Harden host access recovery for v2.6.2

scripts/test-host-access.mjs

@@ -7,8 +7,10 @@ import {
     addTabHostAccessRequest,
     describeTabUrl,
     inspectTabHostAccess,
+    isHostAccessError,
     normalizeTabId,
-    removeTabHostAccessRequest
+    removeTabHostAccessRequest,
+    requestOriginPermission
 } from '../extension/host-access.js';
 
 assert.equal(HOST_ACCESS_REQUIRED_STATUS, 'host_permission_required');
@@ -17,6 +19,11 @@ assert.equal(normalizeTabId(undefined), null);
 assert.equal(normalizeTabId(''), null);
 assert.equal(normalizeTabId(0), null);
 assert.equal(normalizeTabId('42'), 42);
+assert.equal(normalizeTabId(true), null);
+assert.equal(normalizeTabId([42]), null);
+assert.equal(normalizeTabId('42.5'), null);
+assert.equal(normalizeTabId(' 42 '), 42);
+assert.equal(normalizeTabId(Number.MAX_SAFE_INTEGER + 1), null);
 assert.deepEqual(describeTabUrl('https://emby.example:8443/web/index.html'), {
     url: 'https://emby.example:8443/web/index.html',
     host: 'emby.example:8443',
@@ -50,30 +57,41 @@ assert.deepEqual(containsRequest, { origins: ['https://video.example/*'] });
 let requestedTabId = null;
 const requestChrome = {
     permissions: {
-        addHostAccessRequest: async ({ tabId }) => { requestedTabId = tabId; }
+        addHostAccessRequest: async request => { requestedTabId = request; }
     }
 };
-assert.equal(await addTabHostAccessRequest(requestChrome, 42), true);
-assert.equal(requestedTabId, 42);
+assert.equal(await addTabHostAccessRequest(requestChrome, 42, 'https://video.example/*'), true);
+assert.deepEqual(requestedTabId, { tabId: 42, pattern: 'https://video.example/*' });
 assert.equal(await addTabHostAccessRequest({ permissions: {} }, 42), false);
 
 let removedTabId = null;
 const removeRequestChrome = {
     permissions: {
-        removeHostAccessRequest: async ({ tabId }) => { removedTabId = tabId; }
+        removeHostAccessRequest: async request => { removedTabId = request; }
     }
 };
-assert.equal(await removeTabHostAccessRequest(removeRequestChrome, 42), true);
-assert.equal(removedTabId, 42);
+assert.equal(await removeTabHostAccessRequest(removeRequestChrome, 42, 'https://video.example/*'), true);
+assert.deepEqual(removedTabId, { tabId: 42, pattern: 'https://video.example/*' });
 assert.equal(await removeTabHostAccessRequest({ permissions: {} }, 42), false);
 
+assert.equal(isHostAccessError(new Error('Missing host permission for the tab')), true);
+assert.equal(isHostAccessError(new Error('No tab with id: 42')), false);
+const callbackPermissionChrome = {
+    runtime: {},
+    permissions: {
+        request: (_request, callback) => { callback(true); }
+    }
+};
+assert.equal(await requestOriginPermission(callbackPermissionChrome, 'https://video.example/*'), true);
+assert.equal(await requestOriginPermission({ permissions: {} }, 'https://video.example/*'), null);
+
 const background = fs.readFileSync(path.join(cwd(), 'extension', 'background.js'), 'utf8');
 const popup = fs.readFileSync(path.join(cwd(), 'extension', 'popup.js'), 'utf8');
 const popupHtml = fs.readFileSync(path.join(cwd(), 'extension', 'popup.html'), 'utf8');
 
 assert.match(background, /await activateTargetTab\(message\.tabId, message\.tabTitle\)/,
     'SET_TARGET_TAB must await successful activation before acknowledging it');
-assert.match(background, /addTabHostAccessRequest\(chrome, tabId\)/,
+assert.match(background, /addTabHostAccessRequest\(chrome, tabId, access\.originPattern\)/,
     'failed injection must register Chrome host-access request');
 assert.match(background, /retryPendingTarget\(\)/,
     'pending target must resume after the user grants access');
@@ -87,11 +105,11 @@ assert.ok(
     activateTargetBody.indexOf('await injectContentScript') < activateTargetBody.indexOf('currentTabId = selectedTabId'),
     'a tab must not become current until its content script injection succeeds'
 );
-assert.match(background, /removeTabHostAccessRequest\(chrome, pendingTabId\)/,
+assert.match(background, /removeTabHostAccessRequest\([\s\S]*pendingTabId/,
     'clearing a pending target must also clear Chrome toolbar access requests');
 assert.match(popup, /response\?\.status === 'host_permission_required'/,
     'popup must render the structured host-access failure');
-assert.match(popup, /chrome\.permissions\.request\(\{ origins: \[originPattern\] \}\)/,
+assert.match(popup, /requestOriginPermission\(chrome, requestedOriginPattern\)/,
     'retry button must request withheld host access directly');
 assert.match(popupHtml, /id="siteAccessNotice"/,
     'popup must contain a persistent site-access notice');