chromium/chrome/browser/storage_access_api/api_browsertest.cc

// Copyright 2020 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include <memory>
#include <string_view>

#include "base/containers/adapters.h"
#include "base/containers/span.h"
#include "base/feature_list.h"
#include "base/functional/bind.h"
#include "base/path_service.h"
#include "base/strings/escape.h"
#include "base/strings/strcat.h"
#include "base/strings/string_util.h"
#include "base/strings/stringprintf.h"
#include "base/test/bind.h"
#include "base/test/metrics/histogram_tester.h"
#include "base/test/scoped_feature_list.h"
#include "chrome/browser/content_settings/cookie_settings_factory.h"
#include "chrome/browser/content_settings/host_content_settings_map_factory.h"
#include "chrome/browser/net/storage_test_utils.h"
#include "chrome/browser/policy/policy_test_utils.h"
#include "chrome/browser/profiles/profile.h"
#include "chrome/browser/storage_access_api/storage_access_grant_permission_context.h"
#include "chrome/browser/ui/browser.h"
#include "chrome/browser/ui/tabs/tab_strip_model.h"
#include "chrome/browser/webid/federated_identity_permission_context.h"
#include "chrome/browser/webid/federated_identity_permission_context_factory.h"
#include "chrome/test/base/in_process_browser_test.h"
#include "chrome/test/base/ui_test_utils.h"
#include "components/content_settings/browser/page_specific_content_settings.h"
#include "components/content_settings/core/browser/cookie_settings.h"
#include "components/content_settings/core/browser/host_content_settings_map.h"
#include "components/content_settings/core/common/content_settings.h"
#include "components/content_settings/core/common/content_settings_types.h"
#include "components/content_settings/core/common/features.h"
#include "components/content_settings/core/common/pref_names.h"
#include "components/permissions/features.h"
#include "components/permissions/permission_request_manager.h"
#include "components/permissions/request_type.h"
#include "components/permissions/test/mock_permission_prompt_factory.h"
#include "components/permissions/test/permission_request_observer.h"
#include "components/policy/policy_constants.h"
#include "components/prefs/pref_service.h"
#include "content/public/browser/browser_context.h"
#include "content/public/browser/navigation_handle.h"
#include "content/public/browser/storage_partition.h"
#include "content/public/common/content_features.h"
#include "content/public/common/content_paths.h"
#include "content/public/test/browser_test.h"
#include "content/public/test/browser_test_utils.h"
#include "content/public/test/test_navigation_observer.h"
#include "content/public/test/url_loader_interceptor.h"
#include "net/base/features.h"
#include "net/base/schemeful_site.h"
#include "net/cookies/canonical_cookie_test_helpers.h"
#include "net/cookies/cookie_partition_key_collection.h"
#include "net/dns/mock_host_resolver.h"
#include "net/http/http_request_headers.h"
#include "net/test/embedded_test_server/embedded_test_server.h"
#include "net/test/embedded_test_server/http_request.h"
#include "net/test/spawned_test_server/spawned_test_server.h"
#include "net/test/test_data_directory.h"
#include "services/network/public/cpp/network_switches.h"
#include "testing/gtest/include/gtest/gtest.h"
#include "third_party/blink/public/common/features.h"
#include "third_party/blink/public/common/features_generated.h"
#include "third_party/blink/public/mojom/use_counter/metrics/web_feature.mojom-forward.h"
#include "third_party/blink/public/mojom/use_counter/metrics/web_feature.mojom.h"
#include "ui/base/window_open_disposition.h"
#include "url/origin.h"

BrowserThread;
Contains;
Gt;
IsEmpty;
Pair;
UnorderedElementsAre;

namespace {

constexpr char kHostA[] = …;
constexpr char kOriginA[] = …;
constexpr char kOriginB[] = …;
constexpr char kUrlA[] = …;
constexpr char kHostASubdomain[] = …;
constexpr char kHostB[] = …;
constexpr char kHostBSubdomain[] = …;
constexpr char kHostBSubdomain2[] = …;
constexpr char kHostC[] = …;
constexpr char kHostD[] = …;

constexpr char kUseCounterHistogram[] = …;
constexpr char kRequestOutcomeHistogram[] = …;
constexpr char kGrantIsImplicitHistogram[] = …;

// Path for URL of custom response
const char* kEchoCookiesWithCorsPath = …;
constexpr char kRetryPath[] = …;

constexpr char kQueryStorageAccessPermission[] = …;

constexpr char kHeaderNotProvidedSentinel[] = …;

enum class TestType { … };

// Helpers to express expected
std::pair<std::string, std::string> CookieBundle(const std::string& cookies) { … }

std::tuple<std::string, std::string, std::string> CookieBundleWithContent(
    const std::string& cookies) { … }

constexpr std::pair<const char*, const char*> kNoCookies = …;

constexpr std::tuple<const char*, const char*, const char*>
    kNoCookiesWithContent = …;

// Executes the inner_matcher on the string arg after it's transformed into a
// vector of pairs of strings. This assumes that the argument is a string, whose
// value is a '\n' delimited list of name/value pairs (delimited by ':').
MATCHER_P(HeadersAre, inner_matcher, "") { … }

void SetCORSHeaders(const net::test_server::HttpRequest& request,
                    net::test_server::BasicHttpResponse& response) { … }

// Responds to a request to /echocookieswithcors with the cookies that were sent
// with the request. We can't use the default handler /echoheader?Cookie here,
// because it doesn't send the appropriate Access-Control-Allow-Origin and
// Access-Control-Allow-Credentials headers (which are required for this to
// work for cross-origin requests in the tests).
std::unique_ptr<net::test_server::HttpResponse>
HandleEchoCookiesWithCorsRequest(const net::test_server::HttpRequest& request) { … }

std::unique_ptr<net::test_server::HttpResponse> HandleRetryRequest(
    int& fetch_count,
    const net::test_server::HttpRequest& request) { … }

std::string QueryPermission(content::RenderFrameHost* render_frame_host) { … }

bool ThirdPartyPartitionedStorageAllowedByDefault() { … }

std::string CookieAttributes(std::string_view domain) { … }

std::vector<base::test::FeatureRefAndParams> GetEnabledFeaturesForStorage(
    bool is_storage_partitioned) { … }

std::vector<base::test::FeatureRef> GetDisabledFeaturesForStorage(
    bool is_storage_partitioned) { … }

class StorageAccessAPIBaseBrowserTest : public policy::PolicyTest { … };

// Test fixture for core Storage Access API functionality, guaranteed by spec.
// This fixture should use the minimal set of features/params.
class StorageAccessAPIBrowserTest : public StorageAccessAPIBaseBrowserTest { … };

// Test fixture for tests whose behavior could be affected by Origin Isolation
// (kOriginKeyedProcessesByDefault). This is a parameterised version of
// StorageAccessAPIBrowserTest that runs each test with Origin Isolation
// enabled and disabled.
class StorageAccessAPIOriginIsolationBrowserTest
    : public StorageAccessAPIBaseBrowserTest,
      public ::testing::WithParamInterface<bool> { … };

// Check default values for permissions.query on storage-access.
IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest, PermissionQueryDefault) { … }

// Check default values for permissions.query on storage-access when 3p cookie
// is allowed.
IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest,
                       PermissionQueryDefault_AllowCrossSiteCookie) { … }

// Test that permissions.query changes to "granted" when a storage access
// request was successful.
IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest, PermissionQueryGranted) { … }

// Test that permissions.query changes to "denied" when a storage access
// request was denied.
IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest, PermissionQueryDenied) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest, PermissionQueryCrossSite) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest,
                       Permission_Denied_WithoutInteraction) { … }

// Validate that a cross-site iframe can bypass third-party cookie blocking via
// the Storage Access API.
IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest,
                       ThirdPartyCookiesIFrameRequestsAccess_CrossSiteIframe) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest,
                       AccessGranted_DoesNotConsumeUserInteraction) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest,
                       AccessGranted_NoSubsequentUserInteraction) { … }

// Validate that if an iframe obtains access, then cookies become unblocked for
// just that top-level/third-party combination and are still blocked for other
// combinations.
IN_PROC_BROWSER_TEST_F(
    StorageAccessAPIBrowserTest,
    ThirdPartyCookiesIFrameRequestsAccess_CrossSiteIframe_UnrelatedSites) { … }

// Validate that a nested A(B(B)) iframe can obtain cookie access, and that that
// access is not shared with the "middle" B iframe.
IN_PROC_BROWSER_TEST_F(
    StorageAccessAPIBrowserTest,
    ThirdPartyCookiesIFrameRequestsAccess_NestedCrossSiteIframe_InnerRequestsAccess) { … }

// Validate that in a A(B) frame tree, the iframe can make credentialed
// same-site requests, even if the requests are cross-origin.
IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest,
                       ThirdPartyCookiesIFrameRequestsAccess_CrossOriginFetch) { … }

// Validate that in a A(B(B)) frame tree, the middle B iframe can obtain access,
// and that access is not shared with the leaf B iframe.
IN_PROC_BROWSER_TEST_F(
    StorageAccessAPIBrowserTest,
    ThirdPartyCookiesIFrameRequestsAccess_NestedCrossSiteIframe_MiddleRequestsAccess) { … }

// Validate that in a A(B(C)) frame tree, the C leaf iframe can obtain cookie
// access.
IN_PROC_BROWSER_TEST_F(
    StorageAccessAPIBrowserTest,
    ThirdPartyCookiesIFrameRequestsAccess_NestedCrossSiteIframe_DistinctSites) { … }

// Validate that cross-site sibling iframes cannot take advantage of each
// other's granted permission.
IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest,
                       ThirdPartyCookiesCrossSiteSiblingIFrameRequestsAccess) { … }

// Validate that the Storage Access API does not override any explicit user
// settings to block storage access.
IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest,
                       ThirdPartyCookiesIFrameThirdPartyExceptions) { … }

// Validate that user settings take precedence for the leaf in a A(B(B)) frame
// tree.
IN_PROC_BROWSER_TEST_F(
    StorageAccessAPIBrowserTest,
    ThirdPartyCookiesIFrameThirdPartyExceptions_NestedSameSite) { … }

// Validate that user settings take precedence for the leaf in a A(B(C)) frame
// tree.
IN_PROC_BROWSER_TEST_F(
    StorageAccessAPIBrowserTest,
    ThirdPartyCookiesIFrameThirdPartyExceptions_NestedCrossSite) { … }

// Validate that user settings take precedence for the leaf in a A(B(A)) frame
// tree.
IN_PROC_BROWSER_TEST_F(
    StorageAccessAPIBrowserTest,
    ThirdPartyCookiesIFrameThirdPartyExceptions_CrossSiteAncestorChain) { … }

// Validate that user settings take precedence for the leaf in a A(A) frame
// tree.
IN_PROC_BROWSER_TEST_F(
    StorageAccessAPIBrowserTest,
    ThirdPartyCookiesIFrameThirdPartyExceptions_SameSiteAncestorChain) { … }

// Validates that once a grant is removed access is also removed.
IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest,
                       ThirdPartyGrantsDeletedAccess) { … }

// Validates that if the user explicitly blocks cookies, cookie access is
// blocked even with the existing grant.
IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest,
                       ExplicitUserSettingsBlockThirdPartyGrantsAccess) { … }

// Validate that if the iframe's origin is opaque, it cannot obtain storage
// access.
IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest, OpaqueOriginRejects) { … }

// Validate that if the iframe is sandboxed and allows scripts but is missing
// the Storage Access sandbox tag, the iframe cannot obtain storage access.
IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest,
                       MissingSandboxTokenRejects) { … }

// Validate that if the iframe is sandboxed and has the Storage Access sandbox
// tag, the iframe can obtain storage access.
IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest, SandboxTokenResolves) { … }

// Validates that expired grants don't get reused.
IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest, ThirdPartyGrantsExpiry) { … }

// Validate that if an iframe navigates itself to a same-origin endpoint, and
// that navigation does not include any cross-origin redirects, the new document
// can inherit storage access.
IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest,
                       Navigation_SelfInitiated_SameOrigin_Preserves) { … }

// Validate that if an iframe is navigated (by a cross-site initiator) to a
// same-origin endpoint, and that navigation does not include any cross-origin
// redirects, the new document cannot inherit storage access.
IN_PROC_BROWSER_TEST_F(
    StorageAccessAPIBrowserTest,
    Navigation_NonSelfInitiated_SameOriginDestination_CrossSiteInitiator) { … }

// Validate that if an iframe is navigated (by a same-site initiator) to a
// same-origin endpoint (even if the navigation does not include any
// cross-origin redirects), the new document cannot inherit storage access.
IN_PROC_BROWSER_TEST_P(
    StorageAccessAPIOriginIsolationBrowserTest,
    Navigation_NonSelfInitiated_SameOriginDestination_SameSiteInitiator) { … }

// Validate that if an iframe is navigated (by a same-site initiator) to a
// same-origin endpoint (even if the navigation does not include any
// cross-origin redirects, and the navigated frame has obtained storage access
// already), the new document cannot inherit storage access.
IN_PROC_BROWSER_TEST_P(
    StorageAccessAPIOriginIsolationBrowserTest,
    Navigation_NonSelfInitiated_SameOriginDestination_SameSiteInitiator_TargetHasStorageAccess) { … }

// Validate that if an iframe navigates itself to a same-site cross-origin
// endpoint, and that navigation does not include any cross-origin redirects,
// the new document cannot inherit storage access.
IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest,
                       Navigation_SelfInitiated_SameSiteCrossOrigin) { … }

// Validate that if an iframe navigates itself to a cross-site endpoint, and
// that navigation does not include any cross-origin redirects, the new document
// cannot inherit storage access.
IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest,
                       Navigation_SelfInitiated_CrossSite) { … }

// Validate that if an iframe navigates itself to a same-origin endpoint, but
// that navigation include a cross-origin redirect, the new document
// cannot inherit storage access.
IN_PROC_BROWSER_TEST_F(
    StorageAccessAPIBrowserTest,
    Navigation_SelfInitiated_SameOrigin_CrossOriginRedirect) { … }

// Validate that if an iframe navigates itself to a same-origin endpoint, and
// that navigation includes a cross-origin redirect (even if there's a
// subsequent same-origin redirect), the new document cannot inherit storage
// access.
IN_PROC_BROWSER_TEST_F(
    StorageAccessAPIBrowserTest,
    Navigation_SelfInitiated_SameOrigin_CrossSiteAndSameSiteRedirects) { … }

// Validate that in a A(A) frame tree, the inner A iframe can obtain cookie
// access by default.
IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest,
                       EmbeddedSameOriginCookieAccess) { … }

// Validate that in a A(sub.A) frame tree, the inner A iframe can obtain cookie
// access by default.
IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest,
                       EmbeddedSameSiteCookieAccess) { … }

// Validate that in a A(B(A)) frame tree, the inner A iframe can obtain cookie
// access after requesting access.
IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest,
                       NestedSameOriginCookieAccess_CrossSiteAncestorChain) { … }

// Validate that in a A(B(sub.A)) frame tree, the inner iframe can obtain cookie
// access after requesting access.
IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest,
                       NestedSameSiteCookieAccess_CrossSiteAncestorChain) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest,
                       DedicatedWorker_InheritsStorageAccessFromDocument) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest,
                       WebsocketRequestsUseStorageAccessGrants) { … }

// Validate that in a A(B) frame tree, the embedded B iframe can obtain cookie
// access if requested and got accepted.
IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest,
                       EmbeddedCrossSiteCookieAccess_Accept) { … }

// Validate that in a A(B) frame tree, the embedded B iframe can not obtain
// cookie access if requested and got denied.
IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest,
                       EmbeddedCrossSiteCookieAccess_Deny) { … }

// Validate that if third-party cookies are blocked and the permission is
// denied, requestStorageAccess beyond cookies fails.
IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest,
                       BeyondCookies_WithoutCookiesWithoutPermission) { … }

// Validate that if third-party cookies are blocked but the permission is
// allowed, requestStorageAccess beyond cookies succeeds.
IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest,
                       BeyondCookies_WithoutCookiesWithPermission) { … }

class StorageAccessAPIStorageBrowserTest
    : public StorageAccessAPIBaseBrowserTest,
      public testing::WithParamInterface<std::tuple<TestType, bool>> { … };

// Validate that the Storage Access API will unblock other types of storage
// access when a grant is given and that it only applies to the top-level/third
// party pair requested on.
IN_PROC_BROWSER_TEST_P(StorageAccessAPIStorageBrowserTest,
                       ThirdPartyIFrameStorageRequestsAccess) { … }

IN_PROC_BROWSER_TEST_P(StorageAccessAPIStorageBrowserTest,
                       NestedThirdPartyIFrameStorage) { … }

// Test third-party cookie blocking of features that allow to communicate
// between tabs such as SharedWorkers.
IN_PROC_BROWSER_TEST_P(StorageAccessAPIStorageBrowserTest, MultiTabTest) { … }

INSTANTIATE_TEST_SUITE_P(…);

INSTANTIATE_TEST_SUITE_P(…);

class StorageAccessAPIWithFirstPartySetsBrowserTest
    : public StorageAccessAPIBaseBrowserTest { … };

IN_PROC_BROWSER_TEST_F(StorageAccessAPIWithFirstPartySetsBrowserTest,
                       Permission_AutograntedWithinFirstPartySet) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessAPIWithFirstPartySetsBrowserTest,
                       Permission_PromptOrDenyUnderServiceDomain) { … }

IN_PROC_BROWSER_TEST_F(
    StorageAccessAPIWithFirstPartySetsBrowserTest,
    Permission_AutograntedForServiceDomainWithExistingGrant) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessAPIWithFirstPartySetsBrowserTest,
                       Permission_AutodeniedOutsideFirstPartySet_Overridden) { … }

IN_PROC_BROWSER_TEST_F(
    StorageAccessAPIWithFirstPartySetsBrowserTest,
    Permission_AutodeniedInsideFirstPartySet_WithoutInteraction) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessAPIWithFirstPartySetsBrowserTest,
                       PRE_PermissionGrantsRestoredAfterRestart) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessAPIWithFirstPartySetsBrowserTest,
                       PermissionGrantsRestoredAfterRestart) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessAPIWithFirstPartySetsBrowserTest,
                       Permission_GrantedForServiceDomain) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessAPIWithFirstPartySetsBrowserTest,
                       SameSite_NoRegression) { … }

class StorageAccessAPIWithFirstPartySetsAndImplicitGrantsBrowserTest
    : public StorageAccessAPIBaseBrowserTest { … };

// Validate that when auto-deny-outside-fps is disabled (but auto-grant is
// enabled), implicit grants still work.
IN_PROC_BROWSER_TEST_F(
    StorageAccessAPIWithFirstPartySetsAndImplicitGrantsBrowserTest,
    ImplicitGrants) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest,
                       RequestStorageAccess_CoexistsWithPartitionedCookies) { … }

class StorageAccessAPIEnterprisePolicyBrowserTest
    : public StorageAccessAPIBaseBrowserTest,
      public testing::WithParamInterface<
          /* (origin, content_setting, is_storage_partitioned) */
          std::tuple<const char*, ContentSetting, bool>> { … };

INSTANTIATE_TEST_SUITE_P(…);

IN_PROC_BROWSER_TEST_P(StorageAccessAPIEnterprisePolicyBrowserTest,
                       PartitionedStorage) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest,
                       EnsureOnePromptDenialSuffices) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest,
                       DismissalAllowsFuturePrompts) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest,
                       TopLevelUserInteractionRequired) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest,
                       IncognitoDoesntUseRegularInteractionsOrPermission) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessAPIBrowserTest, IncognitoCanUseAPI) { … }

class StorageAccessAPIWithImplicitGrantsBrowserTest
    : public StorageAccessAPIBaseBrowserTest { … };

IN_PROC_BROWSER_TEST_F(StorageAccessAPIWithImplicitGrantsBrowserTest,
                       ImplicitGrantsAllowAccess) { … }

// Tests to verify that when 3p cookie is allowed, the embedded iframe can
// access cookie without requesting, and no prompt is shown if the iframe makes
// the request.
class StorageAccessAPIWith3PCEnabledBrowserTest
    : public StorageAccessAPIBaseBrowserTest { … };

IN_PROC_BROWSER_TEST_F(StorageAccessAPIWith3PCEnabledBrowserTest,
                       AllowedWhenUnblocked) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessAPIWith3PCEnabledBrowserTest,
                       AllowedByUserBypass) { … }

// Validate that if third-party cookies are allowed but the permission is
// denied, requestStorageAccess beyond cookies succeeds.
IN_PROC_BROWSER_TEST_F(StorageAccessAPIWith3PCEnabledBrowserTest,
                       BeyondCookies_WithCookiesWithoutPermission) { … }

// Validate that if third-party cookies are allowed and the permission is
// allowed, requestStorageAccess beyond cookies succeeds.
IN_PROC_BROWSER_TEST_F(StorageAccessAPIWith3PCEnabledBrowserTest,
                       BeyondCookies_WithCookiesWithPermission) { … }

class StorageAccessAPIAutograntsWithFedCMBrowserTest
    : public StorageAccessAPIBaseBrowserTest { … };

IN_PROC_BROWSER_TEST_F(StorageAccessAPIAutograntsWithFedCMBrowserTest,
                       FedCMGrants_RequiresPermissionPolicy) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessAPIAutograntsWithFedCMBrowserTest,
                       FedCMGrants_PreventSilentAccess) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessAPIAutograntsWithFedCMBrowserTest,
                       FedCMGrants_PreventSilentAccess_AfterAutogrant) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessAPIAutograntsWithFedCMBrowserTest,
                       FedCMGrants_PermissionPolicyHeaderIgnored) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessAPIAutograntsWithFedCMBrowserTest,
                       FedCMGrantsAllowCookieAccessViaSAA) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessAPIAutograntsWithFedCMBrowserTest,
                       FedCMGrantsAllowCookieAccess_NestedFrame) { … }

class StorageAccessAPIAutograntsWithFedCMOriginTrialBrowserTest
    : public StorageAccessAPIAutograntsWithFedCMBrowserTest { … };

IN_PROC_BROWSER_TEST_F(
    StorageAccessAPIAutograntsWithFedCMOriginTrialBrowserTest,
    FedCMGrantsAllowCookieAccessViaSAA) { … }

class StorageAccessHeadersDisabledBrowserTest
    : public StorageAccessAPIBrowserTest { … };

IN_PROC_BROWSER_TEST_F(StorageAccessHeadersDisabledBrowserTest, RetryHeader) { … }

class StorageAccessHeadersBrowserTest : public StorageAccessAPIBrowserTest { … };

IN_PROC_BROWSER_TEST_F(StorageAccessHeadersBrowserTest, RetryHeader) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessHeadersBrowserTest,
                       RetryHeader_NoopWithoutGrant) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessHeadersBrowserTest,
                       RetryHeader_ABAContext) { … }

// Regression test for https://crbug.com/352722603. Same as
// `RetryHeader_ABAContext`, except that the iframe calls
// `document.requestStorageAccess()` before issuing the fetch.
IN_PROC_BROWSER_TEST_F(StorageAccessHeadersBrowserTest,
                       RetryHeader_ABAContext_WithIrrelevantApiCall) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessHeadersBrowserTest, LoadHeader) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessHeadersBrowserTest,
                       LoadHeader_NoopWithoutGrant) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessHeadersBrowserTest,
                       RequestHeadersFirstParty) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessHeadersBrowserTest,
                       RequestHeadersCookiesBlocked) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessHeadersBrowserTest, RequestHeadersNone) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessHeadersBrowserTest,
                       RequestHeadersInactive) { … }

IN_PROC_BROWSER_TEST_F(StorageAccessHeadersBrowserTest,
                       RequestHeaderRetryToActive) { … }

class StorageAccessHeadersWithThirdPartyCookiesBrowserTest
    : public StorageAccessHeadersBrowserTest { … };

IN_PROC_BROWSER_TEST_F(StorageAccessHeadersWithThirdPartyCookiesBrowserTest,
                       RetryHeader_NoopWhenCookiesAllowed) { … }

class StorageAccessHeadersWithFedCMBrowserTest
    : public StorageAccessAPIAutograntsWithFedCMBrowserTest { … };

IN_PROC_BROWSER_TEST_F(StorageAccessHeadersWithFedCMBrowserTest, RetryHeader) { … }

// TODO(): Add test cases of 3PC enabled by other mechanisms.

}  // namespace