[sensors] Add Permission guard to the generic sensor apis.

third_party/WebKit/Source/modules/sensor/Sensor.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/sensor/Sensor.h"
 
 #include "core/dom/Document.h"
 #include "core/dom/ExceptionCode.h"
 #include "core/dom/ExecutionContextTask.h"
 #include "core/inspector/ConsoleMessage.h"
 #include "device/generic_sensor/public/interfaces/sensor.mojom-blink.h"
 #include "modules/sensor/SensorErrorEvent.h"
 #include "modules/sensor/SensorPollingStrategy.h"
 #include "modules/sensor/SensorProviderProxy.h"
 #include "modules/sensor/SensorReading.h"
 #include "modules/sensor/SensorReadingEvent.h"
+#include "platform/UserGestureIndicator.h"
 
 using namespace device::mojom::blink;
 
 namespace blink {
 
+using mojom::blink::PermissionStatus;
+
 Sensor::Sensor(ScriptState* scriptState,
                const SensorOptions& sensorOptions,
                ExceptionState& exceptionState,
                SensorType type)
     : ActiveScriptWrappable(this),
       ContextLifecycleObserver(scriptState->getExecutionContext()),
       PageVisibilityObserver(
           toDocument(scriptState->getExecutionContext())->page()),
       m_sensorOptions(sensorOptions),
       m_type(type),
@@ skipping 35 matching lines @@
 
 void Sensor::start(ScriptState* scriptState, ExceptionState& exceptionState) {
   if (m_state != Sensor::SensorState::IDLE &&
       m_state != Sensor::SensorState::ERRORED) {
     exceptionState.throwDOMException(
         InvalidStateError,
         "Cannot start because SensorState is not idle or errored");
     return;
   }
 
   initSensorProxyIfNeeded();

[shalamov, 2016/11/04 19:00:20]

This will request sensor from SensorProvider and initialize proxy with it,    I
think permission should be asked before that (before requesting sensor from
provider).

start() - > Ask permission, so that info about hw capability is not leaked
Granted - > Request sensor
startListening()

[riju_, 2016/11/09 10:30:34]

If there is no proxy, we can't call proxy->somePermissionMethod(), so putting
the permission checking after initSensorProxyIfNeeded()

 
   if (!m_sensorProxy) {
     exceptionState.throwDOMException(
         InvalidStateError, "The Sensor is no longer associated to a frame.");
     return;
   }
 
-  startListening();
+  // If the algorithm is not allowed to show a popup, throw SecurityError.
+  if (!UserGestureIndicator::consumeUserGesture()) {

[Mikhail, 2016/11/07 08:02:02]

must be moved to the beginning.

[riju_, 2016/11/09 10:30:34]

Done.

+    exceptionState.throwDOMException(
+        SecurityError,
+        "Must be handling a user gesture to show a permission request.");
+    return;
+  }
+
+  // Check the permission status first.
+  auto permissionStatus = m_sensorProxy->getPermissionStatus();
+
+  if (permissionStatus == PermissionStatus::ASK) {
+    m_sensorProxy->requestPermission(scriptState->getExecutionContext(),

[Mikhail, 2016/11/07 08:02:02]

return here?

[riju_, 2016/11/09 10:30:34]

Done.

+                                     permissionStatus);
+  } else if (permissionStatus == PermissionStatus::DENIED) {
+    stopListening();
+
+    ConsoleMessage* consoleMessage = ConsoleMessage::create(
+        JSMessageSource, InfoMessageLevel, "Permission Rejected.");
+    scriptState->getExecutionContext()->addConsoleMessage(consoleMessage);
+
+    reportError(PermissionDeniedError,
+                "start() call has failed as permission was denied.");
+  } else {
+    startListening();
+  }
+
+  // Keep listening to changes.
+  m_sensorProxy->getNextPermissionChange(scriptState->getExecutionContext(),

[shalamov, 2016/11/04 19:00:20]

This can be moved after HasPermission is completed (to callback from
HasPermission for example).

[riju_, 2016/11/09 10:30:34]

Done.

+                                         permissionStatus);
 }
 
-void Sensor::stop(ScriptState*, ExceptionState& exceptionState) {
+void Sensor::stop(ScriptState* scriptState, ExceptionState& exceptionState) {
   if (m_state == Sensor::SensorState::IDLE ||
       m_state == Sensor::SensorState::ERRORED) {
     exceptionState.throwDOMException(
         InvalidStateError,
         "Cannot stop because SensorState is either idle or errored");
     return;
   }
 
   stopListening();
+
+  // Check the permission status first.
+  auto permissionStatus = m_sensorProxy->getPermissionStatus();

[shalamov, 2016/11/04 19:00:20]

Is this required for stop()? Should we create issue for spec to clarify it?

[riju_, 2016/11/09 10:30:34]

Will remove.
https://github.com/w3c/sensors/issues/146

+
+  if (permissionStatus != PermissionStatus::GRANTED) {

[Mikhail, 2016/11/07 08:02:02]

is it possible that we had permissions to start but do not have them to stop?

[riju_, 2016/11/09 10:30:34]

My mistake, now spec says we don't need permissions to stop()

+    ConsoleMessage* consoleMessage = ConsoleMessage::create(
+        JSMessageSource, InfoMessageLevel, "Permission Rejected.");
+    scriptState->getExecutionContext()->addConsoleMessage(consoleMessage);
+
+    reportError(PermissionDeniedError,
+                "stop() call has failed as permission was not granted.");
+  }
+
+  // Keep listening to changes.
+  m_sensorProxy->getNextPermissionChange(scriptState->getExecutionContext(),

[Mikhail, 2016/11/07 08:02:02]

this class already has 'getExecutionContext()'

[riju_, 2016/11/09 10:30:34]

Moving this to the onPermissionUpdate callback, as alex suggested.

+                                         permissionStatus);
 }
 
 static String ToString(Sensor::SensorState state) {
   switch (state) {
     case Sensor::SensorState::IDLE:
       return "idle";
     case Sensor::SensorState::ACTIVATING:
       return "activating";
     case Sensor::SensorState::ACTIVE:
       return "active";
@@ skipping 31 matching lines @@
 }
 
 void Sensor::initSensorProxyIfNeeded() {
   if (m_sensorProxy)
     return;
 
   Document* document = toDocument(getExecutionContext());
   if (!document || !document->frame())
     return;
 
-  m_sensorProxy =
-      SensorProviderProxy::from(document->frame())->getOrCreateSensor(m_type);
+  m_sensorProxy = SensorProviderProxy::from(document->frame())
+                      ->getOrCreateSensor(m_type, getExecutionContext());
 }
 
 void Sensor::contextDestroyed() {
   if (m_state == Sensor::SensorState::ACTIVE ||
       m_state == Sensor::SensorState::ACTIVATING)
     stopListening();
+  m_sensorProxy->resetPermissionService();
 }
 
 void Sensor::onSensorInitialized() {
   if (m_state != Sensor::SensorState::ACTIVATING)
     return;
 
   startListening();
 }
 
 void Sensor::onSensorReadingChanged() {
   if (m_polling)
     m_polling->onSensorReadingChanged();
 }
 
+void Sensor::onSensorPermissionChanged() {
+  // Check the permission status first.
+  auto permissionStatus = m_sensorProxy->getPermissionStatus();
+
+  if (permissionStatus != PermissionStatus::GRANTED) {
+    stopListening();
+    reportError(PermissionDeniedError,
+                "start/stop() call has failed as permission was denied.");
+  }

[Mikhail, 2016/11/07 08:02:02]

what if permissions are granted? we probably should start sensor than..

[riju_, 2016/11/09 10:30:34]

Yes, provided a start() was waiting for permissions to be granted.

+}
+
 void Sensor::onSensorError(ExceptionCode code,
                            const String& sanitizedMessage,
                            const String& unsanitizedMessage) {
   reportError(code, sanitizedMessage, unsanitizedMessage);
 }
 
 void Sensor::onStartRequestCompleted(bool result) {
   if (m_state != Sensor::SensorState::ACTIVATING)
     return;
 
@@ skipping 150 matching lines @@
 void Sensor::notifyStateChanged() {
   dispatchEvent(Event::create(EventTypeNames::statechange));
 }
 
 void Sensor::notifyError(DOMException* error) {
   dispatchEvent(
       SensorErrorEvent::create(EventTypeNames::error, std::move(error)));
 }
 
 }  // namespace blink