[FAILS] Add a test to show issue with subdomains as additional permis…

…sions According to the documentation, `strictOrigins` is only concerned with widening of permissions, not additional permissions which are narrower than a pattern already in the manifest origins. However, if `https://subdomain.hassubdomains.com/*` is granted by the user as an optional permission on top of `https://*.hassubdomains.com/*`, this does not change the effective set of permissions. So to be consistent with the documentation, when `strictOrigins` is `true`, the additional subdomain pattern should not be included in the return value of `extractAdditionalPermissions()`. Adding a test based on this expectation causes a failure, showing the current problem. So either the code should be changed, or the documentation for `strictOrigins` expanded to clarify that it also catches narrower permissions as well as wider ones.
aspiers · Jan 21, 2024 · 5901c4b · 5901c4b
1 parent bac783e
commit 5901c4b
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/source/index.test.ts b/source/index.test.ts
@@ -55,6 +55,11 @@ describe.each([
 			origins: [
 				'https://*.github.com/*',
 				'https://git.example.com/*',
+				// According to the documentation, strictOrigins is only concerned
+				// with widening of permissions, not narrowing.  Therefore
+				// This should exclude https://subdomain.hassubdomains.com/*
+				// because it's not an additional permission relative to
+				// https://*.hassubdomains.com/* which is already in the manifest.
 			],
 			permissions: [
 				'someOtherPermission',

diff --git a/test-fixtures/reported-after-addition.json b/test-fixtures/reported-after-addition.json
@@ -5,7 +5,8 @@
 		"https://github.com/*",
 		"https://*.hassubdomains.com/*",
 		"https://*.github.com/*",
-		"https://git.example.com/*"
+		"https://git.example.com/*",
+		"https://subdomain.hassubdomains.com/*"
 	],
 	"permissions": [
 		"activeTab",