/* Any copyright is dedicated to the Public Domain.
   http://creativecommons.org/publicdomain/zero/1.0/ */

"use strict";

// The test is going to test different cookie behaviors. So, it will take a
// longer time to complete.
requestLongerTimeout(3);

add_setup(() => {
  Services.prefs.setIntPref(
    "network.cookie.cookieBehavior",
    Ci.nsICookieService.BEHAVIOR_PARTITION_FOREIGN
  );
  Services.prefs.setBoolPref(
    "network.cookieJarSettings.unblocked_for_testing",
    true
  );
  Services.prefs.setBoolPref("network.cookie.CHIPS.enabled", true);
  Services.prefs.setBoolPref("network.cookie.CHIPS.affectsTCP", false);
  Services.prefs.setBoolPref("dom.storage_access.enabled", true);
  Services.prefs.setBoolPref("dom.storage_access.prompt.testing", true);
  Services.cookies.removeAll();
  Services.perms.removeAll();
});

registerCleanupFunction(() => {
  Services.prefs.clearUserPref("network.cookie.cookieBehavior");
  Services.prefs.clearUserPref(
    "network.cookieJarSettings.unblocked_for_testing"
  );
  Services.prefs.clearUserPref("network.cookie.CHIPS.enabled");
  Services.prefs.clearUserPref("dom.storage_access.enabled");
  Services.prefs.clearUserPref("dom.storage_access.prompt.testing");
  Services.cookies.removeAll();
  Services.perms.removeAll();
});

const COOKIE_PARTITIONED =
  "cookie=partitioned; Partitioned; Secure; SameSite=None;";
const COOKIE_UNPARTITIONED = "cookie=unpartitioned; Secure; SameSite=None;";

const PATH = "/browser/netwerk/cookie/test/browser/";
const PATH_EMPTY = PATH + "file_empty.html";
const HTTP_COOKIE_SET = PATH + "chips.sjs?set";
const HTTP_COOKIE_GET = PATH + "chips.sjs?get";

const FIRST_PARTY = "example.com";
const THIRD_PARTY = "example.org";

const URL_DOCUMENT_FIRSTPARTY = "https://" + FIRST_PARTY + PATH_EMPTY;
const URL_DOCUMENT_THIRDPARTY = "https://" + THIRD_PARTY + PATH_EMPTY;
const FIRST_PARTY_DOMAIN = "https://" + FIRST_PARTY;
const THIRD_PARTY_DOMAIN = "https://" + THIRD_PARTY;
const URL_HTTP_FIRSTPARTY = FIRST_PARTY_DOMAIN + "/" + HTTP_COOKIE_SET;
const URL_HTTP_THIRDPARTY = THIRD_PARTY_DOMAIN + "/" + HTTP_COOKIE_SET;

function createOriginAttributes(partitionKey) {
  return JSON.stringify({
    firstPartyDomain: "",
    geckoViewSessionContextId: "",
    inIsolatedMozBrowser: false,
    partitionKey,
    privateBrowsingId: 0,
    userContextId: 0,
  });
}

function createPartitonKey(url) {
  let uri = NetUtil.newURI(url);
  return `(${uri.scheme},${uri.host})`;
}

// OriginAttributes used to access partitioned and unpartitioned cookie jars
// in all tests.
const partitionedOAs = createOriginAttributes(
  createPartitonKey(URL_DOCUMENT_FIRSTPARTY)
);
const unpartitionedOAs = createOriginAttributes("");

// Set partitioned and unpartitioned cookie from first-party document.
// CHIPS "Partitioned" cookie MUST always be stored in partitioned jar.
// This uses CookieServiceChild internally. CookieService is not explicitly
// tested since CHIPS are in the common function
// CookieCommons::CreateCookieFromDocument().
add_task(
  async function test_chips_store_partitioned_document_first_party_child() {
    const TEST_COOKIE_BEHAVIORS = [
      Ci.nsICookieService.BEHAVIOR_ACCEPT,
      Ci.nsICookieService.BEHAVIOR_REJECT_FOREIGN,
      Ci.nsICookieService.BEHAVIOR_REJECT_TRACKER,
      Ci.nsICookieService.BEHAVIOR_PARTITION_FOREIGN,
    ];

    for (let behavior of TEST_COOKIE_BEHAVIORS) {
      Services.prefs.setIntPref("network.cookie.cookieBehavior", behavior);

      const tab = BrowserTestUtils.addTab(gBrowser, URL_DOCUMENT_FIRSTPARTY);
      const browser = gBrowser.getBrowserForTab(tab);
      await BrowserTestUtils.browserLoaded(browser);

      // Set partitioned and unpartitioned cookie from document child-side
      await SpecialPowers.spawn(
        browser,
        [COOKIE_PARTITIONED, COOKIE_UNPARTITIONED],
        (partitioned, unpartitioned) => {
          content.document.cookie = partitioned;
          content.document.cookie = unpartitioned;
        }
      );

      // Get cookies from partitioned jar
      let partitioned = Services.cookies.getCookiesWithOriginAttributes(
        partitionedOAs,
        FIRST_PARTY
      );
      // Get cookies from unpartitioned jar
      let unpartitioned = Services.cookies.getCookiesWithOriginAttributes(
        unpartitionedOAs,
        FIRST_PARTY
      );

      // Assert partitioned/unpartitioned cookie were stored in correct jars
      Assert.equal(partitioned.length, 1);
      Assert.equal(partitioned[0].value, "partitioned");
      Assert.equal(unpartitioned.length, 1);
      Assert.equal(unpartitioned[0].value, "unpartitioned");

      // Cleanup
      BrowserTestUtils.removeTab(tab);
      Services.cookies.removeAll();
    }
  }
);

// Set partitioned and unpartitioned cookie from third-party document with storage
// access. CHIPS "Partitioned" cookie MUST always be stored in partitioned jar.
// This uses CookieServiceChild internally.  CookieService is not explicitly
// tested since CHIPS are in the common function
// CookieCommons::CreateCookieFromDocument().
add_task(
  async function test_chips_store_partitioned_document_third_party_storage_access_child() {
    // We exclude cookieBehavior BEHAVIOR_REJECT here because the StorageAccess
    // cannot be granted.
    const TEST_COOKIE_BEHAVIORS = [
      Ci.nsICookieService.BEHAVIOR_ACCEPT,
      Ci.nsICookieService.BEHAVIOR_REJECT_TRACKER,
      Ci.nsICookieService.BEHAVIOR_PARTITION_FOREIGN,
    ];

    for (let behavior of TEST_COOKIE_BEHAVIORS) {
      Services.prefs.setIntPref("network.cookie.cookieBehavior", behavior);

      const tab = BrowserTestUtils.addTab(gBrowser, URL_DOCUMENT_FIRSTPARTY);
      const browser = gBrowser.getBrowserForTab(tab);
      await BrowserTestUtils.browserLoaded(browser);

      // Spawn document bc
      await SpecialPowers.spawn(
        browser,
        [URL_DOCUMENT_THIRDPARTY, COOKIE_PARTITIONED, COOKIE_UNPARTITIONED],
        async (url, partitioned, unpartitioned) => {
          let ifr = content.document.createElement("iframe");
          ifr.src = url;
          content.document.body.appendChild(ifr);
          await ContentTaskUtils.waitForEvent(ifr, "load");

          // Spawn iframe bc
          await SpecialPowers.spawn(
            await ifr.browsingContext,
            [partitioned, unpartitioned],
            async (partitioned, unpartitioned) => {
              SpecialPowers.wrap(
                content.document
              ).notifyUserGestureActivation();
              await SpecialPowers.addPermission(
                "storageAccessAPI",
                true,
                content.location.href
              );
              await SpecialPowers.wrap(content.document).requestStorageAccess();

              ok(
                await content.document.hasStorageAccess(),
                "example.org should have storageAccess"
              );

              content.document.cookie = partitioned;
              content.document.cookie = unpartitioned;
            }
          );
        }
      );

      // Get cookies from partitioned jar
      let partitioned = Services.cookies.getCookiesWithOriginAttributes(
        partitionedOAs,
        THIRD_PARTY
      );
      // Get cookies from unpartitioned jar
      let unpartitioned = Services.cookies.getCookiesWithOriginAttributes(
        unpartitionedOAs,
        THIRD_PARTY
      );

      // Assert partitioned/unpartitioned cookie were stored in correct jars
      Assert.equal(partitioned.length, 1);
      Assert.equal(partitioned[0].value, "partitioned");
      Assert.equal(unpartitioned.length, 1);
      Assert.equal(unpartitioned[0].value, "unpartitioned");

      // Cleanup
      BrowserTestUtils.removeTab(tab);
      Services.cookies.removeAll();
    }
  }
);

// Set partitioned and unpartitioned cookie from first-party http load.
// CHIPS "Partitioned" cookie MUST always be stored in partitioned jar.
// This calls CookieService::SetCookieStringFromHttp() internally.
add_task(async function test_chips_store_partitioned_http_first_party_parent() {
  const TEST_COOKIE_BEHAVIORS = [
    Ci.nsICookieService.BEHAVIOR_ACCEPT,
    Ci.nsICookieService.BEHAVIOR_REJECT_FOREIGN,
    Ci.nsICookieService.BEHAVIOR_REJECT_TRACKER,
    Ci.nsICookieService.BEHAVIOR_PARTITION_FOREIGN,
  ];

  for (let behavior of TEST_COOKIE_BEHAVIORS) {
    Services.prefs.setIntPref("network.cookie.cookieBehavior", behavior);

    // Set partitioned and unpartitioned cookie from http parent side through
    // chips.sjs being loaded.
    const tab = BrowserTestUtils.addTab(gBrowser, URL_HTTP_FIRSTPARTY);
    const browser = gBrowser.getBrowserForTab(tab);
    await BrowserTestUtils.browserLoaded(browser);

    // Get cookies from partitioned jar
    let partitioned = Services.cookies.getCookiesWithOriginAttributes(
      partitionedOAs,
      FIRST_PARTY
    );
    // Get cookies from unpartitioned jar
    let unpartitioned = Services.cookies.getCookiesWithOriginAttributes(
      unpartitionedOAs,
      FIRST_PARTY
    );

    // Assert partitioned/unpartitioned cookie were stored in correct jars
    Assert.equal(partitioned.length, 1);
    Assert.equal(partitioned[0].value, "partitioned");
    Assert.equal(unpartitioned.length, 1);
    Assert.equal(unpartitioned[0].value, "unpartitioned");

    // Cleanup
    BrowserTestUtils.removeTab(tab);
    Services.cookies.removeAll();
  }
});

// Set partitioned and unpartitioned cookie from third-party http load.
// CHIPS "Partitioned" cookie MUST always be stored in partitioned jar.
// This calls CookieService::SetCookieStringFromHttp() internally.
add_task(
  async function test_chips_store_partitioned_http_third_party_storage_access_parent() {
    // We exclude cookieBehavior BEHAVIOR_REJECT here because the StorageAccess
    // cannot be granted.
    const TEST_COOKIE_BEHAVIORS = [
      Ci.nsICookieService.BEHAVIOR_ACCEPT,
      Ci.nsICookieService.BEHAVIOR_REJECT_TRACKER,
      Ci.nsICookieService.BEHAVIOR_PARTITION_FOREIGN,
    ];

    for (let behavior of TEST_COOKIE_BEHAVIORS) {
      Services.prefs.setIntPref("network.cookie.cookieBehavior", behavior);
      const tab = BrowserTestUtils.addTab(gBrowser, URL_DOCUMENT_FIRSTPARTY);
      const browser = gBrowser.getBrowserForTab(tab);
      await BrowserTestUtils.browserLoaded(browser);

      // Spawn document bc
      await SpecialPowers.spawn(
        browser,
        [THIRD_PARTY_DOMAIN, URL_HTTP_THIRDPARTY],
        async (url, fetchUrl) => {
          let ifr = content.document.createElement("iframe");
          ifr.src = url;
          content.document.body.appendChild(ifr);
          // Send http request with "set" query parameter, partitioned and
          // unpartitioned cookie will be set through http response from chips.sjs.
          await ContentTaskUtils.waitForEvent(ifr, "load");

          // Spawn iframe bc
          await SpecialPowers.spawn(
            await ifr.browsingContext,
            [fetchUrl],
            async url => {
              SpecialPowers.wrap(
                content.document
              ).notifyUserGestureActivation();
              await SpecialPowers.addPermission(
                "storageAccessAPI",
                true,
                content.location.href
              );
              await SpecialPowers.wrap(content.document).requestStorageAccess();

              ok(
                await content.document.hasStorageAccess(),
                "example.org should have storageAccess"
              );

              await content.fetch(url);
            }
          );
        }
      );

      // Get cookies from partitioned jar
      let partitioned = Services.cookies.getCookiesWithOriginAttributes(
        partitionedOAs,
        THIRD_PARTY
      );
      // Get cookies from unpartitioned jar
      let unpartitioned = Services.cookies.getCookiesWithOriginAttributes(
        unpartitionedOAs,
        THIRD_PARTY
      );

      // Assert partitioned/unpartitioned cookie were stored in correct jars
      Assert.equal(partitioned.length, 1);
      Assert.equal(partitioned[0].value, "partitioned");
      Assert.equal(unpartitioned.length, 1);
      Assert.equal(unpartitioned[0].value, "unpartitioned");

      // Cleanup
      BrowserTestUtils.removeTab(tab);
      Services.cookies.removeAll();
    }
  }
);

// TODO CHIPS - Tests for CookieServiceChild::SetCookieStringFromHttp() need
// to be added. Since this is only checkable on onProxyConnectSuccess needs
// proxy setup test harness. It is also called after onStartRequest() (Http)
// but cookies are already set by the parents
// CookieService::SetCookieStringFromHttp() call.

// Get partitioned and unpartitioned cookies from document (child).
// This uses CookieServiceChild internally.
add_task(
  async function test_chips_send_partitioned_and_unpartitioned_document_child() {
    const TEST_COOKIE_BEHAVIORS = [
      Ci.nsICookieService.BEHAVIOR_ACCEPT,
      Ci.nsICookieService.BEHAVIOR_REJECT_FOREIGN,
      Ci.nsICookieService.BEHAVIOR_REJECT_TRACKER,
      Ci.nsICookieService.BEHAVIOR_PARTITION_FOREIGN,
    ];

    for (let behavior of TEST_COOKIE_BEHAVIORS) {
      Services.prefs.setIntPref("network.cookie.cookieBehavior", behavior);

      const tab = BrowserTestUtils.addTab(gBrowser, URL_DOCUMENT_FIRSTPARTY);
      const browser = gBrowser.getBrowserForTab(tab);
      await BrowserTestUtils.browserLoaded(browser);

      // Spawn document bc
      await SpecialPowers.spawn(
        browser,
        [COOKIE_PARTITIONED, COOKIE_UNPARTITIONED],
        async (partitioned, unpartitioned) => {
          content.document.cookie = partitioned;
          content.document.cookie = unpartitioned;

          // Assert both unpartitioned and partitioned cookie are returned.
          let cookies = content.document.cookie;
          ok(
            cookies.includes("cookie=partitioned"),
            "Cookie from partitioned jar was sent."
          );
          ok(
            cookies.includes("cookie=unpartitioned"),
            "Cookie from unpartitioned jar was sent."
          );
        }
      );

      // Cleanup
      BrowserTestUtils.removeTab(tab);
      Services.cookies.removeAll();
    }
  }
);

// Get partitioned and unpartitioned cookies from document (child) after
// storageAccess was granted. This calls CookieServiceChild::TrackCookieLoad()
// internally to update child's cookies.
add_task(
  async function test_chips_send_partitioned_and_unpartitioned_on_storage_access_child() {
    // We only test cookieBehavior 5 here because the test involves storage
    // access API. The other cookieBehaviors doesn't have the same behavior
    // on StorageAccess API, so the test doesn't apply.
    const TEST_COOKIE_BEHAVIORS = [
      Ci.nsICookieService.BEHAVIOR_PARTITION_FOREIGN,
    ];

    for (let behavior of TEST_COOKIE_BEHAVIORS) {
      Services.prefs.setIntPref("network.cookie.cookieBehavior", behavior);
      // Set example.org first-party unpartitioned cookie
      await BrowserTestUtils.withNewTab(
        URL_DOCUMENT_THIRDPARTY,
        async browser => {
          info("Set a first party cookie via `document.cookie`.");
          await SpecialPowers.spawn(
            browser,
            [COOKIE_UNPARTITIONED],
            async unpartitioned => {
              content.document.cookie = unpartitioned;
              is(
                content.document.cookie,
                "cookie=unpartitioned",
                "Unpartitioned cookie was set."
              );
            }
          );
        }
      );

      // Assert cookie was set on parent cookie service for example.org.
      // Get cookies from unpartitioned jar
      let unpartitioned = Services.cookies.getCookiesWithOriginAttributes(
        unpartitionedOAs,
        THIRD_PARTY
      );
      Assert.equal(unpartitioned.length, 1);
      Assert.equal(unpartitioned[0].value, "unpartitioned");

      // Load example.com as first-party in tab
      const tab = BrowserTestUtils.addTab(gBrowser, URL_DOCUMENT_FIRSTPARTY);
      const browser = gBrowser.getBrowserForTab(tab);
      await BrowserTestUtils.browserLoaded(browser);

      // Set third-party cookie from example.org iframe, get storageAccess and
      // check cookies.
      // Spawn document bc
      await SpecialPowers.spawn(
        browser,
        [URL_DOCUMENT_THIRDPARTY, COOKIE_PARTITIONED],
        async (url, partitioned) => {
          // Create third-party iframe
          let ifr = content.document.createElement("iframe");
          ifr.src = url;
          content.document.body.appendChild(ifr);
          await ContentTaskUtils.waitForEvent(ifr, "load");

          // Spawn iframe bc
          await SpecialPowers.spawn(
            await ifr.browsingContext,
            [partitioned],
            async partitioned => {
              ok(
                !(await content.document.hasStorageAccess()),
                "example.org should not have storageAccess initially."
              );

              // Set a partitioned third-party cookie and assert its the only.
              content.document.cookie = partitioned;
              is(
                content.document.cookie,
                "cookie=partitioned",
                "Partitioned cookie was set."
              );

              info("Simulate user activation.");
              SpecialPowers.wrap(
                content.document
              ).notifyUserGestureActivation();

              info("Request storage access.");
              await content.document.requestStorageAccess();

              ok(
                await content.document.hasStorageAccess(),
                "example.org should now have storageAccess."
              );

              // Assert both unpartitioned and partitioned cookie are returned.
              let cookies = content.document.cookie;
              ok(
                cookies.includes("cookie=partitioned"),
                "Cookie from partitioned jar was sent."
              );
              ok(
                cookies.includes("cookie=unpartitioned"),
                "Cookie from unpartitioned jar was sent."
              );
            }
          );
        }
      );

      // Cleanup
      BrowserTestUtils.removeTab(tab);
      Services.cookies.removeAll();
      Services.perms.removeAll();
    }
  }
);

// Set partitioned and unpartitioned cookies for URL_DOCUMENT_FIRSTPARTY, then
// load URL again, assure cookies are correctly send to content child process.
// This tests CookieServiceParent::TrackCookieLoad() internally.
add_task(
  async function test_chips_send_partitioned_and_unpartitioned_document_parent() {
    const TEST_COOKIE_BEHAVIORS = [
      Ci.nsICookieService.BEHAVIOR_ACCEPT,
      Ci.nsICookieService.BEHAVIOR_REJECT_FOREIGN,
      Ci.nsICookieService.BEHAVIOR_REJECT_TRACKER,
      Ci.nsICookieService.BEHAVIOR_PARTITION_FOREIGN,
    ];

    for (let behavior of TEST_COOKIE_BEHAVIORS) {
      Services.prefs.setIntPref("network.cookie.cookieBehavior", behavior);

      // Set example.com first-party unpartitioned and partitioned cookie, then
      // close tab.
      await BrowserTestUtils.withNewTab(
        URL_DOCUMENT_FIRSTPARTY,
        async browser => {
          await SpecialPowers.spawn(
            browser,
            [COOKIE_PARTITIONED, COOKIE_UNPARTITIONED],
            async (partitioned, unpartitioned) => {
              content.document.cookie = unpartitioned;
              content.document.cookie = partitioned;
              let cookies = content.document.cookie;
              ok(
                cookies.includes("cookie=unpartitioned"),
                "Unpartitioned cookie was set."
              );
              ok(
                cookies.includes("cookie=partitioned"),
                "Partitioned cookie was set."
              );
            }
          );
        }
      );

      // Assert we have one partitioned and one unpartitioned cookie set.
      // Get cookies from partitioned jar
      let partitioned = Services.cookies.getCookiesWithOriginAttributes(
        partitionedOAs,
        FIRST_PARTY
      );
      // Get cookies from unpartitioned jar
      let unpartitioned = Services.cookies.getCookiesWithOriginAttributes(
        unpartitionedOAs,
        FIRST_PARTY
      );
      Assert.equal(partitioned.length, 1);
      Assert.equal(partitioned[0].value, "partitioned");
      Assert.equal(unpartitioned.length, 1);
      Assert.equal(unpartitioned[0].value, "unpartitioned");

      // Reload example.com and assert previously set cookies are correctly
      // send to content child document.
      await BrowserTestUtils.withNewTab(
        URL_DOCUMENT_FIRSTPARTY,
        async browser => {
          await SpecialPowers.spawn(browser, [], () => {
            let cookies = content.document.cookie;
            ok(
              cookies.includes("cookie=unpartitioned"),
              "Unpartitioned cookie was sent."
            );
            ok(
              cookies.includes("cookie=partitioned"),
              "Partitioned cookie was sent."
            );
          });
        }
      );

      // Cleanup
      Services.cookies.removeAll();
    }
  }
);

// Non-CHIPS cookies in the partitioned jar should be filtered out when both
// jars are queried. This tests the filtering in Document::GetCookie (child)
// and CookieService::GetCookiesForURI (parent).
add_task(async function test_chips_filter_nonchips_from_partitioned_jar() {
  Services.prefs.setIntPref(
    "network.cookie.cookieBehavior",
    Ci.nsICookieService.BEHAVIOR_PARTITION_FOREIGN
  );

  // Step 1: Set a non-CHIPS cookie in a third-party context. Under
  // cookieBehavior 5 it lands in the partitioned jar without the Partitioned
  // attribute.
  const tab = BrowserTestUtils.addTab(gBrowser, URL_DOCUMENT_FIRSTPARTY);
  const browser = gBrowser.getBrowserForTab(tab);
  await BrowserTestUtils.browserLoaded(browser);

  await SpecialPowers.spawn(
    browser,
    [URL_DOCUMENT_THIRDPARTY, THIRD_PARTY_DOMAIN],
    async (iframeUrl, thirdPartyDomain) => {
      let ifr = content.document.createElement("iframe");
      ifr.src = iframeUrl;
      content.document.body.appendChild(ifr);
      await ContentTaskUtils.waitForEvent(ifr, "load");

      await SpecialPowers.spawn(
        await ifr.browsingContext,
        [thirdPartyDomain],
        async thirdPartyDomain => {
          // Set a non-CHIPS cookie via HTTP (goes to partitioned jar).
          await content.fetch(
            thirdPartyDomain +
              "/browser/netwerk/cookie/test/browser/chips.sjs?setnonchips"
          );
          // Set a CHIPS cookie via document.cookie.
          content.document.cookie =
            "chips=yes; Partitioned; Secure; SameSite=None";
        }
      );
    }
  );

  // Verify both cookies are in the partitioned jar.
  let partitionedCookies = Services.cookies.getCookiesWithOriginAttributes(
    partitionedOAs,
    THIRD_PARTY
  );
  Assert.equal(partitionedCookies.length, 2, "Two cookies in partitioned jar");

  // Step 2: Set an unpartitioned cookie for example.org as first-party.
  await BrowserTestUtils.withNewTab(URL_DOCUMENT_THIRDPARTY, async browser => {
    await SpecialPowers.spawn(browser, [], () => {
      content.document.cookie = "firstparty=yes; Secure; SameSite=None";
    });
  });

  let unpartitionedCookies = Services.cookies.getCookiesWithOriginAttributes(
    unpartitionedOAs,
    THIRD_PARTY
  );
  Assert.equal(
    unpartitionedCookies.length,
    1,
    "One cookie in unpartitioned jar"
  );

  // Step 3: Load example.com with example.org iframe, grant storage access,
  // read cookies. The non-CHIPS cookie should be filtered out.
  const tab2 = BrowserTestUtils.addTab(gBrowser, URL_DOCUMENT_FIRSTPARTY);
  const browser2 = gBrowser.getBrowserForTab(tab2);
  await BrowserTestUtils.browserLoaded(browser2);

  await SpecialPowers.spawn(
    browser2,
    [URL_DOCUMENT_THIRDPARTY, THIRD_PARTY_DOMAIN],
    async (iframeUrl, thirdPartyDomain) => {
      let ifr = content.document.createElement("iframe");
      ifr.src = iframeUrl;
      content.document.body.appendChild(ifr);
      await ContentTaskUtils.waitForEvent(ifr, "load");

      await SpecialPowers.spawn(
        await ifr.browsingContext,
        [thirdPartyDomain],
        async thirdPartyDomain => {
          SpecialPowers.wrap(content.document).notifyUserGestureActivation();
          await SpecialPowers.addPermission(
            "storageAccessAPI",
            true,
            content.location.href
          );
          await SpecialPowers.wrap(content.document).requestStorageAccess();

          ok(
            await content.document.hasStorageAccess(),
            "example.org should have storageAccess"
          );

          // document.cookie should include the CHIPS cookie and the
          // first-party cookie, but NOT the non-CHIPS partitioned cookie.
          let cookies = content.document.cookie;
          ok(
            cookies.includes("chips=yes"),
            "CHIPS cookie from partitioned jar is visible"
          );
          ok(
            cookies.includes("firstparty=yes"),
            "First-party cookie from unpartitioned jar is visible"
          );
          ok(
            !cookies.includes("nonchips=foreign"),
            "Non-CHIPS cookie from partitioned jar is filtered out"
          );

          // Also verify via HTTP fetch.
          let response = await content.fetch(
            thirdPartyDomain +
              "/browser/netwerk/cookie/test/browser/chips.sjs?get"
          );
          let httpCookies = await response.text();
          ok(
            httpCookies.includes("chips=yes"),
            "CHIPS cookie sent in HTTP request"
          );
          ok(
            httpCookies.includes("firstparty=yes"),
            "First-party cookie sent in HTTP request"
          );
          ok(
            !httpCookies.includes("nonchips=foreign"),
            "Non-CHIPS cookie NOT sent in HTTP request"
          );
        }
      );
    }
  );

  // Cleanup
  BrowserTestUtils.removeTab(tab);
  BrowserTestUtils.removeTab(tab2);
  Services.cookies.removeAll();
  Services.perms.removeAll();
});

// Set partitioned and unpartitioned cookies for URL_DOCUMENT_FIRSTPARTY, then
// send http request, assure cookies are correctly send in "Cookie" header.
// This tests CookieService::GetCookieStringFromHttp() internally.
add_task(
  async function test_chips_send_partitioned_and_unpartitioned_http_parent() {
    const TEST_COOKIE_BEHAVIORS = [
      Ci.nsICookieService.BEHAVIOR_ACCEPT,
      Ci.nsICookieService.BEHAVIOR_REJECT_FOREIGN,
      Ci.nsICookieService.BEHAVIOR_REJECT_TRACKER,
      Ci.nsICookieService.BEHAVIOR_PARTITION_FOREIGN,
    ];

    for (let behavior of TEST_COOKIE_BEHAVIORS) {
      Services.prefs.setIntPref("network.cookie.cookieBehavior", behavior);

      // Load empty document.
      let tab = BrowserTestUtils.addTab(gBrowser, URL_DOCUMENT_FIRSTPARTY);
      let browser = gBrowser.getBrowserForTab(tab);
      await BrowserTestUtils.browserLoaded(browser);

      await SpecialPowers.spawn(
        browser,
        [HTTP_COOKIE_SET, HTTP_COOKIE_GET],
        async (set, get) => {
          // Send http request with "set" query parameter, partitioned and
          // unpartitioned cookie will be set through http response.
          await content.fetch(set);

          // Assert cookies were set to document.
          let cookies = content.document.cookie;
          ok(
            cookies.includes("cookie=unpartitioned"),
            "Unpartitioned cookie was set to document."
          );
          ok(
            cookies.includes("cookie=partitioned"),
            "Partitioned cookie was set to document."
          );

          // Send http request with "get" query parameter, chips.sjs will return
          // the request "Cookie" header string.
          await content
            .fetch(get)
            .then(response => response.text())
            .then(requestCookies => {
              // Assert cookies were sent in http request.
              ok(
                requestCookies.includes("cookie=unpartitioned"),
                "Unpartitioned cookie was sent in http request."
              );
              ok(
                requestCookies.includes("cookie=partitioned"),
                "Partitioned cookie was sent in http request."
              );
            });
        }
      );

      // Cleanup
      BrowserTestUtils.removeTab(tab);
      Services.cookies.removeAll();
    }
  }
);