XuqmGroup-RNSDK/packages/xwebview/tests/permissionPolicy.test.ts

import assert from 'node:assert/strict'
import test from 'node:test'

import {
  allowedWebPermissionResources,
  isPermissionOriginAllowed,
  webPermissionKind,
} from '../src/permissionPolicy'

test('WebView camera and microphone resource names use one canonical mapping', () => {
  assert.equal(webPermissionKind('android.webkit.resource.VIDEO_CAPTURE'), 'camera')
  assert.equal(webPermissionKind('android.webkit.resource.AUDIO_CAPTURE'), 'microphone')
  assert.equal(webPermissionKind('camera'), 'camera')
  assert.equal(webPermissionKind('microphone'), 'microphone')
  assert.equal(webPermissionKind('protected-media-id'), null)
})

test('only system-authorized camera or microphone resources are granted', () => {
  const resources = [
    'android.webkit.resource.VIDEO_CAPTURE',
    'android.webkit.resource.AUDIO_CAPTURE',
    'protected-media-id',
  ]
  assert.deepEqual(allowedWebPermissionResources(resources, new Set(['camera'])), [resources[0]])
  assert.deepEqual(allowedWebPermissionResources(resources, new Set(['microphone'])), [
    resources[1],
  ])
  assert.deepEqual(allowedWebPermissionResources([resources[2]], new Set()), [])
})

test('media permission requires the current document origin to match the exact allowlist', () => {
  assert.equal(
    isPermissionOriginAllowed(
      'https://camera.example.test',
      'https://camera.example.test/app/cert',
      ['https://camera.example.test'],
    ),
    true,
  )
  assert.equal(
    isPermissionOriginAllowed(
      'https://camera.example.test',
      'https://other.example.test/redirected',
      ['https://camera.example.test', 'https://other.example.test'],
    ),
    false,
  )
  assert.equal(
    isPermissionOriginAllowed(
      'https://child.camera.example.test',
      'https://child.camera.example.test',
      ['https://camera.example.test'],
    ),
    false,
  )
  assert.equal(isPermissionOriginAllowed('null', 'file:///tmp/index.html', ['null']), false)
})