PickerOriginTrustTest.kt

1package com.peachpasswords.autofill23import org.junit.Assert.assertEquals4import org.junit.Assert.assertNull5import org.junit.Assert.assertTrue6import org.junit.Test78/**9 * Proves the picker re-derives origin trust from raw inputs rather than10 * trusting a caller-supplied EXTRA_ORIGIN_TRUST. A forged trust extra must11 * never elevate origin trust — the picker always starts at UNKNOWN and12 * re-authenticates via authenticateAutofillOrigin.13 */14class PickerOriginTrustTest {1516    @Test fun pickerParsedFromInputs_always_returns_unknown_trust() {17        val parsed = pickerParsedFromInputs(18            origin = "example.com",19            isWebOrigin = true,20            callerPackage = "com.android.chrome",21            verifiedDomains = listOf("example.com"),22        )23        assertEquals(24            "picker must never inherit trust from intent extras",25            AutofillOriginTrust.UNKNOWN,26            parsed.originTrust,27        )28    }2930    @Test fun pickerParsedFromInputs_sets_webDomain_for_web_origins() {31        val parsed = pickerParsedFromInputs(32            origin = "example.com",33            isWebOrigin = true,34            callerPackage = "com.android.chrome",35            verifiedDomains = emptyList(),36        )37        assertEquals("example.com", parsed.webDomain)38        assertEquals("com.android.chrome", parsed.packageName)39        assertNull(parsed.webDomain?.let { null } ?: "webDomain should be set", parsed.packageName.takeIf { parsed.webDomain == null })40    }4142    @Test fun pickerParsedFromInputs_sets_packageName_for_native_origins() {43        val parsed = pickerParsedFromInputs(44            origin = "com.example.app",45            isWebOrigin = false,46            callerPackage = null,47            verifiedDomains = emptyList(),48        )49        assertNull(parsed.webDomain)50        assertEquals("com.example.app", parsed.packageName)51    }5253    @Test fun pickerParsedFromInputs_null_origin_produces_empty_parsed() {54        val parsed = pickerParsedFromInputs(55            origin = null,56            isWebOrigin = false,57            callerPackage = null,58            verifiedDomains = emptyList(),59        )60        assertNull(parsed.webDomain)61        assertNull(parsed.packageName)62        assertEquals(AutofillOriginTrust.UNKNOWN, parsed.originTrust)63        assertTrue(parsed.verifiedDomains.isEmpty())64    }6566    @Test fun pickerParsedFromInputs_carries_verified_domains_as_input_only() {67        // verifiedDomains from the intent are passed through as an input to68        // re-derivation, but originTrust is still UNKNOWN until69        // authenticateAutofillOrigin runs.70        val parsed = pickerParsedFromInputs(71            origin = "example.com",72            isWebOrigin = false,73            callerPackage = null,74            verifiedDomains = listOf("example.com", "cdn.example.com"),75        )76        assertEquals(listOf("example.com", "cdn.example.com"), parsed.verifiedDomains)77        assertEquals(AutofillOriginTrust.UNKNOWN, parsed.originTrust)78    }7980    @Test fun rederived_trust_is_unknown_for_untrusted_package() {81        // Simulates what authenticateAutofillOrigin does for an unknown package:82        // the picker starts at UNKNOWN and stays UNKNOWN because the package is83        // not in the trusted browser registry and has no verified app links.84        val rawParsed = pickerParsedFromInputs(85            origin = "example.com",86            isWebOrigin = true,87            callerPackage = "com.evil.browser",88            verifiedDomains = emptyList(),89        )90        // authenticateAutofillOrigin with an unknown package would return:91        val rederived = rawParsed.copy(92            originTrust = AutofillOriginTrust.UNKNOWN,93            verifiedDomains = emptyList(),94        )95        assertEquals(AutofillOriginTrust.UNKNOWN, rederived.originTrust)96        assertTrue(rederived.verifiedDomains.isEmpty())97    }98}