Plumb site engagement to the renderer process.

content/renderer/render_frame_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/render_frame_impl.h"
 
 #include <map>
 #include <string>
 #include <utility>
 #include <vector>
@@ skipping 1087 matching lines @@
       is_using_lofi_(false),
       effective_connection_type_(
           blink::WebEffectiveConnectionType::TypeUnknown),
       is_pasting_(false),
       suppress_further_dialogs_(false),
       blame_context_(nullptr),
 #if BUILDFLAG(ENABLE_PLUGINS)
       focused_pepper_plugin_(nullptr),
       pepper_last_mouse_event_target_(nullptr),
 #endif
+      engagement_binding_(this),
       frame_binding_(this),
       host_zoom_binding_(this),
       has_accessed_initial_document_(false),
       weak_factory_(this) {
   // We don't have a service_manager::Connection at this point, so use empty
   // identity/specs.
   // TODO(beng): We should fix this, so we can apply policy about which
   //             interfaces get exposed.
   interface_registry_ = base::MakeUnique<service_manager::InterfaceRegistry>(
       mojom::kNavigation_FrameSpec);
@@ skipping 504 matching lines @@
   // Can be NULL in tests.
   if (render_thread_impl)
     render_thread_impl->GetRendererScheduler()->OnNavigationStarted();
   DCHECK(!IsBrowserSideNavigationEnabled());
   TRACE_EVENT2("navigation,rail", "RenderFrameImpl::OnNavigate", "id",
                routing_id_, "url", common_params.url.possibly_invalid_spec());
   NavigateInternal(common_params, start_params, request_params,
                    std::unique_ptr<StreamOverrideParameters>());
 }
 
-void RenderFrameImpl::Bind(mojom::FrameRequest request,
-                           mojom::FrameHostPtr host) {
+void RenderFrameImpl::BindEngagement(
+    blink::mojom::EngagementClientAssociatedRequest request) {
+  engagement_binding_.Bind(std::move(request));
+}
+
+void RenderFrameImpl::BindFrame(mojom::FrameRequest request,
+                                mojom::FrameHostPtr host) {
   frame_binding_.Bind(std::move(request));
   frame_host_ = std::move(host);
   frame_host_->GetInterfaceProvider(
       std::move(pending_remote_interface_provider_request_));
 }
 
 ManifestManager* RenderFrameImpl::manifest_manager() {
   return manifest_manager_;
 }
 
@@ skipping 995 matching lines @@
 }
 
 bool RenderFrameImpl::IsUsingLoFi() const {
   return is_using_lofi_;
 }
 
 bool RenderFrameImpl::IsPasting() const {
   return is_pasting_;
 }
 
+// blink::mojom::EngagementClient implementation -------------------------------
+
+void RenderFrameImpl::SetEngagementLevel(const url::Origin& origin,

[esprehn, 2016/12/06 00:31:34]

Why do you need to pass an origin? If you connect to the per-frame
ServiceRegistry then its tightly bound to the origin (ex. permissions are
connected to it) , so you don't need to check again here. You'll only get
deliveries about that frame.

[dominickn, 2016/12/06 00:49:57]

nasko suggested passing the origin here like the HostZoom feature does. His
reasoning seemed sound: navigation is inherently racey, so we should only set
engagement when the current security origin matches the origin that we received.

[nasko, 2016/12/06 00:50:30]

Because a single frame can render multiple origins and navigations are racy by
definition. By the time an IPC arrives, the frame might have navigated away to a
different origin or even relaxed it with document.domain.

[esprehn, 2016/12/06 00:58:44]

Right, but that's true of all things using the ServiceRegistry on Frame right?
ex. USB uses the registry to get permissions, you're saying that the permission
could be accidentally granted to the wrong domain? That should never happen, at
the DOMWindow level we should register as a client, just like USB would.

[dominickn, 2016/12/08 02:37:10]

USB doesn't need to request a permission prior to navigation commit though,
whereas in this case, we're usually sending the engagement before commit and
then setting it when the commit happens.

[nasko, 2016/12/08 22:26:48]

If your Mojo interface is bound to the lifetime of a document, then you don't
need to pass the origin. However, this interface is bound to a RenderFrame
lifetime, which can render multiple origins, so we need to pass the origin to
help disambiguate.

+                                         blink::mojom::EngagementLevel level) {
+  // Set the engagement level on |frame_| if its origin matches the one we have
+  // been provided with.
+  if (frame_ && url::Origin(frame_->getSecurityOrigin()) == origin) {
+    frame_->setEngagementLevel(level);
+    return;
+  }
+
+  engagement_levels_[origin] = level;
+}
+
 // mojom::Frame implementation -------------------------------------------------
 
 void RenderFrameImpl::GetInterfaceProvider(
     service_manager::mojom::InterfaceProviderRequest request) {
   service_manager::ServiceInfo child_info =
       ChildThreadImpl::current()->GetChildServiceInfo();
   service_manager::ServiceInfo browser_info =
       ChildThreadImpl::current()->GetBrowserServiceInfo();
 
   service_manager::InterfaceProviderSpec child_spec, browser_spec;
@@ skipping 2066 matching lines @@
 
   const WebURLRequest& request = ds->request();
   const WebURLResponse& response = ds->response();
 
   DocumentState* document_state = DocumentState::FromDataSource(ds);
   NavigationStateImpl* navigation_state =
       static_cast<NavigationStateImpl*>(document_state->navigation_state());
   InternalDocumentStateData* internal_data =
       InternalDocumentStateData::FromDocumentState(document_state);
 
+  // Set the correct engagement level on the frame.
+  EngagementLevels::iterator engagement_level =
+      engagement_levels_.find(url::Origin(frame_->getSecurityOrigin()));
+
+  if (engagement_level != engagement_levels_.end())
+    frame_->setEngagementLevel(engagement_level->second);

[esprehn, 2016/12/06 00:31:34]

This seems like something we should be able to manage inside blink?

[dominickn, 2016/12/06 00:49:57]

See comment below regarding this being sent pre-commit.

+  engagement_levels_.clear();

[dcheng, 2016/12/08 08:14:07]

Out of curiosity... why do we need to maintain a map? I think this needs some
sort of comment (I would have expected a max of one pending entry)

[dominickn, 2016/12/08 09:02:47]

I implemented it analogously to the HostZoom feature, which is also sent down in
ReadyToCommitNavigation and stored in a map. I don't know enough to elaborate in
a comment, but nasko suggested doing it this way.

+
   FrameHostMsg_DidCommitProvisionalLoad_Params params;
   params.http_status_code = response.httpStatusCode();
   params.url_is_unreachable = ds->hasUnreachableURL();
   params.method = "GET";
   params.intended_as_new_entry =
       navigation_state->request_params().intended_as_new_entry;
   params.did_create_new_entry = commit_type == blink::WebStandardCommit;
   params.should_replace_current_entry = ds->replacesCurrentHistoryItem();
   params.post_id = -1;
   params.nav_entry_id = navigation_state->request_params().nav_entry_id;
@@ skipping 1732 matching lines @@
     // Mimics the order of events sent by WebKit.
     // See WebCore::Editor::setComposition() for the corresponding code.
     focused_pepper_plugin_->HandleCompositionEnd(text);
     focused_pepper_plugin_->HandleTextInput(text);
   }
   pepper_composition_text_.clear();
 }
 #endif  // ENABLE_PLUGINS
 
 void RenderFrameImpl::RegisterMojoInterfaces() {
+  GetAssociatedInterfaceRegistry()->AddInterface(
+      base::Bind(&RenderFrameImpl::BindEngagement, weak_factory_.GetWeakPtr()));

[esprehn, 2016/12/06 00:31:34]

You should be able to connect to this interface directly from inside blink and
then not expose new API surface on the WebFrame.

[dominickn, 2016/12/06 00:49:57]

I'm not sure what you mean. The IPC from the browser process is sent
pre-navigation commit, so that when we commit we've already initialized the
frame state to have the correct engagement. Can we guarantee the correct
behaviour if it skips the RenderFrame and goes directly to Blink?

[nasko, 2016/12/08 22:26:48]

It doesn't strictly need to be a map, but it needs to be a tuple. Maybe we can
just use a tuple to store it, if we don't expect more than one.

In general, we do need to keep the URL and score together, since there can be
races between navigations and we want to ensure that we are stamping the correct
score on the correct document.

+
   if (!frame_->parent()) {
     // Only main frame have ImageDownloader service.
     GetInterfaceRegistry()->AddInterface(base::Bind(
         &ImageDownloaderImpl::CreateMojoService, base::Unretained(this)));
 
     // Host zoom is per-page, so only added on the main frame.
     GetAssociatedInterfaceRegistry()->AddInterface(base::Bind(
         &RenderFrameImpl::OnHostZoomClientRequest, weak_factory_.GetWeakPtr()));
   }
 }
@@ skipping 170 matching lines @@
   // event target. Potentially a Pepper plugin will receive the event.
   // In order to tell whether a plugin gets the last mouse event and which it
   // is, we set |pepper_last_mouse_event_target_| to null here. If a plugin gets
   // the event, it will notify us via DidReceiveMouseEvent() and set itself as
   // |pepper_last_mouse_event_target_|.
   pepper_last_mouse_event_target_ = nullptr;
 #endif
 }
 
 }  // namespace content