Changes around how embed roots are set

components/view_manager/public/interfaces/view_tree.mojom

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 module mojo;
 
 import "components/view_manager/public/interfaces/compositor_frame.mojom";
 import "components/view_manager/public/interfaces/surface_id.mojom";
 import "components/view_manager/public/interfaces/view_manager_constants.mojom";
 import "mojo/application/public/interfaces/service_provider.mojom";
@@ skipping 26 matching lines @@
   NONE,
   VALUE_IN_USE,
   ILLEGAL_ARGUMENT,
 };
 
 // Views are identified by a uint32. The upper 16 bits are the connection id,
 // and the lower 16 the id assigned by the client.
 //
 // The root view is identified with a connection id of 0, and value of 1.
 interface ViewTree {
+  enum AccessPolicy {
+    DEFAULT = 0,
+
+    // An embed root has the following abilities:
+    // . The app sees all the descendants of the view the app is ebmedded at,
+    //   even those from separate connections.
+    // . The app is able to Embed() in all the descendants of the view the app
+    //   is embedded at, even those from separate connections.
+    // Only connections originating from the ViewTreeHostFactory can grant this
+    // policy.
+    EMBED_ROOT = 1,
+  };
+
   // Creates a new view with the specified id. It is up to the client to ensure
   // the id is unique to the connection (the id need not be globally unique).
   // Additionally the connection id (embedded in |view_id|) must match that of
   // the connection.
   // Errors:
   //   ERROR_CODE_VALUE_IN_USE: a view already exists with the specified id.
   //   ERROR_CODE_ILLEGAL_ARGUMENT: The connection part of |view_id| does not
   //     match the connection id of the client.
   //
   // TODO(erg): Once we have default values in mojo, make this take a map of
@@ skipping 49 matching lines @@
   ReorderView(uint32 view_id,
               uint32 relative_view_id,
               OrderDirection direction) => (bool success);
 
   // Returns the views comprising the tree starting at |view_id|. |view_id| is
   // the first result in the return value, unless |view_id| is invalid, in which
   // case an empty vector is returned. The views are visited using a depth first
   // search (pre-order).
   GetViewTree(uint32 view_id) => (array<ViewData> views);
 
-  // TODO(sky): rename this and clarify what it does.
-  SetEmbedRoot();
-
   // A connection may grant access to a view from another connection by way of
   // Embed(). Embed() results in a new ViewTreeClient configured with a root of
   // |view_id|.
   //
   // The caller must have created |view_id|. If not the request fails and the
   // response is false.
   //
   // A view may only have one embedding in it at a time. Subsequent calls to
   // Embed() for the same view result in the currently embedded
   // ViewTreeClient being removed. The embedded app is told this by way of
   // OnUnembed(), which is followed by OnViewDeleted() (as the connection no
   // longer has access to the view).
   //
   // The embedder can detect when the embedded app disconnects by way of
   // OnEmbeddedAppDisconnected().
   //
   // When a connection embeds an app the connection no longer has privileges
   // to access or see any of the children of the view. If the view had existing
   // children the children are removed. The one exception is the root
-  // connection and any embed roots. The root always see the full tree, and
-  // embed roots see the complete tree at their embed point.
+  // connection and any connections with the policy ACCESS_POLICY_EMBED_ROOT.
   Embed(uint32 view_id, ViewTreeClient client) => (bool success);
 
   SetFocus(uint32 view_id);
 
   // Set text input state for the given view.
   SetViewTextInputState(uint32 view_id, TextInputState state);
 
   // Set the input method editor UI (software keyboard, etc) visibility.
   // If state is non-null, the specified view's text input state is updated.
   // Otherwise the existing state is used.
   SetImeVisibility(uint32 view_id, bool visible, TextInputState? state);
+
+  // Sets the access policy for the next ViewTreeClient embedded in |view_id|.
+  //
+  // Not all connections are allowed to change the access policy. See each
+  // constant for specifics.
+  //
+  // policy_bitmask is a bitmask of the kAccessPolicy constants. See them for
+  // details.
+  SetAccessPolicy(uint32 view_id, uint32 policy_bitmask);
 };
 
 // Changes to views are not sent to the connection that originated the
 // change. For example, if connection 1 changes the bounds of a view by calling
 // SetBounds(), connection 1 does not receive OnViewBoundsChanged().
 interface ViewTreeClient {
   // Invoked when the client application has been embedded at |root|.
   // See Embed() on ViewTree for more details. |tree| will be a handle back to
   // the view manager service, unless the connection is to the root connection
   // in which case it will be null.
   OnEmbed(uint16 connection_id,
           ViewData root,
           ViewTree? tree,
-          uint32 focused_view);
+          uint32 focused_view,
+          uint32 access_policy);
 
   // Invoked when the application embedded at |view| is disconnected.
   OnEmbeddedAppDisconnected(uint32 view);
 
   // Sent when another connection is embedded in the View this connection was
   // previously embedded in. See Embed() for more information.
   OnUnembed();
 
   // Invoked when a view's bounds have changed.
   OnViewBoundsChanged(uint32 view,
@@ skipping 41 matching lines @@
 
   // Invoked when a view property is changed. If this change is a removal,
   // |new_data| is null.
   OnViewSharedPropertyChanged(uint32 view, string name, array<uint8>? new_data);
 
   // Invoked when an event is targeted at the specified view.
   OnViewInputEvent(uint32 view, mojo.Event event) => ();
 
   OnViewFocused(uint32 focused_view_id);
 };