extensions/common/permissions/permissions_data.h - chromium/src - Git at Google

 // Copyright 2013 The Chromium Authors
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

 #ifndef EXTENSIONS_COMMON_PERMISSIONS_PERMISSIONS_DATA_H_
 #define EXTENSIONS_COMMON_PERMISSIONS_PERMISSIONS_DATA_H_

 #include <map>
 #include <memory>
 #include <string>

 #include "base/synchronization/lock.h"
 #include "base/threading/thread_checker.h"
 #include "extensions/common/extension_id.h"
 #include "extensions/common/manifest.h"
 #include "extensions/common/mojom/api_permission_id.mojom-shared.h"
 #include "extensions/common/mojom/manifest.mojom-shared.h"
 #include "extensions/common/permissions/api_permission.h"
 #include "extensions/common/permissions/permission_message.h"
 #include "extensions/common/permissions/permission_set.h"

 class GURL;

 namespace extensions {
 class URLPatternSet;

 // The possible type of requirements needed in order to capture the current
 // page.
 enum class CaptureRequirement {
   kActiveTabOrAllUrls,  // The extension needs to have the <all_urls> or
                         // activeTab permission in order to capture the current
                         // page.
   kPageCapture,         // <all_urls> is not a requirement to be able to capture
                         // the current page.
 };

 // A container for the permissions state of an extension, including active,
 // withheld, and tab-specific permissions.
 // Thread-Safety: Since this is an object on the Extension object, *some* thread
 // safety is provided. All utility functions for checking if a permission is
 // present or an operation is allowed are thread-safe. However, permissions can
 // only be set (or updated) on the thread to which this object is bound.
 // Permissions may be accessed synchronously on that same thread.
 // Accessing on an improper thread will DCHECK().
 // This is necessary to prevent a scenario in which one thread will access
 // permissions while another thread changes them.
 class PermissionsData {
  public:
   // The possible types of access for a given page.
   // TODO(devlin): Sometimes, this is used for things beyond just a "page",
   // such as network request interception or access to a particular frame.
   // Should we update this?  If so, we should also update the titles of the
   // GetPageAccess()/CanAccessPage() methods below.
   enum class PageAccess {
     kDenied,    // The extension is not allowed to access the given page.
     kAllowed,   // The extension is allowed to access the given page.
     kWithheld,  // The browser must determine if the extension can access
                 // the given page.
   };

   using TabPermissionsMap = std::map<int, std::unique_ptr<const PermissionSet>>;

   // Delegate class to allow different contexts (e.g. browser vs renderer) to
   // have control over policy decisions.
   class PolicyDelegate {
    public:
     virtual ~PolicyDelegate() {}

     // Returns true if script access should be blocked on this page.
     // Otherwise, default policy should decide.
     virtual bool IsRestrictedUrl(const GURL& document_url,
                                  std::string* error) = 0;
   };

   static void SetPolicyDelegate(PolicyDelegate* delegate);

   PermissionsData(const ExtensionId& extension_id,
                   Manifest::Type manifest_type,
                   mojom::ManifestLocation location,
                   std::unique_ptr<const PermissionSet> initial_permissions);

   PermissionsData(const PermissionsData&) = delete;
   PermissionsData& operator=(const PermissionsData&) = delete;

   virtual ~PermissionsData();

   // Returns true if the extension is a COMPONENT extension or is on the
   // allowlist of extensions that can script all pages.
   // NOTE: This is static because it is used during extension initialization,
   // before the extension has an associated PermissionsData object.
   static bool CanExecuteScriptEverywhere(const ExtensionId& extension_id,
                                          mojom::ManifestLocation location);

   // Returns true if the given `url` is restricted for the given `extension`,
   // as is commonly the case for chrome:// urls.
   // NOTE: You probably want to use CanAccessPage().
   bool IsRestrictedUrl(const GURL& document_url, std::string* error) const;

   // Returns true if the "all_urls" meta-pattern should include access to
   // URLs with the "chrome" scheme. Access to these URLs is limited as they
   // are sensitive.
   static bool AllUrlsIncludesChromeUrls(const ExtensionId& extension_id);

   // Is this extension using the default scope for policy_blocked_hosts and
   // policy_allowed_hosts of the ExtensionSettings policy.
   bool UsesDefaultPolicyHostRestrictions() const;

   // Locks the permissions data to the current thread. We don't do this on
   // construction, since extensions are initialized across multiple threads.
   void BindToCurrentThread() const;

   // Sets the current context ID for the extension. Must be called on the
   // same thread this is bound to, if any.
   void SetContextId(int context_id) const;

   // Sets the runtime permissions of the given `extension` to `active` and
   // `withheld`.
   void SetPermissions(std::unique_ptr<const PermissionSet> active,
                       std::unique_ptr<const PermissionSet> withheld) const;

   // Applies restrictions from enterprise policy limiting which URLs this
   // extension can interact with. The same policy can also define a default set
   // of URL restrictions using SetDefaultPolicyHostRestrictions. This function
   // overrides any default host restriction policy.
   void SetPolicyHostRestrictions(
       const URLPatternSet& policy_blocked_hosts,
       const URLPatternSet& policy_allowed_hosts) const;

   // Marks this extension as using default enterprise policy limiting
   // which URLs extensions can interact with. A default policy can be set with
   // SetDefaultPolicyHostRestrictions. A policy specific to this extension
   // can be set with SetPolicyHostRestrictions.
   void SetUsesDefaultHostRestrictions() const;

   // Applies profile dependent restrictions from enterprise policy limiting
   // which URLs all extensions can interact with. This restriction can
   // be overridden on a per-extension basis with SetPolicyHostRestrictions.
   static void SetDefaultPolicyHostRestrictions(
       int context_id,
       const URLPatternSet& default_policy_blocked_hosts,
       const URLPatternSet& default_policy_allowed_hosts);

   // Sets the sites that are explicitly allowed or blocked by the user.
   static void SetUserHostRestrictions(int context_id,
                                       URLPatternSet user_blocked_hosts,
                                       URLPatternSet user_allowed_hosts);

   // Updates the tab-specific permissions of `tab_id` to include those from
   // `permissions`.
   void UpdateTabSpecificPermissions(int tab_id,
                                     const PermissionSet& permissions) const;

   // Clears the tab-specific permissions of `tab_id`.
   void ClearTabSpecificPermissions(int tab_id) const;

   // Returns whether the extension has tab-specific permissions for the security
   // origin of `url` on `tab_id`.
   bool HasTabPermissionsForSecurityOrigin(int tab_id, const GURL& url) const;

   // Returns true if the `extension` has the given `permission`. Prefer
   // IsExtensionWithPermissionOrSuggestInConsole when developers may be using an
   // api that requires a permission they didn't know about, e.g. open web apis.
   // Note this does not include APIs with no corresponding permission, like
   // "runtime" or "browserAction".
   // TODO(mpcomplete): drop the "API" from these names, it's confusing.
   bool HasAPIPermission(mojom::APIPermissionID permission) const;
   bool HasAPIPermission(const std::string& permission_name) const;
   bool HasAPIPermissionForTab(int tab_id,
                               mojom::APIPermissionID permission) const;
   bool CheckAPIPermissionWithParam(
       mojom::APIPermissionID permission,
       const APIPermission::CheckParam* param) const;

   // Returns the hosts this extension effectively has access to, including
   // explicit and scriptable hosts, and any hosts on tabs the extension has
   // active tab permissions for.
   URLPatternSet GetEffectiveHostPermissions() const;

   // TODO(rdevlin.cronin): HasHostPermission() is just a forward for the active
   // permissions. We should either get rid of it, and have callers use
   // active_permissions(), or should get rid of active_permissions(), and make
   // callers use PermissionsData for everything. We should not do both.
   // Whether the extension has access to the given `url`.
   bool HasHostPermission(const GURL& url) const;

   // Returns the full list of permission details for messages that should
   // display at install time, in a nested format ready for display.
   PermissionMessages GetPermissionMessages() const;

   // Returns the list of permission details for permissions that are included in
   // active_permissions(), but not present in `granted_permissions`.  These are
   // returned in a nested format, ready for display.
   PermissionMessages GetNewPermissionMessages(
       const PermissionSet& granted_permissions) const;

   // Returns true if the associated extension has permission to access and
   // interact with the specified page, in order to do things like inject
   // scripts or modify the content.
   // If this returns false and `error` is non-NULL, `error` will be popualted
   // with the reason the extension cannot access the page.
   bool CanAccessPage(const GURL& document_url,
                      int tab_id,
                      std::string* error) const;
   // Like CanAccessPage, but also takes withheld permissions into account.
   // TODO(rdevlin.cronin) We shouldn't have two functions, but not all callers
   // know how to wait for permission.
   PageAccess GetPageAccess(const GURL& document_url,
                            int tab_id,
                            std::string* error) const;

   // Returns true if the associated extension has permission to inject a
   // content script on the page.
   // If this returns false and `error` is non-NULL, `error` will be popualted
   // with the reason the extension cannot script the page.
   // NOTE: You almost certainly want to use CanAccessPage() instead of this
   // method.
   bool CanRunContentScriptOnPage(const GURL& document_url,
                                  int tab_id,
                                  std::string* error) const;
   // Like CanRunContentScriptOnPage, but also takes withheld permissions into
   // account.
   // TODO(rdevlin.cronin) We shouldn't have two functions, but not all callers
   // know how to wait for permission.
   PageAccess GetContentScriptAccess(const GURL& document_url,
                                     int tab_id,
                                     std::string* error) const;

   // Returns true if the associated extension is allowed to obtain the contents
   // of a page as an image. Pages may contain multiple sources (e.g.,
   // example.com may embed google.com), so simply checking the top-frame's URL
   // is insufficient.
   // Instead:
   // - If the page is a chrome:// page, require activeTab.
   // - For all other pages, ensure `capture_requirement` is satisfied.
   bool CanCaptureVisiblePage(const GURL& document_url,
                              int tab_id,
                              std::string* error,
                              CaptureRequirement capture_requirement) const;

   const TabPermissionsMap& tab_specific_permissions() const {
     DCHECK(!thread_checker_ || thread_checker_->CalledOnValidThread());
     return tab_specific_permissions_;
   }

   const PermissionSet& active_permissions() const {
     DCHECK(!thread_checker_ || thread_checker_->CalledOnValidThread());
     return *active_permissions_unsafe_;
   }

   const PermissionSet& withheld_permissions() const {
     DCHECK(!thread_checker_ || thread_checker_->CalledOnValidThread());
     return *withheld_permissions_unsafe_;
   }

   // Returns the default list of hosts that the enterprise policy has explicitly
   // blocked or allowed extensions to run on.
   // This should only be used for 1. Serialization when initializing renderers
   // or 2. Called from utility methods above. For all other uses, call utility
   // methods instead (e.g. CanAccessPage()).
   static URLPatternSet GetDefaultPolicyBlockedHosts(int context_id);
   static URLPatternSet GetDefaultPolicyAllowedHosts(int context_id);

   // Returns the list of hosts that the user has explicitly allowed or blocked
   // all extensions from running on. As with the policy host restrictions above,
   // accessing these should only be done for serialization and to update
   // other services; otherwise, rely on methods like `CanAccessPage()`.
   static URLPatternSet GetUserAllowedHosts(int context_id);
   static URLPatternSet GetUserBlockedHosts(int context_id);

   // Returns the list of user-restricted hosts that applies to the associated
   // extension. This looks at the associated context ID and also at whether the
   // user is allowed to apply settings to the extension (which is disallowed
   // for e.g. policy-installed extensions). As above, accessing these should
   // only be done for serialization and to update other services; otherwise,
   // rely on methods like `CanAccessPage()`.
   URLPatternSet GetUserBlockedHosts() const;

   // Returns list of hosts for *this* extension that enterprise policy has
   // explicitly blocked or allowed extensions to run on. If the extension uses
   // the default set, this will fall back to `GetDefaultPolicy*Hosts()`.
   // This should only be used for 1. Serialization when initializing renderers
   // or 2. Called from utility methods above. For all other uses, call utility
   // methods instead (e.g. CanAccessPage()).
   URLPatternSet policy_blocked_hosts() const;
   URLPatternSet policy_allowed_hosts() const;

   // Check if a specific URL is blocked by policy from extension use at runtime.
   bool IsPolicyBlockedHost(const GURL& url) const {
     base::AutoLock auto_lock(runtime_lock_);
     return IsPolicyBlockedHostUnsafe(url);
   }

 #if defined(UNIT_TEST)
   const PermissionSet* GetTabSpecificPermissionsForTesting(int tab_id) const {
     base::AutoLock auto_lock(runtime_lock_);
     return GetTabSpecificPermissions(tab_id);
   }
 #endif

  private:
   // Gets the tab-specific host permissions of `tab_id`, or NULL if there
   // aren't any.
   // Must be called with `runtime_lock_` acquired.
   const PermissionSet* GetTabSpecificPermissions(int tab_id) const;

   // Returns whether or not the extension is permitted to run on the given page,
   // checking against `permitted_url_patterns` and `tab_url_patterns` in
   // addition to blocking special sites (like the webstore or chrome:// urls).
   // Must be called with `runtime_lock_` acquired.
   PageAccess CanRunOnPage(const GURL& document_url,
                           const URLPatternSet& permitted_url_patterns,
                           const URLPatternSet& withheld_url_patterns,
                           const URLPatternSet* tab_url_patterns,
                           std::string* error) const;

   // Check if a specific URL is blocked by policy from extension use at runtime.
   // You must acquire the runtime_lock_ before calling.
   bool IsPolicyBlockedHostUnsafe(const GURL& url) const;

   // The associated extension's id.
   ExtensionId extension_id_;

   // The associated extension's manifest type.
   Manifest::Type manifest_type_;

   // The associated extension's location.
   mojom::ManifestLocation location_;

   mutable base::Lock runtime_lock_;

   // The permission's which are currently active on the extension during
   // runtime.
   // Unsafe indicates that we must lock anytime this is directly accessed.
   // Unless you need to change `active_permissions_unsafe_`, use the (safe)
   // active_permissions() accessor.
   mutable std::unique_ptr<const PermissionSet> active_permissions_unsafe_;

   // The permissions the extension requested, but was not granted due because
   // they are too powerful. This includes things like all_hosts.
   // Unsafe indicates that we must lock anytime this is directly accessed.
   // Unless you need to change `withheld_permissions_unsafe_`, use the (safe)
   // withheld_permissions() accessor.
   mutable std::unique_ptr<const PermissionSet> withheld_permissions_unsafe_;

   // The list of hosts an extension may not interact with by policy.
   // Unless you need to change `policy_blocked_hosts_unsafe_`, use the (safe)
   // policy_blocked_hosts() accessor.
   mutable URLPatternSet policy_blocked_hosts_unsafe_;

   // The exclusive list of hosts an extension may interact with by policy.
   // Unless you need to change `policy_allowed_hosts_unsafe_`, use the (safe)
   // policy_allowed_hosts() accessor.
   mutable URLPatternSet policy_allowed_hosts_unsafe_;

   // An identifier for the context associated with the PermissionsData.
   // This is required in order to properly map the context to the right default
   // default policy-level and user-level settings.
   // If empty, these settings are ignored. This should mostly only be the case
   // in unittests.
   mutable std::optional<int> context_id_;

   // Whether the extension uses the default policy host restrictions.
   mutable bool uses_default_policy_host_restrictions_ = true;

   mutable TabPermissionsMap tab_specific_permissions_;

   mutable std::unique_ptr<base::ThreadChecker> thread_checker_;
 };

 }  // namespace extensions

 #endif  // EXTENSIONS_COMMON_PERMISSIONS_PERMISSIONS_DATA_H_
	// Copyright 2013 The Chromium Authors
	// Use of this source code is governed by a BSD-style license that can be
	// found in the LICENSE file.

	#ifndef EXTENSIONS_COMMON_PERMISSIONS_PERMISSIONS_DATA_H_
	#define EXTENSIONS_COMMON_PERMISSIONS_PERMISSIONS_DATA_H_

	#include <map>
	#include <memory>
	#include <string>

	#include "base/synchronization/lock.h"
	#include "base/threading/thread_checker.h"
	#include "extensions/common/extension_id.h"
	#include "extensions/common/manifest.h"
	#include "extensions/common/mojom/api_permission_id.mojom-shared.h"
	#include "extensions/common/mojom/manifest.mojom-shared.h"
	#include "extensions/common/permissions/api_permission.h"
	#include "extensions/common/permissions/permission_message.h"
	#include "extensions/common/permissions/permission_set.h"

	class GURL;

	namespace extensions {
	class URLPatternSet;

	// The possible type of requirements needed in order to capture the current
	// page.
	enum class CaptureRequirement {
	kActiveTabOrAllUrls, // The extension needs to have the <all_urls> or
	// activeTab permission in order to capture the current
	// page.
	kPageCapture, // <all_urls> is not a requirement to be able to capture
	// the current page.
	};

	// A container for the permissions state of an extension, including active,
	// withheld, and tab-specific permissions.
	// Thread-Safety: Since this is an object on the Extension object, some thread
	// safety is provided. All utility functions for checking if a permission is
	// present or an operation is allowed are thread-safe. However, permissions can
	// only be set (or updated) on the thread to which this object is bound.
	// Permissions may be accessed synchronously on that same thread.
	// Accessing on an improper thread will DCHECK().
	// This is necessary to prevent a scenario in which one thread will access
	// permissions while another thread changes them.
	class PermissionsData {
	public:
	// The possible types of access for a given page.
	// TODO(devlin): Sometimes, this is used for things beyond just a "page",
	// such as network request interception or access to a particular frame.
	// Should we update this? If so, we should also update the titles of the
	// GetPageAccess()/CanAccessPage() methods below.
	enum class PageAccess {
	kDenied, // The extension is not allowed to access the given page.
	kAllowed, // The extension is allowed to access the given page.
	kWithheld, // The browser must determine if the extension can access
	// the given page.
	};

	using TabPermissionsMap = std::map<int, std::unique_ptr<const PermissionSet>>;

	// Delegate class to allow different contexts (e.g. browser vs renderer) to
	// have control over policy decisions.
	class PolicyDelegate {
	public:
	virtual ~PolicyDelegate() {}

	// Returns true if script access should be blocked on this page.
	// Otherwise, default policy should decide.
	virtual bool IsRestrictedUrl(const GURL& document_url,
	std::string* error) = 0;
	};

	static void SetPolicyDelegate(PolicyDelegate* delegate);

	PermissionsData(const ExtensionId& extension_id,
	Manifest::Type manifest_type,
	mojom::ManifestLocation location,
	std::unique_ptr<const PermissionSet> initial_permissions);

	PermissionsData(const PermissionsData&) = delete;
	PermissionsData& operator=(const PermissionsData&) = delete;

	virtual ~PermissionsData();

	// Returns true if the extension is a COMPONENT extension or is on the
	// allowlist of extensions that can script all pages.
	// NOTE: This is static because it is used during extension initialization,
	// before the extension has an associated PermissionsData object.
	static bool CanExecuteScriptEverywhere(const ExtensionId& extension_id,
	mojom::ManifestLocation location);

	// Returns true if the given `url` is restricted for the given `extension`,
	// as is commonly the case for chrome:// urls.
	// NOTE: You probably want to use CanAccessPage().
	bool IsRestrictedUrl(const GURL& document_url, std::string* error) const;

	// Returns true if the "all_urls" meta-pattern should include access to
	// URLs with the "chrome" scheme. Access to these URLs is limited as they
	// are sensitive.
	static bool AllUrlsIncludesChromeUrls(const ExtensionId& extension_id);

	// Is this extension using the default scope for policy_blocked_hosts and
	// policy_allowed_hosts of the ExtensionSettings policy.
	bool UsesDefaultPolicyHostRestrictions() const;

	// Locks the permissions data to the current thread. We don't do this on
	// construction, since extensions are initialized across multiple threads.
	void BindToCurrentThread() const;

	// Sets the current context ID for the extension. Must be called on the
	// same thread this is bound to, if any.
	void SetContextId(int context_id) const;

	// Sets the runtime permissions of the given `extension` to `active` and
	// `withheld`.
	void SetPermissions(std::unique_ptr<const PermissionSet> active,
	std::unique_ptr<const PermissionSet> withheld) const;

	// Applies restrictions from enterprise policy limiting which URLs this
	// extension can interact with. The same policy can also define a default set
	// of URL restrictions using SetDefaultPolicyHostRestrictions. This function
	// overrides any default host restriction policy.
	void SetPolicyHostRestrictions(
	const URLPatternSet& policy_blocked_hosts,
	const URLPatternSet& policy_allowed_hosts) const;

	// Marks this extension as using default enterprise policy limiting
	// which URLs extensions can interact with. A default policy can be set with
	// SetDefaultPolicyHostRestrictions. A policy specific to this extension
	// can be set with SetPolicyHostRestrictions.
	void SetUsesDefaultHostRestrictions() const;

	// Applies profile dependent restrictions from enterprise policy limiting
	// which URLs all extensions can interact with. This restriction can
	// be overridden on a per-extension basis with SetPolicyHostRestrictions.
	static void SetDefaultPolicyHostRestrictions(
	int context_id,
	const URLPatternSet& default_policy_blocked_hosts,
	const URLPatternSet& default_policy_allowed_hosts);

	// Sets the sites that are explicitly allowed or blocked by the user.
	static void SetUserHostRestrictions(int context_id,
	URLPatternSet user_blocked_hosts,
	URLPatternSet user_allowed_hosts);

	// Updates the tab-specific permissions of `tab_id` to include those from
	// `permissions`.
	void UpdateTabSpecificPermissions(int tab_id,
	const PermissionSet& permissions) const;

	// Clears the tab-specific permissions of `tab_id`.
	void ClearTabSpecificPermissions(int tab_id) const;

	// Returns whether the extension has tab-specific permissions for the security
	// origin of `url` on `tab_id`.
	bool HasTabPermissionsForSecurityOrigin(int tab_id, const GURL& url) const;

	// Returns true if the `extension` has the given `permission`. Prefer
	// IsExtensionWithPermissionOrSuggestInConsole when developers may be using an
	// api that requires a permission they didn't know about, e.g. open web apis.
	// Note this does not include APIs with no corresponding permission, like
	// "runtime" or "browserAction".
	// TODO(mpcomplete): drop the "API" from these names, it's confusing.
	bool HasAPIPermission(mojom::APIPermissionID permission) const;
	bool HasAPIPermission(const std::string& permission_name) const;
	bool HasAPIPermissionForTab(int tab_id,
	mojom::APIPermissionID permission) const;
	bool CheckAPIPermissionWithParam(
	mojom::APIPermissionID permission,
	const APIPermission::CheckParam* param) const;

	// Returns the hosts this extension effectively has access to, including
	// explicit and scriptable hosts, and any hosts on tabs the extension has
	// active tab permissions for.
	URLPatternSet GetEffectiveHostPermissions() const;

	// TODO(rdevlin.cronin): HasHostPermission() is just a forward for the active
	// permissions. We should either get rid of it, and have callers use
	// active_permissions(), or should get rid of active_permissions(), and make
	// callers use PermissionsData for everything. We should not do both.
	// Whether the extension has access to the given `url`.
	bool HasHostPermission(const GURL& url) const;

	// Returns the full list of permission details for messages that should
	// display at install time, in a nested format ready for display.
	PermissionMessages GetPermissionMessages() const;

	// Returns the list of permission details for permissions that are included in
	// active_permissions(), but not present in `granted_permissions`. These are
	// returned in a nested format, ready for display.
	PermissionMessages GetNewPermissionMessages(
	const PermissionSet& granted_permissions) const;

	// Returns true if the associated extension has permission to access and
	// interact with the specified page, in order to do things like inject
	// scripts or modify the content.
	// If this returns false and `error` is non-NULL, `error` will be popualted
	// with the reason the extension cannot access the page.
	bool CanAccessPage(const GURL& document_url,
	int tab_id,
	std::string* error) const;
	// Like CanAccessPage, but also takes withheld permissions into account.
	// TODO(rdevlin.cronin) We shouldn't have two functions, but not all callers
	// know how to wait for permission.
	PageAccess GetPageAccess(const GURL& document_url,
	int tab_id,
	std::string* error) const;

	// Returns true if the associated extension has permission to inject a
	// content script on the page.
	// If this returns false and `error` is non-NULL, `error` will be popualted
	// with the reason the extension cannot script the page.
	// NOTE: You almost certainly want to use CanAccessPage() instead of this
	// method.
	bool CanRunContentScriptOnPage(const GURL& document_url,
	int tab_id,
	std::string* error) const;
	// Like CanRunContentScriptOnPage, but also takes withheld permissions into
	// account.
	// TODO(rdevlin.cronin) We shouldn't have two functions, but not all callers
	// know how to wait for permission.
	PageAccess GetContentScriptAccess(const GURL& document_url,
	int tab_id,
	std::string* error) const;

	// Returns true if the associated extension is allowed to obtain the contents
	// of a page as an image. Pages may contain multiple sources (e.g.,
	// example.com may embed google.com), so simply checking the top-frame's URL
	// is insufficient.
	// Instead:
	// - If the page is a chrome:// page, require activeTab.
	// - For all other pages, ensure `capture_requirement` is satisfied.
	bool CanCaptureVisiblePage(const GURL& document_url,
	int tab_id,
	std::string* error,
	CaptureRequirement capture_requirement) const;

	const TabPermissionsMap& tab_specific_permissions() const {
	DCHECK(!thread_checker_ \|\| thread_checker_->CalledOnValidThread());
	return tab_specific_permissions_;
	}

	const PermissionSet& active_permissions() const {
	DCHECK(!thread_checker_ \|\| thread_checker_->CalledOnValidThread());
	return *active_permissions_unsafe_;
	}

	const PermissionSet& withheld_permissions() const {
	DCHECK(!thread_checker_ \|\| thread_checker_->CalledOnValidThread());
	return *withheld_permissions_unsafe_;
	}

	// Returns the default list of hosts that the enterprise policy has explicitly
	// blocked or allowed extensions to run on.
	// This should only be used for 1. Serialization when initializing renderers
	// or 2. Called from utility methods above. For all other uses, call utility
	// methods instead (e.g. CanAccessPage()).
	static URLPatternSet GetDefaultPolicyBlockedHosts(int context_id);
	static URLPatternSet GetDefaultPolicyAllowedHosts(int context_id);

	// Returns the list of hosts that the user has explicitly allowed or blocked
	// all extensions from running on. As with the policy host restrictions above,
	// accessing these should only be done for serialization and to update
	// other services; otherwise, rely on methods like `CanAccessPage()`.
	static URLPatternSet GetUserAllowedHosts(int context_id);
	static URLPatternSet GetUserBlockedHosts(int context_id);

	// Returns the list of user-restricted hosts that applies to the associated
	// extension. This looks at the associated context ID and also at whether the
	// user is allowed to apply settings to the extension (which is disallowed
	// for e.g. policy-installed extensions). As above, accessing these should
	// only be done for serialization and to update other services; otherwise,
	// rely on methods like `CanAccessPage()`.
	URLPatternSet GetUserBlockedHosts() const;

	// Returns list of hosts for this extension that enterprise policy has
	// explicitly blocked or allowed extensions to run on. If the extension uses
	// the default set, this will fall back to `GetDefaultPolicy*Hosts()`.
	// This should only be used for 1. Serialization when initializing renderers
	// or 2. Called from utility methods above. For all other uses, call utility
	// methods instead (e.g. CanAccessPage()).
	URLPatternSet policy_blocked_hosts() const;
	URLPatternSet policy_allowed_hosts() const;

	// Check if a specific URL is blocked by policy from extension use at runtime.
	bool IsPolicyBlockedHost(const GURL& url) const {
	base::AutoLock auto_lock(runtime_lock_);
	return IsPolicyBlockedHostUnsafe(url);
	}

	#if defined(UNIT_TEST)
	const PermissionSet* GetTabSpecificPermissionsForTesting(int tab_id) const {
	base::AutoLock auto_lock(runtime_lock_);
	return GetTabSpecificPermissions(tab_id);
	}
	#endif

	private:
	// Gets the tab-specific host permissions of `tab_id`, or NULL if there
	// aren't any.
	// Must be called with `runtime_lock_` acquired.
	const PermissionSet* GetTabSpecificPermissions(int tab_id) const;

	// Returns whether or not the extension is permitted to run on the given page,
	// checking against `permitted_url_patterns` and `tab_url_patterns` in
	// addition to blocking special sites (like the webstore or chrome:// urls).
	// Must be called with `runtime_lock_` acquired.
	PageAccess CanRunOnPage(const GURL& document_url,
	const URLPatternSet& permitted_url_patterns,
	const URLPatternSet& withheld_url_patterns,
	const URLPatternSet* tab_url_patterns,
	std::string* error) const;

	// Check if a specific URL is blocked by policy from extension use at runtime.
	// You must acquire the runtime_lock_ before calling.
	bool IsPolicyBlockedHostUnsafe(const GURL& url) const;

	// The associated extension's id.
	ExtensionId extension_id_;

	// The associated extension's manifest type.
	Manifest::Type manifest_type_;

	// The associated extension's location.
	mojom::ManifestLocation location_;

	mutable base::Lock runtime_lock_;

	// The permission's which are currently active on the extension during
	// runtime.
	// Unsafe indicates that we must lock anytime this is directly accessed.
	// Unless you need to change `active_permissions_unsafe_`, use the (safe)
	// active_permissions() accessor.
	mutable std::unique_ptr<const PermissionSet> active_permissions_unsafe_;

	// The permissions the extension requested, but was not granted due because
	// they are too powerful. This includes things like all_hosts.
	// Unsafe indicates that we must lock anytime this is directly accessed.
	// Unless you need to change `withheld_permissions_unsafe_`, use the (safe)
	// withheld_permissions() accessor.
	mutable std::unique_ptr<const PermissionSet> withheld_permissions_unsafe_;

	// The list of hosts an extension may not interact with by policy.
	// Unless you need to change `policy_blocked_hosts_unsafe_`, use the (safe)
	// policy_blocked_hosts() accessor.
	mutable URLPatternSet policy_blocked_hosts_unsafe_;

	// The exclusive list of hosts an extension may interact with by policy.
	// Unless you need to change `policy_allowed_hosts_unsafe_`, use the (safe)
	// policy_allowed_hosts() accessor.
	mutable URLPatternSet policy_allowed_hosts_unsafe_;

	// An identifier for the context associated with the PermissionsData.
	// This is required in order to properly map the context to the right default
	// default policy-level and user-level settings.
	// If empty, these settings are ignored. This should mostly only be the case
	// in unittests.
	mutable std::optional<int> context_id_;

	// Whether the extension uses the default policy host restrictions.
	mutable bool uses_default_policy_host_restrictions_ = true;

	mutable TabPermissionsMap tab_specific_permissions_;

	mutable std::unique_ptr<base::ThreadChecker> thread_checker_;
	};

	} // namespace extensions

	#endif // EXTENSIONS_COMMON_PERMISSIONS_PERMISSIONS_DATA_H_