Zgroza (Luke) Klimek (Gerrit)

unread,

Feb 27, 2026, 10:49:43 AM (4 days ago) Feb 27

to Andrew Rayskiy, Chromium LUCI CQ, Simon Hangl, AyeAye, mgiuca...@chromium.org, philli...@chromium.org, aixba+wat...@chromium.org, webap...@microsoft.com, zelin+watch-we...@chromium.org, dibyapal+wa...@chromium.org, mek+w...@chromium.org, rmcelra...@chromium.org, network-ser...@chromium.org, dmurph+watc...@chromium.org, kuragin+web-ap...@chromium.org, japhet+...@chromium.org, loyso...@chromium.org

Attention needed from Andrew Rayskiy

Zgroza (Luke) Klimek voted and added 1 comment

Votes added by Zgroza (Luke) Klimek

Commit-Queue

+1

1 comment

Patchset-level comments

File-level comment, Patchset 2 (Latest):

Zgroza (Luke) Klimek . resolved

@green...@google.com PTAL at the first part

Open in Gerrit

Related details

Attention is currently required from:

Andrew Rayskiy

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review
Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

Zgroza (Luke) Klimek (Gerrit)

unread,

Feb 27, 2026, 11:37:40 AM (4 days ago) Feb 27

to Simon Hangl, Andrew Rayskiy, Chromium LUCI CQ, AyeAye, mgiuca...@chromium.org, philli...@chromium.org, aixba+wat...@chromium.org, webap...@microsoft.com, zelin+watch-we...@chromium.org, dibyapal+wa...@chromium.org, mek+w...@chromium.org, rmcelra...@chromium.org, network-ser...@chromium.org, dmurph+watc...@chromium.org, kuragin+web-ap...@chromium.org, japhet+...@chromium.org, loyso...@chromium.org

Attention needed from Andrew Rayskiy and Simon Hangl

Zgroza (Luke) Klimek added 1 comment

Patchset-level comments

File-level comment, Patchset 2 (Latest):

Zgroza (Luke) Klimek . resolved

@sim...@google.com can You too PTAL?

Open in Gerrit

Related details

Attention is currently required from:

Andrew Rayskiy
Simon Hangl

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review
Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

Andrew Rayskiy (Gerrit)

unread,

Feb 27, 2026, 12:44:11 PM (4 days ago) Feb 27

to Zgroza (Luke) Klimek, Simon Hangl, Chromium LUCI CQ, AyeAye, mgiuca...@chromium.org, philli...@chromium.org, aixba+wat...@chromium.org, webap...@microsoft.com, zelin+watch-we...@chromium.org, dibyapal+wa...@chromium.org, mek+w...@chromium.org, rmcelra...@chromium.org, network-ser...@chromium.org, dmurph+watc...@chromium.org, kuragin+web-ap...@chromium.org, japhet+...@chromium.org, loyso...@chromium.org

Attention needed from Simon Hangl and Zgroza (Luke) Klimek

Andrew Rayskiy voted and added 4 comments

Votes added by Andrew Rayskiy

Code-Review

+1

4 comments

File chrome/browser/web_applications/isolated_web_apps/runtime_data/chrome_iwa_runtime_data_provider.cc

Line 20, Patchset 2 (Latest): base::DictValue dict;

Andrew Rayskiy . unresolved

nit: revert this

File chrome/browser/web_applications/isolated_web_apps/runtime_data/iwa_entitlements.h

Line 44, Patchset 2 (Latest):std::optional<IwaAccessControl::UserInstallAllowlistItemData::Entitlement>

Andrew Rayskiy . unresolved

nit: `std::optional<IwaEntitlement>`

File chrome/browser/web_applications/isolated_web_apps/runtime_data/iwa_entitlements.cc

Line 68, Patchset 2 (Latest): return network::IsPermissionsPolicyFeatureGuardedByIsolatedContext(

Andrew Rayskiy . unresolved

nit: this bypass function doesn't really do much. Maybe just directly call `network::IsPermissionsPolicyFeatureGuardedByIsolatedContext` where needed?

File services/network/build/scripts/templates/permissions_policy_features_generated.cc.tmpl

Line 98, Patchset 2 (Latest): static const char* kIsolatedContextFeatures[] = {

Andrew Rayskiy . unresolved

Ideally this should be a `FixedFlatSet` with a one-off static initializer (via `MakeFixedFlatSet`

Open in Gerrit

Related details

Attention is currently required from:

Simon Hangl
Zgroza (Luke) Klimek

Submit Requirements:

Code-Coverage
Code-Owners

Code-Review
No-Unresolved-Comments
Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

Zgroza (Luke) Klimek (Gerrit)

unread,

Mar 2, 2026, 7:59:35 AM (yesterday) Mar 2

to Andrew Rayskiy, Simon Hangl, Chromium LUCI CQ, AyeAye, mgiuca...@chromium.org, philli...@chromium.org, aixba+wat...@chromium.org, webap...@microsoft.com, zelin+watch-we...@chromium.org, dibyapal+wa...@chromium.org, mek+w...@chromium.org, rmcelra...@chromium.org, network-ser...@chromium.org, dmurph+watc...@chromium.org, kuragin+web-ap...@chromium.org, japhet+...@chromium.org, loyso...@chromium.org

Attention needed from Andrew Rayskiy and Simon Hangl

Zgroza (Luke) Klimek voted and added 3 comments

Votes added by Zgroza (Luke) Klimek

Commit-Queue

+1

3 comments

File chrome/browser/web_applications/isolated_web_apps/runtime_data/chrome_iwa_runtime_data_provider.cc

Line 20, Patchset 2: base::DictValue dict;

Andrew Rayskiy . resolved

nit: revert this

Zgroza (Luke) Klimek

Done

File chrome/browser/web_applications/isolated_web_apps/runtime_data/iwa_entitlements.h

Line 44, Patchset 2:std::optional<IwaAccessControl::UserInstallAllowlistItemData::Entitlement>

Andrew Rayskiy . resolved

nit: `std::optional<IwaEntitlement>`

Zgroza (Luke) Klimek

Done

File services/network/build/scripts/templates/permissions_policy_features_generated.cc.tmpl

Line 98, Patchset 2: static const char* kIsolatedContextFeatures[] = {

Andrew Rayskiy . resolved

Ideally this should be a `FixedFlatSet` with a one-off static initializer (via `MakeFixedFlatSet`

Zgroza (Luke) Klimek

Done

Open in Gerrit

Related details

Attention is currently required from:

Andrew Rayskiy
Simon Hangl

Submit Requirements:

Code-Coverage
Code-Owners

Code-Review

No-Unresolved-Comments

Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

Andrew Rayskiy (Gerrit)

unread,

Mar 2, 2026, 8:05:05 AM (yesterday) Mar 2

to Zgroza (Luke) Klimek, Simon Hangl, Chromium LUCI CQ, AyeAye, mgiuca...@chromium.org, philli...@chromium.org, aixba+wat...@chromium.org, webap...@microsoft.com, zelin+watch-we...@chromium.org, dibyapal+wa...@chromium.org, mek+w...@chromium.org, rmcelra...@chromium.org, network-ser...@chromium.org, dmurph+watc...@chromium.org, kuragin+web-ap...@chromium.org, japhet+...@chromium.org, loyso...@chromium.org

Attention needed from Simon Hangl and Zgroza (Luke) Klimek

Andrew Rayskiy voted Code-Review+1

Code-Review

+1

Open in Gerrit

Related details

Attention is currently required from:

Simon Hangl
Zgroza (Luke) Klimek

Submit Requirements:

Code-Coverage
Code-Owners

Code-Review

No-Unresolved-Comments

Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

Zgroza (Luke) Klimek (Gerrit)

unread,

Mar 2, 2026, 8:10:18 AM (yesterday) Mar 2

to Daniel Vogelheim, Andrew Rayskiy, Simon Hangl, Chromium LUCI CQ, AyeAye, mgiuca...@chromium.org, philli...@chromium.org, aixba+wat...@chromium.org, webap...@microsoft.com, zelin+watch-we...@chromium.org, dibyapal+wa...@chromium.org, mek+w...@chromium.org, rmcelra...@chromium.org, network-ser...@chromium.org, dmurph+watc...@chromium.org, kuragin+web-ap...@chromium.org, japhet+...@chromium.org, loyso...@chromium.org

Attention needed from Daniel Vogelheim and Simon Hangl

Zgroza (Luke) Klimek added 1 comment

Patchset-level comments

File-level comment, Patchset 3 (Latest):

Zgroza (Luke) Klimek . resolved

Hi @voge...@chromium.org, can You PTAL at the permissions policy-related helper added here?

Open in Gerrit

Related details

Attention is currently required from:

Daniel Vogelheim
Simon Hangl

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review
No-Unresolved-Comments
Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

Zgroza (Luke) Klimek (Gerrit)

unread,

Mar 2, 2026, 9:20:01 AM (yesterday) Mar 2

to Daniel Vogelheim, Andrew Rayskiy, Simon Hangl, Chromium LUCI CQ, AyeAye, mgiuca...@chromium.org, philli...@chromium.org, aixba+wat...@chromium.org, webap...@microsoft.com, zelin+watch-we...@chromium.org, dibyapal+wa...@chromium.org, mek+w...@chromium.org, rmcelra...@chromium.org, network-ser...@chromium.org, dmurph+watc...@chromium.org, kuragin+web-ap...@chromium.org, japhet+...@chromium.org, loyso...@chromium.org

Attention needed from Daniel Vogelheim and Simon Hangl

Zgroza (Luke) Klimek added 1 comment

File chrome/browser/web_applications/isolated_web_apps/runtime_data/iwa_entitlements.cc

Line 68, Patchset 2: return network::IsPermissionsPolicyFeatureGuardedByIsolatedContext(

Andrew Rayskiy . resolved

nit: this bypass function doesn't really do much. Maybe just directly call `network::IsPermissionsPolicyFeatureGuardedByIsolatedContext` where needed?

Zgroza (Luke) Klimek

Done

Open in Gerrit

Related details

Attention is currently required from:

Daniel Vogelheim
Simon Hangl

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review

Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

Daniel Vogelheim (Gerrit)

unread,

Mar 2, 2026, 9:30:04 AM (yesterday) Mar 2

to Zgroza (Luke) Klimek, Daniel Vogelheim, Andrew Rayskiy, Simon Hangl, Chromium LUCI CQ, AyeAye, mgiuca...@chromium.org, philli...@chromium.org, aixba+wat...@chromium.org, webap...@microsoft.com, zelin+watch-we...@chromium.org, dibyapal+wa...@chromium.org, mek+w...@chromium.org, rmcelra...@chromium.org, network-ser...@chromium.org, dmurph+watc...@chromium.org, kuragin+web-ap...@chromium.org, japhet+...@chromium.org, loyso...@chromium.org

Attention needed from Simon Hangl and Zgroza (Luke) Klimek

Daniel Vogelheim voted and added 1 comment

Votes added by Daniel Vogelheim

Code-Review

+1

1 comment

Patchset-level comments

File-level comment, Patchset 3 (Latest):

Daniel Vogelheim . resolved

LGTM for *permissions_policy*.

Open in Gerrit

Related details

Attention is currently required from:

Simon Hangl
Zgroza (Luke) Klimek

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review
Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

Zgroza (Luke) Klimek (Gerrit)

unread,

Mar 2, 2026, 9:36:52 AM (yesterday) Mar 2

to Maks Orlovich, Daniel Vogelheim, Andrew Rayskiy, Simon Hangl, Chromium LUCI CQ, AyeAye, mgiuca...@chromium.org, philli...@chromium.org, aixba+wat...@chromium.org, webap...@microsoft.com, zelin+watch-we...@chromium.org, dibyapal+wa...@chromium.org, mek+w...@chromium.org, rmcelra...@chromium.org, network-ser...@chromium.org, dmurph+watc...@chromium.org, kuragin+web-ap...@chromium.org, japhet+...@chromium.org, loyso...@chromium.org

Attention needed from Maks Orlovich and Simon Hangl

Zgroza (Luke) Klimek added 1 comment

Patchset-level comments

File-level comment, Patchset 3:

Zgroza (Luke) Klimek . resolved

Hi @morl...@chromium.org, can You PTAL at the remaining files in `services/network/OWNERS`?

Open in Gerrit

Related details

Attention is currently required from:

Maks Orlovich
Simon Hangl

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review
Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

Zgroza (Luke) Klimek (Gerrit)

unread,

Mar 2, 2026, 9:39:42 AM (yesterday) Mar 2

to Maks Orlovich, Daniel Vogelheim, Andrew Rayskiy, Simon Hangl, Chromium LUCI CQ, AyeAye, mgiuca...@chromium.org, philli...@chromium.org, aixba+wat...@chromium.org, webap...@microsoft.com, zelin+watch-we...@chromium.org, dibyapal+wa...@chromium.org, mek+w...@chromium.org, rmcelra...@chromium.org, network-ser...@chromium.org, dmurph+watc...@chromium.org, kuragin+web-ap...@chromium.org, japhet+...@chromium.org, loyso...@chromium.org

Attention needed from Maks Orlovich and Simon Hangl

Zgroza (Luke) Klimek added 1 comment

Patchset-level comments

File-level comment, Patchset 3:

Zgroza (Luke) Klimek . resolved

Hi @morl...@chromium.org, can You PTAL at the remaining files in `services/network/OWNERS`?

Zgroza (Luke) Klimek

A note: from `services/network/build/OWNERS` and `third_party/blink/public/common/permissions_policy/OWNERS` it seems as though `services/network/build/scripts/*permissions_policy*` changes should be approvable by @voge...@chromium.org, but apparently Gerrit disagrees?

satisfied_requirement

unsatisfied_requirement

open

diffy

Maks Orlovich (Gerrit)

unread,

Mar 2, 2026, 9:57:14 AM (yesterday) Mar 2

to Zgroza (Luke) Klimek, Daniel Vogelheim, Andrew Rayskiy, Simon Hangl, Chromium LUCI CQ, AyeAye, mgiuca...@chromium.org, philli...@chromium.org, aixba+wat...@chromium.org, webap...@microsoft.com, zelin+watch-we...@chromium.org, dibyapal+wa...@chromium.org, mek+w...@chromium.org, rmcelra...@chromium.org, network-ser...@chromium.org, dmurph+watc...@chromium.org, kuragin+web-ap...@chromium.org, japhet+...@chromium.org, loyso...@chromium.org

Attention needed from Simon Hangl and Zgroza (Luke) Klimek

Maks Orlovich added 1 comment

File services/network/public/cpp/permissions_policy/permissions_policy_features_generated.h

Line 23, Patchset 4 (Latest):bool IsPermissionsPolicyFeatureGuardedByIsolatedContext(

Maks Orlovich . unresolved

So it might be because I am lacking context --- what "guarded by" may be obvious to you --- but I think it would be helpful if this had a comment particularly explaining the directionality of this method --- e.g. does a return of true mean that the feature supposed to be allowed/disallowed/be asked about elsewhere?

Open in Gerrit

Related details

Attention is currently required from:

Simon Hangl
Zgroza (Luke) Klimek

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review

No-Unresolved-Comments
Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

Andrew Rayskiy (Gerrit)

unread,

Mar 2, 2026, 10:04:55 AM (yesterday) Mar 2

to Zgroza (Luke) Klimek, Maks Orlovich, Daniel Vogelheim, Simon Hangl, Chromium LUCI CQ, AyeAye, mgiuca...@chromium.org, philli...@chromium.org, aixba+wat...@chromium.org, webap...@microsoft.com, zelin+watch-we...@chromium.org, dibyapal+wa...@chromium.org, mek+w...@chromium.org, rmcelra...@chromium.org, network-ser...@chromium.org, dmurph+watc...@chromium.org, kuragin+web-ap...@chromium.org, japhet+...@chromium.org, loyso...@chromium.org

Attention needed from Simon Hangl and Zgroza (Luke) Klimek

Andrew Rayskiy voted and added 1 comment

Votes added by Andrew Rayskiy

Code-Review

+1

1 comment

File services/network/public/cpp/permissions_policy/permissions_policy_features_generated.h

Line 23, Patchset 4 (Latest):bool IsPermissionsPolicyFeatureGuardedByIsolatedContext(

Maks Orlovich . unresolved

So it might be because I am lacking context --- what "guarded by" may be obvious to you --- but I think it would be helpful if this had a comment particularly explaining the directionality of this method --- e.g. does a return of true mean that the feature supposed to be allowed/disallowed/be asked about elsewhere?

Andrew Rayskiy

[Example](https://source.chromium.org/chromium/chromium/src/+/main:services/network/public/cpp/permissions_policy/permissions_policy_features.json5;l=326-337?q=-f:%5Eout%2F%20-f:%5Egen%2F%20-f:%5Esrc%2F%20case:auto%20f:json%20permissions_p%20IsolatedContext). Maybe `PermissionsPolicyRequiresIsolatedContext()`?

satisfied_requirement

unsatisfied_requirement

open

diffy

Zgroza (Luke) Klimek (Gerrit)

unread,

Mar 2, 2026, 10:10:45 AM (yesterday) Mar 2

to Maks Orlovich, Daniel Vogelheim, Andrew Rayskiy, Simon Hangl, Chromium LUCI CQ, AyeAye, mgiuca...@chromium.org, philli...@chromium.org, aixba+wat...@chromium.org, webap...@microsoft.com, zelin+watch-we...@chromium.org, dibyapal+wa...@chromium.org, mek+w...@chromium.org, rmcelra...@chromium.org, network-ser...@chromium.org, dmurph+watc...@chromium.org, kuragin+web-ap...@chromium.org, japhet+...@chromium.org, loyso...@chromium.org

Attention needed from Andrew Rayskiy, Maks Orlovich and Simon Hangl

Zgroza (Luke) Klimek added 1 comment

File services/network/public/cpp/permissions_policy/permissions_policy_features_generated.h

Line 23, Patchset 4:bool IsPermissionsPolicyFeatureGuardedByIsolatedContext(

Maks Orlovich . unresolved

So it might be because I am lacking context --- what "guarded by" may be obvious to you --- but I think it would be helpful if this had a comment particularly explaining the directionality of this method --- e.g. does a return of true mean that the feature supposed to be allowed/disallowed/be asked about elsewhere?

Zgroza (Luke) Klimek

So, in short, this means that `permissions_policy_features.json5` specifies `visibility: "IsolatedContext"` for this feature.
I added a comment above explaining that, does it sound better now?

Open in Gerrit

Related details

Attention is currently required from:

Andrew Rayskiy
Maks Orlovich
Simon Hangl

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review
No-Unresolved-Comments
Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

Maks Orlovich (Gerrit)

unread,

Mar 2, 2026, 1:15:14 PM (23 hours ago) Mar 2

to Zgroza (Luke) Klimek, Daniel Vogelheim, Andrew Rayskiy, Simon Hangl, Chromium LUCI CQ, AyeAye, mgiuca...@chromium.org, philli...@chromium.org, aixba+wat...@chromium.org, webap...@microsoft.com, zelin+watch-we...@chromium.org, dibyapal+wa...@chromium.org, mek+w...@chromium.org, rmcelra...@chromium.org, network-ser...@chromium.org, dmurph+watc...@chromium.org, kuragin+web-ap...@chromium.org, japhet+...@chromium.org, loyso...@chromium.org

Attention needed from Andrew Rayskiy, Simon Hangl and Zgroza (Luke) Klimek

Maks Orlovich voted and added 1 comment

Votes added by Maks Orlovich

Code-Review

+1

1 comment

File services/network/public/cpp/permissions_policy/permissions_policy_features_generated.h

Line 23, Patchset 4:bool IsPermissionsPolicyFeatureGuardedByIsolatedContext(

Maks Orlovich . resolved

So it might be because I am lacking context --- what "guarded by" may be obvious to you --- but I think it would be helpful if this had a comment particularly explaining the directionality of this method --- e.g. does a return of true mean that the feature supposed to be allowed/disallowed/be asked about elsewhere?

Zgroza (Luke) Klimek

So, in short, this means that `permissions_policy_features.json5` specifies `visibility: "IsolatedContext"` for this feature.
I added a comment above explaining that, does it sound better now?

Maks Orlovich

I think a broader comment that explains more would be better, but this is precise enough to be useful.

Open in Gerrit

Related details

Attention is currently required from:

Andrew Rayskiy

Simon Hangl
Zgroza (Luke) Klimek

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review
Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

open

diffy

Andrew Rayskiy (Gerrit)

unread,

5:37 AM (6 hours ago) 5:37 AM

to Zgroza (Luke) Klimek, Maks Orlovich, Daniel Vogelheim, Simon Hangl, Chromium LUCI CQ, AyeAye, mgiuca...@chromium.org, philli...@chromium.org, aixba+wat...@chromium.org, webap...@microsoft.com, zelin+watch-we...@chromium.org, dibyapal+wa...@chromium.org, mek+w...@chromium.org, rmcelra...@chromium.org, network-ser...@chromium.org, dmurph+watc...@chromium.org, kuragin+web-ap...@chromium.org, japhet+...@chromium.org, loyso...@chromium.org

Attention needed from Simon Hangl and Zgroza (Luke) Klimek

Andrew Rayskiy voted Commit-Queue+2

Commit-Queue

+2

Open in Gerrit

Related details

Attention is currently required from:

Simon Hangl
Zgroza (Luke) Klimek

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review
Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

open

diffy

Chromium LUCI CQ (Gerrit)

unread,

6:22 AM (6 hours ago) 6:22 AM

to Zgroza (Luke) Klimek, Andrew Rayskiy, Maks Orlovich, Daniel Vogelheim, Simon Hangl, AyeAye, mgiuca...@chromium.org, philli...@chromium.org, aixba+wat...@chromium.org, webap...@microsoft.com, zelin+watch-we...@chromium.org, dibyapal+wa...@chromium.org, mek+w...@chromium.org, rmcelra...@chromium.org, network-ser...@chromium.org, dmurph+watc...@chromium.org, kuragin+web-ap...@chromium.org, japhet+...@chromium.org, loyso...@chromium.org

Chromium LUCI CQ submitted the change

Change information

Commit message:

IWA: Add proto changes and immediate handling for entitlements

This change introduces the data structures and proto definitions
required to support entitlement enforcement for Isolated Web Apps.

This change does not "use this" yet, the entitlements are now parsed
and passed to places but not yet enforced. For usage of things added
here see the chained CL: crrev.com/c/7594555.

Key changes:
- Updated key_distribution.proto to include an Entitlements message,
  allowing an allowlist of features to be associated with specific
  Web Bundle IDs and version ranges.
- Introduced IwaEntitlementsSet and helper functions to map
  Permissions Policy features to these new entitlements.
- Enhanced IwaKeyDistributionInfoProvider to parse and expose
  entitlement data from the key distribution component.
- Updated ChromeIwaRuntimeDataProvider to carry entitlement
  information for user-installed apps.
- Added a helper function for determining whether the feature is guarded
  by IsolatedContext to permissions_policy_features_generated.h

Bug: 487246273

Change-Id: I56e5e87c1b35354bc6cae395970d26146a6a6964

Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7613535

Reviewed-by: Andrew Rayskiy <green...@google.com>

Reviewed-by: Maks Orlovich <morl...@chromium.org>

Reviewed-by: Daniel Vogelheim <voge...@chromium.org>

Commit-Queue: Andrew Rayskiy <green...@google.com>

Cr-Commit-Position: refs/heads/main@{#1593125}

Files:

M chrome/browser/web_applications/BUILD.gn
M chrome/browser/web_applications/isolated_web_apps/key_distribution/iwa_key_distribution_info_provider.cc
M chrome/browser/web_applications/isolated_web_apps/key_distribution/iwa_key_distribution_info_provider_unittest.cc
M chrome/browser/web_applications/isolated_web_apps/key_distribution/proto/key_distribution.proto
M chrome/browser/web_applications/isolated_web_apps/runtime_data/BUILD.gn
M chrome/browser/web_applications/isolated_web_apps/runtime_data/chrome_iwa_runtime_data_provider.cc
M chrome/browser/web_applications/isolated_web_apps/runtime_data/chrome_iwa_runtime_data_provider.h
A chrome/browser/web_applications/isolated_web_apps/runtime_data/iwa_entitlements.cc
A chrome/browser/web_applications/isolated_web_apps/runtime_data/iwa_entitlements.h
A chrome/browser/web_applications/isolated_web_apps/runtime_data/iwa_entitlements_unittest.cc
M services/network/build/scripts/templates/permissions_policy_features_generated.cc.tmpl
M services/network/build/scripts/tests/permissions_policy_default_value_control/output/permissions_policy_features_generated.cc.ref
M services/network/public/cpp/BUILD.gn
M services/network/public/cpp/permissions_policy/permissions_policy_features_generated.h
A services/network/public/cpp/permissions_policy/permissions_policy_features_unittest.cc

Change size: L

Delta: 15 files changed, 358 insertions(+), 5 deletions(-)

Branch: refs/heads/main

Submit Requirements:

Code-Review: +1 by Daniel Vogelheim, +1 by Andrew Rayskiy, +1 by Maks Orlovich

Open in Gerrit

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

open

diffy

satisfied_requirement

Reply all

Reply to author

Forward

IWA: Add proto changes and immediate handling for entitlements [chromium/src : main]

Zgroza (Luke) Klimek (Gerrit)

Zgroza (Luke) Klimek voted and added 1 comment

Votes added by Zgroza (Luke) Klimek

1 comment

Related details

Zgroza (Luke) Klimek (Gerrit)

Zgroza (Luke) Klimek added 1 comment

Related details

Andrew Rayskiy (Gerrit)

Andrew Rayskiy voted and added 4 comments

Votes added by Andrew Rayskiy

4 comments

Related details

Zgroza (Luke) Klimek (Gerrit)

Zgroza (Luke) Klimek voted and added 3 comments

Votes added by Zgroza (Luke) Klimek

3 comments

Related details

Andrew Rayskiy (Gerrit)

Andrew Rayskiy voted Code-Review+1

Related details

Zgroza (Luke) Klimek (Gerrit)

Zgroza (Luke) Klimek added 1 comment

Related details

Zgroza (Luke) Klimek (Gerrit)

Zgroza (Luke) Klimek added 1 comment

Related details

Daniel Vogelheim (Gerrit)

Daniel Vogelheim voted and added 1 comment

Votes added by Daniel Vogelheim

1 comment

Related details

Zgroza (Luke) Klimek (Gerrit)

Zgroza (Luke) Klimek added 1 comment

Related details

Zgroza (Luke) Klimek (Gerrit)

Zgroza (Luke) Klimek added 1 comment

Maks Orlovich (Gerrit)

Maks Orlovich added 1 comment

Related details

Andrew Rayskiy (Gerrit)

Andrew Rayskiy voted and added 1 comment

Votes added by Andrew Rayskiy

1 comment

Zgroza (Luke) Klimek (Gerrit)

Zgroza (Luke) Klimek added 1 comment

Related details

Maks Orlovich (Gerrit)

Maks Orlovich voted and added 1 comment

Votes added by Maks Orlovich

1 comment

Related details

Andrew Rayskiy (Gerrit)

Andrew Rayskiy voted Commit-Queue+2

Related details

Chromium LUCI CQ (Gerrit)

Chromium LUCI CQ submitted the change

Change information