Refactor SecurityStateModel/Clients for simplicity and reusability.

chrome/browser/ssl/security_state_tab_helper_browser_tests.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "chrome/browser/ssl/chrome_security_state_model_client.h"
+#include "chrome/browser/ssl/security_state_tab_helper.h"
 
 #include "base/command_line.h"
 #include "base/files/file_path.h"
 #include "base/macros.h"
 #include "base/strings/string_split.h"
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/browser/ssl/cert_verifier_browser_test.h"
-#include "chrome/browser/ssl/chrome_security_state_model_client.h"
 #include "chrome/browser/ssl/ssl_blocking_page.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_commands.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/pref_names.h"
-#include "chrome/grit/generated_resources.h"
 #include "chrome/test/base/in_process_browser_test.h"
 #include "chrome/test/base/ui_test_utils.h"
 #include "components/prefs/pref_service.h"
-#include "components/security_state/switches.h"
+#include "components/security_state/core/security_state.h"
+#include "components/security_state/core/switches.h"
+#include "components/strings/grit/components_strings.h"
 #include "content/public/browser/interstitial_page.h"
 #include "content/public/browser/navigation_controller.h"
 #include "content/public/browser/navigation_entry.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/notification_types.h"
 #include "content/public/browser/security_style_explanation.h"
 #include "content/public/browser/security_style_explanations.h"
 #include "content/public/browser/ssl_status.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/referrer.h"
@@ skipping 13 matching lines @@
 #include "net/test/embedded_test_server/embedded_test_server.h"
 #include "net/test/embedded_test_server/request_handler_util.h"
 #include "net/test/test_data_directory.h"
 #include "net/test/url_request/url_request_failed_job.h"
 #include "net/test/url_request/url_request_mock_http_job.h"
 #include "net/url_request/url_request_filter.h"
 #include "net/url_request/url_request_test_util.h"
 #include "third_party/boringssl/src/include/openssl/ssl.h"
 #include "ui/base/l10n/l10n_util.h"
 
-using security_state::SecurityStateModel;
-
 namespace {
 
 enum CertificateStatus { VALID_CERTIFICATE, INVALID_CERTIFICATE };
 
 const base::FilePath::CharType kDocRoot[] =
     FILE_PATH_LITERAL("chrome/test/data");
 
 // A WebContentsObserver useful for testing the SecurityStyleChanged()
 // method: it keeps track of the latest security style and explanation
 // that was fired.
@@ skipping 52 matching lines @@
             expired_explanation.broken_explanations[0].summary);
 
   base::string16 error_string = base::UTF8ToUTF16(net::ErrorToString(error));
   EXPECT_EQ(l10n_util::GetStringFUTF8(
                 IDS_CERTIFICATE_CHAIN_ERROR_DESCRIPTION_FORMAT, error_string),
             expired_explanation.broken_explanations[0].description);
 
   // Check the associated certificate.
   net::X509Certificate* cert = browser->tab_strip_model()
                                    ->GetActiveWebContents()
-                                    ->GetController()
+                                   ->GetController()
                                    .GetActiveEntry()
                                    ->GetSSL()
                                    .certificate.get();
   EXPECT_TRUE(cert->Equals(expected_cert));
   EXPECT_TRUE(expired_explanation.broken_explanations[0].has_certificate);
 }
 
 // Checks that the given |secure_explanations| contains an appropriate
 // explanation if the certificate status is valid.
 void CheckSecureExplanations(
@@ skipping 17 matching lines @@
                                      .certificate.get();
     EXPECT_TRUE(cert->Equals(expected_cert));
     EXPECT_TRUE(secure_explanations[0].has_certificate);
   }
 
   EXPECT_EQ(l10n_util::GetStringUTF8(IDS_STRONG_SSL_SUMMARY),
             secure_explanations.back().summary);
 
   content::WebContents* web_contents =
       browser->tab_strip_model()->GetActiveWebContents();
-  SecurityStateModel::SecurityInfo security_info;
-  ChromeSecurityStateModelClient::FromWebContents(web_contents)
+  security_state::SecurityInfo security_info;
+  SecurityStateTabHelper::FromWebContents(web_contents)
       ->GetSecurityInfo(&security_info);
 
   const char *protocol, *key_exchange, *cipher, *mac;
   int ssl_version =
       net::SSLConnectionStatusToVersion(security_info.connection_status);
   net::SSLVersionToString(&protocol, ssl_version);
   bool is_aead, is_tls13;
   uint16_t cipher_suite =
       net::SSLConnectionStatusToCipherSuite(security_info.connection_status);
   net::SSLCipherSuiteToStrings(&key_exchange, &cipher, &mac, &is_aead,
@@ skipping 16 matching lines @@
   description_replacements.push_back(base::ASCIIToUTF16(cipher));
   base::string16 secure_description = l10n_util::GetStringFUTF16(
       IDS_STRONG_SSL_DESCRIPTION, description_replacements, nullptr);
 
   EXPECT_EQ(secure_description,
             base::ASCIIToUTF16(secure_explanations.back().description));
 }
 
 void CheckSecurityInfoForSecure(
     content::WebContents* contents,
-    SecurityStateModel::SecurityLevel expect_security_level,
-    SecurityStateModel::SHA1DeprecationStatus expect_sha1_status,
-    SecurityStateModel::ContentStatus expect_mixed_content_status,
+    security_state::SecurityLevel expect_security_level,
+    security_state::SHA1DeprecationStatus expect_sha1_status,
+    security_state::ContentStatus expect_mixed_content_status,
     bool pkp_bypassed,
     bool expect_cert_error) {
   ASSERT_TRUE(contents);
 
-  ChromeSecurityStateModelClient* model_client =
-      ChromeSecurityStateModelClient::FromWebContents(contents);
-  ASSERT_TRUE(model_client);
-  SecurityStateModel::SecurityInfo security_info;
-  model_client->GetSecurityInfo(&security_info);
+  SecurityStateTabHelper* helper =
+      SecurityStateTabHelper::FromWebContents(contents);
+  ASSERT_TRUE(helper);
+  security_state::SecurityInfo security_info;
+  helper->GetSecurityInfo(&security_info);
   EXPECT_EQ(expect_security_level, security_info.security_level);
   EXPECT_EQ(expect_sha1_status, security_info.sha1_deprecation_status);
   EXPECT_EQ(expect_mixed_content_status, security_info.mixed_content_status);
   EXPECT_TRUE(security_info.sct_verify_statuses.empty());
   EXPECT_TRUE(security_info.scheme_is_cryptographic);
   EXPECT_EQ(pkp_bypassed, security_info.pkp_bypassed);
   EXPECT_EQ(expect_cert_error,
             net::IsCertStatusError(security_info.cert_status));
   EXPECT_GT(security_info.security_bits, 0);
   EXPECT_TRUE(!!security_info.certificate);
 }
 
 void CheckSecurityInfoForNonSecure(content::WebContents* contents) {
   ASSERT_TRUE(contents);
 
-  ChromeSecurityStateModelClient* model_client =
-      ChromeSecurityStateModelClient::FromWebContents(contents);
-  ASSERT_TRUE(model_client);
-  SecurityStateModel::SecurityInfo security_info;
-  model_client->GetSecurityInfo(&security_info);
-  EXPECT_EQ(SecurityStateModel::NONE, security_info.security_level);
-  EXPECT_EQ(SecurityStateModel::NO_DEPRECATED_SHA1,
+  SecurityStateTabHelper* helper =
+      SecurityStateTabHelper::FromWebContents(contents);
+  ASSERT_TRUE(helper);
+  security_state::SecurityInfo security_info;
+  helper->GetSecurityInfo(&security_info);
+  EXPECT_EQ(security_state::NONE, security_info.security_level);
+  EXPECT_EQ(security_state::NO_DEPRECATED_SHA1,
             security_info.sha1_deprecation_status);
-  EXPECT_EQ(SecurityStateModel::CONTENT_STATUS_NONE,
+  EXPECT_EQ(security_state::CONTENT_STATUS_NONE,
             security_info.mixed_content_status);
   EXPECT_TRUE(security_info.sct_verify_statuses.empty());
   EXPECT_FALSE(security_info.scheme_is_cryptographic);
   EXPECT_FALSE(net::IsCertStatusError(security_info.cert_status));
   EXPECT_EQ(-1, security_info.security_bits);
   EXPECT_FALSE(!!security_info.certificate);
 }
 
 void ProceedThroughInterstitial(content::WebContents* tab) {
   content::InterstitialPage* interstitial_page = tab->GetInterstitialPage();
@@ skipping 11 matching lines @@
     const std::string& original_file_path,
     const net::HostPortPair& host_port_pair,
     std::string* replacement_path) {
   base::StringPairs replacement_text;
   replacement_text.push_back(
       make_pair("REPLACE_WITH_HOST_AND_PORT", host_port_pair.ToString()));
   net::test_server::GetFilePathWithReplacements(
       original_file_path, replacement_text, replacement_path);
 }
 
-class ChromeSecurityStateModelClientTest : public CertVerifierBrowserTest {
+class SecurityStateTabHelperTest : public CertVerifierBrowserTest {
  public:
-  ChromeSecurityStateModelClientTest()
+  SecurityStateTabHelperTest()
       : https_server_(net::EmbeddedTestServer::TYPE_HTTPS) {
     https_server_.ServeFilesFromSourceDirectory(base::FilePath(kDocRoot));
   }
 
   void SetUpCommandLine(base::CommandLine* command_line) override {
     // Browser will both run and display insecure content.
     command_line->AppendSwitch(switches::kAllowRunningInsecureContent);
   }
 
  protected:
   void SetUpMockCertVerifierForHttpsServer(net::CertStatus cert_status,
                                            int net_result) {
     scoped_refptr<net::X509Certificate> cert(https_server_.GetCertificate());
     net::CertVerifyResult verify_result;
     verify_result.is_issued_by_known_root = true;
     verify_result.verified_cert = cert;
     verify_result.cert_status = cert_status;
 
     mock_cert_verifier()->AddResultForCert(cert, verify_result, net_result);
   }
 
   net::EmbeddedTestServer https_server_;
 
  private:
-  DISALLOW_COPY_AND_ASSIGN(ChromeSecurityStateModelClientTest);
+  DISALLOW_COPY_AND_ASSIGN(SecurityStateTabHelperTest);
 };
 
 GURL GetURLWithNonLocalHostname(net::EmbeddedTestServer* server,
                                 const std::string& path) {
   GURL::Replacements replace_host;
   replace_host.SetHostStr("example.test");
   return server->GetURL(path).ReplaceComponents(replace_host);
 }
 
-class ChromeSecurityStateModelClientTestWithPasswordCcSwitch
-    : public ChromeSecurityStateModelClientTest,
+class SecurityStateTabHelperTestWithPasswordCcSwitch
+    : public SecurityStateTabHelperTest,
       public testing::WithParamInterface<bool> {
  public:
-  ChromeSecurityStateModelClientTestWithPasswordCcSwitch()
-      : ChromeSecurityStateModelClientTest() {}
+  SecurityStateTabHelperTestWithPasswordCcSwitch()
+      : SecurityStateTabHelperTest() {}
 
   void SetUpOnMainThread() override {
     ASSERT_TRUE(embedded_test_server()->Start());
     ASSERT_TRUE(https_server_.Start());
     host_resolver()->AddRule("*", embedded_test_server()->GetURL("/").host());
     SetUpMockCertVerifierForHttpsServer(0, net::OK);
   }
 
   void SetUpCommandLine(base::CommandLine* command_line) override {
-    ChromeSecurityStateModelClientTest::SetUpCommandLine(command_line);
+    SecurityStateTabHelperTest::SetUpCommandLine(command_line);
     if (GetParam()) {
       command_line->AppendSwitchASCII(
           security_state::switches::kMarkHttpAs,
           security_state::switches::
               kMarkHttpWithPasswordsOrCcWithChipAndFormWarning);
     } else {
       command_line->AppendSwitchASCII(
           security_state::switches::kMarkHttpAs,
           security_state::switches::kMarkHttpWithPasswordsOrCcWithChip);
     }
   }
 
  private:
-  DISALLOW_COPY_AND_ASSIGN(
-      ChromeSecurityStateModelClientTestWithPasswordCcSwitch);
+  DISALLOW_COPY_AND_ASSIGN(SecurityStateTabHelperTestWithPasswordCcSwitch);
 };
 
 class SecurityStyleChangedTest : public InProcessBrowserTest {
  public:
   SecurityStyleChangedTest()
       : https_server_(net::EmbeddedTestServer::TYPE_HTTPS) {
     https_server_.ServeFilesFromSourceDirectory(base::FilePath(kDocRoot));
   }
 
   void SetUpCommandLine(base::CommandLine* command_line) override {
     // Browser will both run and display insecure content.
     command_line->AppendSwitch(switches::kAllowRunningInsecureContent);
   }
 
  protected:
   net::EmbeddedTestServer https_server_;
 
  private:
   DISALLOW_COPY_AND_ASSIGN(SecurityStyleChangedTest);
 };
 
-IN_PROC_BROWSER_TEST_F(ChromeSecurityStateModelClientTest, HttpPage) {
+IN_PROC_BROWSER_TEST_F(SecurityStateTabHelperTest, HttpPage) {
   ASSERT_TRUE(embedded_test_server()->Start());
   ui_test_utils::NavigateToURL(
       browser(), embedded_test_server()->GetURL("/ssl/google.html"));
   content::WebContents* contents =
       browser()->tab_strip_model()->GetActiveWebContents();
   ASSERT_TRUE(contents);
 
-  ChromeSecurityStateModelClient* model_client =
-      ChromeSecurityStateModelClient::FromWebContents(contents);
-  ASSERT_TRUE(model_client);
-  SecurityStateModel::SecurityInfo security_info;
-  model_client->GetSecurityInfo(&security_info);
-  EXPECT_EQ(SecurityStateModel::NONE, security_info.security_level);
-  EXPECT_EQ(SecurityStateModel::NO_DEPRECATED_SHA1,
+  SecurityStateTabHelper* helper =
+      SecurityStateTabHelper::FromWebContents(contents);
+  ASSERT_TRUE(helper);
+  security_state::SecurityInfo security_info;
+  helper->GetSecurityInfo(&security_info);
+  EXPECT_EQ(security_state::NONE, security_info.security_level);
+  EXPECT_EQ(security_state::NO_DEPRECATED_SHA1,
             security_info.sha1_deprecation_status);
-  EXPECT_EQ(SecurityStateModel::CONTENT_STATUS_NONE,
+  EXPECT_EQ(security_state::CONTENT_STATUS_NONE,
             security_info.mixed_content_status);
   EXPECT_TRUE(security_info.sct_verify_statuses.empty());
   EXPECT_FALSE(security_info.scheme_is_cryptographic);
   EXPECT_FALSE(net::IsCertStatusError(security_info.cert_status));
   EXPECT_FALSE(!!security_info.certificate);
   EXPECT_EQ(-1, security_info.security_bits);
   EXPECT_EQ(0, security_info.connection_status);
 }
 
-IN_PROC_BROWSER_TEST_F(ChromeSecurityStateModelClientTest, HttpsPage) {
+IN_PROC_BROWSER_TEST_F(SecurityStateTabHelperTest, HttpsPage) {
   ASSERT_TRUE(https_server_.Start());
   SetUpMockCertVerifierForHttpsServer(0, net::OK);
 
   ui_test_utils::NavigateToURL(browser(),
                                https_server_.GetURL("/ssl/google.html"));
   CheckSecurityInfoForSecure(
       browser()->tab_strip_model()->GetActiveWebContents(),
-      SecurityStateModel::SECURE, SecurityStateModel::NO_DEPRECATED_SHA1,
-      SecurityStateModel::CONTENT_STATUS_NONE, false,
+      security_state::SECURE, security_state::NO_DEPRECATED_SHA1,
+      security_state::CONTENT_STATUS_NONE, false,
       false /* expect cert status error */);
 }
 
-IN_PROC_BROWSER_TEST_F(ChromeSecurityStateModelClientTest, SHA1Broken) {
+IN_PROC_BROWSER_TEST_F(SecurityStateTabHelperTest, SHA1Broken) {
   ASSERT_TRUE(https_server_.Start());
   // The test server uses a long-lived cert by default, so a SHA1
   // signature in it will register as a "broken" condition rather than
   // "warning".
   SetUpMockCertVerifierForHttpsServer(net::CERT_STATUS_SHA1_SIGNATURE_PRESENT,
                                       net::OK);
 
   ui_test_utils::NavigateToURL(browser(),
                                https_server_.GetURL("/ssl/google.html"));
   CheckSecurityInfoForSecure(
       browser()->tab_strip_model()->GetActiveWebContents(),
-      SecurityStateModel::DANGEROUS, SecurityStateModel::DEPRECATED_SHA1_MAJOR,
-      SecurityStateModel::CONTENT_STATUS_NONE, false,
+      security_state::DANGEROUS, security_state::DEPRECATED_SHA1_MAJOR,
+      security_state::CONTENT_STATUS_NONE, false,
       false /* expect cert status error */);
 }
 
-IN_PROC_BROWSER_TEST_F(ChromeSecurityStateModelClientTest, MixedContent) {
+IN_PROC_BROWSER_TEST_F(SecurityStateTabHelperTest, MixedContent) {
   ASSERT_TRUE(embedded_test_server()->Start());
   ASSERT_TRUE(https_server_.Start());
   SetUpMockCertVerifierForHttpsServer(0, net::OK);
   host_resolver()->AddRule("example.test",
                            https_server_.GetURL("/title1.html").host());
 
   net::HostPortPair replacement_pair = embedded_test_server()->host_port_pair();
   replacement_pair.set_host("example.test");
 
   // Navigate to an HTTPS page that displays mixed content.
   std::string replacement_path;
   GetFilePathWithHostAndPortReplacement(
-      "/ssl/page_displays_insecure_content.html",
-      replacement_pair, &replacement_path);
+      "/ssl/page_displays_insecure_content.html", replacement_pair,
+      &replacement_path);
   ui_test_utils::NavigateToURL(browser(),
                                https_server_.GetURL(replacement_path));
   CheckSecurityInfoForSecure(
       browser()->tab_strip_model()->GetActiveWebContents(),
-      SecurityStateModel::NONE, SecurityStateModel::NO_DEPRECATED_SHA1,
-      SecurityStateModel::CONTENT_STATUS_DISPLAYED, false,
+      security_state::NONE, security_state::NO_DEPRECATED_SHA1,
+      security_state::CONTENT_STATUS_DISPLAYED, false,
       false /* expect cert status error */);
 
   // Navigate to an HTTPS page that displays mixed content dynamically.
   GetFilePathWithHostAndPortReplacement(
-      "/ssl/page_with_dynamic_insecure_content.html",
-      replacement_pair, &replacement_path);
+      "/ssl/page_with_dynamic_insecure_content.html", replacement_pair,
+      &replacement_path);
   ui_test_utils::NavigateToURL(browser(),
                                https_server_.GetURL(replacement_path));
   CheckSecurityInfoForSecure(
       browser()->tab_strip_model()->GetActiveWebContents(),
-      SecurityStateModel::SECURE, SecurityStateModel::NO_DEPRECATED_SHA1,
-      SecurityStateModel::CONTENT_STATUS_NONE, false,
+      security_state::SECURE, security_state::NO_DEPRECATED_SHA1,
+      security_state::CONTENT_STATUS_NONE, false,
       false /* expect cert status error */);
   // Load the insecure image.
   bool js_result = false;
   EXPECT_TRUE(content::ExecuteScriptAndExtractBool(
       browser()->tab_strip_model()->GetActiveWebContents(), "loadBadImage();",
       &js_result));
   EXPECT_TRUE(js_result);
   CheckSecurityInfoForSecure(
       browser()->tab_strip_model()->GetActiveWebContents(),
-      SecurityStateModel::NONE, SecurityStateModel::NO_DEPRECATED_SHA1,
-      SecurityStateModel::CONTENT_STATUS_DISPLAYED, false,
+      security_state::NONE, security_state::NO_DEPRECATED_SHA1,
+      security_state::CONTENT_STATUS_DISPLAYED, false,
       false /* expect cert status error */);
 
   // Navigate to an HTTPS page that runs mixed content.
-  GetFilePathWithHostAndPortReplacement(
-      "/ssl/page_runs_insecure_content.html",
-      replacement_pair, &replacement_path);
+  GetFilePathWithHostAndPortReplacement("/ssl/page_runs_insecure_content.html",
+                                        replacement_pair, &replacement_path);
   ui_test_utils::NavigateToURL(browser(),
                                https_server_.GetURL(replacement_path));
   CheckSecurityInfoForSecure(
       browser()->tab_strip_model()->GetActiveWebContents(),
-      SecurityStateModel::DANGEROUS, SecurityStateModel::NO_DEPRECATED_SHA1,
-      SecurityStateModel::CONTENT_STATUS_RAN, false,
+      security_state::DANGEROUS, security_state::NO_DEPRECATED_SHA1,
+      security_state::CONTENT_STATUS_RAN, false,
       false /* expect cert status error */);
 
   // Navigate to an HTTPS page that runs and displays mixed content.
   GetFilePathWithHostAndPortReplacement(
-      "/ssl/page_runs_and_displays_insecure_content.html",
-      replacement_pair, &replacement_path);
+      "/ssl/page_runs_and_displays_insecure_content.html", replacement_pair,
+      &replacement_path);
   ui_test_utils::NavigateToURL(browser(),
                                https_server_.GetURL(replacement_path));
   CheckSecurityInfoForSecure(
       browser()->tab_strip_model()->GetActiveWebContents(),
-      SecurityStateModel::DANGEROUS, SecurityStateModel::NO_DEPRECATED_SHA1,
-      SecurityStateModel::CONTENT_STATUS_DISPLAYED_AND_RAN, false,
+      security_state::DANGEROUS, security_state::NO_DEPRECATED_SHA1,
+      security_state::CONTENT_STATUS_DISPLAYED_AND_RAN, false,
       false /* expect cert status error */);
 
   // Navigate to an HTTPS page that runs mixed content in an iframe.
   net::HostPortPair host_port_pair =
       net::HostPortPair::FromURL(https_server_.GetURL("/title1.html"));
   host_port_pair.set_host("different-host.test");
   host_resolver()->AddRule("different-host.test",
                            https_server_.GetURL("/title1.html").host());
   host_resolver()->AddRule(
       "different-http-host.test",
       embedded_test_server()->GetURL("/title1.html").host());
   GetFilePathWithHostAndPortReplacement(
       "/ssl/page_runs_insecure_content_in_iframe.html", host_port_pair,
       &replacement_path);
   ui_test_utils::NavigateToURL(browser(),
                                https_server_.GetURL(replacement_path));
   CheckSecurityInfoForSecure(
       browser()->tab_strip_model()->GetActiveWebContents(),
-      SecurityStateModel::DANGEROUS, SecurityStateModel::NO_DEPRECATED_SHA1,
-      SecurityStateModel::CONTENT_STATUS_RAN, false,
+      security_state::DANGEROUS, security_state::NO_DEPRECATED_SHA1,
+      security_state::CONTENT_STATUS_RAN, false,
       false /* expect cert status error */);
 }
 
-IN_PROC_BROWSER_TEST_F(ChromeSecurityStateModelClientTest,
+IN_PROC_BROWSER_TEST_F(SecurityStateTabHelperTest,
                        ActiveContentWithCertErrors) {
   ASSERT_TRUE(https_server_.Start());
   SetUpMockCertVerifierForHttpsServer(0, net::OK);
 
   // Navigate to an HTTPS page and simulate active content with
   // certificate errors.
   ui_test_utils::NavigateToURL(browser(), https_server_.GetURL("/title1.html"));
   content::WebContents* web_contents =
       browser()->tab_strip_model()->GetActiveWebContents();
   ASSERT_TRUE(web_contents);
   content::NavigationEntry* entry =
       web_contents->GetController().GetVisibleEntry();
   ASSERT_TRUE(entry);
   entry->GetSSL().content_status |=
       content::SSLStatus::RAN_CONTENT_WITH_CERT_ERRORS;
 
-  ChromeSecurityStateModelClient* model_client =
-      ChromeSecurityStateModelClient::FromWebContents(web_contents);
-  ASSERT_TRUE(model_client);
-  SecurityStateModel::SecurityInfo security_info;
-  model_client->GetSecurityInfo(&security_info);
+  SecurityStateTabHelper* helper =
+      SecurityStateTabHelper::FromWebContents(web_contents);
+  ASSERT_TRUE(helper);
+  security_state::SecurityInfo security_info;
+  helper->GetSecurityInfo(&security_info);
 
   EXPECT_FALSE(net::IsCertStatusError(security_info.cert_status));
-  EXPECT_EQ(SecurityStateModel::DANGEROUS, security_info.security_level);
-  EXPECT_EQ(SecurityStateModel::CONTENT_STATUS_RAN,
+  EXPECT_EQ(security_state::DANGEROUS, security_info.security_level);
+  EXPECT_EQ(security_state::CONTENT_STATUS_RAN,
             security_info.content_with_cert_errors_status);
 }
 
-IN_PROC_BROWSER_TEST_F(ChromeSecurityStateModelClientTest,
+IN_PROC_BROWSER_TEST_F(SecurityStateTabHelperTest,
                        PassiveContentWithCertErrors) {
   ASSERT_TRUE(https_server_.Start());
   SetUpMockCertVerifierForHttpsServer(0, net::OK);
 
   // Navigate to an HTTPS page and simulate passive content with
   // certificate errors.
   ui_test_utils::NavigateToURL(browser(), https_server_.GetURL("/title1.html"));
   content::WebContents* web_contents =
       browser()->tab_strip_model()->GetActiveWebContents();
   ASSERT_TRUE(web_contents);
   content::NavigationEntry* entry =
       web_contents->GetController().GetVisibleEntry();
   ASSERT_TRUE(entry);
   entry->GetSSL().content_status |=
       content::SSLStatus::DISPLAYED_CONTENT_WITH_CERT_ERRORS;
 
-  ChromeSecurityStateModelClient* model_client =
-      ChromeSecurityStateModelClient::FromWebContents(web_contents);
-  ASSERT_TRUE(model_client);
-  SecurityStateModel::SecurityInfo security_info;
-  model_client->GetSecurityInfo(&security_info);
+  SecurityStateTabHelper* helper =
+      SecurityStateTabHelper::FromWebContents(web_contents);
+  ASSERT_TRUE(helper);
+  security_state::SecurityInfo security_info;
+  helper->GetSecurityInfo(&security_info);
 
   EXPECT_FALSE(net::IsCertStatusError(security_info.cert_status));
-  EXPECT_EQ(SecurityStateModel::NONE, security_info.security_level);
-  EXPECT_EQ(SecurityStateModel::CONTENT_STATUS_DISPLAYED,
+  EXPECT_EQ(security_state::NONE, security_info.security_level);
+  EXPECT_EQ(security_state::CONTENT_STATUS_DISPLAYED,
             security_info.content_with_cert_errors_status);
 }
 
-IN_PROC_BROWSER_TEST_F(ChromeSecurityStateModelClientTest,
+IN_PROC_BROWSER_TEST_F(SecurityStateTabHelperTest,
                        ActiveAndPassiveContentWithCertErrors) {
   ASSERT_TRUE(https_server_.Start());
   SetUpMockCertVerifierForHttpsServer(0, net::OK);
 
   // Navigate to an HTTPS page and simulate active and passive content
   // with certificate errors.
   ui_test_utils::NavigateToURL(browser(), https_server_.GetURL("/title1.html"));
   content::WebContents* web_contents =
       browser()->tab_strip_model()->GetActiveWebContents();
   ASSERT_TRUE(web_contents);
   content::NavigationEntry* entry =
       web_contents->GetController().GetVisibleEntry();
   ASSERT_TRUE(entry);
   entry->GetSSL().content_status |=
       content::SSLStatus::RAN_CONTENT_WITH_CERT_ERRORS;
   entry->GetSSL().content_status |=
       content::SSLStatus::DISPLAYED_CONTENT_WITH_CERT_ERRORS;
 
-  ChromeSecurityStateModelClient* model_client =
-      ChromeSecurityStateModelClient::FromWebContents(web_contents);
-  ASSERT_TRUE(model_client);
-  SecurityStateModel::SecurityInfo security_info;
-  model_client->GetSecurityInfo(&security_info);
+  SecurityStateTabHelper* helper =
+      SecurityStateTabHelper::FromWebContents(web_contents);
+  ASSERT_TRUE(helper);
+  security_state::SecurityInfo security_info;
+  helper->GetSecurityInfo(&security_info);
 
   EXPECT_FALSE(net::IsCertStatusError(security_info.cert_status));
-  EXPECT_EQ(SecurityStateModel::DANGEROUS, security_info.security_level);
-  EXPECT_EQ(SecurityStateModel::CONTENT_STATUS_DISPLAYED_AND_RAN,
+  EXPECT_EQ(security_state::DANGEROUS, security_info.security_level);
+  EXPECT_EQ(security_state::CONTENT_STATUS_DISPLAYED_AND_RAN,
             security_info.content_with_cert_errors_status);
 }
 
 // Same as the test above but with a long-lived SHA1 cert.
-IN_PROC_BROWSER_TEST_F(ChromeSecurityStateModelClientTest,
-                       MixedContentWithBrokenSHA1) {
+IN_PROC_BROWSER_TEST_F(SecurityStateTabHelperTest, MixedContentWithBrokenSHA1) {
   ASSERT_TRUE(embedded_test_server()->Start());
   ASSERT_TRUE(https_server_.Start());
   // The test server uses a long-lived cert by default, so a SHA1
   // signature in it will register as a "broken" condition rather than
   // "warning".
   SetUpMockCertVerifierForHttpsServer(net::CERT_STATUS_SHA1_SIGNATURE_PRESENT,
                                       net::OK);
 
   host_resolver()->AddRule("example.test",
                            https_server_.GetURL("/title1.html").host());
 
   net::HostPortPair replacement_pair = embedded_test_server()->host_port_pair();
   replacement_pair.set_host("example.test");
 
   // Navigate to an HTTPS page that displays mixed content.
   std::string replacement_path;
   GetFilePathWithHostAndPortReplacement(
-      "/ssl/page_displays_insecure_content.html",
-      replacement_pair, &replacement_path);
+      "/ssl/page_displays_insecure_content.html", replacement_pair,
+      &replacement_path);
   ui_test_utils::NavigateToURL(browser(),
                                https_server_.GetURL(replacement_path));
   CheckSecurityInfoForSecure(
       browser()->tab_strip_model()->GetActiveWebContents(),
-      SecurityStateModel::DANGEROUS, SecurityStateModel::DEPRECATED_SHA1_MAJOR,
-      SecurityStateModel::CONTENT_STATUS_DISPLAYED, false,
+      security_state::DANGEROUS, security_state::DEPRECATED_SHA1_MAJOR,
+      security_state::CONTENT_STATUS_DISPLAYED, false,
       false /* expect cert status error */);
 
   // Navigate to an HTTPS page that displays mixed content dynamically.
   GetFilePathWithHostAndPortReplacement(
-      "/ssl/page_with_dynamic_insecure_content.html",
-      replacement_pair, &replacement_path);
+      "/ssl/page_with_dynamic_insecure_content.html", replacement_pair,
+      &replacement_path);
   ui_test_utils::NavigateToURL(browser(),
                                https_server_.GetURL(replacement_path));
   CheckSecurityInfoForSecure(
       browser()->tab_strip_model()->GetActiveWebContents(),
-      SecurityStateModel::DANGEROUS, SecurityStateModel::DEPRECATED_SHA1_MAJOR,
-      SecurityStateModel::CONTENT_STATUS_NONE, false,
+      security_state::DANGEROUS, security_state::DEPRECATED_SHA1_MAJOR,
+      security_state::CONTENT_STATUS_NONE, false,
       false /* expect cert status error */);
   // Load the insecure image.
   bool js_result = false;
   EXPECT_TRUE(content::ExecuteScriptAndExtractBool(
       browser()->tab_strip_model()->GetActiveWebContents(), "loadBadImage();",
       &js_result));
   EXPECT_TRUE(js_result);
   CheckSecurityInfoForSecure(
       browser()->tab_strip_model()->GetActiveWebContents(),
-      SecurityStateModel::DANGEROUS, SecurityStateModel::DEPRECATED_SHA1_MAJOR,
-      SecurityStateModel::CONTENT_STATUS_DISPLAYED, false,
+      security_state::DANGEROUS, security_state::DEPRECATED_SHA1_MAJOR,
+      security_state::CONTENT_STATUS_DISPLAYED, false,
       false /* expect cert status error */);
 
   // Navigate to an HTTPS page that runs mixed content.
-  GetFilePathWithHostAndPortReplacement(
-      "/ssl/page_runs_insecure_content.html",
-      replacement_pair, &replacement_path);
+  GetFilePathWithHostAndPortReplacement("/ssl/page_runs_insecure_content.html",
+                                        replacement_pair, &replacement_path);
   ui_test_utils::NavigateToURL(browser(),
                                https_server_.GetURL(replacement_path));
   CheckSecurityInfoForSecure(
       browser()->tab_strip_model()->GetActiveWebContents(),
-      SecurityStateModel::DANGEROUS, SecurityStateModel::DEPRECATED_SHA1_MAJOR,
-      SecurityStateModel::CONTENT_STATUS_RAN, false,
+      security_state::DANGEROUS, security_state::DEPRECATED_SHA1_MAJOR,
+      security_state::CONTENT_STATUS_RAN, false,
       false /* expect cert status error */);
 
   // Navigate to an HTTPS page that runs and displays mixed content.
   GetFilePathWithHostAndPortReplacement(
-      "/ssl/page_runs_and_displays_insecure_content.html",
-      replacement_pair, &replacement_path);
+      "/ssl/page_runs_and_displays_insecure_content.html", replacement_pair,
+      &replacement_path);
   ui_test_utils::NavigateToURL(browser(),
                                https_server_.GetURL(replacement_path));
   CheckSecurityInfoForSecure(
       browser()->tab_strip_model()->GetActiveWebContents(),
-      SecurityStateModel::DANGEROUS, SecurityStateModel::DEPRECATED_SHA1_MAJOR,
-      SecurityStateModel::CONTENT_STATUS_DISPLAYED_AND_RAN, false,
+      security_state::DANGEROUS, security_state::DEPRECATED_SHA1_MAJOR,
+      security_state::CONTENT_STATUS_DISPLAYED_AND_RAN, false,
       false /* expect cert status error */);
 }
 
 // Tests that the Content Security Policy block-all-mixed-content
 // directive stops mixed content from running.
-IN_PROC_BROWSER_TEST_F(ChromeSecurityStateModelClientTest,
-                       MixedContentStrictBlocking) {
+IN_PROC_BROWSER_TEST_F(SecurityStateTabHelperTest, MixedContentStrictBlocking) {
   ASSERT_TRUE(https_server_.Start());
   SetUpMockCertVerifierForHttpsServer(0, net::OK);
 
   // Navigate to an HTTPS page that tries to run mixed content in an
   // iframe, with strict mixed content blocking.
   std::string replacement_path;
   net::HostPortPair host_port_pair =
       net::HostPortPair::FromURL(https_server_.GetURL("/title1.html"));
   host_port_pair.set_host("different-host.test");
   host_resolver()->AddRule("different-host.test",
                            https_server_.GetURL("/title1.html").host());
   GetFilePathWithHostAndPortReplacement(
       "/ssl/page_runs_insecure_content_in_iframe_with_strict_blocking.html",
       host_port_pair, &replacement_path);
   ui_test_utils::NavigateToURL(browser(),
                                https_server_.GetURL(replacement_path));
   CheckSecurityInfoForSecure(
       browser()->tab_strip_model()->GetActiveWebContents(),
-      SecurityStateModel::SECURE, SecurityStateModel::NO_DEPRECATED_SHA1,
-      SecurityStateModel::CONTENT_STATUS_NONE, false,
+      security_state::SECURE, security_state::NO_DEPRECATED_SHA1,
+      security_state::CONTENT_STATUS_NONE, false,
       false /* expect cert status error */);
 }
 
-IN_PROC_BROWSER_TEST_F(ChromeSecurityStateModelClientTest, BrokenHTTPS) {
+IN_PROC_BROWSER_TEST_F(SecurityStateTabHelperTest, BrokenHTTPS) {
   ASSERT_TRUE(embedded_test_server()->Start());
   ASSERT_TRUE(https_server_.Start());
   SetUpMockCertVerifierForHttpsServer(net::CERT_STATUS_DATE_INVALID,
                                       net::ERR_CERT_DATE_INVALID);
 
   ui_test_utils::NavigateToURL(browser(),
                                https_server_.GetURL("/ssl/google.html"));
   CheckSecurityInfoForSecure(
       browser()->tab_strip_model()->GetActiveWebContents(),
-      SecurityStateModel::DANGEROUS, SecurityStateModel::NO_DEPRECATED_SHA1,
-      SecurityStateModel::CONTENT_STATUS_NONE, false,
+      security_state::DANGEROUS, security_state::NO_DEPRECATED_SHA1,
+      security_state::CONTENT_STATUS_NONE, false,
       true /* expect cert status error */);
 
   ProceedThroughInterstitial(
       browser()->tab_strip_model()->GetActiveWebContents());
 
   CheckSecurityInfoForSecure(
       browser()->tab_strip_model()->GetActiveWebContents(),
-      SecurityStateModel::DANGEROUS, SecurityStateModel::NO_DEPRECATED_SHA1,
-      SecurityStateModel::CONTENT_STATUS_NONE, false,
+      security_state::DANGEROUS, security_state::NO_DEPRECATED_SHA1,
+      security_state::CONTENT_STATUS_NONE, false,
       true /* expect cert status error */);
 
   // Navigate to a broken HTTPS page that displays mixed content.
   std::string replacement_path;
   GetFilePathWithHostAndPortReplacement(
       "/ssl/page_displays_insecure_content.html",
       embedded_test_server()->host_port_pair(), &replacement_path);
   ui_test_utils::NavigateToURL(browser(),
                                https_server_.GetURL(replacement_path));
   CheckSecurityInfoForSecure(
       browser()->tab_strip_model()->GetActiveWebContents(),
-      SecurityStateModel::DANGEROUS, SecurityStateModel::NO_DEPRECATED_SHA1,
-      SecurityStateModel::CONTENT_STATUS_DISPLAYED, false,
+      security_state::DANGEROUS, security_state::NO_DEPRECATED_SHA1,
+      security_state::CONTENT_STATUS_DISPLAYED, false,
       true /* expect cert status error */);
 }
 
 const char kReportURI[] = "https://report-hpkp.test";
 
-class PKPModelClientTest : public ChromeSecurityStateModelClientTest {
+class PKPModelClientTest : public SecurityStateTabHelperTest {
  public:
   void SetUpOnMainThread() override {
     ASSERT_TRUE(https_server_.Start());
     url_request_context_getter_ = browser()->profile()->GetRequestContext();
     content::BrowserThread::PostTask(
         content::BrowserThread::IO, FROM_HERE,
         base::Bind(&PKPModelClientTest::SetUpOnIOThread,
                    base::Unretained(this)));
   }
 
@@ skipping 33 matching lines @@
   memset(hash.data(), 1, hash.size());
   verify_result.public_key_hashes.push_back(hash);
 
   mock_cert_verifier()->AddResultForCert(cert, verify_result, net::OK);
 
   ui_test_utils::NavigateToURL(browser(),
                                https_server_.GetURL("/ssl/google.html"));
 
   CheckSecurityInfoForSecure(
       browser()->tab_strip_model()->GetActiveWebContents(),
-      SecurityStateModel::SECURE, SecurityStateModel::NO_DEPRECATED_SHA1,
-      SecurityStateModel::CONTENT_STATUS_NONE, true, false);
+      security_state::SECURE, security_state::NO_DEPRECATED_SHA1,
+      security_state::CONTENT_STATUS_NONE, true, false);
 
   const content::SecurityStyleExplanations& explanation =
       observer.latest_explanations();
   EXPECT_TRUE(explanation.pkp_bypassed);
   EXPECT_FALSE(explanation.info_explanations.empty());
 }
 
 IN_PROC_BROWSER_TEST_F(PKPModelClientTest, PKPEnforced) {
   content::WebContents* web_contents =
       browser()->tab_strip_model()->GetActiveWebContents();
@@ skipping 35 matching lines @@
   DISALLOW_COPY_AND_ASSIGN(PendingJobInterceptor);
 };
 
 void InstallLoadingInterceptor(const std::string& host) {
   net::URLRequestFilter* filter = net::URLRequestFilter::GetInstance();
   filter->AddHostnameInterceptor(
       "http", host,
       std::unique_ptr<net::URLRequestInterceptor>(new PendingJobInterceptor()));
 }
 
-class SecurityStateModelLoadingTest
-    : public ChromeSecurityStateModelClientTest {
+class SecurityStateLoadingTest : public SecurityStateTabHelperTest {
  public:
-  SecurityStateModelLoadingTest() : ChromeSecurityStateModelClientTest() {}
-  ~SecurityStateModelLoadingTest() override{};
+  SecurityStateLoadingTest() : SecurityStateTabHelperTest() {}
+  ~SecurityStateLoadingTest() override{};
 
  protected:
   void SetUpOnMainThread() override {
     ASSERT_TRUE(embedded_test_server()->Start());
 
     content::BrowserThread::PostTask(
         content::BrowserThread::IO, FROM_HERE,
         base::Bind(&InstallLoadingInterceptor,
                    embedded_test_server()->GetURL("/title1.html").host()));
   }
 
-  DISALLOW_COPY_AND_ASSIGN(SecurityStateModelLoadingTest);
+  DISALLOW_COPY_AND_ASSIGN(SecurityStateLoadingTest);
 };
 
 // Tests that navigation state changes cause the security state to be
 // updated.
-IN_PROC_BROWSER_TEST_F(SecurityStateModelLoadingTest, NavigationStateChanges) {
+IN_PROC_BROWSER_TEST_F(SecurityStateLoadingTest, NavigationStateChanges) {
   ASSERT_TRUE(https_server_.Start());
   SetUpMockCertVerifierForHttpsServer(0, net::OK);
 
   // Navigate to an HTTPS page.
   ui_test_utils::NavigateToURL(browser(),
                                https_server_.GetURL("/ssl/google.html"));
   CheckSecurityInfoForSecure(
       browser()->tab_strip_model()->GetActiveWebContents(),
-      SecurityStateModel::SECURE, SecurityStateModel::NO_DEPRECATED_SHA1,
-      SecurityStateModel::CONTENT_STATUS_NONE, false,
+      security_state::SECURE, security_state::NO_DEPRECATED_SHA1,
+      security_state::CONTENT_STATUS_NONE, false,
       false /* expect cert status error */);
 
   // Navigate to a page that doesn't finish loading. Test that the
   // security state is neutral while the page is loading.
   browser()->OpenURL(content::OpenURLParams(
       embedded_test_server()->GetURL("/title1.html"), content::Referrer(),
       WindowOpenDisposition::CURRENT_TAB, ui::PAGE_TRANSITION_TYPED, false));
   CheckSecurityInfoForNonSecure(
       browser()->tab_strip_model()->GetActiveWebContents());
 }
 
-// Tests that the NavigationEntry's flags for nonsecure password/credit
-// card inputs are reflected in the VisibleSecurityState.
-IN_PROC_BROWSER_TEST_F(ChromeSecurityStateModelClientTest,
-                       VisibleSecurityStateNonsecureFormInputs) {
-  ASSERT_TRUE(https_server_.Start());
-  ui_test_utils::NavigateToURL(browser(),
-                               https_server_.GetURL("/ssl/google.html"));
-
-  content::WebContents* contents =
-      browser()->tab_strip_model()->GetActiveWebContents();
-  ASSERT_TRUE(contents);
-
-  ChromeSecurityStateModelClient* model_client =
-      ChromeSecurityStateModelClient::FromWebContents(contents);
-  ASSERT_TRUE(model_client);
-
-  // First, test that if the flags aren't set on the NavigationEntry,
-  // then they also aren't set on the VisibleSecurityState.
-  content::SSLStatus& ssl_status =
-      contents->GetController().GetVisibleEntry()->GetSSL();
-  ASSERT_FALSE(ssl_status.content_status &
-               content::SSLStatus::DISPLAYED_PASSWORD_FIELD_ON_HTTP);
-  ASSERT_FALSE(ssl_status.content_status &
-               content::SSLStatus::DISPLAYED_CREDIT_CARD_FIELD_ON_HTTP);
-  SecurityStateModel::VisibleSecurityState
-      visible_security_state_no_sensitive_inputs;
-  model_client->GetVisibleSecurityState(
-      &visible_security_state_no_sensitive_inputs);
-  EXPECT_FALSE(visible_security_state_no_sensitive_inputs
-                   .displayed_password_field_on_http);
-  EXPECT_FALSE(visible_security_state_no_sensitive_inputs
-                   .displayed_credit_card_field_on_http);
-
-  // Now, set the flags on the NavigationEntry and test that they are
-  // reflected in the VisibleSecurityState.
-  ssl_status.content_status |=
-      content::SSLStatus::DISPLAYED_PASSWORD_FIELD_ON_HTTP;
-  ssl_status.content_status |=
-      content::SSLStatus::DISPLAYED_CREDIT_CARD_FIELD_ON_HTTP;
-  SecurityStateModel::VisibleSecurityState
-      visible_security_state_sensitive_inputs;
-  model_client->GetVisibleSecurityState(
-      &visible_security_state_sensitive_inputs);
-  EXPECT_TRUE(
-      visible_security_state_sensitive_inputs.displayed_password_field_on_http);
-  EXPECT_TRUE(visible_security_state_sensitive_inputs
-                  .displayed_credit_card_field_on_http);
-}
-
 // Tests that when a visible password field is detected on an HTTP page
 // load, and when the command-line flag is set, the security level is
 // downgraded to HTTP_SHOW_WARNING.
-IN_PROC_BROWSER_TEST_P(ChromeSecurityStateModelClientTestWithPasswordCcSwitch,
+IN_PROC_BROWSER_TEST_P(SecurityStateTabHelperTestWithPasswordCcSwitch,
                        PasswordSecurityLevelDowngraded) {
   content::WebContents* contents =
       browser()->tab_strip_model()->GetActiveWebContents();
   ASSERT_TRUE(contents);
 
-  ChromeSecurityStateModelClient* model_client =
-      ChromeSecurityStateModelClient::FromWebContents(contents);
-  ASSERT_TRUE(model_client);
+  SecurityStateTabHelper* helper =
+      SecurityStateTabHelper::FromWebContents(contents);
+  ASSERT_TRUE(helper);
 
   ui_test_utils::NavigateToURL(
       browser(), GetURLWithNonLocalHostname(embedded_test_server(),
                                             "/password/simple_password.html"));
-  security_state::SecurityStateModel::SecurityInfo security_info;
-  model_client->GetSecurityInfo(&security_info);
-  EXPECT_EQ(security_state::SecurityStateModel::HTTP_SHOW_WARNING,
-            security_info.security_level);
+  security_state::SecurityInfo security_info;
+  helper->GetSecurityInfo(&security_info);
+  EXPECT_EQ(security_state::HTTP_SHOW_WARNING, security_info.security_level);
 
   content::NavigationEntry* entry = contents->GetController().GetVisibleEntry();
   ASSERT_TRUE(entry);
   EXPECT_TRUE(entry->GetSSL().content_status &
               content::SSLStatus::DISPLAYED_PASSWORD_FIELD_ON_HTTP);
 }
 
 // Tests that when an invisible password field is present on an HTTP page
 // load, and when the command-line flag is set, the security level is
 // *not* downgraded to HTTP_SHOW_WARNING.
-IN_PROC_BROWSER_TEST_P(ChromeSecurityStateModelClientTestWithPasswordCcSwitch,
+IN_PROC_BROWSER_TEST_P(SecurityStateTabHelperTestWithPasswordCcSwitch,
                        PasswordSecurityLevelNotDowngradedForInvisibleInput) {
   content::WebContents* contents =
       browser()->tab_strip_model()->GetActiveWebContents();
   ASSERT_TRUE(contents);
 
-  ChromeSecurityStateModelClient* model_client =
-      ChromeSecurityStateModelClient::FromWebContents(contents);
-  ASSERT_TRUE(model_client);
+  SecurityStateTabHelper* helper =
+      SecurityStateTabHelper::FromWebContents(contents);
+  ASSERT_TRUE(helper);
 
   ui_test_utils::NavigateToURL(
       browser(),
       GetURLWithNonLocalHostname(embedded_test_server(),
                                  "/password/invisible_password.html"));
-  security_state::SecurityStateModel::SecurityInfo security_info;
-  model_client->GetSecurityInfo(&security_info);
-  EXPECT_EQ(security_state::SecurityStateModel::NONE,
-            security_info.security_level);
+  security_state::SecurityInfo security_info;
+  helper->GetSecurityInfo(&security_info);
+  EXPECT_EQ(security_state::NONE, security_info.security_level);
 
   content::NavigationEntry* entry = contents->GetController().GetVisibleEntry();
   ASSERT_TRUE(entry);
   EXPECT_FALSE(entry->GetSSL().content_status &
                content::SSLStatus::DISPLAYED_PASSWORD_FIELD_ON_HTTP);
 }
 
 // Tests that when a visible password field is detected inside an iframe
 // on an HTTP page load, and when the command-line flag is set, the
 // security level is downgraded to HTTP_SHOW_WARNING.
-IN_PROC_BROWSER_TEST_P(ChromeSecurityStateModelClientTestWithPasswordCcSwitch,
+IN_PROC_BROWSER_TEST_P(SecurityStateTabHelperTestWithPasswordCcSwitch,
                        PasswordSecurityLevelDowngradedFromIframe) {
   content::WebContents* contents =
       browser()->tab_strip_model()->GetActiveWebContents();
   ASSERT_TRUE(contents);
 
-  ChromeSecurityStateModelClient* model_client =
-      ChromeSecurityStateModelClient::FromWebContents(contents);
-  ASSERT_TRUE(model_client);
+  SecurityStateTabHelper* helper =
+      SecurityStateTabHelper::FromWebContents(contents);
+  ASSERT_TRUE(helper);
 
   ui_test_utils::NavigateToURL(
       browser(),
       GetURLWithNonLocalHostname(embedded_test_server(),
                                  "/password/simple_password_in_iframe.html"));
-  security_state::SecurityStateModel::SecurityInfo security_info;
-  model_client->GetSecurityInfo(&security_info);
-  EXPECT_EQ(security_state::SecurityStateModel::HTTP_SHOW_WARNING,
-            security_info.security_level);
+  security_state::SecurityInfo security_info;
+  helper->GetSecurityInfo(&security_info);
+  EXPECT_EQ(security_state::HTTP_SHOW_WARNING, security_info.security_level);
 
   content::NavigationEntry* entry = contents->GetController().GetVisibleEntry();
   ASSERT_TRUE(entry);
   EXPECT_TRUE(entry->GetSSL().content_status &
               content::SSLStatus::DISPLAYED_PASSWORD_FIELD_ON_HTTP);
 }
 
 // Tests that when a visible password field is detected inside an iframe
 // on an HTTP page load, and when the command-line flag is set, the
 // security level is downgraded to HTTP_SHOW_WARNING, even if the iframe
 // itself was loaded over HTTPS.
 #if defined(OS_LINUX)
 // Flaky on Linux. See https://crbug.com/662485.
 #define MAYBE_PasswordSecurityLevelDowngradedFromHttpsIframe \
   DISABLED_PasswordSecurityLevelDowngradedFromHttpsIframe
 #else
 #define MAYBE_PasswordSecurityLevelDowngradedFromHttpsIframe \
   PasswordSecurityLevelDowngradedFromHttpsIframe
 #endif
-IN_PROC_BROWSER_TEST_P(ChromeSecurityStateModelClientTestWithPasswordCcSwitch,
+IN_PROC_BROWSER_TEST_P(SecurityStateTabHelperTestWithPasswordCcSwitch,
                        MAYBE_PasswordSecurityLevelDowngradedFromHttpsIframe) {
   content::WebContents* contents =
       browser()->tab_strip_model()->GetActiveWebContents();
   ASSERT_TRUE(contents);
 
-  ChromeSecurityStateModelClient* model_client =
-      ChromeSecurityStateModelClient::FromWebContents(contents);
-  ASSERT_TRUE(model_client);
+  SecurityStateTabHelper* helper =
+      SecurityStateTabHelper::FromWebContents(contents);
+  ASSERT_TRUE(helper);
 
   // Navigate to an HTTP URL, which loads an iframe using the host and port of
   // |https_server_|.
   std::string replacement_path;
   GetFilePathWithHostAndPortReplacement(
       "/password/simple_password_in_https_iframe.html",
       https_server_.host_port_pair(), &replacement_path);
   ui_test_utils::NavigateToURL(
       browser(),
       GetURLWithNonLocalHostname(embedded_test_server(), replacement_path));
-  security_state::SecurityStateModel::SecurityInfo security_info;
-  model_client->GetSecurityInfo(&security_info);
-  EXPECT_EQ(security_state::SecurityStateModel::HTTP_SHOW_WARNING,
-            security_info.security_level);
+  security_state::SecurityInfo security_info;
+  helper->GetSecurityInfo(&security_info);
+  EXPECT_EQ(security_state::HTTP_SHOW_WARNING, security_info.security_level);
 
   content::NavigationEntry* entry = contents->GetController().GetVisibleEntry();
   ASSERT_TRUE(entry);
   EXPECT_TRUE(entry->GetSSL().content_status &
               content::SSLStatus::DISPLAYED_PASSWORD_FIELD_ON_HTTP);
 }
 
 // Tests that when a visible password field is detected on an HTTP page
 // load, and when the command-line flag is *not* set, the security level is
 // *not* downgraded to HTTP_SHOW_WARNING.
-IN_PROC_BROWSER_TEST_F(ChromeSecurityStateModelClientTest,
+IN_PROC_BROWSER_TEST_F(SecurityStateTabHelperTest,
                        PasswordSecurityLevelNotDowngradedWithoutSwitch) {
   ASSERT_TRUE(embedded_test_server()->Start());
   host_resolver()->AddRule("*", embedded_test_server()->GetURL("/").host());
 
   content::WebContents* contents =
       browser()->tab_strip_model()->GetActiveWebContents();
   ASSERT_TRUE(contents);
 
-  ChromeSecurityStateModelClient* model_client =
-      ChromeSecurityStateModelClient::FromWebContents(contents);
-  ASSERT_TRUE(model_client);
+  SecurityStateTabHelper* helper =
+      SecurityStateTabHelper::FromWebContents(contents);
+  ASSERT_TRUE(helper);
 
   ui_test_utils::NavigateToURL(
       browser(), GetURLWithNonLocalHostname(embedded_test_server(),
                                             "/password/simple_password.html"));
   // The security level should not be HTTP_SHOW_WARNING, because the
   // command-line switch was not set.
-  security_state::SecurityStateModel::SecurityInfo security_info;
-  model_client->GetSecurityInfo(&security_info);
-  EXPECT_EQ(security_state::SecurityStateModel::NONE,
-            security_info.security_level);
+  security_state::SecurityInfo security_info;
+  helper->GetSecurityInfo(&security_info);
+  EXPECT_EQ(security_state::NONE, security_info.security_level);
 
   // The appropriate SSLStatus flags should be set, however.
   content::NavigationEntry* entry = contents->GetController().GetVisibleEntry();
   ASSERT_TRUE(entry);
   EXPECT_TRUE(entry->GetSSL().content_status &
               content::SSLStatus::DISPLAYED_PASSWORD_FIELD_ON_HTTP);
 }
 
 // Tests that when a visible password field is detected on an HTTPS page
 // load, and when the command-line flag is set, the security level is
 // *not* downgraded to HTTP_SHOW_WARNING.
-IN_PROC_BROWSER_TEST_P(ChromeSecurityStateModelClientTestWithPasswordCcSwitch,
+IN_PROC_BROWSER_TEST_P(SecurityStateTabHelperTestWithPasswordCcSwitch,
                        PasswordSecurityLevelNotDowngradedOnHttps) {
   content::WebContents* contents =
       browser()->tab_strip_model()->GetActiveWebContents();
   ASSERT_TRUE(contents);
 
-  ChromeSecurityStateModelClient* model_client =
-      ChromeSecurityStateModelClient::FromWebContents(contents);
-  ASSERT_TRUE(model_client);
+  SecurityStateTabHelper* helper =
+      SecurityStateTabHelper::FromWebContents(contents);
+  ASSERT_TRUE(helper);
 
   GURL url = GetURLWithNonLocalHostname(&https_server_,
                                         "/password/simple_password.html");
   ui_test_utils::NavigateToURL(browser(), url);
   // The security level should not be HTTP_SHOW_WARNING, because the page was
   // HTTPS instead of HTTP.
-  security_state::SecurityStateModel::SecurityInfo security_info;
-  model_client->GetSecurityInfo(&security_info);
-  EXPECT_EQ(security_state::SecurityStateModel::SECURE,
-            security_info.security_level);
+  security_state::SecurityInfo security_info;
+  helper->GetSecurityInfo(&security_info);
+  EXPECT_EQ(security_state::SECURE, security_info.security_level);
 
   // The SSLStatus flags should only be set if the top-level page load was HTTP,
   // which it was not in this case.
   content::NavigationEntry* entry = contents->GetController().GetVisibleEntry();
   ASSERT_TRUE(entry);
   EXPECT_FALSE(entry->GetSSL().content_status &
                content::SSLStatus::DISPLAYED_PASSWORD_FIELD_ON_HTTP);
 }
 
 // A Browser subclass that keeps track of messages that have been
@@ skipping 57 matching lines @@
     ConsoleWebContentsDelegate* delegate) {
   const std::vector<base::string16>& messages = delegate->console_messages();
   ASSERT_EQ(1u, messages.size());
   EXPECT_NE(base::string16::npos,
             messages[0].find(base::ASCIIToUTF16("warning will be added")));
 }
 
 // Tests that console messages are printed upon a call to
 // GetSecurityInfo() on an HTTP_SHOW_WARNING page, exactly once per
 // main-frame navigation.
-IN_PROC_BROWSER_TEST_P(ChromeSecurityStateModelClientTestWithPasswordCcSwitch,
+IN_PROC_BROWSER_TEST_P(SecurityStateTabHelperTestWithPasswordCcSwitch,
                        ConsoleMessage) {
   ConsoleWebContentsDelegate* delegate = new ConsoleWebContentsDelegate(
       Browser::CreateParams(browser()->profile()));
   content::WebContents* original_contents =
       browser()->tab_strip_model()->GetActiveWebContents();
   content::WebContents* contents =
       content::WebContents::Create(content::WebContents::CreateParams(
           original_contents->GetBrowserContext()));
   ASSERT_TRUE(contents);
   contents->SetDelegate(delegate);
@@ skipping 12 matching lines @@
   EXPECT_EQ(http_url, entry->GetURL());
   EXPECT_TRUE(delegate->console_messages().empty());
 
   // Trigger the HTTP_SHOW_WARNING state.
   base::RunLoop first_message;
   delegate->set_console_message_callback(first_message.QuitClosure());
   contents->OnPasswordInputShownOnHttp();
   first_message.Run();
 
   // Check that the HTTP_SHOW_WARNING state was actually triggered.
-  ChromeSecurityStateModelClient* client =
-      ChromeSecurityStateModelClient::FromWebContents(contents);
-  ASSERT_TRUE(client);
-  security_state::SecurityStateModel::SecurityInfo security_info;
-  client->GetSecurityInfo(&security_info);
-  EXPECT_EQ(security_state::SecurityStateModel::HTTP_SHOW_WARNING,
-            security_info.security_level);
+  SecurityStateTabHelper* helper =
+      SecurityStateTabHelper::FromWebContents(contents);
+  ASSERT_TRUE(helper);
+  security_state::SecurityInfo security_info;
+  helper->GetSecurityInfo(&security_info);
+  EXPECT_EQ(security_state::HTTP_SHOW_WARNING, security_info.security_level);
 
   // Check that the expected console message is present.
   ASSERT_NO_FATAL_FAILURE(CheckForOneHttpWarningConsoleMessage(delegate));
   delegate->ClearConsoleMessages();
 
   // Two subsequent triggers of VisibleSecurityStateChanged -- one on the
   // same navigation and one on another navigation -- should only result
   // in one additional console message.
   contents->OnCreditCardInputShownOnHttp();
   GURL second_http_url =
       GetURLWithNonLocalHostname(embedded_test_server(), "/title2.html");
   ui_test_utils::NavigateToURL(delegate, second_http_url);
   entry = contents->GetController().GetVisibleEntry();
   ASSERT_TRUE(entry);
   EXPECT_EQ(second_http_url, entry->GetURL());
 
   base::RunLoop second_message;
   delegate->set_console_message_callback(second_message.QuitClosure());
   contents->OnPasswordInputShownOnHttp();
   second_message.Run();
 
-  client->GetSecurityInfo(&security_info);
-  EXPECT_EQ(security_state::SecurityStateModel::HTTP_SHOW_WARNING,
-            security_info.security_level);
+  helper->GetSecurityInfo(&security_info);
+  EXPECT_EQ(security_state::HTTP_SHOW_WARNING, security_info.security_level);
 
   ASSERT_NO_FATAL_FAILURE(CheckForOneHttpWarningConsoleMessage(delegate));
 }
 
 // Tests that console messages are printed upon a call to
 // GetSecurityInfo() on a NONE page that will be marked
 // HTTP_SHOW_WARNING in future, exactly once per main-frame navigation.
-IN_PROC_BROWSER_TEST_F(ChromeSecurityStateModelClientTest, ConsoleMessage) {
+IN_PROC_BROWSER_TEST_F(SecurityStateTabHelperTest, ConsoleMessage) {
   ASSERT_TRUE(embedded_test_server()->Start());
   host_resolver()->AddRule("*", embedded_test_server()->GetURL("/").host());
   ConsoleWebContentsDelegate* delegate = new ConsoleWebContentsDelegate(
       Browser::CreateParams(browser()->profile()));
   content::WebContents* original_contents =
       browser()->tab_strip_model()->GetActiveWebContents();
   content::WebContents* contents =
       content::WebContents::Create(content::WebContents::CreateParams(
           original_contents->GetBrowserContext()));
   ASSERT_TRUE(contents);
@@ skipping 13 matching lines @@
   EXPECT_EQ(http_url, entry->GetURL());
   EXPECT_TRUE(delegate->console_messages().empty());
 
   // Trigger the a state that will be marked as HTTP_SHOW_WARNING in future.
   base::RunLoop first_message;
   delegate->set_console_message_callback(first_message.QuitClosure());
   contents->OnPasswordInputShownOnHttp();
   first_message.Run();
 
   // Check that the correct state was actually triggered.
-  ChromeSecurityStateModelClient* client =
-      ChromeSecurityStateModelClient::FromWebContents(contents);
-  ASSERT_TRUE(client);
-  security_state::SecurityStateModel::SecurityInfo security_info;
-  client->GetSecurityInfo(&security_info);
-  EXPECT_EQ(security_state::SecurityStateModel::NONE,
-            security_info.security_level);
+  SecurityStateTabHelper* helper =
+      SecurityStateTabHelper::FromWebContents(contents);
+  ASSERT_TRUE(helper);
+  security_state::SecurityInfo security_info;
+  helper->GetSecurityInfo(&security_info);
+  EXPECT_EQ(security_state::NONE, security_info.security_level);
   EXPECT_TRUE(security_info.displayed_password_field_on_http);
 
   // Check that the expected console message is present.
   ASSERT_NO_FATAL_FAILURE(CheckForOneFutureHttpWarningConsoleMessage(delegate));
   delegate->ClearConsoleMessages();
 
   // Two subsequent triggers of VisibleSecurityStateChanged -- one on the
   // same navigation and one on another navigation -- should only result
   // in one additional console message.
   contents->OnCreditCardInputShownOnHttp();
   GURL second_http_url =
       GetURLWithNonLocalHostname(embedded_test_server(), "/title2.html");
   ui_test_utils::NavigateToURL(delegate, second_http_url);
   entry = contents->GetController().GetVisibleEntry();
   ASSERT_TRUE(entry);
   EXPECT_EQ(second_http_url, entry->GetURL());
 
   base::RunLoop second_message;
   delegate->set_console_message_callback(second_message.QuitClosure());
   contents->OnPasswordInputShownOnHttp();
   second_message.Run();
 
-  client->GetSecurityInfo(&security_info);
-  EXPECT_EQ(security_state::SecurityStateModel::NONE,
-            security_info.security_level);
+  helper->GetSecurityInfo(&security_info);
+  EXPECT_EQ(security_state::NONE, security_info.security_level);
   EXPECT_TRUE(security_info.displayed_password_field_on_http);
   EXPECT_FALSE(security_info.displayed_credit_card_field_on_http);
 
   ASSERT_NO_FATAL_FAILURE(CheckForOneFutureHttpWarningConsoleMessage(delegate));
   delegate->ClearConsoleMessages();
 
   // Check that a console message is printed for credit card field shown.
   ui_test_utils::NavigateToURL(delegate, http_url);
   entry = contents->GetController().GetVisibleEntry();
   ASSERT_TRUE(entry);
   EXPECT_EQ(http_url, entry->GetURL());
 
   base::RunLoop third_message;
   delegate->set_console_message_callback(third_message.QuitClosure());
   contents->OnCreditCardInputShownOnHttp();
   third_message.Run();
 
-  client->GetSecurityInfo(&security_info);
-  EXPECT_EQ(security_state::SecurityStateModel::NONE,
-            security_info.security_level);
+  helper->GetSecurityInfo(&security_info);
+  EXPECT_EQ(security_state::NONE, security_info.security_level);
   EXPECT_TRUE(security_info.displayed_credit_card_field_on_http);
 
   ASSERT_NO_FATAL_FAILURE(CheckForOneFutureHttpWarningConsoleMessage(delegate));
 }
 
 // Tests that additional HTTP_SHOW_WARNING console messages are not
 // printed after subframe navigations.
-IN_PROC_BROWSER_TEST_P(ChromeSecurityStateModelClientTestWithPasswordCcSwitch,
+IN_PROC_BROWSER_TEST_P(SecurityStateTabHelperTestWithPasswordCcSwitch,
                        ConsoleMessageNotPrintedForFrameNavigation) {
   ConsoleWebContentsDelegate* delegate = new ConsoleWebContentsDelegate(
       Browser::CreateParams(browser()->profile()));
   content::WebContents* original_contents =
       browser()->tab_strip_model()->GetActiveWebContents();
   content::WebContents* contents =
       content::WebContents::Create(content::WebContents::CreateParams(
           original_contents->GetBrowserContext()));
   ASSERT_TRUE(contents);
   contents->SetDelegate(delegate);
@@ skipping 12 matching lines @@
   EXPECT_EQ(http_url, entry->GetURL());
   EXPECT_TRUE(delegate->console_messages().empty());
 
   // Trigger the HTTP_SHOW_WARNING state.
   base::RunLoop first_message;
   delegate->set_console_message_callback(first_message.QuitClosure());
   contents->OnPasswordInputShownOnHttp();
   first_message.Run();
 
   // Check that the HTTP_SHOW_WARNING state was actually triggered.
-  ChromeSecurityStateModelClient* client =
-      ChromeSecurityStateModelClient::FromWebContents(contents);
-  ASSERT_TRUE(client);
-  security_state::SecurityStateModel::SecurityInfo security_info;
-  client->GetSecurityInfo(&security_info);
-  EXPECT_EQ(security_state::SecurityStateModel::HTTP_SHOW_WARNING,
-            security_info.security_level);
+  SecurityStateTabHelper* helper =
+      SecurityStateTabHelper::FromWebContents(contents);
+  ASSERT_TRUE(helper);
+  security_state::SecurityInfo security_info;
+  helper->GetSecurityInfo(&security_info);
+  EXPECT_EQ(security_state::HTTP_SHOW_WARNING, security_info.security_level);
 
   // Check that the expected console message is present.
   ASSERT_NO_FATAL_FAILURE(CheckForOneHttpWarningConsoleMessage(delegate));
   delegate->ClearConsoleMessages();
 
   // Navigate the subframe and trigger VisibleSecurityStateChanged
   // again. While the security level is still HTTP_SHOW_WARNING, an
   // additional console message should not be logged because there was
   // already a console message logged for the current main-frame
   // navigation.
   content::WindowedNotificationObserver subframe_observer(
       content::NOTIFICATION_LOAD_STOP,
       content::Source<content::NavigationController>(
           &contents->GetController()));
   EXPECT_TRUE(content::ExecuteScript(
       contents, "document.getElementById('navFrame').src = '/title2.html';"));
   subframe_observer.Wait();
   contents->OnCreditCardInputShownOnHttp();
-  EXPECT_EQ(security_state::SecurityStateModel::HTTP_SHOW_WARNING,
-            security_info.security_level);
+  EXPECT_EQ(security_state::HTTP_SHOW_WARNING, security_info.security_level);
 
   // Do a main frame navigation and then trigger HTTP_SHOW_WARNING
   // again. From the above subframe navigation and this main-frame
   // navigation, exactly one console message is expected.
   GURL second_http_url =
       GetURLWithNonLocalHostname(embedded_test_server(), "/title2.html");
   ui_test_utils::NavigateToURL(delegate, second_http_url);
   entry = contents->GetController().GetVisibleEntry();
   ASSERT_TRUE(entry);
   EXPECT_EQ(second_http_url, entry->GetURL());
 
   base::RunLoop second_message;
   delegate->set_console_message_callback(second_message.QuitClosure());
   contents->OnPasswordInputShownOnHttp();
   second_message.Run();
 
-  client->GetSecurityInfo(&security_info);
-  EXPECT_EQ(security_state::SecurityStateModel::HTTP_SHOW_WARNING,
-            security_info.security_level);
+  helper->GetSecurityInfo(&security_info);
+  EXPECT_EQ(security_state::HTTP_SHOW_WARNING, security_info.security_level);
   ASSERT_NO_FATAL_FAILURE(CheckForOneHttpWarningConsoleMessage(delegate));
 }
 
 // Tests that additional HTTP_SHOW_WARNING console messages are not
 // printed after pushState navigations.
-IN_PROC_BROWSER_TEST_P(ChromeSecurityStateModelClientTestWithPasswordCcSwitch,
+IN_PROC_BROWSER_TEST_P(SecurityStateTabHelperTestWithPasswordCcSwitch,
                        ConsoleMessageNotPrintedForPushStateNavigation) {
   ConsoleWebContentsDelegate* delegate = new ConsoleWebContentsDelegate(
       Browser::CreateParams(browser()->profile()));
   content::WebContents* original_contents =
       browser()->tab_strip_model()->GetActiveWebContents();
   content::WebContents* contents =
       content::WebContents::Create(content::WebContents::CreateParams(
           original_contents->GetBrowserContext()));
   ASSERT_TRUE(contents);
   contents->SetDelegate(delegate);
@@ skipping 12 matching lines @@
   EXPECT_EQ(http_url, entry->GetURL());
   EXPECT_TRUE(delegate->console_messages().empty());
 
   // Trigger the HTTP_SHOW_WARNING state.
   base::RunLoop first_message;
   delegate->set_console_message_callback(first_message.QuitClosure());
   contents->OnPasswordInputShownOnHttp();
   first_message.Run();
 
   // Check that the HTTP_SHOW_WARNING state was actually triggered.
-  ChromeSecurityStateModelClient* client =
-      ChromeSecurityStateModelClient::FromWebContents(contents);
-  ASSERT_TRUE(client);
-  security_state::SecurityStateModel::SecurityInfo security_info;
-  client->GetSecurityInfo(&security_info);
-  EXPECT_EQ(security_state::SecurityStateModel::HTTP_SHOW_WARNING,
-            security_info.security_level);
+  SecurityStateTabHelper* helper =
+      SecurityStateTabHelper::FromWebContents(contents);
+  ASSERT_TRUE(helper);
+  security_state::SecurityInfo security_info;
+  helper->GetSecurityInfo(&security_info);
+  EXPECT_EQ(security_state::HTTP_SHOW_WARNING, security_info.security_level);
 
   // Check that the expected console message is present.
   ASSERT_NO_FATAL_FAILURE(CheckForOneHttpWarningConsoleMessage(delegate));
   delegate->ClearConsoleMessages();
 
   // Navigate with pushState and trigger VisibleSecurityStateChanged
   // again. While the security level is still HTTP_SHOW_WARNING, an
   // additional console message should not be logged because there was
   // already a console message logged for the current main-frame
   // navigation.
   EXPECT_TRUE(content::ExecuteScript(
       contents, "history.pushState({ foo: 'bar' }, 'foo', 'bar');"));
   contents->OnCreditCardInputShownOnHttp();
-  EXPECT_EQ(security_state::SecurityStateModel::HTTP_SHOW_WARNING,
-            security_info.security_level);
+  EXPECT_EQ(security_state::HTTP_SHOW_WARNING, security_info.security_level);
 
   // Do a main frame navigation and then trigger HTTP_SHOW_WARNING
   // again. From the above pushState navigation and this main-frame
   // navigation, exactly one console message is expected.
   GURL second_http_url =
       GetURLWithNonLocalHostname(embedded_test_server(), "/title2.html");
   ui_test_utils::NavigateToURL(delegate, second_http_url);
   entry = contents->GetController().GetVisibleEntry();
   ASSERT_TRUE(entry);
   EXPECT_EQ(second_http_url, entry->GetURL());
 
   base::RunLoop second_message;
   delegate->set_console_message_callback(second_message.QuitClosure());
   contents->OnPasswordInputShownOnHttp();
   second_message.Run();
 
-  client->GetSecurityInfo(&security_info);
-  EXPECT_EQ(security_state::SecurityStateModel::HTTP_SHOW_WARNING,
-            security_info.security_level);
+  helper->GetSecurityInfo(&security_info);
+  EXPECT_EQ(security_state::HTTP_SHOW_WARNING, security_info.security_level);
   ASSERT_NO_FATAL_FAILURE(CheckForOneHttpWarningConsoleMessage(delegate));
 }
 
-INSTANTIATE_TEST_CASE_P(ChromeSecurityStateModelClientTestWithPasswordCcSwitch,
-                        ChromeSecurityStateModelClientTestWithPasswordCcSwitch,
+INSTANTIATE_TEST_CASE_P(SecurityStateTabHelperTestWithPasswordCcSwitch,
+                        SecurityStateTabHelperTestWithPasswordCcSwitch,
                         // Here 'true' means that the omnibox warning + form
                         // warning are enabled, and 'false' means just the
                         // omnibox warning is enabled.
                         testing::Bool());
 
-// Tests that the SecurityStateModel for a WebContents is up to date
-// when the WebContents is inserted into a Browser's TabStripModel.
-IN_PROC_BROWSER_TEST_F(ChromeSecurityStateModelClientTest, AddedTab) {
+// Tests that the security state for a WebContents is up to date when the
+// WebContents is inserted into a Browser's TabStripModel.
+IN_PROC_BROWSER_TEST_F(SecurityStateTabHelperTest, AddedTab) {
   ASSERT_TRUE(https_server_.Start());
   SetUpMockCertVerifierForHttpsServer(0, net::OK);
 
   content::WebContents* tab =
       browser()->tab_strip_model()->GetActiveWebContents();
   ASSERT_TRUE(tab);
 
   content::WebContents* new_contents = content::WebContents::Create(
       content::WebContents::CreateParams(tab->GetBrowserContext()));
   content::NavigationController& controller = new_contents->GetController();
-  ChromeSecurityStateModelClient::CreateForWebContents(new_contents);
+  SecurityStateTabHelper::CreateForWebContents(new_contents);
   CheckSecurityInfoForNonSecure(new_contents);
   controller.LoadURL(https_server_.GetURL("/title1.html"), content::Referrer(),
                      ui::PAGE_TRANSITION_TYPED, std::string());
   EXPECT_TRUE(content::WaitForLoadStop(new_contents));
-  CheckSecurityInfoForSecure(new_contents, SecurityStateModel::SECURE,
-                             SecurityStateModel::NO_DEPRECATED_SHA1,
-                             SecurityStateModel::CONTENT_STATUS_NONE, false,
+  CheckSecurityInfoForSecure(new_contents, security_state::SECURE,
+                             security_state::NO_DEPRECATED_SHA1,
+                             security_state::CONTENT_STATUS_NONE, false,
                              false /* expect cert status error */);
 
   browser()->tab_strip_model()->InsertWebContentsAt(0, new_contents,
                                                     TabStripModel::ADD_NONE);
-  CheckSecurityInfoForSecure(new_contents, SecurityStateModel::SECURE,
-                             SecurityStateModel::NO_DEPRECATED_SHA1,
-                             SecurityStateModel::CONTENT_STATUS_NONE, false,
+  CheckSecurityInfoForSecure(new_contents, security_state::SECURE,
+                             security_state::NO_DEPRECATED_SHA1,
+                             security_state::CONTENT_STATUS_NONE, false,
                              false /* expect cert status error */);
 }
 
 // Tests that the WebContentsObserver::SecurityStyleChanged event fires
 // with the current style on HTTP, broken HTTPS, and valid HTTPS pages.
 IN_PROC_BROWSER_TEST_F(SecurityStyleChangedTest, SecurityStyleChangedObserver) {
   ASSERT_TRUE(https_server_.Start());
   ASSERT_TRUE(embedded_test_server()->Start());
 
   net::EmbeddedTestServer https_test_server_expired(
@@ skipping 499 matching lines @@
 // connection, the SCTs verification statuses are exposed on the
 // SecurityInfo.
 IN_PROC_BROWSER_TEST_F(BrowserTestURLRequestWithSCTs,
                        SecurityInfoWithSCTsAttached) {
   ui_test_utils::NavigateToURL(
       browser(), GURL(std::string("https://") + kMockHostnameWithSCTs));
 
   content::WebContents* web_contents =
       browser()->tab_strip_model()->GetActiveWebContents();
   ASSERT_TRUE(web_contents);
-  ChromeSecurityStateModelClient* model_client =
-      ChromeSecurityStateModelClient::FromWebContents(web_contents);
-  ASSERT_TRUE(model_client);
-  SecurityStateModel::SecurityInfo security_info;
-  model_client->GetSecurityInfo(&security_info);
-  EXPECT_EQ(SecurityStateModel::SECURE, security_info.security_level);
+  SecurityStateTabHelper* helper =
+      SecurityStateTabHelper::FromWebContents(web_contents);
+  ASSERT_TRUE(helper);
+  security_state::SecurityInfo security_info;
+  helper->GetSecurityInfo(&security_info);
+  EXPECT_EQ(security_state::SECURE, security_info.security_level);
   EXPECT_EQ(kTestSCTStatuses, security_info.sct_verify_statuses);
 }
 
 }  // namespace