// Copyright 2024 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "net/device_bound_sessions/session_inclusion_rules.h"

#include <initializer_list>

#include "base/strings/string_util.h"
#include "net/base/registry_controlled_domains/registry_controlled_domain.h"
#include "net/device_bound_sessions/proto/storage.pb.h"
#include "net/device_bound_sessions/session_error.h"
#include "testing/gtest/include/gtest/gtest.h"
#include "url/gurl.h"
#include "url/origin.h"

namespace net::device_bound_sessions {

namespace {

using Result = SessionInclusionRules::InclusionResult;
using RuleType = SessionParams::Scope::Specification::Type;

// These tests depend on the registry_controlled_domains code, so assert ahead
// of time that the eTLD+1 is what we expect, for clarity and to avoid confusing
// test failures.
void AssertDomainAndRegistry(const url::Origin& origin,
                             const std::string& expected_domain_and_registry) {
  ASSERT_EQ(
      registry_controlled_domains::GetDomainAndRegistry(
          origin, registry_controlled_domains::INCLUDE_PRIVATE_REGISTRIES),
      expected_domain_and_registry)
      << "Unexpected domain and registry.";
}

}  // namespace

class SessionInclusionRulesTest : public ::testing::Test {
 public:
  struct EvaluateUrlTestCase {
    const char* url;
    Result expected_result;
  };

  struct AddUrlRuleTestCase {
    RuleType rule_type;
    const char* host_pattern;
    const char* path_prefix;
    // This is kSuccess if there is no error expected when adding.
    SessionError::ErrorType expected_is_added_result;
  };

  SessionInclusionRulesTest() = default;

  void SetOrigin(const url::Origin& origin) { origin_ = origin; }

  void SetIncludeSite(bool include_site) {
    params_.include_site = include_site;
  }

  void CheckMayIncludeSite(bool expected_may_include_site) {
    auto inclusion_rules_or_error =
        SessionInclusionRules::Create(origin_, params_, GURL());
    ASSERT_TRUE(inclusion_rules_or_error.has_value());
    SessionInclusionRules& rules = *inclusion_rules_or_error;
    EXPECT_EQ(rules.may_include_site_for_testing(), expected_may_include_site);
  }

  void CheckEvaluateUrlTestCases(
      std::initializer_list<EvaluateUrlTestCase> test_cases) {
    auto inclusion_rules_or_error =
        SessionInclusionRules::Create(origin_, params_, GURL());
    ASSERT_TRUE(inclusion_rules_or_error.has_value());
    SessionInclusionRules& rules = *inclusion_rules_or_error;

    for (const auto& test_case : test_cases) {
      SCOPED_TRACE(test_case.url);
      EXPECT_EQ(rules.EvaluateRequestUrl(GURL(test_case.url)),
                test_case.expected_result);
    }
  }

  void CheckAddUrlRuleTestCases(
      std::initializer_list<AddUrlRuleTestCase> test_cases) {
    auto inclusion_rules_or_error =
        SessionInclusionRules::Create(origin_, params_, GURL());
    ASSERT_TRUE(inclusion_rules_or_error.has_value());

    for (const auto& test_case : test_cases) {
      SCOPED_TRACE(base::JoinString(
          {test_case.host_pattern, test_case.path_prefix}, ", "));
      params_.specifications.emplace_back(
          test_case.rule_type, test_case.host_pattern, test_case.path_prefix);
      inclusion_rules_or_error =
          SessionInclusionRules::Create(origin_, params_, GURL());
      EXPECT_EQ(inclusion_rules_or_error.has_value(),
                test_case.expected_is_added_result == SessionError::kSuccess);
      if (test_case.expected_is_added_result != SessionError::kSuccess &&
          !inclusion_rules_or_error.has_value()) {
        EXPECT_EQ(inclusion_rules_or_error.error().type,
                  test_case.expected_is_added_result);
      }
      if (!inclusion_rules_or_error.has_value()) {
        // Forget about this rule so that future rules can be evaluated.
        params_.specifications.pop_back();
      }
    }
  }

  const SessionParams::Scope& params() { return params_; }

 private:
  SessionParams::Scope params_;
  url::Origin origin_;
};

TEST_F(SessionInclusionRulesTest, DefaultIncludeOriginMayNotIncludeSite) {
  url::Origin subdomain_origin =
      url::Origin::Create(GURL("https://some.site.test"));

  AssertDomainAndRegistry(subdomain_origin, "site.test");

  SetOrigin(subdomain_origin);

  CheckMayIncludeSite(false);

  CheckEvaluateUrlTestCases(
      {// URL not valid.
       {"", Result::kExclude},
       // Origins match.
       {"https://some.site.test", Result::kInclude},
       // Path is allowed.
       {"https://some.site.test/path", Result::kInclude},
       // Not same scheme.
       {"http://some.site.test", Result::kExclude},
       // Not same host (same-site subdomain).
       {"https://some.other.site.test", Result::kExclude},
       // Not same host (superdomain).
       {"https://site.test", Result::kExclude},
       // Unrelated site.
       {"https://unrelated.test", Result::kExclude},
       // Not same port.
       {"https://some.site.test:8888", Result::kExclude}});
}

TEST_F(SessionInclusionRulesTest, DefaultIncludeOriginThoughMayIncludeSite) {
  url::Origin root_site_origin = url::Origin::Create(GURL("https://site.test"));

  AssertDomainAndRegistry(root_site_origin, "site.test");

  SetOrigin(root_site_origin);
  CheckMayIncludeSite(true);

  // All expectations are as above. Even though including the site is allowed,
  // because the origin's host is its root eTLD+1, it is still limited to a
  // default origin inclusion_rules because it did not set include_site.
  CheckEvaluateUrlTestCases({// URL not valid.
                             {"", Result::kExclude},
                             // Origins match.
                             {"https://site.test", Result::kInclude},
                             // Path is allowed.
                             {"https://site.test/path", Result::kInclude},
                             // Not same scheme.
                             {"http://site.test", Result::kExclude},
                             // Not same host (same-site subdomain).
                             {"https://other.site.test", Result::kExclude},
                             // Not same host (superdomain).
                             {"https://test", Result::kExclude},
                             // Unrelated site.
                             {"https://unrelated.test", Result::kExclude},
                             // Not same port.
                             {"https://site.test:8888", Result::kExclude}});
}

TEST_F(SessionInclusionRulesTest, IncludeSiteAttemptedButNotAllowed) {
  url::Origin subdomain_origin =
      url::Origin::Create(GURL("https://some.site.test"));

  AssertDomainAndRegistry(subdomain_origin, "site.test");

  SessionParams::Scope params;
  params.include_site = true;
  auto rules_or_error = SessionInclusionRules::Create(
      subdomain_origin, params, GURL("https://some.site.test/refresh"));
  ASSERT_FALSE(rules_or_error.has_value());
  EXPECT_EQ(rules_or_error.error().type,
            SessionError::kInvalidScopeIncludeSite);
}

TEST_F(SessionInclusionRulesTest, IncludeSite) {
  url::Origin root_site_origin = url::Origin::Create(GURL("https://site.test"));

  AssertDomainAndRegistry(root_site_origin, "site.test");

  SetOrigin(root_site_origin);
  CheckMayIncludeSite(true);

  SetIncludeSite(true);

  CheckEvaluateUrlTestCases(
      {// URL not valid.
       {"", Result::kExclude},
       // Origins match.
       {"https://site.test", Result::kInclude},
       // Path is allowed.
       {"https://site.test/path", Result::kInclude},
       // Not same scheme (site is schemeful).
       {"http://site.test", Result::kExclude},
       // Same-site subdomain is allowed.
       {"https://some.site.test", Result::kInclude},
       {"https://some.other.site.test", Result::kInclude},
       // Not same host (superdomain).
       {"https://test", Result::kExclude},
       // Unrelated site.
       {"https://unrelated.test", Result::kExclude},
       // Other port is allowed because whole site is included.
       {"https://site.test:8888", Result::kInclude}});
}

TEST_F(SessionInclusionRulesTest, AddUrlRuleToOriginOnly) {
  url::Origin subdomain_origin =
      url::Origin::Create(GURL("https://some.site.test"));

  AssertDomainAndRegistry(subdomain_origin, "site.test");

  SetOrigin(subdomain_origin);
  CheckMayIncludeSite(false);

  CheckAddUrlRuleTestCases(
      {// Host pattern equals origin's host. Path is valid.
       {RuleType::kExclude, "some.site.test", "/static",
        SessionError::kSuccess},
       // Add an opposite rule to check later.
       {RuleType::kInclude, "some.site.test", "/static/included",
        SessionError::kSuccess},
       // Path not valid.
       {RuleType::kExclude, "some.site.test", "NotAPath",
        SessionError::kInvalidScopeRulePath},
       // Has a valid wildcard, but the origin scoping ensures it will
       // only match some.site.test.
       {RuleType::kInclude, "*.site.test", "/static/wildcard_match/",
        SessionError::kSuccess},
       // Other host patterns are not accepted.
       {RuleType::kInclude, "unrelated.test", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch},
       {RuleType::kInclude, "site.test", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch},
       {RuleType::kInclude, "other.site.test", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch},
       {RuleType::kInclude, "https://some.site.test", "/static/https_rule/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch},
       {RuleType::kInclude, "some.site.test:8000", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch}});

  EXPECT_EQ(params().specifications.size(), 3u);

  CheckEvaluateUrlTestCases(
      {// Matches the rule.
       {"https://some.site.test/static", Result::kExclude},
       // A path under the rule's path prefix is subject to the rule.
       {"https://some.site.test/static/some/thing", Result::kExclude},
       // These do not match the rule, so are subject to the basic rules (the
       // origin).
       {"https://some.site.test/staticcccccccc", Result::kInclude},
       {"https://other.site.test/static", Result::kExclude},
       // The more recently added rule wins out.
       {"https://some.site.test/static/included", Result::kInclude},
       {"https://some.site.test/valid_path", Result::kInclude},
       // The wildcard matching is valid, but only matches the origin.
       {"https://some.site.test/static/wildcard_match/", Result::kInclude},
       // The origin scoping takes precedence over the rule.
       {"https://subdomain.site.test/static/wildcard_match/", Result::kExclude},
       {"https://unrelated.test/", Result::kExclude},
       {"https://site.test/", Result::kExclude},
       {"https://other.test/", Result::kExclude},
       {"https://some.site.test/static/https_rule/", Result::kExclude},
       {"https://some.site.test:8000/", Result::kExclude}});

  // Note that what matters is when the rule was added, not how specific the URL
  // path prefix is. Let's add another rule now to show that.
  CheckAddUrlRuleTestCases(
      {{RuleType::kExclude, "some.site.test", "/", SessionError::kSuccess}});
  CheckEvaluateUrlTestCases(
      {{"https://some.site.test/static/included", Result::kExclude}});
}

TEST_F(SessionInclusionRulesTest, AddUrlRuleToOriginThatMayIncludeSite) {
  url::Origin root_site_origin = url::Origin::Create(GURL("https://site.test"));

  AssertDomainAndRegistry(root_site_origin, "site.test");

  SetOrigin(root_site_origin);
  CheckMayIncludeSite(true);

  // Without any rules yet, the basic rules is just the origin, because
  // include_site was not set.
  CheckEvaluateUrlTestCases({{"https://site.test/static", Result::kInclude},
                             {"https://other.site.test", Result::kExclude}});

  CheckAddUrlRuleTestCases(
      {{RuleType::kExclude, "excluded.site.test", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch},
       {RuleType::kInclude, "included.site.test", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch},
       {RuleType::kExclude, "site.test", "/static", SessionError::kSuccess},
       {RuleType::kInclude, "unrelated.test", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch}});

  EXPECT_EQ(params().specifications.size(), 1u);

  CheckEvaluateUrlTestCases(
      {// Path is excluded by rule.
       {"https://site.test/static", Result::kExclude},
       // Session is origin-scoped, so this rule is ignored.
       {"https://excluded.site.test", Result::kExclude},
       // Session is origin-scoped, so this rule is ignored.
       {"https://included.site.test", Result::kExclude},
       // Rule does not apply to wrong scheme.
       {"http://included.site.test", Result::kExclude},
       // No rules applies to these URLs, so the basic
       // rules (origin) applies.
       {"https://other.site.test", Result::kExclude},
       {"https://site.test/stuff", Result::kInclude},
       // Origin scoping takes precedence over rule.
       {"https://unrelated.test/", Result::kExclude}});
}

TEST_F(SessionInclusionRulesTest, AddUrlRuleToRulesIncludingSite) {
  url::Origin root_site_origin = url::Origin::Create(GURL("https://site.test"));

  AssertDomainAndRegistry(root_site_origin, "site.test");

  SetOrigin(root_site_origin);
  CheckMayIncludeSite(true);
  SetIncludeSite(true);

  // Without any rules yet, the basic rules is the site.
  CheckEvaluateUrlTestCases({{"https://site.test/static", Result::kInclude},
                             {"https://other.site.test", Result::kInclude}});

  // Since the origin's host is the root eTLD+1, it is allowed to set rules that
  // affect URLs other than the setting origin (but still within the site).
  CheckAddUrlRuleTestCases(
      {{RuleType::kExclude, "excluded.site.test", "/", SessionError::kSuccess},
       {RuleType::kInclude, "included.site.test", "/", SessionError::kSuccess},
       {RuleType::kExclude, "site.test", "/static", SessionError::kSuccess},
       {RuleType::kInclude, "unrelated.test", "/",
        SessionError::kScopeRuleSiteScopedHostPatternMismatch}});

  EXPECT_EQ(params().specifications.size(), 3u);

  CheckEvaluateUrlTestCases(
      {// Path is excluded by rule.
       {"https://site.test/static", Result::kExclude},
       // Rule excludes URL explicitly.
       {"https://excluded.site.test", Result::kExclude},
       // Rule includes URL explicitly.
       {"https://included.site.test", Result::kInclude},
       // Rule does not apply to wrong scheme.
       {"http://included.site.test", Result::kExclude},
       // No rule applies to these URLs, so the basic rules (site) applies.
       {"https://other.site.test", Result::kInclude},
       {"https://site.test/stuff", Result::kInclude},
       // Site scoping takes precedence over rule.
       {"https://unrelated.test/", Result::kExclude}});
}

TEST_F(SessionInclusionRulesTest, AddUrlRuleToRulesIncludingOrigin) {
  url::Origin root_site_origin = url::Origin::Create(GURL("https://site.test"));

  AssertDomainAndRegistry(root_site_origin, "site.test");

  SetOrigin(root_site_origin);
  CheckMayIncludeSite(true);
  SetIncludeSite(false);

  CheckAddUrlRuleTestCases(
      {{RuleType::kExclude, "excluded.site.test", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch},
       {RuleType::kInclude, "included.site.test", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch},
       {RuleType::kExclude, "site.test", "/static", SessionError::kSuccess},
       {RuleType::kInclude, "unrelated.test", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch}});

  EXPECT_EQ(params().specifications.size(), 1u);

  CheckEvaluateUrlTestCases({// Path is excluded by rule.
                             {"https://site.test/static", Result::kExclude},
                             // Rejected rules
                             {"https://excluded.site.test", Result::kExclude},
                             {"https://included.site.test", Result::kExclude},
                             // No rules applies to these URLs, so the basic
                             // rules (which is only the origin) applies.
                             {"https://other.site.test", Result::kExclude},
                             {"https://site.test/stuff", Result::kInclude},
                             // Site scoping takes precedence over rule.
                             {"https://unrelated.test/", Result::kExclude}});
}

TEST_F(SessionInclusionRulesTest, UrlRuleParsing) {
  url::Origin root_site_origin = url::Origin::Create(GURL("https://site.test"));

  AssertDomainAndRegistry(root_site_origin, "site.test");

  // Use the most permissive type of inclusion_rules, to hit the interesting
  // edge cases.
  SetOrigin(root_site_origin);
  CheckMayIncludeSite(true);

  CheckAddUrlRuleTestCases(
      {// Empty host pattern not permitted.
       {RuleType::kExclude, "", "/",
        SessionError::kInvalidScopeRuleHostPattern},
       // Host pattern that is only whitespace is not permitted.
       {RuleType::kExclude, " ", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch},
       // Forbidden characters in host_pattern.
       {RuleType::kExclude, "https://site.test", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch},
       {RuleType::kExclude, "site.test:8888", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch},
       {RuleType::kExclude, "site.test,other.test", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch},
       // Non-IPv6-allowable characters within the brackets.
       {RuleType::kExclude, "[*.:abcd::3:4:ff]", "/",
        SessionError::kInvalidScopeRuleHostPattern},
       {RuleType::kExclude, "[1:ab+cd::3:4:ff]", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch},
       {RuleType::kExclude, "[[1:abcd::3:4:ff]]", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch},
       // Internal wildcard characters are forbidden in the host pattern.
       {RuleType::kExclude, "sub.*.site.test", "/",
        SessionError::kInvalidScopeRuleHostPattern},
       // Multiple wildcard characters are forbidden in the host pattern.
       {RuleType::kExclude, "*.sub.*.site.test", "/",
        SessionError::kInvalidScopeRuleHostPattern},
       // Wildcard must be followed by a dot.
       {RuleType::kExclude, "*site.test", "/",
        SessionError::kInvalidScopeRuleHostPattern},
       // Wildcard may be followed by an eTLD, but will only match
       // for requests matching the scope origin or requests that are
       // subdomains of the site (depending on `include_site`).
       {RuleType::kExclude, "*.test", "/", SessionError::kSuccess},
       // Other sites are not allowed.
       {RuleType::kExclude, "unrelated.site", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch},
       {RuleType::kExclude, "4.31.198.44", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch},
       {RuleType::kExclude, "[1:abcd::3:4:ff]", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch},
       {RuleType::kExclude, "co.uk", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch},
       {RuleType::kExclude, "com", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch}});
}

TEST_F(SessionInclusionRulesTest, UrlRuleParsingTopLevelDomain) {
  url::Origin tld_origin = url::Origin::Create(GURL("https://com"));

  AssertDomainAndRegistry(tld_origin, "");

  SetOrigin(tld_origin);
  CheckMayIncludeSite(false);

  CheckAddUrlRuleTestCases(
      {// Exact host is allowed.
       {RuleType::kExclude, "com", "/", SessionError::kSuccess},
       // Wildcards are not permitted.
       {RuleType::kExclude, "*.com", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch},
       // Other hosts with no registrable domain are not allowed.
       {RuleType::kExclude, "4.31.198.44", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch},
       {RuleType::kExclude, "[1:abcd::3:4:ff]", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch},
       {RuleType::kExclude, "co.uk", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch}});
}

TEST_F(SessionInclusionRulesTest, UrlRuleParsingIPv4Address) {
  url::Origin ip_origin = url::Origin::Create(GURL("https://4.31.198.44"));

  AssertDomainAndRegistry(ip_origin, "");

  SetOrigin(ip_origin);
  CheckMayIncludeSite(false);

  CheckAddUrlRuleTestCases(
      {// Exact host is allowed.
       {RuleType::kExclude, "4.31.198.44", "/", SessionError::kSuccess},
       // Wildcards are not permitted for IPv4 addresses.
       {RuleType::kExclude, "*.31.198.44", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch},
       {RuleType::kExclude, "*.4.31.198.44", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch},
       // Other hosts with no registrable domain are not allowed.
       {RuleType::kExclude, "[1:abcd::3:4:ff]", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch},
       {RuleType::kExclude, "co.uk", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch},
       {RuleType::kExclude, "com", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch}});
}

TEST_F(SessionInclusionRulesTest, UrlRuleParsingIPv6Address) {
  url::Origin ipv6_origin =
      url::Origin::Create(GURL("https://[1:abcd::3:4:ff]"));

  AssertDomainAndRegistry(ipv6_origin, "");

  SetOrigin(ipv6_origin);
  CheckMayIncludeSite(false);

  CheckAddUrlRuleTestCases(
      {// Exact host is allowed.
       {RuleType::kExclude, "[1:abcd::3:4:ff]", "/", SessionError::kSuccess},
       // Wildcards are not permitted.
       {RuleType::kExclude, "*.[1:abcd::3:4:ff]", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch},
       // Brackets mismatched is not allowed.
       {RuleType::kExclude, "[1:abcd::3:4:ff", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch},
       {RuleType::kExclude, "1:abcd::3:4:ff]", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch},
       // Non-IPv6-allowable characters within the brackets is not allowed.
       {RuleType::kExclude, "[*.:abcd::3:4:ff]", "/",
        SessionError::kInvalidScopeRuleHostPattern},
       {RuleType::kExclude, "[1:ab+cd::3:4:ff]", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch},
       {RuleType::kExclude, "[[1:abcd::3:4:ff]]", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch},
       // Other hosts with no registrable domain are not allowed.
       {RuleType::kExclude, "4.31.198.44", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch},
       {RuleType::kExclude, "co.uk", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch},
       {RuleType::kExclude, "com", "/",
        SessionError::kScopeRuleOriginScopedHostPatternMismatch}});
}

// This test is more to document the current behavior than anything else. We may
// discover a need for more comprehensive support for port numbers in the
// future.
TEST_F(SessionInclusionRulesTest, NonstandardPort) {
  url::Origin nonstandard_port_origin =
      url::Origin::Create(GURL("https://site.test:8888"));

  AssertDomainAndRegistry(nonstandard_port_origin, "site.test");

  SetOrigin(nonstandard_port_origin);
  CheckMayIncludeSite(true);

  // Without any URL rules, the default origin rule allows only the same origin.
  CheckEvaluateUrlTestCases({{"https://site.test", Result::kExclude},
                             {"https://site.test:8888", Result::kInclude},
                             {"https://other.site.test", Result::kExclude}});

  // If we include_site, then same-site URLs regardless of port number are
  // included.
  SetIncludeSite(true);
  CheckEvaluateUrlTestCases({{"https://site.test", Result::kInclude},
                             {"https://site.test:8888", Result::kInclude},
                             {"https://site.test:1234", Result::kInclude},
                             {"https://other.site.test", Result::kInclude}});

  // However, adding URL rules to an inclusion_rules based on such an origin may
  // lead to unintuitive outcomes. It is not possible to specify a rule that
  // applies to the same origin as the setting origin if the setting origin has
  // a nonstandard port.
  CheckAddUrlRuleTestCases(
      {// The pattern is not accepted
       {RuleType::kInclude, "site.test:8888", "/",
        SessionError::kScopeRuleSiteScopedHostPatternMismatch},
       // A rule with the same host without port specified is accepted.
       // This rule applies to any URL with the specified host.
       {RuleType::kExclude, "site.test", "/", SessionError::kSuccess},
       // The pattern is not accepted
       {RuleType::kInclude, "site.test:443", "/",
        SessionError::kScopeRuleSiteScopedHostPatternMismatch}});

  EXPECT_EQ(params().specifications.size(), 1u);

  CheckEvaluateUrlTestCases(
      {// This is same-origin but gets caught in the "site.test" rule because
       // the rule didn't specify a port.
       {"https://site.test:8888", Result::kExclude},
       // This is same-site but gets caught in the "site.test" rule because
       // the rule didn't specify a port.
       {"https://site.test:1234", Result::kExclude},
       // Same-site is included by basic rules.
       {"https://other.site.test", Result::kInclude},
       // Also excluded explicitly by rule.
       {"https://site.test", Result::kExclude},
       {"https://site.test:443", Result::kExclude}});
}

TEST_F(SessionInclusionRulesTest, ToFromProto) {
  // Create a valid SessionInclusionRules object with default inclusion rule and
  // a couple of additional URL rules.
  url::Origin root_site_origin = url::Origin::Create(GURL("https://site.test"));
  AssertDomainAndRegistry(root_site_origin, "site.test");

  SessionParams::Scope params;
  params.include_site = true;
  params.specifications = {{RuleType::kExclude, "excluded.site.test", "/"},
                           {RuleType::kInclude, "included.site.test", "/"}};
  auto inclusion_rules_or_error = SessionInclusionRules::Create(
      root_site_origin, std::move(params), GURL());
  ASSERT_TRUE(inclusion_rules_or_error.has_value());
  SessionInclusionRules& rules = *inclusion_rules_or_error;

  // Create a corresponding proto object and validate.
  proto::SessionInclusionRules proto = rules.ToProto();
  EXPECT_EQ(root_site_origin.Serialize(), proto.origin());
  EXPECT_TRUE(proto.do_include_site());
  ASSERT_EQ(proto.url_rules().size(), 2);
  {
    const auto& rule = proto.url_rules(0);
    EXPECT_EQ(rule.rule_type(), proto::RuleType::EXCLUDE);
    EXPECT_EQ(rule.host_pattern(), "excluded.site.test");
    EXPECT_EQ(rule.path_prefix(), "/");
  }
  {
    const auto& rule = proto.url_rules(1);
    EXPECT_EQ(rule.rule_type(), proto::RuleType::INCLUDE);
    EXPECT_EQ(rule.host_pattern(), "included.site.test");
    EXPECT_EQ(rule.path_prefix(), "/");
  }

  // Create a SessionInclusionRules object from the proto and verify
  // that it is the same as the original.
  std::optional<SessionInclusionRules> restored_inclusion_rules =
      SessionInclusionRules::CreateFromProto(proto);
  ASSERT_TRUE(restored_inclusion_rules.has_value());
  EXPECT_EQ(*restored_inclusion_rules, rules);
}

TEST_F(SessionInclusionRulesTest, FailCreateFromInvalidProto) {
  // Empty proto.
  {
    proto::SessionInclusionRules proto;
    EXPECT_FALSE(SessionInclusionRules::CreateFromProto(proto));
  }
  // Opaque origin.
  {
    proto::SessionInclusionRules proto;
    proto.set_origin("about:blank");
    proto.set_do_include_site(false);
    EXPECT_FALSE(SessionInclusionRules::CreateFromProto(proto));
  }

  // Create a fully populated proto.
  url::Origin root_site_origin = url::Origin::Create(GURL("https://site.test"));
  SessionParams::Scope params;
  params.include_site = true;
  params.specifications = {{RuleType::kExclude, "excluded.site.test", "/"},
                           {RuleType::kInclude, "included.site.test", "/"}};
  auto inclusion_rules_or_error = SessionInclusionRules::Create(
      root_site_origin, std::move(params), GURL());
  ASSERT_TRUE(inclusion_rules_or_error.has_value());
  SessionInclusionRules& rules = *inclusion_rules_or_error;
  proto::SessionInclusionRules proto = rules.ToProto();

  // The proto must actually be valid, or none of the following tests will be
  // validating anything.
  ASSERT_TRUE(SessionInclusionRules::CreateFromProto(proto).has_value());

  // Test for missing proto fields by clearing the fields one at a time.
  {
    proto::SessionInclusionRules p(proto);
    p.clear_origin();
    EXPECT_FALSE(SessionInclusionRules::CreateFromProto(p));
  }
  {
    proto::SessionInclusionRules p(proto);
    p.clear_do_include_site();
    EXPECT_FALSE(SessionInclusionRules::CreateFromProto(p));
  }
  // URL rules with missing parameters.
  {
    proto::SessionInclusionRules p(proto);
    p.mutable_url_rules(0)->clear_rule_type();
    EXPECT_FALSE(SessionInclusionRules::CreateFromProto(p));
  }
  {
    proto::SessionInclusionRules p(proto);
    p.mutable_url_rules(0)->clear_host_pattern();
    EXPECT_FALSE(SessionInclusionRules::CreateFromProto(p));
  }
  {
    proto::SessionInclusionRules p(proto);
    p.mutable_url_rules(0)->clear_path_prefix();
    EXPECT_FALSE(SessionInclusionRules::CreateFromProto(p));
  }
}

}  // namespace net::device_bound_sessions