/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* ***** BEGIN LICENSE BLOCK *****
 * Version: MPL 1.1/GPL 2.0/LGPL 2.1
 *
 * The contents of this file are subject to the Mozilla Public License Version
 * 1.1 (the "License"); you may not use this file except in compliance with
 * the License. You may obtain a copy of the License at
 * http://www.mozilla.org/MPL/
 *
 * Software distributed under the License is distributed on an "AS IS" basis,
 * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
 * for the specific language governing rights and limitations under the
 * License.
 *
 * The Original Code is mozilla.org code.
 *
 * The Initial Developer of the Original Code is
 * Netscape Communications Corporation.
 * Portions created by the Initial Developer are Copyright (C) 1999
 * the Initial Developer. All Rights Reserved.
 *
 * Contributor(s):
 *
 * Alternatively, the contents of this file may be used under the terms of
 * either of the GNU General Public License Version 2 or later (the "GPL"),
 * or the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
 * in which case the provisions of the GPL or the LGPL are applicable instead
 * of those above. If you wish to allow use of your version of this file only
 * under the terms of either the GPL or the LGPL, and not to allow others to
 * use your version of this file under the terms of the MPL, indicate your
 * decision by deleting the provisions above and replace them with the notice
 * and other provisions required by the GPL or the LGPL. If you do not delete
 * the provisions above, a recipient may use your version of this file under
 * the terms of any one of the MPL, the GPL or the LGPL.
 *
 * ***** END LICENSE BLOCK ***** */

#include "nsISupports.idl"
#include "nsIPrincipal.idl"
#include "nsIXPCSecurityManager.idl"
interface nsIURI;


[scriptable, uuid(f4d74511-2b2d-4a14-a3e4-a392ac5ac3ff)]
interface nsIScriptSecurityManager : nsIXPCSecurityManager
{
    ///////////////// Security Checks //////////////////
    /**
     * Checks whether the running script is allowed to access aProperty.
     */
    [noscript] void checkPropertyAccess(in JSContextPtr aJSContext,
                                        in JSObjectPtr aJSObject,
                                        in string aClassName,
                                        in JSVal aProperty,
                                        in PRUint32 aAction);

    /**
     * Checks whether the running script is allowed to connect to aTargetURI
     */
    [noscript] void checkConnect(in JSContextPtr aJSContext,
                                 in nsIURI aTargetURI,
                                 in string aClassName,
                                 in string aProperty);

    /**
     * Check that the script currently running in context "cx" can load "uri".
     *
     * Will return error code NS_ERROR_DOM_BAD_URI if the load request 
     * should be denied.
     *
     * @param cx the JSContext of the script causing the load
     * @param uri the URI that is being loaded
     */
    [noscript] void checkLoadURIFromScript(in JSContextPtr cx, in nsIURI uri);

    /**
     * Default CheckLoadURI permissions
     */
    // Default permissions
    const unsigned long STANDARD = 0;

    // If the source is mail, disallow the load
    const unsigned long DISALLOW_FROM_MAIL = 1 << 0;

    // Allow the loading of chrome URLs by non-chrome URLs
    const unsigned long ALLOW_CHROME = 1 << 1;

    // Don't allow javascript: and data: URLs to load
    const unsigned long DISALLOW_SCRIPT_OR_DATA = 1 << 2;

    // Don't allow javascript: URLs to load
    //   WARNING: Support for this value was added in Mozilla 1.7.8 and
    //   Firefox 1.0.4.  Use in prior versions WILL BE IGNORED.
    const unsigned long DISALLOW_SCRIPT = 1 << 3;

    /**
     * Check that content with principal aPrincipal can load "uri".
     *
     * Will return error code NS_ERROR_DOM_BAD_URI if the load request 
     * should be denied.
     *
     * @param aPrincipal the URI causing the load
     * @param uri the URI that is being loaded
     * @param flags the permission set, see above
     */
    [noscript] void checkLoadURIWithPrincipal(in nsIPrincipal aPrincipal,
                                              in nsIURI uri, 
                                              in unsigned long flags);

    /**
     * Check that content from "from" can load "uri".
     *
     * Will return error code NS_ERROR_DOM_BAD_URI if the load request 
     * should be denied.
     *
     * @param from the URI causing the load
     * @param uri the URI that is being loaded
     * @param flags the permission set, see above
     */
    void checkLoadURI(in nsIURI from, in nsIURI uri, 
                      in unsigned long flags);

    /**
     * Same as CheckLoadURI but takes string arguments for ease of use
     * by scripts
     */
    void checkLoadURIStr(in AUTF8String from, in AUTF8String uri, 
                         in unsigned long flags);

    /**
     * Check that the function 'funObj' is allowed to run on 'targetObj'
     *
     * Will return error code NS_ERROR_DOM_SECURITY_ERR if the function
     * should not run
     *
     * @param cx The current active JavaScript context.
     * @param funObj The function trying to run..
     * @param targetObj The object the function will run on.
     */
    [noscript] void checkFunctionAccess(in JSContextPtr cx, in voidPtr funObj,
                                        in voidPtr targetObj);

    /**
     * Return true if content from the given principal is allowed to
     * execute scripts.
     */
    [noscript] boolean canExecuteScripts(in JSContextPtr cx,
                                         in nsIPrincipal principal);

    ///////////////// Principals /////////////////////// 
    /**
     * Return the principal of the innermost frame of the currently 
     * executing script. Will return null if there is no script 
     * currently executing.
     */
    [noscript] nsIPrincipal getSubjectPrincipal();

    /**
     * Return the all-powerful system principal.
     */
    [noscript] nsIPrincipal getSystemPrincipal();

    /**
     * Return a principal with the specified certificate fingerprint, subject
     * name (the full name or concatenated set of names of the entity
     * represented by the certificate), pretty name, certificate, and
     * codebase URI.  The certificate fingerprint and subject name MUST be
     * nonempty; otherwise an error will be thrown.  Similarly, aCert must
     * not be null.
     */
    [noscript] nsIPrincipal
         getCertificatePrincipal(in AUTF8String aCertFingerprint,
                                 in AUTF8String aSubjectName,
                                 in AUTF8String aPrettyName,
                                 in nsISupports aCert,
                                 in nsIURI aURI);

    /**
     * Return a principal that has the same origin as aURI.
     */
    [noscript] nsIPrincipal getCodebasePrincipal(in nsIURI aURI);

    ///////////////// Capabilities API /////////////////////
    /**
     * Request that 'capability' can be enabled by scripts or applets
     * running with 'principal'. Will prompt user if
     * necessary. Returns nsIPrincipal::ENABLE_GRANTED or
     * nsIPrincipal::ENABLE_DENIED based on user's choice.
     */
    [noscript] short requestCapability(in nsIPrincipal principal,
                                       in string capability);
    
    /**
     * Return true if the currently executing script has 'capability' enabled.
     */
    boolean isCapabilityEnabled(in string capability);
    
    /**
     * Enable 'capability' in the innermost frame of the currently executing
     * script.
     */
    void enableCapability(in string capability);

    /**
     * Remove 'capability' from the innermost frame of the currently
     * executing script. Any setting of 'capability' from enclosing
     * frames thus comes into effect.
     */
    void revertCapability(in string capability);

    /**
     * Disable 'capability' in the innermost frame of the currently executing
     * script.
     */
    void disableCapability(in string capability);

    //////////////// Master Certificate Functions ////////////////////
    /**
     * Allow 'certificateID' to enable 'capability.' Can only be performed
     * by code signed by the system certificate.
     */
    // XXXbz Capabilities can't have non-ascii chars?
    // XXXbz ideally we'd pass a subjectName here too, and the nsISupports
    // cert we're enabling for...
    void setCanEnableCapability(in AUTF8String certificateFingerprint,
                                in string capability, 
                                in short canEnable);

    ///////////////////////
    /**
     * Return the principal of the specified object in the specified context.
     */
    [noscript] nsIPrincipal getObjectPrincipal(in JSContextPtr cx,
                                               in JSObjectPtr obj);

    /**
     * Returns true if the principal of the currently running script is the
     * system principal, false otherwise.
     */
    [noscript] boolean subjectPrincipalIsSystem();

    /**
     * Returns OK if aJSContext and target have the same "origin"
     * (scheme, host, and port).
     */
    [noscript] void checkSameOrigin(in JSContextPtr aJSContext,
                                    in nsIURI aTargetURI);

    /**
     * Returns OK if aSourceURI and target have the same "origin"
     * (scheme, host, and port).
     */
    void checkSameOriginURI(in nsIURI aSourceURI,
                            in nsIURI aTargetURI);

    /**
     * Returns OK if aSourcePrincipal and aTargetPrincipal
     * have the same "origin" (scheme, host, and port).
     */
    [noscript] void checkSameOriginPrincipal(in nsIPrincipal aSourcePrincipal,
                                             in nsIPrincipal aTargetPrincipal);

    /**
     * Returns the principal of the global object of the given context, or null
     * if no global or no principal.
     */
    [noscript] nsIPrincipal getPrincipalFromContext(in JSContextPtr cx);

    /**
     * Utility method for comparing two URIs.  For security purposes, two URIs
     * are equivalent if their schemes, hosts, and ports (if any) match.  This
     * method returns true if aSubjectURI and aObjectURI have the same origin,
     * false otherwise.
     */
    [noscript] boolean securityCompareURIs(in nsIURI aSubjectURI,
                                           in nsIURI aObjectURI);
};

%{C++
#define NS_SCRIPTSECURITYMANAGER_CONTRACTID "@mozilla.org/scriptsecuritymanager;1"
#define NS_SCRIPTSECURITYMANAGER_CLASSNAME "scriptsecuritymanager"
%}