
   URLPatternSet::CreateDifference(set1_safe->scriptable_hosts(),
                                   set2_safe->scriptable_hosts(),
                                   &scriptable_hosts);
 
   return new PermissionSet(apis, explicit_hosts, scriptable_hosts);
 }
 
 // static
 PermissionSet* PermissionSet::CreateIntersection(
     const PermissionSet* set1,
     const PermissionSet* set2) {
   scoped_refptr<PermissionSet> empty = new PermissionSet();
   const PermissionSet* set1_safe = (set1 == NULL) ? empty : set1;
   const PermissionSet* set2_safe = (set2 == NULL) ? empty : set2;
 
   APIPermissionSet apis;
-  std::set_intersection(set1_safe->apis().begin(), set1_safe->apis().end(),
-                        set2_safe->apis().begin(), set2_safe->apis().end(),
-                        std::insert_iterator<APIPermissionSet>(
-                            apis, apis.begin()));
+  APIPermissionSet::Intersection(set1_safe->apis(), set2_safe->apis(), &apis);
+
   URLPatternSet explicit_hosts;
   URLPatternSet::CreateIntersection(set1_safe->explicit_hosts(),
                                     set2_safe->explicit_hosts(),
                                     &explicit_hosts);
 
   URLPatternSet scriptable_hosts;
   URLPatternSet::CreateIntersection(set1_safe->scriptable_hosts(),
                                     set2_safe->scriptable_hosts(),
                                     &scriptable_hosts);
 
   return new PermissionSet(apis, explicit_hosts, scriptable_hosts);
 }
 
 // static
 PermissionSet* PermissionSet::CreateUnion(
     const PermissionSet* set1,
     const PermissionSet* set2) {
   scoped_refptr<PermissionSet> empty = new PermissionSet();
   const PermissionSet* set1_safe = (set1 == NULL) ? empty : set1;
   const PermissionSet* set2_safe = (set2 == NULL) ? empty : set2;
 
   APIPermissionSet apis;
-  std::set_union(set1_safe->apis().begin(), set1_safe->apis().end(),
-                 set2_safe->apis().begin(), set2_safe->apis().end(),
-                 std::insert_iterator<APIPermissionSet>(
-                     apis, apis.begin()));
+  APIPermissionSet::Union(set1_safe->apis(), set2_safe->apis(), &apis);
 
   URLPatternSet explicit_hosts;
   URLPatternSet::CreateUnion(set1_safe->explicit_hosts(),
                              set2_safe->explicit_hosts(),
                              &explicit_hosts);
 
   URLPatternSet scriptable_hosts;
   URLPatternSet::CreateUnion(set1_safe->scriptable_hosts(),
                              set2_safe->scriptable_hosts(),
                              &scriptable_hosts);
 
   return new PermissionSet(apis, explicit_hosts, scriptable_hosts);
 }
 
 bool PermissionSet::operator==(
     const PermissionSet& rhs) const {
   return apis_ == rhs.apis_ &&
       scriptable_hosts_ == rhs.scriptable_hosts_ &&
       explicit_hosts_ == rhs.explicit_hosts_;
 }
 
 bool PermissionSet::Contains(const PermissionSet& set) const {
   // Every set includes the empty set.
   if (set.IsEmpty())
     return true;
 
-  if (!std::includes(apis_.begin(), apis_.end(),
-                     set.apis().begin(), set.apis().end()))
-    return false;
+  APIPermissionSet::const_iterator first1 = apis_.begin();
+  APIPermissionSet::const_iterator first2 = set.apis().begin();
+  APIPermissionSet::const_iterator end1 = apis_.end();
+  APIPermissionSet::const_iterator end2 = set.apis().end();
+
+  while (first1 != end1 && first2 != end2) {
+    if (first1->id() > first2->id()) {
+      return false;
+    } else if (first1->id() < first2->id()) {
+      ++first1;
+    } else {
+        if (!first1->Contains(*first2))
+          return false;
+      first1++;
+      first2++;
+    }
+  }
 
   if (!explicit_hosts().Contains(set.explicit_hosts()))
     return false;
 
   if (!scriptable_hosts().Contains(set.scriptable_hosts()))
     return false;
 
   return true;
 }
 
 std::set<std::string> PermissionSet::GetAPIsAsStrings() const {
-  PermissionsInfo* info = PermissionsInfo::GetInstance();
   std::set<std::string> apis_str;
   for (APIPermissionSet::const_iterator i = apis_.begin();
        i != apis_.end(); ++i) {
-    APIPermission* permission = info->GetByID(*i);
-    if (permission)
-      apis_str.insert(permission->name());
+    apis_str.insert(i->name());
   }
   return apis_str;
 }
 
 std::set<std::string> PermissionSet::
     GetAPIsWithAnyAccessAsStrings() const {
   std::set<std::string> result = GetAPIsAsStrings();
   for (size_t i = 0; i < kNumNonPermissionModuleNames; ++i)
     result.insert(kNonPermissionModuleNames[i]);
   for (size_t i = 0; i < kNumNonPermissionFunctionNames; ++i)
@@ skipping 88 matching lines @@
 bool PermissionSet::IsEmpty() const {
   // Not default if any host permissions are present.
   if (!(explicit_hosts().is_empty() && scriptable_hosts().is_empty()))
     return false;
 
   // Or if it has no api permissions.
   return apis().empty();
 }
 
 bool PermissionSet::HasAPIPermission(
-    APIPermission::ID permission) const {
-  return apis().find(permission) != apis().end();
+    APIPermission::ID id) const {
+  return apis().find(id) != apis().end();
+}
+
+bool PermissionSet::CheckAPIPermission(APIPermission::ID permission) const {
+  return CheckAPIPermissionWithDetail(permission, NULL);
+}
+
+bool PermissionSet::CheckAPIPermissionWithDetail(
+    APIPermission::ID permission,
+    const APIPermissionDetail::CheckParam* param) const {
+  APIPermissionSet::const_iterator iter = apis().find(permission);
+  if (iter == apis().end())
+    return false;
+  return iter->Check(param);
 }
 
 bool PermissionSet::HasAccessToFunction(
     const std::string& function_name) const {
   // TODO(jstritar): Embed this information in each permission and add a method
   // like GrantsAccess(function_name) to APIPermission. A "default"
   // permission can then handle the modules and functions that everyone can
   // access.
   for (size_t i = 0; i < kNumNonPermissionFunctionNames; ++i) {
     if (function_name == kNonPermissionFunctionNames[i])
@@ skipping 32 matching lines @@
   // There are two ways this set can have effective access to all hosts:
   //  1) it has an <all_urls> URL pattern.
   //  2) it has a named permission with implied full URL access.
   for (URLPatternSet::const_iterator host = effective_hosts().begin();
        host != effective_hosts().end(); ++host) {
     if (host->match_all_urls() ||
         (host->match_subdomains() && host->host().empty()))
       return true;
   }
 
-  PermissionsInfo* info = PermissionsInfo::GetInstance();
   for (APIPermissionSet::const_iterator i = apis().begin();
        i != apis().end(); ++i) {
-    APIPermission* permission = info->GetByID(*i);
-    if (permission->implies_full_url_access())
+    if (i->permission()->implies_full_url_access())
       return true;
   }
   return false;
 }
 
 bool PermissionSet::HasEffectiveAccessToURL(
     const GURL& url) const {
   return effective_hosts().MatchesURL(url);
 }
 
 bool PermissionSet::HasEffectiveFullAccess() const {
-  PermissionsInfo* info = PermissionsInfo::GetInstance();
   for (APIPermissionSet::const_iterator i = apis().begin();
        i != apis().end(); ++i) {
-    APIPermission* permission = info->GetByID(*i);
-    if (permission->implies_full_access())
+    if (i->permission()->implies_full_access())
       return true;
   }
   return false;
 }
 
 bool PermissionSet::HasLessPrivilegesThan(
     const PermissionSet* permissions) const {
   // Things can't get worse than native code access.
   if (HasEffectiveFullAccess())
     return false;
@@ skipping 109 matching lines @@
 }
 
 std::set<PermissionMessage>
     PermissionSet::GetSimplePermissionMessages() const {
   std::set<PermissionMessage> messages;
   PermissionsInfo* info = PermissionsInfo::GetInstance();
   for (APIPermissionSet::const_iterator i = apis_.begin();
        i != apis_.end(); ++i) {
     DCHECK_GT(PermissionMessage::kNone,
               PermissionMessage::kUnknown);
-    APIPermission* perm = info->GetByID(*i);
+    APIPermission* perm = info->GetByID(i->id());
     if (perm && perm->message_id() > PermissionMessage::kNone)
       messages.insert(perm->GetMessage_());
   }
   return messages;
 }
 
 bool PermissionSet::HasLessAPIPrivilegesThan(
     const PermissionSet* permissions) const {
   if (permissions == NULL)
     return false;
@@ skipping 33 matching lines @@
   std::set<std::string> new_hosts_only;
 
   std::set_difference(new_hosts_set.begin(), new_hosts_set.end(),
                       old_hosts_set.begin(), old_hosts_set.end(),
                       std::inserter(new_hosts_only, new_hosts_only.begin()));
 
   return !new_hosts_only.empty();
 }
 
 }  // namespace extensions