notifications/cross-origin-nested.tentative.https.sub.html

<!DOCTYPE html>
<meta charset="utf-8">
<title>Notifications in cross origin iframes</title>
<link rel="help" href="https://github.com/whatwg/notifications/issues/177">
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="/resources/testdriver.js"></script>
<script src="/resources/testdriver-vendor.js"></script>
<script src="resources/helpers.js"></script>
<script>
// The syntax below will give us a third party URL.
// See: https://web-platform-tests.org/writing-tests/server-features.html
const thirdPartyIframe =
  'https://{{hosts[alt][]}}:{{ports[https][0]}}/notifications/resources/cross-origin-nested-parent.sub.html';
const promises = new Map();

// Firefox and Chrome deny notification permission in a third party partitioned
// iframe even if the permission is granted for origin of the iframe.

// Set up the listeners and then create a third party iframe.
// The iframe will again create a first party iframe.
promise_setup(async () => {
  await trySettingPermission("granted");

  // parent: the third party iframe
  // child: the first party iframe in the third party one (ABA)
  for (const iframe of ["parent", "child"]) {
    // from the iframe window, or the worker opened from there
    for (const worker of ["", "Worker"]) {
      // permission attribute (.permission), or
      // the permission request (.requestPermission())
      for (const type of ["", "Request"]) {
        const sender = iframe + worker + type;
        promises.set(sender, new Promise(r => window.addEventListener("message", ev => {
          if (ev.data.sender === sender) {
            r(ev.data);
          }
        })));
      }
    }
  }

  const iframe = document.createElement("iframe");
  iframe.src = thirdPartyIframe;
  document.body.append(iframe);
})

promise_test(async t => {
  const result = await promises.get("parent");
  assert_equals(result.permission, "denied", `should deny the permission`);
  assert_false(result.shown, `notification should not be shown`);

  const parentRequestResult = await promises.get("parentRequest");
  assert_equals(parentRequestResult.permission, "denied", "should deny the permission request");
}, "third party iframe");

promise_test(async t => {
  const result = await promises.get("child");
  assert_equals(result.permission, "granted", `should grant the permission`);
  assert_true(result.shown, `notification should be shown`);

  const childRequestResult = await promises.get("childRequest");
  assert_equals(childRequestResult.permission, "granted", "should accept the permission request");
}, "nested first party iframe");

promise_test(async t => {
  const result = await promises.get("parentWorker");
  assert_equals(result.permission, "denied", `should deny the permission`);
  assert_false(result.shown, `notification should not be shown`);
}, "third party worker");

promise_test(async t => {
  const result = await promises.get("childWorker");
  assert_equals(result.permission, "granted", `should grant the permission`);
  assert_true(result.shown, `notification should be shown`);
}, "nested first party worker");
</script>