[webid] Add approvedBy to the WebID IDL.

Spec: https://wicg.github.io/WebID/#FederatedCredential

Change-Id: If450d8e16793054f4e05c395e6168098a1e507c3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3124017
Commit-Queue: Sam Goto <goto@chromium.org>
Reviewed-by: Mike West <mkwst@chromium.org>
Reviewed-by: Ken Buchanan <kenrb@chromium.org>
Reviewed-by: Yi Gu <yigu@chromium.org>
Cr-Commit-Position: refs/heads/main@{#919417}
diff --git a/third_party/blink/renderer/modules/credentialmanager/federated_credential.h b/third_party/blink/renderer/modules/credentialmanager/federated_credential.h
index 46b6bdc..6a5d84b 100644
--- a/third_party/blink/renderer/modules/credentialmanager/federated_credential.h
+++ b/third_party/blink/renderer/modules/credentialmanager/federated_credential.h
@@ -60,6 +60,12 @@
     return g_empty_string;
   }
 
+  const String& approvedBy() const {
+    // TODO(goto): This is a stub, so that we can port the WebID API
+    // gradually.
+    return g_empty_string;
+  }
+
   static ScriptPromise logout(ScriptState*, const Vector<String>&);
   static ScriptPromise revoke(ScriptState*, const String);
 
diff --git a/third_party/blink/renderer/modules/credentialmanager/federated_credential.idl b/third_party/blink/renderer/modules/credentialmanager/federated_credential.idl
index 1a2671c..3f78492 100644
--- a/third_party/blink/renderer/modules/credentialmanager/federated_credential.idl
+++ b/third_party/blink/renderer/modules/credentialmanager/federated_credential.idl
@@ -4,6 +4,11 @@
 
 // https://w3c.github.io/webappsec-credential-management/#federatedcredential
 
+enum FederatedCredentialApprover {
+  "auto",
+  "user"
+};
+
 [
     Exposed=Window,
     SecureContext
@@ -13,6 +18,13 @@
 
     // https://github.com/WICG/WebID
     [RuntimeEnabled=WebID] readonly attribute USVString idToken;
+    // Allows the RP to distinguish whether an "auto" sign-in [1] happened or an
+    // "explicit" sign-in [2] happened.
+    // [1] https://wicg.github.io/WebID/#use-cases-auto-sign-in
+    // [2] https://wicg.github.io/WebID/#use-cases-explicit-sign-in
+    [RuntimeEnabled=WebID] readonly attribute FederatedCredentialApprover approvedBy;
+
+    // Allows IDPs to logout the user out of all of the logged in RPs.
     [RuntimeEnabled=WebID, CallWith=ScriptState] static Promise<void> logout(optional sequence<USVString> logout_endpoints = []);
     [RuntimeEnabled=WebID, CallWith=ScriptState] static Promise<void> revoke(USVString account_id);
 
diff --git a/third_party/blink/web_tests/webexposed/global-interface-listing-expected.txt b/third_party/blink/web_tests/webexposed/global-interface-listing-expected.txt
index e727d23..029bbc3f 100644
--- a/third_party/blink/web_tests/webexposed/global-interface-listing-expected.txt
+++ b/third_party/blink/web_tests/webexposed/global-interface-listing-expected.txt
@@ -2608,6 +2608,7 @@
     static method logout
     static method revoke
     attribute @@toStringTag
+    getter approvedBy
     getter iconURL
     getter idToken
     getter name