[Connection-Allowlist] Add web platform tests for connection allowlist enforcement on PaymentRequest API: service worker registration

The web platform tests cover the service worker registration behavior
when there is a connection allowlist on the initiator frame of PaymentRequest API.

Requests flow:
1. PaymentRequest API sends a HEAD request to payment url.
2. A response with Link header pointing to the app manifest is
   sent back.
3. The API downloads the app manifest.
4. The app registers a service worker.

The test sets up allowlist to either block or allow the registration.

About CA: https://github.com/WICG/connection-allowlists

Bug: 519915328, 447954811, 506480941
Change-Id: I6f7b8f39e6227404242c22d24fee5c2992c50f10
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8012329
Commit-Queue: Xiaochen Zhou <xiaochenzh@chromium.org>
Reviewed-by: Andrew Verge <averge@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1668628}

Author: xiaochen-z

connection-allowlist/tentative/payment-app-manifest.json

@@ -0,0 +1,15 @@
+{
+  "default_applications": ["payment-app-manifest.json"],
+  "name": "Test Payment App",
+  "icons": [
+    {
+      "src": "/images/rgrg-256x256.png",
+      "sizes": "256x256",
+      "type": "image/png"
+    }
+  ],
+  "serviceworker": {
+    "src": "payment-app-sw.js",
+    "scope": "./"
+  }
+}

connection-allowlist/tentative/payment-app-manifest.json.headers

@@ -0,0 +1 @@
+Link: </connection-allowlist/tentative/payment-app-manifest.json>; rel="payment-method-manifest"

connection-allowlist/tentative/payment-app-sw.js

@@ -0,0 +1,10 @@
+self.addEventListener('canmakepayment', event => {
+  event.respondWith(true);
+});
+
+self.addEventListener('paymentrequest', event => {
+  event.respondWith({
+    methodName: event.methodData[0].supportedMethods,
+    details: {status: 'success'},
+  });
+});

connection-allowlist/tentative/payment-request-sw-registration-allowed.https.window.js

@@ -0,0 +1,56 @@
+// META: script=/resources/testdriver.js
+// META: script=/resources/testdriver-vendor.js
+//
+// The test assumes the connection allowlist has been set:
+// Connection-Allowlist: (response-origin)
+//
+// It allows same-origin network requests, so the JIT payment app installation
+// (manifest, icon, service worker registration) is allowed. It also allows the
+// test to communicate with the test runner (testharness.js and testdriver.js)
+//
+// 1. Trigger PaymentRequest JIT installation with same-origin payment manifest.
+// 2. JIT succeeds, payment app registers a same-origin service worker.
+// 3. Verify the service worker is registered.
+
+const pay_url = window.location.origin +
+    '/connection-allowlist/tentative/payment-app-manifest.json';
+
+const defaultDetails = {
+  total: {
+    label: 'Total',
+    amount: {
+      currency: 'USD',
+      value: '0.01',
+    },
+  },
+};
+
+promise_test(
+    async t => {
+      // Ensure any registered service workers are cleaned up after the test,
+      // regardless of whether the test passes, fails, or throws.
+      t.add_cleanup(async () => {
+        const regs = await navigator.serviceWorker.getRegistrations();
+        for (const reg of regs) {
+          if (reg.scope.includes('connection-allowlist/tentative/')) {
+            await reg.unregister();
+          }
+        }
+      });
+
+      const request =
+          new PaymentRequest([{supportedMethods: pay_url}], defaultDetails);
+
+      const response =
+          await test_driver.bless('installing a payment app', () => {
+            return request.show();
+          });
+      await response.complete('success');
+
+      const regs = await navigator.serviceWorker.getRegistrations();
+      const found = regs.some(
+          reg => reg.scope.includes('connection-allowlist/tentative/'));
+      assert_true(found, 'Service worker should be registered');
+    },
+    'Payment Request API payment app service worker registration is allowed ' +
+        'by the connection allowlist.');

connection-allowlist/tentative/payment-request-sw-registration-allowed.https.window.js.headers

@@ -0,0 +1 @@
+Connection-Allowlist: (response-origin)

connection-allowlist/tentative/payment-request-sw-registration-blocked.https.window.js

@@ -0,0 +1,76 @@
+// META: script=/resources/testdriver.js
+// META: script=/resources/testdriver-vendor.js
+//
+// The test assumes the connection allowlist has been set:
+// Connection-Allowlist: (
+//   "*://*:*/connection-allowlist/tentative/payment-app-manifest.json"
+//   "*://*:*/images/rgrg-256x256.png"
+//   "*://*:*/connection-allowlist/tentative/payment-request-sw-registration-blocked.https.window.js"
+//   "*://*:*/resources/testharness.js"
+//   "*://*:*/resources/testharnessreport.js"
+//   "*://*:*/resources/testdriver.js"
+//   "*://*:*/resources/testdriver-vendor.js"
+// )
+//
+// Note: The allowlist explicitly allows required test runner scripts, the
+// payment app manifest, and the icon, but does not allow the service worker
+// script ("payment-app-sw.js").
+//
+// 1. Trigger PaymentRequest JIT installation with same-origin payment manifest.
+// 2. The manifest and icon downloads are allowed, but the service worker script
+//    is not allowed by the connection allowlist.
+// 3. Verify the service worker registration fails.
+
+const pay_url = window.location.origin +
+    '/connection-allowlist/tentative/payment-app-manifest.json';
+
+const defaultDetails = {
+  total: {
+    label: 'Total',
+    amount: {
+      currency: 'USD',
+      value: '0.01',
+    },
+  },
+};
+
+promise_test(
+    async t => {
+      // Ensure any registered service workers are cleaned up after the test,
+      // regardless of whether the test passes, fails, or throws.
+      t.add_cleanup(async () => {
+        const regs = await navigator.serviceWorker.getRegistrations();
+        for (const reg of regs) {
+          if (reg.scope.includes('connection-allowlist/tentative/')) {
+            await reg.unregister();
+          }
+        }
+      });
+
+      const request =
+          new PaymentRequest([{supportedMethods: pay_url}], defaultDetails);
+
+      test_driver.bless('installing a payment app', () => {
+        // request.show() initiates JIT payment app installation asynchronously.
+        // We do not await this promise because if JIT installation fails, an
+        // error dialog is displayed that keeps the promise pending indefinitely
+        // until closed.
+        request.show().catch(() => {});
+      });
+
+      // Wait for some time to allow Payment Request API to attempt fetching and
+      // registering `payment-app-sw.js` which gets blocked by the connection
+      // allowlist.
+      await new Promise(resolve => t.step_timeout(resolve, 2000));
+
+      const regs = await navigator.serviceWorker.getRegistrations();
+      let found = false;
+      for (const reg of regs) {
+        if (reg.scope.includes('connection-allowlist/tentative/')) {
+          found = true;
+        }
+      }
+      assert_false(found, 'Service worker should not be registered');
+    },
+    'Payment Request API payment app service worker registration is blocked ' +
+        'by the connection allowlist.');

connection-allowlist/tentative/payment-request-sw-registration-blocked.https.window.js.headers

@@ -0,0 +1 @@
+Connection-Allowlist: ("*://*:*/connection-allowlist/tentative/payment-app-manifest.json" "*://*:*/images/rgrg-256x256.png" "*://*:*/connection-allowlist/tentative/payment-request-sw-registration-blocked.https.window.js" "*://*:*/resources/testharness.js" "*://*:*/resources/testharnessreport.js" "*://*:*/resources/testdriver.js" "*://*:*/resources/testdriver-vendor.js")