/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */

/* This Source Code Form is subject to the terms of the Mozilla Public

 * License, v. 2.0. If a copy of the MPL was not distributed with this

 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

/* Defines the abstract interface for a principal. */

#include "nsISerializable.idl"

%{C++

struct JSPrincipals;

#include "nsCOMPtr.h"

#include "nsTArray.h"

#include "mozilla/DebugOnly.h"

namespace mozilla {

class OriginAttributes;

}

/**

 * Some methods have a fast path for the case when we're comparing a principal

 * to itself. The situation may happen for example with about:blank documents.

 */

#define DECL_FAST_INLINE_HELPER(method_)                       \

  inline bool method_(nsIPrincipal* aOther)                    \

  {                                                            \

    mozilla::DebugOnly<bool> val = false;                      \

    MOZ_ASSERT_IF(this == aOther,                              \

                  NS_SUCCEEDED(method_(aOther, &val)) && val); \

                                                               \

    bool retVal = false;                                       \

    return                                                     \

      this == aOther ||                                        \

      (NS_SUCCEEDED(method_(aOther, &retVal)) && retVal);      \

  }

%}

interface nsIURI;

interface nsIContentSecurityPolicy;

interface nsIDOMDocument;

[ptr] native JSContext(JSContext);

[ptr] native JSPrincipals(JSPrincipals);

[ref] native PrincipalArray(const nsTArray<nsCOMPtr<nsIPrincipal>>);

[ref] native const_OriginAttributes(const mozilla::OriginAttributes);

[scriptable, builtinclass, uuid(f75f502d-79fd-48be-a079-e5a7b8f80c8b)]

interface nsIPrincipal : nsISerializable

{

    /**

     * Returns whether the other principal is equivalent to this principal.

     * Principals are considered equal if they are the same principal, or

     * they have the same origin.

     */

    boolean equals(in nsIPrincipal other);

    /**

     * Like equals, but takes document.domain changes into account.

     */

    boolean equalsConsideringDomain(in nsIPrincipal other);

    %{C++

      DECL_FAST_INLINE_HELPER(Equals)

      DECL_FAST_INLINE_HELPER(EqualsConsideringDomain)

    %}

    /**

     * Returns a hash value for the principal.

     */

    [noscript] readonly attribute unsigned long hashValue;

    /**

     * The codebase URI to which this principal pertains.  This is

     * generally the document URI.

     */

    readonly attribute nsIURI URI;

    /**

     * The domain URI to which this principal pertains.

     * This is null unless script successfully sets document.domain to our URI

     * or a superdomain of our URI.

     * Setting this has no effect on the URI.

     * See https://developer.mozilla.org/en-US/docs/Web/Security/Same-origin_policy#Changing_origin

     */

    [noscript] attribute nsIURI domain;

    /**

     * Returns whether the other principal is equal to or weaker than this

     * principal. Principals are equal if they are the same object or they

     * have the same origin.

     *

     * Thus a principal always subsumes itself.

     *

     * The system principal subsumes itself and all other principals.

     *

     * A null principal (corresponding to an unknown, hence assumed minimally

     * privileged, security context) is not equal to any other principal

     * (including other null principals), and therefore does not subsume

     * anything but itself.

     */

    boolean subsumes(in nsIPrincipal other);

    /**

     * Same as the previous method, subsumes(), but takes document.domain into

     * account.

     */

    boolean subsumesConsideringDomain(in nsIPrincipal other);

    /**

     * Same as the subsumesConsideringDomain(), but ignores the first party

     * domain in its originAttributes.

     */

    boolean subsumesConsideringDomainIgnoringFPD(in nsIPrincipal other);

    %{C++

      DECL_FAST_INLINE_HELPER(Subsumes)

      DECL_FAST_INLINE_HELPER(SubsumesConsideringDomain)

      DECL_FAST_INLINE_HELPER(SubsumesConsideringDomainIgnoringFPD)

#undef DECL_FAST_INLINE_HELPER

    %}

    /**

     * Checks whether this principal is allowed to load the network resource

     * located at the given URI under the same-origin policy. This means that

     * codebase principals are only allowed to load resources from the same

     * domain, the system principal is allowed to load anything, and null

     * principals can only load URIs where they are the principal. This is

     * changed by the optional flag allowIfInheritsPrincipal (which defaults to

     * false) which allows URIs that inherit their loader's principal.

     *

     * If the load is allowed this function does nothing. If the load is not

     * allowed the function throws NS_ERROR_DOM_BAD_URI.

     *

     * NOTE: Other policies might override this, such as the Access-Control

     *       specification.

     * NOTE: The 'domain' attribute has no effect on the behaviour of this

     *       function.

     *

     *

     * @param uri    The URI about to be loaded.

     * @param report If true, will report a warning to the console service

     *               if the load is not allowed.

     * @param allowIfInheritsPrincipal   If true, the load is allowed if the

     *                                   loadee inherits the principal of the

     *                                   loader.

     * @throws NS_ERROR_DOM_BAD_URI if the load is not allowed.

     */

    void checkMayLoad(in nsIURI uri, in boolean report,

                      in boolean allowIfInheritsPrincipal);

    /**

     * A Content Security Policy associated with this principal.

     * Use this function to query the associated CSP with this principal.

     * Please *only* use this function to *set* a CSP when you know exactly what you are doing.

     * Most likely you want to call ensureCSP instead of setCSP.

     */

    [noscript] attribute nsIContentSecurityPolicy csp;

    /*

     * Use this function to query a CSP associated with this principal.

     * If no CSP is associated with this principal then one is created

     * internally and setRequestContext is called on the CSP using aDocument.

     *

     * Please note if aDocument is null, then setRequestContext on the

     * CSP object is called using the current principal.

     */

    [noscript] nsIContentSecurityPolicy ensureCSP(in nsIDOMDocument aDocument);

    /**

     * A speculative Content Security Policy associated with this

     * principal. Set during speculative loading (preloading) and

     * used *only* for preloads.

     *

     * If you want to query the CSP associated with that principal,

     * then this is *not* what you want. Instead query 'csp'.

     */

    [noscript] readonly attribute nsIContentSecurityPolicy preloadCsp;

    /*

     * Use this function to query a speculative CSP associated with this

     * principal. If no speculative CSP is associated with this principal

     * then one is created internally and setRequestContext is called on

     * the CSP using aDocument.

     *

     * Please note if aDocument is null, then setRequestContext on the

     * speculative CSP object is called using the current principal.

     */

    [noscript] nsIContentSecurityPolicy ensurePreloadCSP(in nsIDOMDocument aDocument);

    /**

     * The CSP of the principal in JSON notation.

     * Note, that the CSP itself is not exposed to JS, but script

     * should be able to obtain a JSON representation of the CSP.

     */

    readonly attribute AString cspJSON;

    /**

     * A dictionary of the non-default origin attributes associated with this

     * nsIPrincipal.

     *

     * Attributes are tokens that are taken into account when determining whether

     * two principals are same-origin - if any attributes differ, the principals

     * are cross-origin, even if the scheme, host, and port are the same.

     * Attributes should also be considered for all security and bucketing decisions,

     * even those which make non-standard comparisons (like cookies, which ignore

     * scheme, or quotas, which ignore subdomains).

     *

     * If you're looking for an easy-to-use canonical stringification of the origin

     * attributes, see |originSuffix| below.

     */

    [implicit_jscontext]

    readonly attribute jsval originAttributes;

    [noscript, notxpcom, nostdcall, binaryname(OriginAttributesRef)]

    const_OriginAttributes OriginAttributesRef();

    /**

     * A canonical representation of the origin for this principal. This

     * consists of a base string (which, for codebase principals, is of the

     * format scheme://host:port), concatenated with |originAttributes| (see

     * below).

     *

     * We maintain the invariant that principalA.equals(principalB) if and only

     * if principalA.origin == principalB.origin.

     */

    readonly attribute ACString origin;

    /**

     * The base part of |origin| without the concatenation with |originSuffix|.

     * This doesn't have the important invariants described above with |origin|,

     * and as such should only be used for legacy situations.

     */

    readonly attribute ACString originNoSuffix;

    /**

     * A string of the form !key1=value1&key2=value2, where each pair represents

     * an attribute with a non-default value. If all attributes have default

     * values, this is the empty string.

     *

     * The value of .originSuffix is automatically serialized into .origin, so any

     * consumers using that are automatically origin-attribute-aware. Consumers with

     * special requirements must inspect and compare .originSuffix manually.

     */

    readonly attribute AUTF8String originSuffix;

    /**

     * The base domain of the codebase URI to which this principal pertains

     * (generally the document URI), handling null principals and

     * non-hierarchical schemes correctly.

     */

    readonly attribute ACString baseDomain;

    /**

     * Gets the id of the app this principal is inside.  If this principal is

     * not inside an app, returns nsIScriptSecurityManager::NO_APP_ID.

     *

     * Note that this principal does not necessarily have the permissions of

     * the app identified by appId.  For example, this principal might

     * correspond to an iframe whose origin differs from that of the app frame

     * containing it.  In this case, the iframe will have the appId of its

     * containing app frame, but the iframe must not run with the app's

     * permissions.

     *

     * Similarly, this principal might correspond to an <iframe mozbrowser>

     * inside an app frame; in this case, the content inside the iframe should

     * not have any of the app's permissions, even if the iframe is at the same

     * origin as the app.

     */

    [infallible] readonly attribute unsigned long appId;

    /**

     * Gets the ID of the add-on this principal belongs to.

     */

    readonly attribute AString addonId;

    readonly attribute nsISupports addonPolicy;

    /**

     * Gets the id of the user context this principal is inside.  If this

     * principal is inside the default userContext, this returns

     * nsIScriptSecurityManager::DEFAULT_USER_CONTEXT_ID.

     */

    [infallible] readonly attribute unsigned long userContextId;

    /**

     * Gets the id of the private browsing state of the context containing

     * this principal. If the principal has a private browsing value of 0, it

     * is not in private browsing.

     */

    [infallible] readonly attribute unsigned long privateBrowsingId;

    /**

     * Returns true iff the principal is inside an isolated mozbrowser element.

     * <xul:browser> is not considered to be a mozbrowser element.

     * <iframe mozbrowser noisolation> does not count as isolated since

     * isolation is disabled.  Isolation can only be disabled if the

     * containing document is chrome.

     */

    [infallible] readonly attribute boolean isInIsolatedMozBrowserElement;

    /**

     * Returns true iff this is a null principal (corresponding to an

     * unknown, hence assumed minimally privileged, security context).

     */

    [infallible] readonly attribute boolean isNullPrincipal;

    /**

     * Returns true iff this principal corresponds to a codebase origin.

     */

    [infallible] readonly attribute boolean isCodebasePrincipal;

    /**

     * Returns true iff this is an expanded principal.

     */

    [infallible] readonly attribute boolean isExpandedPrincipal;

    /**

     * Returns true iff this is the system principal.

     */

    [infallible] readonly attribute boolean isSystemPrincipal;

};

/**

 * If SystemPrincipal is too risky to use, but we want a principal to access

 * more than one origin, ExpandedPrincipals letting us define an array of

 * principals it subsumes. So script with an ExpandedPrincipals will gain

 * same origin access when at least one of its principals it contains gained

 * sameorigin acccess. An ExpandedPrincipal will be subsumed by the system

 * principal, and by another ExpandedPrincipal that has all its principals.

 * It is added for jetpack content-scripts to let them interact with the

 * content and a well defined set of other domains, without the risk of

 * leaking out a system principal to the content. See: Bug 734891

 */

[uuid(f3e177Df-6a5e-489f-80a7-2dd1481471d8)]

interface nsIExpandedPrincipal : nsISupports

{

  /**

   * An array of principals that the expanded principal subsumes.

   *

   * When an expanded principal is used as a triggering principal for a

   * request that inherits a security context, one of its constitutent

   * principals is inherited rather than the expanded principal itself. The

   * last principal in the whitelist is the default principal to inherit.

   *

   * Note: this list is not reference counted, it is shared, so

   * should not be changed and should only be used ephemerally.

   */

  [noscript, notxpcom, nostdcall]

  PrincipalArray WhiteList();

};