Bug 1888590 - Mark some subtests on trusted-types-event-handlers.html as failing...

[gecko.git] / extensions / permissions / PermissionManager.cpp

/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* vim: set ts=8 sts=2 et sw=2 tw=80: */
/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

#include "mozilla/AbstractThread.h"
#include "mozilla/AppShutdown.h"
#include "mozilla/BasePrincipal.h"
#include "mozilla/ClearOnShutdown.h"
#include "mozilla/ContentPrincipal.h"
#include "mozilla/DebugOnly.h"
#include "mozilla/dom/CanonicalBrowsingContext.h"
#include "mozilla/dom/ContentParent.h"
#include "mozilla/dom/Document.h"
#include "mozilla/dom/WindowGlobalParent.h"
#include "mozilla/ExpandedPrincipal.h"
#include "mozilla/net/NeckoMessageUtils.h"
#include "mozilla/Permission.h"
#include "mozilla/PermissionManager.h"
#include "mozilla/Preferences.h"
#include "mozilla/ScopeExit.h"
#include "mozilla/StaticPrefs_permissions.h"
#include "mozilla/Telemetry.h"

#include "mozIStorageService.h"
#include "mozIStorageConnection.h"
#include "mozIStorageStatement.h"
#include "mozStorageCID.h"

#include "nsAppDirectoryServiceDefs.h"
#include "nsComponentManagerUtils.h"
#include "nsContentUtils.h"
#include "nsCRT.h"
#include "nsDebug.h"
#include "nsEffectiveTLDService.h"
#include "nsIConsoleService.h"
#include "nsIUserIdleService.h"
#include "nsIInputStream.h"
#include "nsINavHistoryService.h"
#include "nsIObserverService.h"
#include "nsIPrefBranch.h"
#include "nsIPrincipal.h"
#include "nsIURIMutator.h"
#include "nsIWritablePropertyBag2.h"
#include "nsReadLine.h"
#include "nsStringFwd.h"
#include "nsTHashSet.h"
#include "nsToolkitCompsCID.h"

using namespace mozilla::dom;

namespace mozilla {

#define PERMISSIONS_FILE_NAME "permissions.sqlite"
#define HOSTS_SCHEMA_VERSION 12

// Default permissions are read from a URL - this is the preference we read
// to find that URL. If not set, don't use any default permissions.
constexpr char kDefaultsUrlPrefName[] = "permissions.manager.defaultsUrl";

constexpr char kPermissionChangeNotification[] = PERM_CHANGE_NOTIFICATION;

// A special value for a permission ID that indicates the ID was loaded as
// a default value.  These will never be written to the database, but may
// be overridden with an explicit permission (including UNKNOWN_ACTION)
constexpr int64_t cIDPermissionIsDefault = -1;

static StaticRefPtr<PermissionManager> gPermissionManager;

#define ENSURE_NOT_CHILD_PROCESS_(onError)                 \
  PR_BEGIN_MACRO                                           \
  if (IsChildProcess()) {                                  \
    NS_ERROR("Cannot perform action in content process!"); \
    onError                                                \
  }                                                        \
  PR_END_MACRO

#define ENSURE_NOT_CHILD_PROCESS \
  ENSURE_NOT_CHILD_PROCESS_({ return NS_ERROR_NOT_AVAILABLE; })

#define ENSURE_NOT_CHILD_PROCESS_NORET ENSURE_NOT_CHILD_PROCESS_(;)

#define EXPIRY_NOW PR_Now() / 1000

////////////////////////////////////////////////////////////////////////////////

namespace {

bool IsChildProcess() { return XRE_IsContentProcess(); }

void LogToConsole(const nsAString& aMsg) {
  nsCOMPtr<nsIConsoleService> console(
      do_GetService("@mozilla.org/consoleservice;1"));
  if (!console) {
    NS_WARNING("Failed to log message to console.");
    return;
  }

  nsAutoString msg(aMsg);
  console->LogStringMessage(msg.get());
}

// NOTE: an empty string can be passed as aType - if it is this function will
// return "false" unconditionally.
bool HasDefaultPref(const nsACString& aType) {
  // A list of permissions that can have a fallback default permission
  // set under the permissions.default.* pref.
  static const nsLiteralCString kPermissionsWithDefaults[] = {
      "camera"_ns,    "microphone"_ns,      "geo"_ns, "desktop-notification"_ns,
      "shortcuts"_ns, "screen-wake-lock"_ns};

  if (!aType.IsEmpty()) {
    for (const auto& perm : kPermissionsWithDefaults) {
      if (perm.Equals(aType)) {
        return true;
      }
    }
  }

  return false;
}

// These permissions are special permissions which must be transmitted to the
// content process before documents with their principals have loaded within
// that process.
//
// Permissions which are in this list are considered to have a "" permission
// key, even if their principal would not normally have that key.
static const nsLiteralCString kPreloadPermissions[] = {
    // This permission is preloaded to support properly blocking service worker
    // interception when a user has disabled storage for a specific site.  Once
    // service worker interception moves to the parent process this should be
    // removed.  See bug 1428130.
    "cookie"_ns, "https-only-load-insecure"_ns};

// NOTE: nullptr can be passed as aType - if it is this function will return
// "false" unconditionally.
bool IsPreloadPermission(const nsACString& aType) {
  if (!aType.IsEmpty()) {
    for (const auto& perm : kPreloadPermissions) {
      if (perm.Equals(aType)) {
        return true;
      }
    }
  }

  return false;
}

// Array of permission types which should not be isolated by origin attributes,
// for user context and private browsing.
// Keep this array in sync with 'STRIPPED_PERMS' in
// 'test_permmanager_oa_strip.js'
// Currently only preloaded permissions are supported.
// This is because perms are sent to the content process in bulk by perm key.
// Non-preloaded, but OA stripped permissions would not be accessible by sites
// in private browsing / non-default user context.
static constexpr std::array<nsLiteralCString, 2> kStripOAPermissions = {
    {"cookie"_ns, "https-only-load-insecure"_ns}};

bool IsOAForceStripPermission(const nsACString& aType) {
  if (aType.IsEmpty()) {
    return false;
  }
  for (const auto& perm : kStripOAPermissions) {
    if (perm.Equals(aType)) {
      return true;
    }
  }
  return false;
}

// Array of permission prefixes which should be isolated only by site.
// These site-scoped permissions are stored under their site's principal.
// GetAllForPrincipal also needs to look for these especially.
static constexpr std::array<nsLiteralCString, 3> kSiteScopedPermissions = {
    {"3rdPartyStorage^"_ns, "AllowStorageAccessRequest^"_ns,
     "3rdPartyFrameStorage^"_ns}};

bool IsSiteScopedPermission(const nsACString& aType) {
  if (aType.IsEmpty()) {
    return false;
  }
  for (const auto& perm : kSiteScopedPermissions) {
    if (aType.Length() >= perm.Length() &&
        Substring(aType, 0, perm.Length()) == perm) {
      return true;
    }
  }
  return false;
}

// Array of permission type prefixes which have a secondary key encoded in the
// permission type. These permissions will not be stored in-process with the
// secondary key, but updates to them will cause "perm-changed" notifications on
// processes for that key.
static constexpr std::array<nsLiteralCString, 3> kSecondaryKeyedPermissions = {
    {"3rdPartyStorage^"_ns, "AllowStorageAccessRequest^"_ns,
     "3rdPartyFrameStorage^"_ns}};

bool GetSecondaryKey(const nsACString& aType, nsACString& aSecondaryKey) {
  aSecondaryKey.Truncate();
  if (aType.IsEmpty()) {
    return false;
  }
  for (const auto& perm : kSecondaryKeyedPermissions) {
    if (aType.Length() > perm.Length() &&
        Substring(aType, 0, perm.Length()) == perm) {
      aSecondaryKey = Substring(aType, perm.Length());
      return true;
    }
  }
  return false;
}

void OriginAppendOASuffix(OriginAttributes aOriginAttributes,
                          bool aForceStripOA, nsACString& aOrigin) {
  PermissionManager::MaybeStripOriginAttributes(aForceStripOA,
                                                aOriginAttributes);

  nsAutoCString oaSuffix;
  aOriginAttributes.CreateSuffix(oaSuffix);
  aOrigin.Append(oaSuffix);
}

nsresult GetOriginFromPrincipal(nsIPrincipal* aPrincipal, bool aForceStripOA,
                                nsACString& aOrigin) {
  nsresult rv = aPrincipal->GetOriginNoSuffix(aOrigin);
  // The principal may belong to the about:blank content viewer, so this can be
  // expected to fail.
  if (NS_FAILED(rv)) {
    return rv;
  }

  nsAutoCString suffix;
  rv = aPrincipal->GetOriginSuffix(suffix);
  NS_ENSURE_SUCCESS(rv, rv);

  OriginAttributes attrs;
  NS_ENSURE_TRUE(attrs.PopulateFromSuffix(suffix), NS_ERROR_FAILURE);

  OriginAppendOASuffix(attrs, aForceStripOA, aOrigin);

  return NS_OK;
}

// Returns the site of the principal, including OA, given a principal.
nsresult GetSiteFromPrincipal(nsIPrincipal* aPrincipal, bool aForceStripOA,
                              nsACString& aSite) {
  nsCOMPtr<nsIURI> uri = aPrincipal->GetURI();
  nsEffectiveTLDService* etld = nsEffectiveTLDService::GetInstance();
  NS_ENSURE_TRUE(etld, NS_ERROR_FAILURE);
  NS_ENSURE_TRUE(uri, NS_ERROR_FAILURE);
  nsresult rv = etld->GetSite(uri, aSite);

  // The principal may belong to the about:blank content viewer, so this can be
  // expected to fail.
  if (NS_FAILED(rv)) {
    rv = aPrincipal->GetOrigin(aSite);
    NS_ENSURE_SUCCESS(rv, rv);
    return NS_OK;
  }

  nsAutoCString suffix;
  rv = aPrincipal->GetOriginSuffix(suffix);
  NS_ENSURE_SUCCESS(rv, rv);

  OriginAttributes attrs;
  NS_ENSURE_TRUE(attrs.PopulateFromSuffix(suffix), NS_ERROR_FAILURE);

  OriginAppendOASuffix(attrs, aForceStripOA, aSite);

  return NS_OK;
}

nsresult GetOriginFromURIAndOA(nsIURI* aURI,
                               const OriginAttributes* aOriginAttributes,
                               bool aForceStripOA, nsACString& aOrigin) {
  nsAutoCString origin(aOrigin);
  nsresult rv = ContentPrincipal::GenerateOriginNoSuffixFromURI(aURI, origin);
  NS_ENSURE_SUCCESS(rv, rv);

  OriginAppendOASuffix(*aOriginAttributes, aForceStripOA, origin);

  aOrigin = origin;

  return NS_OK;
}

nsresult GetPrincipalFromOrigin(const nsACString& aOrigin, bool aForceStripOA,
                                nsIPrincipal** aPrincipal) {
  nsAutoCString originNoSuffix;
  OriginAttributes attrs;
  if (!attrs.PopulateFromOrigin(aOrigin, originNoSuffix)) {
    return NS_ERROR_FAILURE;
  }

  PermissionManager::MaybeStripOriginAttributes(aForceStripOA, attrs);

  nsCOMPtr<nsIURI> uri;
  nsresult rv = NS_NewURI(getter_AddRefs(uri), originNoSuffix);
  NS_ENSURE_SUCCESS(rv, rv);

  nsCOMPtr<nsIPrincipal> principal =
      BasePrincipal::CreateContentPrincipal(uri, attrs);
  principal.forget(aPrincipal);
  return NS_OK;
}

nsresult GetPrincipal(nsIURI* aURI, nsIPrincipal** aPrincipal) {
  OriginAttributes attrs;
  nsCOMPtr<nsIPrincipal> principal =
      BasePrincipal::CreateContentPrincipal(aURI, attrs);
  NS_ENSURE_TRUE(principal, NS_ERROR_FAILURE);

  principal.forget(aPrincipal);
  return NS_OK;
}

nsCString GetNextSubDomainForHost(const nsACString& aHost) {
  nsCString subDomain;
  nsresult rv =
      nsEffectiveTLDService::GetInstance()->GetNextSubDomain(aHost, subDomain);
  // We can fail if there is no more subdomain or if the host can't have a
  // subdomain.
  if (NS_FAILED(rv)) {
    return ""_ns;
  }

  return subDomain;
}

// This function produces a nsIURI which is identical to the current
// nsIURI, except that it has one less subdomain segment. It returns
// `nullptr` if there are no more segments to remove.
already_AddRefed<nsIURI> GetNextSubDomainURI(nsIURI* aURI) {
  nsAutoCString host;
  nsresult rv = aURI->GetHost(host);
  if (NS_FAILED(rv)) {
    return nullptr;
  }

  nsCString domain = GetNextSubDomainForHost(host);
  if (domain.IsEmpty()) {
    return nullptr;
  }

  nsCOMPtr<nsIURI> uri;
  rv = NS_MutateURI(aURI).SetHost(domain).Finalize(uri);
  if (NS_FAILED(rv) || !uri) {
    return nullptr;
  }

  return uri.forget();
}

nsresult UpgradeHostToOriginAndInsert(
    const nsACString& aHost, const nsCString& aType, uint32_t aPermission,
    uint32_t aExpireType, int64_t aExpireTime, int64_t aModificationTime,
    std::function<nsresult(const nsACString& aOrigin, const nsCString& aType,
                           uint32_t aPermission, uint32_t aExpireType,
                           int64_t aExpireTime, int64_t aModificationTime)>&&
        aCallback) {
  if (aHost.EqualsLiteral("<file>")) {
    // We no longer support the magic host <file>
    NS_WARNING(
        "The magic host <file> is no longer supported. "
        "It is being removed from the permissions database.");
    return NS_OK;
  }

  // First, we check to see if the host is a valid URI. If it is, it can be
  // imported directly
  nsCOMPtr<nsIURI> uri;
  nsresult rv = NS_NewURI(getter_AddRefs(uri), aHost);
  if (NS_SUCCEEDED(rv)) {
    // It was previously possible to insert useless entries to your permissions
    // database for URIs which have a null principal. This acts as a cleanup,
    // getting rid of these useless database entries
    if (uri->SchemeIs("moz-nullprincipal")) {
      NS_WARNING("A moz-nullprincipal: permission is being discarded.");
      return NS_OK;
    }

    nsCOMPtr<nsIPrincipal> principal;
    rv = GetPrincipal(uri, getter_AddRefs(principal));
    NS_ENSURE_SUCCESS(rv, rv);

    nsAutoCString origin;
    rv = GetOriginFromPrincipal(principal, IsOAForceStripPermission(aType),
                                origin);
    NS_ENSURE_SUCCESS(rv, rv);

    aCallback(origin, aType, aPermission, aExpireType, aExpireTime,
              aModificationTime);
    return NS_OK;
  }

  // The user may use this host at non-standard ports or protocols, we can use
  // their history to guess what ports and protocols we want to add permissions
  // for. We find every URI which they have visited with this host (or a
  // subdomain of this host), and try to add it as a principal.
  bool foundHistory = false;

  nsCOMPtr<nsINavHistoryService> histSrv =
      do_GetService(NS_NAVHISTORYSERVICE_CONTRACTID);

  if (histSrv) {
    nsCOMPtr<nsINavHistoryQuery> histQuery;
    rv = histSrv->GetNewQuery(getter_AddRefs(histQuery));
    NS_ENSURE_SUCCESS(rv, rv);

    // Get the eTLD+1 of the domain
    nsAutoCString eTLD1;
    rv = nsEffectiveTLDService::GetInstance()->GetBaseDomainFromHost(aHost, 0,
                                                                     eTLD1);

    if (NS_FAILED(rv)) {
      // If the lookup on the tldService for the base domain for the host
      // failed, that means that we just want to directly use the host as the
      // host name for the lookup.
      eTLD1 = aHost;
    }

    // We want to only find history items for this particular eTLD+1, and
    // subdomains
    rv = histQuery->SetDomain(eTLD1);
    NS_ENSURE_SUCCESS(rv, rv);

    rv = histQuery->SetDomainIsHost(false);
    NS_ENSURE_SUCCESS(rv, rv);

    nsCOMPtr<nsINavHistoryQueryOptions> histQueryOpts;
    rv = histSrv->GetNewQueryOptions(getter_AddRefs(histQueryOpts));
    NS_ENSURE_SUCCESS(rv, rv);

    // We want to get the URIs for every item in the user's history with the
    // given host
    rv =
        histQueryOpts->SetResultType(nsINavHistoryQueryOptions::RESULTS_AS_URI);
    NS_ENSURE_SUCCESS(rv, rv);

    // We only search history, because searching both bookmarks and history
    // is not supported, and history tends to be more comprehensive.
    rv = histQueryOpts->SetQueryType(
        nsINavHistoryQueryOptions::QUERY_TYPE_HISTORY);
    NS_ENSURE_SUCCESS(rv, rv);

    // We include hidden URIs (such as those visited via iFrames) as they may
    // have permissions too
    rv = histQueryOpts->SetIncludeHidden(true);
    NS_ENSURE_SUCCESS(rv, rv);

    nsCOMPtr<nsINavHistoryResult> histResult;
    rv = histSrv->ExecuteQuery(histQuery, histQueryOpts,
                               getter_AddRefs(histResult));
    NS_ENSURE_SUCCESS(rv, rv);

    nsCOMPtr<nsINavHistoryContainerResultNode> histResultContainer;
    rv = histResult->GetRoot(getter_AddRefs(histResultContainer));
    NS_ENSURE_SUCCESS(rv, rv);

    rv = histResultContainer->SetContainerOpen(true);
    NS_ENSURE_SUCCESS(rv, rv);

    uint32_t childCount = 0;
    rv = histResultContainer->GetChildCount(&childCount);
    NS_ENSURE_SUCCESS(rv, rv);

    nsTHashSet<nsCString> insertedOrigins;
    for (uint32_t i = 0; i < childCount; i++) {
      nsCOMPtr<nsINavHistoryResultNode> child;
      histResultContainer->GetChild(i, getter_AddRefs(child));
      if (NS_WARN_IF(NS_FAILED(rv))) continue;

      uint32_t type;
      rv = child->GetType(&type);
      if (NS_WARN_IF(NS_FAILED(rv)) ||
          type != nsINavHistoryResultNode::RESULT_TYPE_URI) {
        NS_WARNING(
            "Unexpected non-RESULT_TYPE_URI node in "
            "UpgradeHostToOriginAndInsert()");
        continue;
      }

      nsAutoCString uriSpec;
      rv = child->GetUri(uriSpec);
      if (NS_WARN_IF(NS_FAILED(rv))) continue;

      nsCOMPtr<nsIURI> uri;
      rv = NS_NewURI(getter_AddRefs(uri), uriSpec);
      if (NS_WARN_IF(NS_FAILED(rv))) continue;

      // Use the provided host - this URI may be for a subdomain, rather than
      // the host we care about.
      rv = NS_MutateURI(uri).SetHost(aHost).Finalize(uri);
      if (NS_WARN_IF(NS_FAILED(rv))) continue;

      // We now have a URI which we can make a nsIPrincipal out of
      nsCOMPtr<nsIPrincipal> principal;
      rv = GetPrincipal(uri, getter_AddRefs(principal));
      if (NS_WARN_IF(NS_FAILED(rv))) continue;

      nsAutoCString origin;
      rv = GetOriginFromPrincipal(principal, IsOAForceStripPermission(aType),
                                  origin);
      if (NS_WARN_IF(NS_FAILED(rv))) continue;

      // Ensure that we don't insert the same origin repeatedly
      if (insertedOrigins.Contains(origin)) {
        continue;
      }

      foundHistory = true;
      rv = aCallback(origin, aType, aPermission, aExpireType, aExpireTime,
                     aModificationTime);
      NS_WARNING_ASSERTION(NS_SUCCEEDED(rv), "Insert failed");
      insertedOrigins.Insert(origin);
    }

    rv = histResultContainer->SetContainerOpen(false);
    NS_ENSURE_SUCCESS(rv, rv);
  }

  // If we didn't find any origins for this host in the poermissions database,
  // we can insert the default http:// and https:// permissions into the
  // database. This has a relatively high likelihood of applying the permission
  // to the correct origin.
  if (!foundHistory) {
    nsAutoCString hostSegment;
    nsCOMPtr<nsIPrincipal> principal;
    nsAutoCString origin;

    // If this is an ipv6 URI, we need to surround it in '[', ']' before trying
    // to parse it as a URI.
    if (aHost.FindChar(':') != -1) {
      hostSegment.AssignLiteral("[");
      hostSegment.Append(aHost);
      hostSegment.AppendLiteral("]");
    } else {
      hostSegment.Assign(aHost);
    }

    // http:// URI default
    rv = NS_NewURI(getter_AddRefs(uri), "http://"_ns + hostSegment);
    NS_ENSURE_SUCCESS(rv, rv);

    rv = GetPrincipal(uri, getter_AddRefs(principal));
    NS_ENSURE_SUCCESS(rv, rv);

    rv = GetOriginFromPrincipal(principal, IsOAForceStripPermission(aType),
                                origin);
    NS_ENSURE_SUCCESS(rv, rv);

    aCallback(origin, aType, aPermission, aExpireType, aExpireTime,
              aModificationTime);

    // https:// URI default
    rv = NS_NewURI(getter_AddRefs(uri), "https://"_ns + hostSegment);
    NS_ENSURE_SUCCESS(rv, rv);

    rv = GetPrincipal(uri, getter_AddRefs(principal));
    NS_ENSURE_SUCCESS(rv, rv);

    rv = GetOriginFromPrincipal(principal, IsOAForceStripPermission(aType),
                                origin);
    NS_ENSURE_SUCCESS(rv, rv);

    aCallback(origin, aType, aPermission, aExpireType, aExpireTime,
              aModificationTime);
  }

  return NS_OK;
}

bool IsExpandedPrincipal(nsIPrincipal* aPrincipal) {
  nsCOMPtr<nsIExpandedPrincipal> ep = do_QueryInterface(aPrincipal);
  return !!ep;
}

// We only want to persist permissions which don't have session or policy
// expiration.
bool IsPersistentExpire(uint32_t aExpire, const nsACString& aType) {
  bool res = (aExpire != nsIPermissionManager::EXPIRE_SESSION &&
              aExpire != nsIPermissionManager::EXPIRE_POLICY);
  return res;
}

nsresult NotifySecondaryKeyPermissionUpdateInContentProcess(
    const nsACString& aType, uint32_t aPermission,
    const nsACString& aSecondaryKey, nsIPrincipal* aTopPrincipal) {
  NS_ENSURE_ARG_POINTER(aTopPrincipal);
  MOZ_ASSERT(XRE_IsParentProcess());
  AutoTArray<RefPtr<BrowsingContextGroup>, 5> bcGroups;
  BrowsingContextGroup::GetAllGroups(bcGroups);
  for (const auto& bcGroup : bcGroups) {
    for (const auto& topBC : bcGroup->Toplevels()) {
      CanonicalBrowsingContext* topCBC = topBC->Canonical();
      RefPtr<nsIURI> topURI = topCBC->GetCurrentURI();
      if (!topURI) {
        continue;
      }
      bool thirdParty;
      nsresult rv = aTopPrincipal->IsThirdPartyURI(topURI, &thirdParty);
      if (NS_FAILED(rv)) {
        continue;
      }
      if (!thirdParty) {
        AutoTArray<RefPtr<BrowsingContext>, 5> bcs;
        topBC->GetAllBrowsingContextsInSubtree(bcs);
        for (const auto& bc : bcs) {
          CanonicalBrowsingContext* cbc = bc->Canonical();
          ContentParent* cp = cbc->GetContentParent();
          if (!cp) {
            continue;
          }
          if (cp->NeedsSecondaryKeyPermissionsUpdate(aSecondaryKey)) {
            WindowGlobalParent* wgp = cbc->GetCurrentWindowGlobal();
            if (!wgp) {
              continue;
            }
            bool success = wgp->SendNotifyPermissionChange(aType, aPermission);
            Unused << NS_WARN_IF(!success);
          }
        }
      }
    }
  }
  return NS_OK;
}

}  // namespace

////////////////////////////////////////////////////////////////////////////////

PermissionManager::PermissionKey*
PermissionManager::PermissionKey::CreateFromPrincipal(nsIPrincipal* aPrincipal,
                                                      bool aForceStripOA,
                                                      bool aScopeToSite,
                                                      nsresult& aResult) {
  nsAutoCString keyString;
  if (aScopeToSite) {
    aResult = GetSiteFromPrincipal(aPrincipal, aForceStripOA, keyString);
  } else {
    aResult = GetOriginFromPrincipal(aPrincipal, aForceStripOA, keyString);
  }
  if (NS_WARN_IF(NS_FAILED(aResult))) {
    return nullptr;
  }
  return new PermissionKey(keyString);
}

PermissionManager::PermissionKey*
PermissionManager::PermissionKey::CreateFromURIAndOriginAttributes(
    nsIURI* aURI, const OriginAttributes* aOriginAttributes, bool aForceStripOA,
    nsresult& aResult) {
  nsAutoCString origin;
  aResult =
      GetOriginFromURIAndOA(aURI, aOriginAttributes, aForceStripOA, origin);
  if (NS_WARN_IF(NS_FAILED(aResult))) {
    return nullptr;
  }

  return new PermissionKey(origin);
}

PermissionManager::PermissionKey*
PermissionManager::PermissionKey::CreateFromURI(nsIURI* aURI,
                                                nsresult& aResult) {
  nsAutoCString origin;
  aResult = ContentPrincipal::GenerateOriginNoSuffixFromURI(aURI, origin);
  if (NS_WARN_IF(NS_FAILED(aResult))) {
    return nullptr;
  }

  return new PermissionKey(origin);
}

////////////////////////////////////////////////////////////////////////////////
// PermissionManager Implementation

NS_IMPL_ISUPPORTS(PermissionManager, nsIPermissionManager, nsIObserver,
                  nsISupportsWeakReference, nsIAsyncShutdownBlocker)

PermissionManager::PermissionManager()
    : mMonitor("PermissionManager::mMonitor"),
      mState(eInitializing),
      mMemoryOnlyDB(false),
      mLargestID(0) {}

PermissionManager::~PermissionManager() {
  // NOTE: Make sure to reject each of the promises in mPermissionKeyPromiseMap
  // before destroying.
  for (const auto& promise : mPermissionKeyPromiseMap.Values()) {
    if (promise) {
      promise->Reject(NS_ERROR_FAILURE, __func__);
    }
  }
  mPermissionKeyPromiseMap.Clear();

  if (mThread) {
    mThread->Shutdown();
    mThread = nullptr;
  }
}

/* static */
StaticMutex PermissionManager::sCreationMutex;

// static
already_AddRefed<nsIPermissionManager> PermissionManager::GetXPCOMSingleton() {
  // The lazy initialization could race.
  StaticMutexAutoLock lock(sCreationMutex);

  if (gPermissionManager) {
    return do_AddRef(gPermissionManager);
  }

  // Create a new singleton PermissionManager.
  // We AddRef only once since XPCOM has rules about the ordering of module
  // teardowns - by the time our module destructor is called, it's too late to
  // Release our members, since GC cycles have already been completed and
  // would result in serious leaks.
  // See bug 209571.
  auto permManager = MakeRefPtr<PermissionManager>();
  if (NS_SUCCEEDED(permManager->Init())) {
    gPermissionManager = permManager.get();
    return permManager.forget();
  }

  return nullptr;
}

// static
PermissionManager* PermissionManager::GetInstance() {
  // TODO: There is a minimal chance that we can race here with a
  // GetXPCOMSingleton call that did not yet set gPermissionManager.
  // See bug 1745056.
  if (!gPermissionManager) {
    // Hand off the creation of the permission manager to GetXPCOMSingleton.
    nsCOMPtr<nsIPermissionManager> permManager = GetXPCOMSingleton();
  }

  return gPermissionManager;
}

nsresult PermissionManager::Init() {
  // If we are already shutting down, do not permit a creation.
  // This must match the phase in GetAsyncShutdownBarrier.
  if (AppShutdown::IsInOrBeyond(ShutdownPhase::XPCOMWillShutdown)) {
    return NS_ERROR_ILLEGAL_DURING_SHUTDOWN;
  }

  // If the 'permissions.memory_only' pref is set to true, then don't write any
  // permission settings to disk, but keep them in a memory-only database.
  mMemoryOnlyDB = Preferences::GetBool("permissions.memory_only", false);

  nsresult rv;
  nsCOMPtr<nsIPrefService> prefService =
      do_GetService(NS_PREFSERVICE_CONTRACTID, &rv);
  NS_ENSURE_SUCCESS(rv, rv);

  rv = prefService->GetBranch("permissions.default.",
                              getter_AddRefs(mDefaultPrefBranch));
  NS_ENSURE_SUCCESS(rv, rv);

  if (IsChildProcess()) {
    // Stop here; we don't need the DB in the child process. Instead we will be
    // sent permissions as we need them by our parent process.
    mState = eReady;

    // We use ClearOnShutdown on the content process only because on the parent
    // process we need to block the shutdown for the final closeDB() call.
    ClearOnShutdown(&gPermissionManager);
    return NS_OK;
  }

  nsCOMPtr<nsIObserverService> observerService = services::GetObserverService();
  if (observerService) {
    observerService->AddObserver(this, "profile-do-change", true);
    observerService->AddObserver(this, "testonly-reload-permissions-from-disk",
                                 true);
  }

  if (XRE_IsParentProcess()) {
    nsCOMPtr<nsIAsyncShutdownClient> asc = GetAsyncShutdownBarrier();
    if (!asc) {
      return NS_ERROR_NOT_AVAILABLE;
    }
    nsAutoString blockerName;
    MOZ_ALWAYS_SUCCEEDS(GetName(blockerName));

    nsresult rv = asc->AddBlocker(
        this, NS_LITERAL_STRING_FROM_CSTRING(__FILE__), __LINE__, blockerName);
    NS_ENSURE_SUCCESS(rv, rv);
  }

  AddIdleDailyMaintenanceJob();

  MOZ_ASSERT(!mThread);
  NS_ENSURE_SUCCESS(NS_NewNamedThread("Permission", getter_AddRefs(mThread)),
                    NS_ERROR_FAILURE);

  PRThread* prThread;
  MOZ_ALWAYS_SUCCEEDS(mThread->GetPRThread(&prThread));
  MOZ_ASSERT(prThread);

  mThreadBoundData.Transfer(prThread);

  InitDB(false);

  return NS_OK;
}

nsresult PermissionManager::OpenDatabase(nsIFile* aPermissionsFile) {
  MOZ_ASSERT(!NS_IsMainThread());
  auto data = mThreadBoundData.Access();

  nsresult rv;
  nsCOMPtr<mozIStorageService> storage =
      do_GetService(MOZ_STORAGE_SERVICE_CONTRACTID);
  if (!storage) {
    return NS_ERROR_UNEXPECTED;
  }
  // cache a connection to the hosts database
  if (mMemoryOnlyDB) {
    rv = storage->OpenSpecialDatabase(
        kMozStorageMemoryStorageKey, VoidCString(),
        mozIStorageService::CONNECTION_DEFAULT, getter_AddRefs(data->mDBConn));
  } else {
    rv = storage->OpenDatabase(aPermissionsFile,
                               mozIStorageService::CONNECTION_DEFAULT,
                               getter_AddRefs(data->mDBConn));
  }
  return rv;
}

void PermissionManager::InitDB(bool aRemoveFile) {
  mState = eInitializing;

  {
    MonitorAutoLock lock(mMonitor);
    mReadEntries.Clear();
  }

  auto readyIfFailed = MakeScopeExit([&]() {
    // ignore failure here, since it's non-fatal (we can run fine without
    // persistent storage - e.g. if there's no profile).
    // XXX should we tell the user about this?
    mState = eReady;
  });

  if (!mPermissionsFile) {
    nsresult rv = NS_GetSpecialDirectory(NS_APP_PERMISSION_PARENT_DIR,
                                         getter_AddRefs(mPermissionsFile));
    if (NS_FAILED(rv)) {
      rv = NS_GetSpecialDirectory(NS_APP_USER_PROFILE_50_DIR,
                                  getter_AddRefs(mPermissionsFile));
      if (NS_FAILED(rv)) {
        return;
      }
    }

    rv =
        mPermissionsFile->AppendNative(nsLiteralCString(PERMISSIONS_FILE_NAME));
    NS_ENSURE_SUCCESS_VOID(rv);
  }

  nsCOMPtr<nsIInputStream> defaultsInputStream = GetDefaultsInputStream();

  RefPtr<PermissionManager> self = this;
  mThread->Dispatch(NS_NewRunnableFunction(
      "PermissionManager::InitDB", [self, aRemoveFile, defaultsInputStream] {
        nsresult rv = self->TryInitDB(aRemoveFile, defaultsInputStream);
        Unused << NS_WARN_IF(NS_FAILED(rv));

        // This extra runnable calls EnsureReadCompleted to finialize the
        // initialization. If there is something blocked by the monitor, it will
        // be NOP.
        NS_DispatchToMainThread(
            NS_NewRunnableFunction("PermissionManager::InitDB-MainThread",
                                   [self] { self->EnsureReadCompleted(); }));

        self->mMonitor.Notify();
      }));

  readyIfFailed.release();
}

nsresult PermissionManager::TryInitDB(bool aRemoveFile,
                                      nsIInputStream* aDefaultsInputStream) {
  MOZ_ASSERT(!NS_IsMainThread());

  MonitorAutoLock lock(mMonitor);

  auto raii = MakeScopeExit([&]() {
    if (aDefaultsInputStream) {
      aDefaultsInputStream->Close();
    }

    mState = eDBInitialized;
  });

  auto data = mThreadBoundData.Access();

  auto raiiFailure = MakeScopeExit([&]() {
    if (data->mDBConn) {
      DebugOnly<nsresult> rv = data->mDBConn->Close();
      MOZ_ASSERT(NS_SUCCEEDED(rv));
      data->mDBConn = nullptr;
    }
  });

  nsresult rv;

  if (aRemoveFile) {
    bool exists = false;
    rv = mPermissionsFile->Exists(&exists);
    NS_ENSURE_SUCCESS(rv, rv);
    if (exists) {
      rv = mPermissionsFile->Remove(false);
      NS_ENSURE_SUCCESS(rv, rv);
    }
  }

  rv = OpenDatabase(mPermissionsFile);
  if (rv == NS_ERROR_FILE_CORRUPTED) {
    LogToConsole(u"permissions.sqlite is corrupted! Try again!"_ns);

    // Add telemetry probe
    Telemetry::Accumulate(Telemetry::PERMISSIONS_SQL_CORRUPTED, 1);

    // delete corrupted permissions.sqlite and try again
    rv = mPermissionsFile->Remove(false);
    NS_ENSURE_SUCCESS(rv, rv);
    LogToConsole(u"Corrupted permissions.sqlite has been removed."_ns);

    rv = OpenDatabase(mPermissionsFile);
    NS_ENSURE_SUCCESS(rv, rv);
    LogToConsole(u"OpenDatabase to permissions.sqlite is successful!"_ns);
  }

  if (NS_WARN_IF(NS_FAILED(rv))) {
    return rv;
  }

  bool ready;
  data->mDBConn->GetConnectionReady(&ready);
  if (!ready) {
    LogToConsole(nsLiteralString(
        u"Fail to get connection to permissions.sqlite! Try again!"));

    // delete and try again
    rv = mPermissionsFile->Remove(false);
    NS_ENSURE_SUCCESS(rv, rv);
    LogToConsole(u"Defective permissions.sqlite has been removed."_ns);

    // Add telemetry probe
    Telemetry::Accumulate(Telemetry::DEFECTIVE_PERMISSIONS_SQL_REMOVED, 1);

    rv = OpenDatabase(mPermissionsFile);
    NS_ENSURE_SUCCESS(rv, rv);
    LogToConsole(u"OpenDatabase to permissions.sqlite is successful!"_ns);

    data->mDBConn->GetConnectionReady(&ready);
    if (!ready) return NS_ERROR_UNEXPECTED;
  }

  bool tableExists = false;
  data->mDBConn->TableExists("moz_perms"_ns, &tableExists);
  if (!tableExists) {
    data->mDBConn->TableExists("moz_hosts"_ns, &tableExists);
  }
  if (!tableExists) {
    rv = CreateTable();
    NS_ENSURE_SUCCESS(rv, rv);
  } else {
    // table already exists; check the schema version before reading
    int32_t dbSchemaVersion;
    rv = data->mDBConn->GetSchemaVersion(&dbSchemaVersion);
    NS_ENSURE_SUCCESS(rv, rv);

    switch (dbSchemaVersion) {
        // upgrading.
        // every time you increment the database schema, you need to
        // implement the upgrading code from the previous version to the
        // new one. fall through to current version

      case 1: {
        // previous non-expiry version of database.  Upgrade it by adding
        // the expiration columns
        rv = data->mDBConn->ExecuteSimpleSQL(
            "ALTER TABLE moz_hosts ADD expireType INTEGER"_ns);
        NS_ENSURE_SUCCESS(rv, rv);

        rv = data->mDBConn->ExecuteSimpleSQL(
            "ALTER TABLE moz_hosts ADD expireTime INTEGER"_ns);
        NS_ENSURE_SUCCESS(rv, rv);
      }

        // fall through to the next upgrade
        [[fallthrough]];

      // TODO: we want to make default version as version 2 in order to
      // fix bug 784875.
      case 0:
      case 2: {
        // Add appId/isInBrowserElement fields.
        rv = data->mDBConn->ExecuteSimpleSQL(
            "ALTER TABLE moz_hosts ADD appId INTEGER"_ns);
        NS_ENSURE_SUCCESS(rv, rv);

        rv = data->mDBConn->ExecuteSimpleSQL(nsLiteralCString(
            "ALTER TABLE moz_hosts ADD isInBrowserElement INTEGER"));
        NS_ENSURE_SUCCESS(rv, rv);

        rv = data->mDBConn->SetSchemaVersion(3);
        NS_ENSURE_SUCCESS(rv, rv);
      }

        // fall through to the next upgrade
        [[fallthrough]];

      // Version 3->4 is the creation of the modificationTime field.
      case 3: {
        rv = data->mDBConn->ExecuteSimpleSQL(nsLiteralCString(
            "ALTER TABLE moz_hosts ADD modificationTime INTEGER"));
        NS_ENSURE_SUCCESS(rv, rv);

        // We leave the modificationTime at zero for all existing records;
        // using now() would mean, eg, that doing "remove all from the
        // last hour" within the first hour after migration would remove
        // all permissions.

        rv = data->mDBConn->SetSchemaVersion(4);
        NS_ENSURE_SUCCESS(rv, rv);
      }

        // fall through to the next upgrade
        [[fallthrough]];

      // In version 5, host appId, and isInBrowserElement were merged into
      // a single origin entry
      //
      // In version 6, the tables were renamed for backwards compatability
      // reasons with version 4 and earlier.
      //
      // In version 7, a bug in the migration used for version 4->5 was
      // discovered which could have triggered data-loss. Because of that,
      // all users with a version 4, 5, or 6 database will be re-migrated
      // from the backup database. (bug 1186034). This migration bug is
      // not present after bug 1185340, and the re-migration ensures that
      // all users have the fix.
      case 5:
        // This branch could also be reached via dbSchemaVersion == 3, in
        // which case we want to fall through to the dbSchemaVersion == 4
        // case. The easiest way to do that is to perform this extra check
        // here to make sure that we didn't get here via a fallthrough
        // from v3
        if (dbSchemaVersion == 5) {
          // In version 5, the backup database is named moz_hosts_v4. We
          // perform the version 5->6 migration to get the tables to have
          // consistent naming conventions.

          // Version 5->6 is the renaming of moz_hosts to moz_perms, and
          // moz_hosts_v4 to moz_hosts (bug 1185343)
          //
          // In version 5, we performed the modifications to the
          // permissions database in place, this meant that if you
          // upgraded to a version which used V5, and then downgraded to a
          // version which used v4 or earlier, the fallback path would
          // drop the table, and your permissions data would be lost. This
          // migration undoes that mistake, by restoring the old moz_hosts
          // table (if it was present), and instead using the new table
          // moz_perms for the new permissions schema.
          //
          // NOTE: If you downgrade, store new permissions, and then
          // upgrade again, these new permissions won't be migrated or
          // reflected in the updated database. This migration only occurs
          // once, as if moz_perms exists, it will skip creating it. In
          // addition, permissions added after the migration will not be
          // visible in previous versions of firefox.

          bool permsTableExists = false;
          data->mDBConn->TableExists("moz_perms"_ns, &permsTableExists);
          if (!permsTableExists) {
            // Move the upgraded database to moz_perms
            rv = data->mDBConn->ExecuteSimpleSQL(
                "ALTER TABLE moz_hosts RENAME TO moz_perms"_ns);
            NS_ENSURE_SUCCESS(rv, rv);
          } else {
            NS_WARNING(
                "moz_hosts was not renamed to moz_perms, "
                "as a moz_perms table already exists");

            // In the situation where a moz_perms table already exists,
            // but the schema is lower than 6, a migration has already
            // previously occured to V6, but a downgrade has caused the
            // moz_hosts table to be dropped. This should only occur in
            // the case of a downgrade to a V5 database, which was only
            // present in a few day's nightlies. As that version was
            // likely used only on a temporary basis, we assume that the
            // database from the previous V6 has the permissions which the
            // user actually wants to use. We have to get rid of moz_hosts
            // such that moz_hosts_v4 can be moved into its place if it
            // exists.
            rv = data->mDBConn->ExecuteSimpleSQL("DROP TABLE moz_hosts"_ns);
            NS_ENSURE_SUCCESS(rv, rv);
          }

#ifdef DEBUG
          // The moz_hosts table shouldn't exist anymore
          bool hostsTableExists = false;
          data->mDBConn->TableExists("moz_hosts"_ns, &hostsTableExists);
          MOZ_ASSERT(!hostsTableExists);
#endif

          // Rename moz_hosts_v4 back to it's original location, if it
          // exists
          bool v4TableExists = false;
          data->mDBConn->TableExists("moz_hosts_v4"_ns, &v4TableExists);
          if (v4TableExists) {
            rv = data->mDBConn->ExecuteSimpleSQL(nsLiteralCString(
                "ALTER TABLE moz_hosts_v4 RENAME TO moz_hosts"));
            NS_ENSURE_SUCCESS(rv, rv);
          }

          rv = data->mDBConn->SetSchemaVersion(6);
          NS_ENSURE_SUCCESS(rv, rv);
        }

        // fall through to the next upgrade
        [[fallthrough]];

      // At this point, the version 5 table has been migrated to a version
      // 6 table We are guaranteed to have at least one of moz_hosts and
      // moz_perms. If we have moz_hosts, we will migrate moz_hosts into
      // moz_perms (even if we already have a moz_perms, as we need a
      // re-migration due to bug 1186034).
      //
      // After this migration, we are guaranteed to have both a moz_hosts
      // (for backwards compatability), and a moz_perms table. The
      // moz_hosts table will have a v4 schema, and the moz_perms table
      // will have a v6 schema.
      case 4:
      case 6: {
        bool hostsTableExists = false;
        data->mDBConn->TableExists("moz_hosts"_ns, &hostsTableExists);
        if (hostsTableExists) {
          // Both versions 4 and 6 have a version 4 formatted hosts table
          // named moz_hosts. We can migrate this table to our version 7
          // table moz_perms. If moz_perms is present, then we can use it
          // as a basis for comparison.

          rv = data->mDBConn->BeginTransaction();
          NS_ENSURE_SUCCESS(rv, rv);

          bool tableExists = false;
          data->mDBConn->TableExists("moz_hosts_new"_ns, &tableExists);
          if (tableExists) {
            NS_WARNING(
                "The temporary database moz_hosts_new already exists, "
                "dropping "
                "it.");
            rv = data->mDBConn->ExecuteSimpleSQL("DROP TABLE moz_hosts_new"_ns);
            NS_ENSURE_SUCCESS(rv, rv);
          }
          rv = data->mDBConn->ExecuteSimpleSQL(
              nsLiteralCString("CREATE TABLE moz_hosts_new ("
                               " id INTEGER PRIMARY KEY"
                               ",origin TEXT"
                               ",type TEXT"
                               ",permission INTEGER"
                               ",expireType INTEGER"
                               ",expireTime INTEGER"
                               ",modificationTime INTEGER"
                               ")"));
          NS_ENSURE_SUCCESS(rv, rv);

          nsCOMPtr<mozIStorageStatement> stmt;
          rv = data->mDBConn->CreateStatement(
              nsLiteralCString(
                  "SELECT host, type, permission, expireType, "
                  "expireTime, "
                  "modificationTime, isInBrowserElement FROM moz_hosts"),
              getter_AddRefs(stmt));
          NS_ENSURE_SUCCESS(rv, rv);

          int64_t id = 0;
          bool hasResult;

          while (NS_SUCCEEDED(stmt->ExecuteStep(&hasResult)) && hasResult) {
            MigrationEntry entry;

            // Read in the old row
            rv = stmt->GetUTF8String(0, entry.mHost);
            if (NS_WARN_IF(NS_FAILED(rv))) {
              continue;
            }
            rv = stmt->GetUTF8String(1, entry.mType);
            if (NS_WARN_IF(NS_FAILED(rv))) {
              continue;
            }

            entry.mId = id++;
            entry.mPermission = stmt->AsInt32(2);
            entry.mExpireType = stmt->AsInt32(3);
            entry.mExpireTime = stmt->AsInt64(4);
            entry.mModificationTime = stmt->AsInt64(5);

            mMigrationEntries.AppendElement(entry);
          }

          // We don't drop the moz_hosts table such that it is available
          // for backwards-compatability and for future migrations in case
          // of migration errors in the current code. Create a marker
          // empty table which will indicate that the moz_hosts table is
          // intended to act as a backup. If this table is not present,
          // then the moz_hosts table was created as a random empty table.
          rv = data->mDBConn->ExecuteSimpleSQL(
              nsLiteralCString("CREATE TABLE moz_hosts_is_backup (dummy "
                               "INTEGER PRIMARY KEY)"));
          NS_ENSURE_SUCCESS(rv, rv);

          bool permsTableExists = false;
          data->mDBConn->TableExists("moz_perms"_ns, &permsTableExists);
          if (permsTableExists) {
            // The user already had a moz_perms table, and we are
            // performing a re-migration. We count the rows in the old
            // table for telemetry, and then back up their old database as
            // moz_perms_v6

            nsCOMPtr<mozIStorageStatement> countStmt;
            rv = data->mDBConn->CreateStatement(
                "SELECT COUNT(*) FROM moz_perms"_ns, getter_AddRefs(countStmt));
            bool hasResult = false;
            if (NS_FAILED(rv) ||
                NS_FAILED(countStmt->ExecuteStep(&hasResult)) || !hasResult) {
              NS_WARNING("Could not count the rows in moz_perms");
            }

            // Back up the old moz_perms database as moz_perms_v6 before
            // we move the new table into its position
            rv = data->mDBConn->ExecuteSimpleSQL(nsLiteralCString(
                "ALTER TABLE moz_perms RENAME TO moz_perms_v6"));
            NS_ENSURE_SUCCESS(rv, rv);
          }

          rv = data->mDBConn->ExecuteSimpleSQL(nsLiteralCString(
              "ALTER TABLE moz_hosts_new RENAME TO moz_perms"));
          NS_ENSURE_SUCCESS(rv, rv);

          rv = data->mDBConn->CommitTransaction();
          NS_ENSURE_SUCCESS(rv, rv);
        } else {
          // We don't have a moz_hosts table, so we create one for
          // downgrading purposes. This table is empty.
          rv = data->mDBConn->ExecuteSimpleSQL(
              nsLiteralCString("CREATE TABLE moz_hosts ("
                               " id INTEGER PRIMARY KEY"
                               ",host TEXT"
                               ",type TEXT"
                               ",permission INTEGER"
                               ",expireType INTEGER"
                               ",expireTime INTEGER"
                               ",modificationTime INTEGER"
                               ",appId INTEGER"
                               ",isInBrowserElement INTEGER"
                               ")"));
          NS_ENSURE_SUCCESS(rv, rv);

          // We are guaranteed to have a moz_perms table at this point.
        }

#ifdef DEBUG
        {
          // At this point, both the moz_hosts and moz_perms tables should
          // exist
          bool hostsTableExists = false;
          bool permsTableExists = false;
          data->mDBConn->TableExists("moz_hosts"_ns, &hostsTableExists);
          data->mDBConn->TableExists("moz_perms"_ns, &permsTableExists);
          MOZ_ASSERT(hostsTableExists && permsTableExists);
        }
#endif

        rv = data->mDBConn->SetSchemaVersion(7);
        NS_ENSURE_SUCCESS(rv, rv);
      }

        // fall through to the next upgrade
        [[fallthrough]];

      // The version 7-8 migration is the re-migration of localhost and
      // ip-address entries due to errors in the previous version 7
      // migration which caused localhost and ip-address entries to be
      // incorrectly discarded. The version 7 migration logic has been
      // corrected, and thus this logic only needs to execute if the user
      // is currently on version 7.
      case 7: {
        // This migration will be relatively expensive as we need to
        // perform database lookups for each origin which we want to
        // insert. Fortunately, it shouldn't be too expensive as we only
        // want to insert a small number of entries created for localhost
        // or IP addresses.

        // We only want to perform the re-migration if moz_hosts is a
        // backup
        bool hostsIsBackupExists = false;
        data->mDBConn->TableExists("moz_hosts_is_backup"_ns,
                                   &hostsIsBackupExists);

        // Only perform this migration if the original schema version was
        // 7, and the moz_hosts table is a backup.
        if (dbSchemaVersion == 7 && hostsIsBackupExists) {
          nsCOMPtr<mozIStorageStatement> stmt;
          rv = data->mDBConn->CreateStatement(
              nsLiteralCString(
                  "SELECT host, type, permission, expireType, "
                  "expireTime, "
                  "modificationTime, isInBrowserElement FROM moz_hosts"),
              getter_AddRefs(stmt));
          NS_ENSURE_SUCCESS(rv, rv);

          nsCOMPtr<mozIStorageStatement> idStmt;
          rv = data->mDBConn->CreateStatement(
              "SELECT MAX(id) FROM moz_hosts"_ns, getter_AddRefs(idStmt));

          int64_t id = 0;
          bool hasResult = false;
          if (NS_SUCCEEDED(rv) &&
              NS_SUCCEEDED(idStmt->ExecuteStep(&hasResult)) && hasResult) {
            id = idStmt->AsInt32(0) + 1;
          }

          while (NS_SUCCEEDED(stmt->ExecuteStep(&hasResult)) && hasResult) {
            MigrationEntry entry;

            // Read in the old row
            rv = stmt->GetUTF8String(0, entry.mHost);
            if (NS_WARN_IF(NS_FAILED(rv))) {
              continue;
            }

            nsAutoCString eTLD1;
            rv = nsEffectiveTLDService::GetInstance()->GetBaseDomainFromHost(
                entry.mHost, 0, eTLD1);
            if (NS_SUCCEEDED(rv)) {
              // We only care about entries which the tldService can't
              // handle
              continue;
            }

            rv = stmt->GetUTF8String(1, entry.mType);
            if (NS_WARN_IF(NS_FAILED(rv))) {
              continue;
            }

            entry.mId = id++;
            entry.mPermission = stmt->AsInt32(2);
            entry.mExpireType = stmt->AsInt32(3);
            entry.mExpireTime = stmt->AsInt64(4);
            entry.mModificationTime = stmt->AsInt64(5);

            mMigrationEntries.AppendElement(entry);
          }
        }

        // Even if we didn't perform the migration, we want to bump the
        // schema version to 8.
        rv = data->mDBConn->SetSchemaVersion(8);
        NS_ENSURE_SUCCESS(rv, rv);
      }

        // fall through to the next upgrade
        [[fallthrough]];

      // The version 8-9 migration removes the unnecessary backup
      // moz-hosts database contents. as the data no longer needs to be
      // migrated
      case 8: {
        // We only want to clear out the old table if it is a backup. If
        // it isn't a backup, we don't need to touch it.
        bool hostsIsBackupExists = false;
        data->mDBConn->TableExists("moz_hosts_is_backup"_ns,
                                   &hostsIsBackupExists);
        if (hostsIsBackupExists) {
          // Delete everything from the backup, we want to keep around the
          // table so that you can still downgrade and not break things,
          // but we don't need to keep the rows around.
          rv = data->mDBConn->ExecuteSimpleSQL("DELETE FROM moz_hosts"_ns);
          NS_ENSURE_SUCCESS(rv, rv);

          // The table is no longer a backup, so get rid of it.
          rv = data->mDBConn->ExecuteSimpleSQL(
              "DROP TABLE moz_hosts_is_backup"_ns);
          NS_ENSURE_SUCCESS(rv, rv);
        }

        rv = data->mDBConn->SetSchemaVersion(9);
        NS_ENSURE_SUCCESS(rv, rv);
      }

        // fall through to the next upgrade
        [[fallthrough]];

      case 9: {
        rv = data->mDBConn->SetSchemaVersion(10);
        NS_ENSURE_SUCCESS(rv, rv);
      }

        // fall through to the next upgrade
        [[fallthrough]];

      case 10: {
        // Filter out the rows with storage access API permissions with a
        // granted origin, and remove the granted origin part from the
        // permission type.
        rv = data->mDBConn->ExecuteSimpleSQL(nsLiteralCString(
            "UPDATE moz_perms "
            "SET type=SUBSTR(type, 0, INSTR(SUBSTR(type, INSTR(type, "
            "'^') + "
            "1), '^') + INSTR(type, '^')) "
            "WHERE INSTR(SUBSTR(type, INSTR(type, '^') + 1), '^') AND "
            "SUBSTR(type, 0, 18) == \"storageAccessAPI^\";"));
        NS_ENSURE_SUCCESS(rv, rv);

        rv = data->mDBConn->SetSchemaVersion(11);
        NS_ENSURE_SUCCESS(rv, rv);
      }

        // fall through to the next upgrade
        [[fallthrough]];

      case 11: {
        // Migrate 3rdPartyStorage keys to a site scope
        rv = data->mDBConn->BeginTransaction();
        NS_ENSURE_SUCCESS(rv, rv);
        nsCOMPtr<mozIStorageStatement> updateStmt;
        rv = data->mDBConn->CreateStatement(
            nsLiteralCString("UPDATE moz_perms SET origin = ?2 WHERE id = ?1"),
            getter_AddRefs(updateStmt));
        NS_ENSURE_SUCCESS(rv, rv);

        nsCOMPtr<mozIStorageStatement> deleteStmt;
        rv = data->mDBConn->CreateStatement(
            nsLiteralCString("DELETE FROM moz_perms WHERE id = ?1"),
            getter_AddRefs(deleteStmt));
        NS_ENSURE_SUCCESS(rv, rv);

        nsCOMPtr<mozIStorageStatement> selectStmt;
        rv = data->mDBConn->CreateStatement(
            nsLiteralCString("SELECT id, origin, type FROM moz_perms WHERE "
                             " SUBSTR(type, 0, 17) == \"3rdPartyStorage^\""),
            getter_AddRefs(selectStmt));
        NS_ENSURE_SUCCESS(rv, rv);

        nsTHashSet<nsCStringHashKey> deduplicationSet;
        bool hasResult;
        while (NS_SUCCEEDED(selectStmt->ExecuteStep(&hasResult)) && hasResult) {
          int64_t id;
          rv = selectStmt->GetInt64(0, &id);
          NS_ENSURE_SUCCESS(rv, rv);

          nsCString origin;
          rv = selectStmt->GetUTF8String(1, origin);
          NS_ENSURE_SUCCESS(rv, rv);

          nsCString type;
          rv = selectStmt->GetUTF8String(2, type);
          NS_ENSURE_SUCCESS(rv, rv);

          nsCOMPtr<nsIURI> uri;
          rv = NS_NewURI(getter_AddRefs(uri), origin);
          if (NS_FAILED(rv)) {
            continue;
          }
          nsCString site;
          rv = nsEffectiveTLDService::GetInstance()->GetSite(uri, site);
          if (NS_WARN_IF(NS_FAILED(rv))) {
            continue;
          }

          nsCString deduplicationKey =
              nsPrintfCString("%s,%s", site.get(), type.get());
          if (deduplicationSet.Contains(deduplicationKey)) {
            rv = deleteStmt->BindInt64ByIndex(0, id);
            NS_ENSURE_SUCCESS(rv, rv);

            rv = deleteStmt->Execute();
            NS_ENSURE_SUCCESS(rv, rv);
          } else {
            deduplicationSet.Insert(deduplicationKey);
            rv = updateStmt->BindInt64ByIndex(0, id);
            NS_ENSURE_SUCCESS(rv, rv);
            rv = updateStmt->BindUTF8StringByIndex(1, site);
            NS_ENSURE_SUCCESS(rv, rv);

            rv = updateStmt->Execute();
            NS_ENSURE_SUCCESS(rv, rv);
          }
        }
        rv = data->mDBConn->CommitTransaction();
        NS_ENSURE_SUCCESS(rv, rv);

        rv = data->mDBConn->SetSchemaVersion(HOSTS_SCHEMA_VERSION);
        NS_ENSURE_SUCCESS(rv, rv);
      }

        // fall through to the next upgrade
        [[fallthrough]];

      // current version.
      case HOSTS_SCHEMA_VERSION:
        break;

      // downgrading.
      // if columns have been added to the table, we can still use the
      // ones we understand safely. if columns have been deleted or
      // altered, just blow away the table and start from scratch! if you
      // change the way a column is interpreted, make sure you also change
      // its name so this check will catch it.
      default: {
        // check if all the expected columns exist
        nsCOMPtr<mozIStorageStatement> stmt;
        rv = data->mDBConn->CreateStatement(
            nsLiteralCString("SELECT origin, type, permission, "
                             "expireType, expireTime, "
                             "modificationTime FROM moz_perms"),
            getter_AddRefs(stmt));
        if (NS_SUCCEEDED(rv)) break;

        // our columns aren't there - drop the table!
        rv = data->mDBConn->ExecuteSimpleSQL("DROP TABLE moz_perms"_ns);
        NS_ENSURE_SUCCESS(rv, rv);

        rv = CreateTable();
        NS_ENSURE_SUCCESS(rv, rv);
      } break;
    }
  }

  // cache frequently used statements (for insertion, deletion, and
  // updating)
  rv = data->mDBConn->CreateStatement(
      nsLiteralCString("INSERT INTO moz_perms "
                       "(id, origin, type, permission, expireType, "
                       "expireTime, modificationTime) "
                       "VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7)"),
      getter_AddRefs(data->mStmtInsert));
  NS_ENSURE_SUCCESS(rv, rv);

  rv = data->mDBConn->CreateStatement(nsLiteralCString("DELETE FROM moz_perms "
                                                       "WHERE id = ?1"),
                                      getter_AddRefs(data->mStmtDelete));
  NS_ENSURE_SUCCESS(rv, rv);

  rv = data->mDBConn->CreateStatement(
      nsLiteralCString("UPDATE moz_perms "
                       "SET permission = ?2, expireType= ?3, expireTime = "
                       "?4, modificationTime = ?5 WHERE id = ?1"),
      getter_AddRefs(data->mStmtUpdate));
  NS_ENSURE_SUCCESS(rv, rv);

  // Always import default permissions.
  ConsumeDefaultsInputStream(aDefaultsInputStream, lock);

  // check whether to import or just read in the db
  if (tableExists) {
    rv = Read(lock);
    NS_ENSURE_SUCCESS(rv, rv);
  }

  raiiFailure.release();

  return NS_OK;
}

void PermissionManager::AddIdleDailyMaintenanceJob() {
  MOZ_ASSERT(NS_IsMainThread());

  nsCOMPtr<nsIObserverService> observerService = services::GetObserverService();
  NS_ENSURE_TRUE_VOID(observerService);

  nsresult rv =
      observerService->AddObserver(this, OBSERVER_TOPIC_IDLE_DAILY, false);
  NS_ENSURE_SUCCESS_VOID(rv);
}

void PermissionManager::RemoveIdleDailyMaintenanceJob() {
  MOZ_ASSERT(NS_IsMainThread());

  nsCOMPtr<nsIObserverService> observerService = services::GetObserverService();
  NS_ENSURE_TRUE_VOID(observerService);

  nsresult rv =
      observerService->RemoveObserver(this, OBSERVER_TOPIC_IDLE_DAILY);
  NS_ENSURE_SUCCESS_VOID(rv);
}

void PermissionManager::PerformIdleDailyMaintenance() {
  MOZ_ASSERT(NS_IsMainThread());

  RefPtr<PermissionManager> self = this;
  mThread->Dispatch(NS_NewRunnableFunction(
      "PermissionManager::PerformIdleDailyMaintenance", [self] {
        auto data = self->mThreadBoundData.Access();

        if (self->mState == eClosed || !data->mDBConn) {
          return;
        }

        nsCOMPtr<mozIStorageStatement> stmtDeleteExpired;
        nsresult rv = data->mDBConn->CreateStatement(
            nsLiteralCString("DELETE FROM moz_perms WHERE expireType = "
                             "?1 AND expireTime <= ?2"),
            getter_AddRefs(stmtDeleteExpired));
        NS_ENSURE_SUCCESS_VOID(rv);

        rv = stmtDeleteExpired->BindInt32ByIndex(
            0, nsIPermissionManager::EXPIRE_TIME);
        NS_ENSURE_SUCCESS_VOID(rv);

        rv = stmtDeleteExpired->BindInt64ByIndex(1, EXPIRY_NOW);
        NS_ENSURE_SUCCESS_VOID(rv);

        rv = stmtDeleteExpired->Execute();
        NS_ENSURE_SUCCESS_VOID(rv);
      }));
}

// sets the schema version and creates the moz_perms table.
nsresult PermissionManager::CreateTable() {
  MOZ_ASSERT(!NS_IsMainThread());
  auto data = mThreadBoundData.Access();

  // set the schema version, before creating the table
  nsresult rv = data->mDBConn->SetSchemaVersion(HOSTS_SCHEMA_VERSION);
  if (NS_FAILED(rv)) return rv;

  // create the table
  // SQL also lives in automation.py.in. If you change this SQL change that
  // one too
  rv = data->mDBConn->ExecuteSimpleSQL(
      nsLiteralCString("CREATE TABLE moz_perms ("
                       " id INTEGER PRIMARY KEY"
                       ",origin TEXT"
                       ",type TEXT"
                       ",permission INTEGER"
                       ",expireType INTEGER"
                       ",expireTime INTEGER"
                       ",modificationTime INTEGER"
                       ")"));
  if (NS_FAILED(rv)) return rv;

  // We also create a legacy V4 table, for backwards compatability,
  // and to ensure that downgrades don't trigger a schema version change.
  return data->mDBConn->ExecuteSimpleSQL(
      nsLiteralCString("CREATE TABLE moz_hosts ("
                       " id INTEGER PRIMARY KEY"
                       ",host TEXT"
                       ",type TEXT"
                       ",permission INTEGER"
                       ",expireType INTEGER"
                       ",expireTime INTEGER"
                       ",modificationTime INTEGER"
                       ",isInBrowserElement INTEGER"
                       ")"));
}

// Returns whether the given combination of expire type and expire time are
// expired. Note that EXPIRE_SESSION only honors expireTime if it is nonzero.
bool PermissionManager::HasExpired(uint32_t aExpireType, int64_t aExpireTime) {
  return (aExpireType == nsIPermissionManager::EXPIRE_TIME ||
          (aExpireType == nsIPermissionManager::EXPIRE_SESSION &&
           aExpireTime != 0)) &&
         aExpireTime <= EXPIRY_NOW;
}

NS_IMETHODIMP
PermissionManager::AddFromPrincipalAndPersistInPrivateBrowsing(
    nsIPrincipal* aPrincipal, const nsACString& aType, uint32_t aPermission) {
  ENSURE_NOT_CHILD_PROCESS;
  NS_ENSURE_ARG_POINTER(aPrincipal);
  // We don't add the system principal because it actually has no URI and we
  // always allow action for them.
  if (aPrincipal->IsSystemPrincipal()) {
    return NS_OK;
  }

  // Null principals can't meaningfully have persisted permissions attached to
  // them, so we don't allow adding permissions for them.
  if (aPrincipal->GetIsNullPrincipal()) {
    return NS_OK;
  }

  // Permissions may not be added to expanded principals.
  if (IsExpandedPrincipal(aPrincipal)) {
    return NS_ERROR_INVALID_ARG;
  }

  // A modificationTime of zero will cause AddInternal to use now().
  int64_t modificationTime = 0;

  return AddInternal(aPrincipal, aType, aPermission, 0,
                     nsIPermissionManager::EXPIRE_NEVER,
                     /* aExpireTime */ 0, modificationTime, eNotify, eWriteToDB,
                     /* aIgnoreSessionPermissions */ false,
                     /* aOriginString*/ nullptr,
                     /* aAllowPersistInPrivateBrowsing */ true);
}

NS_IMETHODIMP
PermissionManager::AddFromPrincipal(nsIPrincipal* aPrincipal,
                                    const nsACString& aType,
                                    uint32_t aPermission, uint32_t aExpireType,
                                    int64_t aExpireTime) {
  ENSURE_NOT_CHILD_PROCESS;
  NS_ENSURE_ARG_POINTER(aPrincipal);
  NS_ENSURE_TRUE(aExpireType == nsIPermissionManager::EXPIRE_NEVER ||
                     aExpireType == nsIPermissionManager::EXPIRE_TIME ||
                     aExpireType == nsIPermissionManager::EXPIRE_SESSION ||
                     aExpireType == nsIPermissionManager::EXPIRE_POLICY,
                 NS_ERROR_INVALID_ARG);

  // Skip addition if the permission is already expired.
  if (HasExpired(aExpireType, aExpireTime)) {
    return NS_OK;
  }

  // We don't add the system principal because it actually has no URI and we
  // always allow action for them.
  if (aPrincipal->IsSystemPrincipal()) {
    return NS_OK;
  }

  // Null principals can't meaningfully have persisted permissions attached to
  // them, so we don't allow adding permissions for them.
  if (aPrincipal->GetIsNullPrincipal()) {
    return NS_OK;
  }

  // Permissions may not be added to expanded principals.
  if (IsExpandedPrincipal(aPrincipal)) {
    return NS_ERROR_INVALID_ARG;
  }

  // A modificationTime of zero will cause AddInternal to use now().
  int64_t modificationTime = 0;

  return AddInternal(aPrincipal, aType, aPermission, 0, aExpireType,
                     aExpireTime, modificationTime, eNotify, eWriteToDB);
}

nsresult PermissionManager::AddInternal(
    nsIPrincipal* aPrincipal, const nsACString& aType, uint32_t aPermission,
    int64_t aID, uint32_t aExpireType, int64_t aExpireTime,
    int64_t aModificationTime, NotifyOperationType aNotifyOperation,
    DBOperationType aDBOperation, const bool aIgnoreSessionPermissions,
    const nsACString* aOriginString,
    const bool aAllowPersistInPrivateBrowsing) {
  MOZ_ASSERT(NS_IsMainThread());

  EnsureReadCompleted();

  nsresult rv = NS_OK;
  nsAutoCString origin;
  // Only attempt to compute the origin string when it is going to be needed
  // later on in the function.
  if (!IsChildProcess() ||
      (aDBOperation == eWriteToDB && IsPersistentExpire(aExpireType, aType))) {
    if (aOriginString) {
      // Use the origin string provided by the caller.
      origin = *aOriginString;
    } else {
      if (IsSiteScopedPermission(aType)) {
        rv = GetSiteFromPrincipal(aPrincipal, IsOAForceStripPermission(aType),
                                  origin);
      } else {
        // Compute it from the principal provided.
        rv = GetOriginFromPrincipal(aPrincipal, IsOAForceStripPermission(aType),
                                    origin);
      }
      NS_ENSURE_SUCCESS(rv, rv);
    }
  }

  // Unless the caller sets aAllowPersistInPrivateBrowsing, only store
  // permissions for the session in Private Browsing. Except for default
  // permissions which are stored in-memory only and imported each startup. We
  // also allow setting persistent UKNOWN_ACTION, to support removing default
  // private browsing permissions.
  if (!aAllowPersistInPrivateBrowsing && aID != cIDPermissionIsDefault &&
      aPermission != UNKNOWN_ACTION && aExpireType != EXPIRE_SESSION) {
    uint32_t privateBrowsingId =
        nsScriptSecurityManager::DEFAULT_PRIVATE_BROWSING_ID;
    nsresult rv = aPrincipal->GetPrivateBrowsingId(&privateBrowsingId);
    if (NS_SUCCEEDED(rv) &&
        privateBrowsingId !=
            nsScriptSecurityManager::DEFAULT_PRIVATE_BROWSING_ID) {
      aExpireType = EXPIRE_SESSION;
    }
  }

  // Let's send the new permission to the content process only if it has to be
  // notified.
  if (!IsChildProcess() && aNotifyOperation == eNotify) {
    IPC::Permission permission(origin, aType, aPermission, aExpireType,
                               aExpireTime);

    nsAutoCString permissionKey;
    GetKeyForPermission(aPrincipal, aType, permissionKey);
    bool isSecondaryKeyed;
    nsAutoCString secondaryKey;
    isSecondaryKeyed = GetSecondaryKey(aType, secondaryKey);
    if (isSecondaryKeyed) {
      NotifySecondaryKeyPermissionUpdateInContentProcess(
          aType, aPermission, secondaryKey, aPrincipal);
    }

    nsTArray<ContentParent*> cplist;
    ContentParent::GetAll(cplist);
    for (uint32_t i = 0; i < cplist.Length(); ++i) {
      ContentParent* cp = cplist[i];
      if (cp->NeedsPermissionsUpdate(permissionKey)) {
        Unused << cp->SendAddPermission(permission);
      }
    }
  }

  MOZ_ASSERT(PermissionAvailable(aPrincipal, aType));

  // look up the type index
  int32_t typeIndex = GetTypeIndex(aType, true);
  NS_ENSURE_TRUE(typeIndex != -1, NS_ERROR_OUT_OF_MEMORY);

  // When an entry already exists, PutEntry will return that, instead
  // of adding a new one
  RefPtr<PermissionKey> key = PermissionKey::CreateFromPrincipal(
      aPrincipal, IsOAForceStripPermission(aType),
      IsSiteScopedPermission(aType), rv);
  if (!key) {
    MOZ_ASSERT(NS_FAILED(rv));
    return rv;
  }

  PermissionHashKey* entry = mPermissionTable.PutEntry(key);
  if (!entry) return NS_ERROR_FAILURE;
  if (!entry->GetKey()) {
    mPermissionTable.RemoveEntry(entry);
    return NS_ERROR_OUT_OF_MEMORY;
  }

  // figure out the transaction type, and get any existing permission value
  OperationType op;
  int32_t index = entry->GetPermissionIndex(typeIndex);
  if (index == -1) {
    if (aPermission == nsIPermissionManager::UNKNOWN_ACTION)
      op = eOperationNone;
    else
      op = eOperationAdding;

  } else {
    PermissionEntry oldPermissionEntry = entry->GetPermissions()[index];

    // remove the permission if the permission is UNKNOWN, update the
    // permission if its value or expire type have changed OR if the time has
    // changed and the expire type is time, otherwise, don't modify.  There's
    // no need to modify a permission that doesn't expire with time when the
    // only thing changed is the expire time.
    if (aPermission == oldPermissionEntry.mPermission &&
        aExpireType == oldPermissionEntry.mExpireType &&
        (aExpireType == nsIPermissionManager::EXPIRE_NEVER ||
         aExpireTime == oldPermissionEntry.mExpireTime))
      op = eOperationNone;
    else if (oldPermissionEntry.mID == cIDPermissionIsDefault)
      // The existing permission is one added as a default and the new
      // permission doesn't exactly match so we are replacing the default.  This
      // is true even if the new permission is UNKNOWN_ACTION (which means a
      // "logical remove" of the default)
      op = eOperationReplacingDefault;
    else if (aID == cIDPermissionIsDefault)
      // We are adding a default permission but a "real" permission already
      // exists.  This almost-certainly means we just did a removeAllSince and
      // are re-importing defaults - so we can ignore this.
      op = eOperationNone;
    else if (aPermission == nsIPermissionManager::UNKNOWN_ACTION)
      op = eOperationRemoving;
    else
      op = eOperationChanging;
  }

  // child processes should *always* be passed a modificationTime of zero.
  MOZ_ASSERT(!IsChildProcess() || aModificationTime == 0);

  // do the work for adding, deleting, or changing a permission:
  // update the in-memory list, write to the db, and notify consumers.
  int64_t id;
  if (aModificationTime == 0) {
    aModificationTime = EXPIRY_NOW;
  }

  switch (op) {
    case eOperationNone: {
      // nothing to do
      return NS_OK;
    }

    case eOperationAdding: {
      if (aDBOperation == eWriteToDB) {
        // we'll be writing to the database - generate a known unique id
        id = ++mLargestID;
      } else {
        // we're reading from the database - use the id already assigned
        id = aID;
      }

      entry->GetPermissions().AppendElement(
          PermissionEntry(id, typeIndex, aPermission, aExpireType, aExpireTime,
                          aModificationTime));

      if (aDBOperation == eWriteToDB &&
          IsPersistentExpire(aExpireType, aType)) {
        UpdateDB(op, id, origin, aType, aPermission, aExpireType, aExpireTime,
                 aModificationTime);
      }

      if (aNotifyOperation == eNotify) {
        NotifyObserversWithPermission(aPrincipal, mTypeArray[typeIndex],
                                      aPermission, aExpireType, aExpireTime,
                                      aModificationTime, u"added");
      }

      break;
    }

    case eOperationRemoving: {
      PermissionEntry oldPermissionEntry = entry->GetPermissions()[index];
      id = oldPermissionEntry.mID;

      // If the type we want to remove is EXPIRE_POLICY, we need to reject
      // attempts to change the permission.
      if (entry->GetPermissions()[index].mExpireType == EXPIRE_POLICY) {
        NS_WARNING("Attempting to remove EXPIRE_POLICY permission");
        break;
      }

      entry->GetPermissions().RemoveElementAt(index);

      if (aDBOperation == eWriteToDB)
        // We care only about the id here so we pass dummy values for all other
        // parameters.
        UpdateDB(op, id, ""_ns, ""_ns, 0, nsIPermissionManager::EXPIRE_NEVER, 0,
                 0);

      if (aNotifyOperation == eNotify) {
        NotifyObserversWithPermission(
            aPrincipal, mTypeArray[typeIndex], oldPermissionEntry.mPermission,
            oldPermissionEntry.mExpireType, oldPermissionEntry.mExpireTime,
            oldPermissionEntry.mModificationTime, u"deleted");
      }

      // If there are no more permissions stored for that entry, clear it.
      if (entry->GetPermissions().IsEmpty()) {
        mPermissionTable.RemoveEntry(entry);
      }

      break;
    }

    case eOperationChanging: {
      id = entry->GetPermissions()[index].mID;

      // If the existing type is EXPIRE_POLICY, we need to reject attempts to
      // change the permission.
      if (entry->GetPermissions()[index].mExpireType == EXPIRE_POLICY) {
        NS_WARNING("Attempting to modify EXPIRE_POLICY permission");
        break;
      }

      PermissionEntry oldPermissionEntry = entry->GetPermissions()[index];

      // If the new expireType is EXPIRE_SESSION, then we have to keep a
      // copy of the previous permission/expireType values. This cached value
      // will be used when restoring the permissions of an app.
      if (entry->GetPermissions()[index].mExpireType !=
              nsIPermissionManager::EXPIRE_SESSION &&
          aExpireType == nsIPermissionManager::EXPIRE_SESSION) {
        entry->GetPermissions()[index].mNonSessionPermission =
            entry->GetPermissions()[index].mPermission;
        entry->GetPermissions()[index].mNonSessionExpireType =
            entry->GetPermissions()[index].mExpireType;
        entry->GetPermissions()[index].mNonSessionExpireTime =
            entry->GetPermissions()[index].mExpireTime;
      } else if (aExpireType != nsIPermissionManager::EXPIRE_SESSION) {
        entry->GetPermissions()[index].mNonSessionPermission = aPermission;
        entry->GetPermissions()[index].mNonSessionExpireType = aExpireType;
        entry->GetPermissions()[index].mNonSessionExpireTime = aExpireTime;
      }

      entry->GetPermissions()[index].mPermission = aPermission;
      entry->GetPermissions()[index].mExpireType = aExpireType;
      entry->GetPermissions()[index].mExpireTime = aExpireTime;
      entry->GetPermissions()[index].mModificationTime = aModificationTime;

      if (aDBOperation == eWriteToDB) {
        bool newIsPersistentExpire = IsPersistentExpire(aExpireType, aType);
        bool oldIsPersistentExpire =
            IsPersistentExpire(oldPermissionEntry.mExpireType, aType);

        if (!newIsPersistentExpire && oldIsPersistentExpire) {
          // Maybe we have to remove the previous permission if that was
          // persistent.
          UpdateDB(eOperationRemoving, id, ""_ns, ""_ns, 0,
                   nsIPermissionManager::EXPIRE_NEVER, 0, 0);
        } else if (newIsPersistentExpire && !oldIsPersistentExpire) {
          // It could also be that the previous permission was session-only but
          // this needs to be written into the DB. In this case, we have to run
          // an Adding operation.
          UpdateDB(eOperationAdding, id, origin, aType, aPermission,
                   aExpireType, aExpireTime, aModificationTime);
        } else if (newIsPersistentExpire) {
          // This is the a simple update.  We care only about the id, the
          // permission and expireType/expireTime/modificationTime here. We pass
          // dummy values for all other parameters.
          UpdateDB(op, id, ""_ns, ""_ns, aPermission, aExpireType, aExpireTime,
                   aModificationTime);
        }
      }

      if (aNotifyOperation == eNotify) {
        NotifyObserversWithPermission(aPrincipal, mTypeArray[typeIndex],
                                      aPermission, aExpireType, aExpireTime,
                                      aModificationTime, u"changed");
      }

      break;
    }
    case eOperationReplacingDefault: {
      // this is handling the case when we have an existing permission
      // entry that was created as a "default" (and thus isn't in the DB) with
      // an explicit permission (that may include UNKNOWN_ACTION.)
      // Note we will *not* get here if we are replacing an already replaced
      // default value - that is handled as eOperationChanging.

      // So this is a hybrid of eOperationAdding (as we are writing a new entry
      // to the DB) and eOperationChanging (as we are replacing the in-memory
      // repr and sending a "changed" notification).

      // We want a new ID even if not writing to the DB, so the modified entry
      // in memory doesn't have the magic cIDPermissionIsDefault value.
      id = ++mLargestID;

      // The default permission being replaced can't have session expiry or
      // policy expiry.
      NS_ENSURE_TRUE(entry->GetPermissions()[index].mExpireType !=
                         nsIPermissionManager::EXPIRE_SESSION,
                     NS_ERROR_UNEXPECTED);
      NS_ENSURE_TRUE(entry->GetPermissions()[index].mExpireType !=
                         nsIPermissionManager::EXPIRE_POLICY,
                     NS_ERROR_UNEXPECTED);
      // We don't support the new entry having any expiry - supporting that
      // would make things far more complex and none of the permissions we set
      // as a default support that.
      NS_ENSURE_TRUE(aExpireType == EXPIRE_NEVER, NS_ERROR_UNEXPECTED);

      // update the existing entry in memory.
      entry->GetPermissions()[index].mID = id;
      entry->GetPermissions()[index].mPermission = aPermission;
      entry->GetPermissions()[index].mExpireType = aExpireType;
      entry->GetPermissions()[index].mExpireTime = aExpireTime;
      entry->GetPermissions()[index].mModificationTime = aModificationTime;

      // If requested, create the entry in the DB.
      if (aDBOperation == eWriteToDB &&
          IsPersistentExpire(aExpireType, aType)) {
        UpdateDB(eOperationAdding, id, origin, aType, aPermission, aExpireType,
                 aExpireTime, aModificationTime);
      }

      if (aNotifyOperation == eNotify) {
        NotifyObserversWithPermission(aPrincipal, mTypeArray[typeIndex],
                                      aPermission, aExpireType, aExpireTime,
                                      aModificationTime, u"changed");
      }

    } break;
  }

  return NS_OK;
}

NS_IMETHODIMP
PermissionManager::RemoveFromPrincipal(nsIPrincipal* aPrincipal,
                                       const nsACString& aType) {
  ENSURE_NOT_CHILD_PROCESS;
  NS_ENSURE_ARG_POINTER(aPrincipal);

  // System principals are never added to the database, no need to remove them.
  if (aPrincipal->IsSystemPrincipal()) {
    return NS_OK;
  }

  // Permissions may not be added to expanded principals.
  if (IsExpandedPrincipal(aPrincipal)) {
    return NS_ERROR_INVALID_ARG;
  }

  // AddInternal() handles removal, just let it do the work
  return AddInternal(aPrincipal, aType, nsIPermissionManager::UNKNOWN_ACTION, 0,
                     nsIPermissionManager::EXPIRE_NEVER, 0, 0, eNotify,
                     eWriteToDB);
}

NS_IMETHODIMP
PermissionManager::RemovePermission(nsIPermission* aPerm) {
  if (!aPerm) {
    return NS_OK;
  }
  nsCOMPtr<nsIPrincipal> principal;
  nsresult rv = aPerm->GetPrincipal(getter_AddRefs(principal));
  NS_ENSURE_SUCCESS(rv, rv);

  nsAutoCString type;
  rv = aPerm->GetType(type);
  NS_ENSURE_SUCCESS(rv, rv);

  // Permissions are uniquely identified by their principal and type.
  // We remove the permission using these two pieces of data.
  return RemoveFromPrincipal(principal, type);
}

NS_IMETHODIMP
PermissionManager::RemoveAll() {
  ENSURE_NOT_CHILD_PROCESS;
  return RemoveAllInternal(true);
}

NS_IMETHODIMP
PermissionManager::RemoveAllSince(int64_t aSince) {
  ENSURE_NOT_CHILD_PROCESS;
  return RemoveAllModifiedSince(aSince);
}

template <class T>
nsresult PermissionManager::RemovePermissionEntries(T aCondition) {
  EnsureReadCompleted();

  Vector<std::tuple<nsCOMPtr<nsIPrincipal>, nsCString, nsCString>, 10> array;
  for (const PermissionHashKey& entry : mPermissionTable) {
    for (const auto& permEntry : entry.GetPermissions()) {
      if (!aCondition(permEntry)) {
        continue;
      }

      nsCOMPtr<nsIPrincipal> principal;
      nsresult rv = GetPrincipalFromOrigin(
          entry.GetKey()->mOrigin,
          IsOAForceStripPermission(mTypeArray[permEntry.mType]),
          getter_AddRefs(principal));
      if (NS_FAILED(rv)) {
        continue;
      }

      if (!array.emplaceBack(principal, mTypeArray[permEntry.mType],
                             entry.GetKey()->mOrigin)) {
        continue;
      }
    }
  }

  for (auto& i : array) {
    // AddInternal handles removal, so let it do the work...
    AddInternal(
        std::get<0>(i), std::get<1>(i), nsIPermissionManager::UNKNOWN_ACTION, 0,
        nsIPermissionManager::EXPIRE_NEVER, 0, 0, PermissionManager::eNotify,
        PermissionManager::eWriteToDB, false, &std::get<2>(i));
  }

  // now re-import any defaults as they may now be required if we just deleted
  // an override.
  ImportLatestDefaults();
  return NS_OK;
}

NS_IMETHODIMP
PermissionManager::RemoveByType(const nsACString& aType) {
  ENSURE_NOT_CHILD_PROCESS;

  int32_t typeIndex = GetTypeIndex(aType, false);
  // If type == -1, the type isn't known,
  // so just return NS_OK
  if (typeIndex == -1) {
    return NS_OK;
  }

  return RemovePermissionEntries(
      [typeIndex](const PermissionEntry& aPermEntry) {
        return static_cast<uint32_t>(typeIndex) == aPermEntry.mType;
      });
}

NS_IMETHODIMP
PermissionManager::RemoveByTypeSince(const nsACString& aType,
                                     int64_t aModificationTime) {
  ENSURE_NOT_CHILD_PROCESS;

  int32_t typeIndex = GetTypeIndex(aType, false);
  // If type == -1, the type isn't known,
  // so just return NS_OK
  if (typeIndex == -1) {
    return NS_OK;
  }

  return RemovePermissionEntries(
      [typeIndex, aModificationTime](const PermissionEntry& aPermEntry) {
        return uint32_t(typeIndex) == aPermEntry.mType &&
               aModificationTime <= aPermEntry.mModificationTime;
      });
}

void PermissionManager::CloseDB(CloseDBNextOp aNextOp) {
  EnsureReadCompleted();

  mState = eClosed;

  nsCOMPtr<nsIInputStream> defaultsInputStream;
  if (aNextOp == eRebuldOnSuccess) {
    defaultsInputStream = GetDefaultsInputStream();
  }

  RefPtr<PermissionManager> self = this;
  mThread->Dispatch(NS_NewRunnableFunction(
      "PermissionManager::CloseDB", [self, aNextOp, defaultsInputStream] {
        auto data = self->mThreadBoundData.Access();
        // Null the statements, this will finalize them.
        data->mStmtInsert = nullptr;
        data->mStmtDelete = nullptr;
        data->mStmtUpdate = nullptr;
        if (data->mDBConn) {
          DebugOnly<nsresult> rv = data->mDBConn->Close();
          MOZ_ASSERT(NS_SUCCEEDED(rv));
          data->mDBConn = nullptr;

          if (aNextOp == eRebuldOnSuccess) {
            self->TryInitDB(true, defaultsInputStream);
          }
        }

        if (aNextOp == eShutdown) {
          NS_DispatchToMainThread(NS_NewRunnableFunction(
              "PermissionManager::MaybeCompleteShutdown",
              [self] { self->MaybeCompleteShutdown(); }));
        }
      }));
}

nsresult PermissionManager::RemoveAllFromIPC() {
  MOZ_ASSERT(IsChildProcess());

  // Remove from memory and notify immediately. Since the in-memory
  // database is authoritative, we do not need confirmation from the
  // on-disk database to notify observers.
  RemoveAllFromMemory();

  return NS_OK;
}

nsresult PermissionManager::RemoveAllInternal(bool aNotifyObservers) {
  ENSURE_NOT_CHILD_PROCESS;

  EnsureReadCompleted();

  // Let's broadcast the removeAll() to any content process.
  nsTArray<ContentParent*> parents;
  ContentParent::GetAll(parents);
  for (ContentParent* parent : parents) {
    Unused << parent->SendRemoveAllPermissions();
  }

  // Remove from memory and notify immediately. Since the in-memory
  // database is authoritative, we do not need confirmation from the
  // on-disk database to notify observers.
  RemoveAllFromMemory();

  // Re-import the defaults
  ImportLatestDefaults();

  if (aNotifyObservers) {
    NotifyObservers(nullptr, u"cleared");
  }

  RefPtr<PermissionManager> self = this;
  mThread->Dispatch(
      NS_NewRunnableFunction("PermissionManager::RemoveAllInternal", [self] {
        auto data = self->mThreadBoundData.Access();

        if (self->mState == eClosed || !data->mDBConn) {
          return;
        }

        // clear the db
        nsresult rv =
            data->mDBConn->ExecuteSimpleSQL("DELETE FROM moz_perms"_ns);
        if (NS_WARN_IF(NS_FAILED(rv))) {
          NS_DispatchToMainThread(NS_NewRunnableFunction(
              "PermissionManager::RemoveAllInternal-Failure",
              [self] { self->CloseDB(eRebuldOnSuccess); }));
        }
      }));

  return NS_OK;
}

NS_IMETHODIMP
PermissionManager::TestExactPermissionFromPrincipal(nsIPrincipal* aPrincipal,
                                                    const nsACString& aType,
                                                    uint32_t* aPermission) {
  return CommonTestPermission(aPrincipal, -1, aType, aPermission,
                              nsIPermissionManager::UNKNOWN_ACTION, false, true,
                              true);
}

NS_IMETHODIMP
PermissionManager::TestExactPermanentPermission(nsIPrincipal* aPrincipal,
                                                const nsACString& aType,
                                                uint32_t* aPermission) {
  return CommonTestPermission(aPrincipal, -1, aType, aPermission,
                              nsIPermissionManager::UNKNOWN_ACTION, false, true,
                              false);
}

nsresult PermissionManager::LegacyTestPermissionFromURI(
    nsIURI* aURI, const OriginAttributes* aOriginAttributes,
    const nsACString& aType, uint32_t* aPermission) {
  return CommonTestPermission(aURI, aOriginAttributes, -1, aType, aPermission,
                              nsIPermissionManager::UNKNOWN_ACTION, false,
                              false, true);
}

NS_IMETHODIMP
PermissionManager::TestPermissionFromPrincipal(nsIPrincipal* aPrincipal,
                                               const nsACString& aType,
                                               uint32_t* aPermission) {
  return CommonTestPermission(aPrincipal, -1, aType, aPermission,
                              nsIPermissionManager::UNKNOWN_ACTION, false,
                              false, true);
}

NS_IMETHODIMP
PermissionManager::GetPermissionObject(nsIPrincipal* aPrincipal,
                                       const nsACString& aType,
                                       bool aExactHostMatch,
                                       nsIPermission** aResult) {
  NS_ENSURE_ARG_POINTER(aPrincipal);
  *aResult = nullptr;

  EnsureReadCompleted();

  if (aPrincipal->IsSystemPrincipal()) {
    return NS_OK;
  }

  // Querying the permission object of an nsEP is non-sensical.
  if (IsExpandedPrincipal(aPrincipal)) {
    return NS_ERROR_INVALID_ARG;
  }

  MOZ_ASSERT(PermissionAvailable(aPrincipal, aType));

  int32_t typeIndex = GetTypeIndex(aType, false);
  // If type == -1, the type isn't known,
  // so just return NS_OK
  if (typeIndex == -1) return NS_OK;

  PermissionHashKey* entry =
      GetPermissionHashKey(aPrincipal, typeIndex, aExactHostMatch);
  if (!entry) {
    return NS_OK;
  }

  // We don't call GetPermission(typeIndex) because that returns a fake
  // UNKNOWN_ACTION entry if there is no match.
  int32_t idx = entry->GetPermissionIndex(typeIndex);
  if (-1 == idx) {
    return NS_OK;
  }

  nsCOMPtr<nsIPrincipal> principal;
  nsresult rv = GetPrincipalFromOrigin(entry->GetKey()->mOrigin,
                                       IsOAForceStripPermission(aType),
                                       getter_AddRefs(principal));
  NS_ENSURE_SUCCESS(rv, rv);

  PermissionEntry& perm = entry->GetPermissions()[idx];
  nsCOMPtr<nsIPermission> r = Permission::Create(
      principal, mTypeArray[perm.mType], perm.mPermission, perm.mExpireType,
      perm.mExpireTime, perm.mModificationTime);
  if (NS_WARN_IF(!r)) {
    return NS_ERROR_FAILURE;
  }
  r.forget(aResult);
  return NS_OK;
}

nsresult PermissionManager::CommonTestPermissionInternal(
    nsIPrincipal* aPrincipal, nsIURI* aURI,
    const OriginAttributes* aOriginAttributes, int32_t aTypeIndex,
    const nsACString& aType, uint32_t* aPermission, bool aExactHostMatch,
    bool aIncludingSession) {
  MOZ_ASSERT(aPrincipal || aURI);
  NS_ENSURE_ARG_POINTER(aPrincipal || aURI);
  MOZ_ASSERT_IF(aPrincipal, !aURI && !aOriginAttributes);
  MOZ_ASSERT_IF(aURI || aOriginAttributes, !aPrincipal);

  EnsureReadCompleted();

#ifdef DEBUG
  {
    nsCOMPtr<nsIPrincipal> prin = aPrincipal;
    if (!prin) {
      if (aURI) {
        prin = BasePrincipal::CreateContentPrincipal(aURI, OriginAttributes());
      }
    }
    MOZ_ASSERT(prin);
    MOZ_ASSERT(PermissionAvailable(prin, aType));
  }
#endif

  PermissionHashKey* entry =
      aPrincipal ? GetPermissionHashKey(aPrincipal, aTypeIndex, aExactHostMatch)
                 : GetPermissionHashKey(aURI, aOriginAttributes, aTypeIndex,
                                        aExactHostMatch);
  if (!entry || (!aIncludingSession &&
                 entry->GetPermission(aTypeIndex).mNonSessionExpireType ==
                     nsIPermissionManager::EXPIRE_SESSION)) {
    return NS_OK;
  }

  *aPermission = aIncludingSession
                     ? entry->GetPermission(aTypeIndex).mPermission
                     : entry->GetPermission(aTypeIndex).mNonSessionPermission;

  return NS_OK;
}

// Helper function to filter permissions using a condition function.
template <class T>
nsresult PermissionManager::GetPermissionEntries(
    T aCondition, nsTArray<RefPtr<nsIPermission>>& aResult) {
  aResult.Clear();
  if (XRE_IsContentProcess()) {
    NS_WARNING(
        "Iterating over all permissions is not available in the "
        "content process, as not all permissions may be available.");
    return NS_ERROR_NOT_AVAILABLE;
  }

  EnsureReadCompleted();

  for (const PermissionHashKey& entry : mPermissionTable) {
    for (const auto& permEntry : entry.GetPermissions()) {
      // Given how "default" permissions work and the possibility of them being
      // overridden with UNKNOWN_ACTION, we might see this value here - but we
      // do *not* want to return them via the enumerator.
      if (permEntry.mPermission == nsIPermissionManager::UNKNOWN_ACTION) {
        continue;
      }

      // If the permission is expired, skip it. We're not deleting it here
      // because we're iterating over a lot of permissions.
      // It will be removed as part of the daily maintenance later.
      if (HasExpired(permEntry.mExpireType, permEntry.mExpireTime)) {
        continue;
      }

      if (!aCondition(permEntry)) {
        continue;
      }

      nsCOMPtr<nsIPrincipal> principal;
      nsresult rv = GetPrincipalFromOrigin(
          entry.GetKey()->mOrigin,
          IsOAForceStripPermission(mTypeArray[permEntry.mType]),
          getter_AddRefs(principal));
      if (NS_FAILED(rv)) {
        continue;
      }

      RefPtr<nsIPermission> permission = Permission::Create(
          principal, mTypeArray[permEntry.mType], permEntry.mPermission,
          permEntry.mExpireType, permEntry.mExpireTime,
          permEntry.mModificationTime);
      if (NS_WARN_IF(!permission)) {
        continue;
      }
      aResult.AppendElement(std::move(permission));
    }
  }

  return NS_OK;
}

NS_IMETHODIMP PermissionManager::GetAll(
    nsTArray<RefPtr<nsIPermission>>& aResult) {
  return GetPermissionEntries(
      [](const PermissionEntry& aPermEntry) { return true; }, aResult);
}

NS_IMETHODIMP PermissionManager::GetAllByTypeSince(
    const nsACString& aPrefix, int64_t aSince,
    nsTArray<RefPtr<nsIPermission>>& aResult) {
  // Check that aSince is a reasonable point in time, not in the future
  if (aSince > (PR_Now() / PR_USEC_PER_MSEC)) {
    return NS_ERROR_INVALID_ARG;
  }
  return GetPermissionEntries(
      [&](const PermissionEntry& aPermEntry) {
        return mTypeArray[aPermEntry.mType].Equals(aPrefix) &&
               aSince <= aPermEntry.mModificationTime;
      },
      aResult);
}

NS_IMETHODIMP PermissionManager::GetAllWithTypePrefix(
    const nsACString& aPrefix, nsTArray<RefPtr<nsIPermission>>& aResult) {
  return GetPermissionEntries(
      [&](const PermissionEntry& aPermEntry) {
        return StringBeginsWith(mTypeArray[aPermEntry.mType], aPrefix);
      },
      aResult);
}

NS_IMETHODIMP PermissionManager::GetAllByTypes(
    const nsTArray<nsCString>& aTypes,
    nsTArray<RefPtr<nsIPermission>>& aResult) {
  if (aTypes.IsEmpty()) {
    return NS_OK;
  }

  return GetPermissionEntries(
      [&](const PermissionEntry& aPermEntry) {
        return aTypes.Contains(mTypeArray[aPermEntry.mType]);
      },
      aResult);
}

nsresult PermissionManager::GetAllForPrincipalHelper(
    nsIPrincipal* aPrincipal, bool aSiteScopePermissions,
    nsTArray<RefPtr<nsIPermission>>& aResult) {
  nsresult rv;
  RefPtr<PermissionKey> key = PermissionKey::CreateFromPrincipal(
      aPrincipal, false, aSiteScopePermissions, rv);
  if (!key) {
    MOZ_ASSERT(NS_FAILED(rv));
    return rv;
  }
  PermissionHashKey* entry = mPermissionTable.GetEntry(key);

  nsTArray<PermissionEntry> strippedPerms;
  rv = GetStripPermsForPrincipal(aPrincipal, aSiteScopePermissions,
                                 strippedPerms);
  if (NS_FAILED(rv)) {
    return rv;
  }

  if (entry) {
    for (const auto& permEntry : entry->GetPermissions()) {
      // Only return custom permissions
      if (permEntry.mPermission == nsIPermissionManager::UNKNOWN_ACTION) {
        continue;
      }

      // If the permission is expired, skip it. We're not deleting it here
      // because we're iterating over a lot of permissions.
      // It will be removed as part of the daily maintenance later.
      if (HasExpired(permEntry.mExpireType, permEntry.mExpireTime)) {
        continue;
      }

      // Make sure that we only get site scoped permissions if this
      // helper is being invoked for that purpose.
      if (aSiteScopePermissions !=
          IsSiteScopedPermission(mTypeArray[permEntry.mType])) {
        continue;
      }

      // Stripped principal permissions overwrite regular ones
      // For each permission check if there is a stripped permission we should
      // use instead
      PermissionEntry perm = permEntry;
      nsTArray<PermissionEntry>::index_type index = 0;
      for (const auto& strippedPerm : strippedPerms) {
        if (strippedPerm.mType == permEntry.mType) {
          perm = strippedPerm;
          strippedPerms.RemoveElementAt(index);
          break;
        }
        index++;
      }

      RefPtr<nsIPermission> permission = Permission::Create(
          aPrincipal, mTypeArray[perm.mType], perm.mPermission,
          perm.mExpireType, perm.mExpireTime, perm.mModificationTime);
      if (NS_WARN_IF(!permission)) {
        continue;
      }
      aResult.AppendElement(permission);
    }
  }

  for (const auto& perm : strippedPerms) {
    RefPtr<nsIPermission> permission = Permission::Create(
        aPrincipal, mTypeArray[perm.mType], perm.mPermission, perm.mExpireType,
        perm.mExpireTime, perm.mModificationTime);
    if (NS_WARN_IF(!permission)) {
      continue;
    }
    aResult.AppendElement(permission);
  }

  return NS_OK;
}

NS_IMETHODIMP
PermissionManager::GetAllForPrincipal(
    nsIPrincipal* aPrincipal, nsTArray<RefPtr<nsIPermission>>& aResult) {
  nsresult rv;
  aResult.Clear();
  EnsureReadCompleted();

  MOZ_ASSERT(PermissionAvailable(aPrincipal, ""_ns));

  // First, append the non-site-scoped permissions.
  rv = GetAllForPrincipalHelper(aPrincipal, false, aResult);
  NS_ENSURE_SUCCESS(rv, rv);

  // Second, append the site-scoped permissions.
  return GetAllForPrincipalHelper(aPrincipal, true, aResult);
}

NS_IMETHODIMP PermissionManager::Observe(nsISupports* aSubject,
                                         const char* aTopic,
                                         const char16_t* someData) {
  ENSURE_NOT_CHILD_PROCESS;

  if (!nsCRT::strcmp(aTopic, "profile-do-change") && !mPermissionsFile) {
    // profile startup is complete, and we didn't have the permissions file
    // before; init the db from the new location
    InitDB(false);
  } else if (!nsCRT::strcmp(aTopic, "testonly-reload-permissions-from-disk")) {
    // Testing mechanism to reload all permissions from disk. Because the
    // permission manager automatically initializes itself at startup, tests
    // that directly manipulate the permissions database need some way to reload
    // the database for their changes to have any effect. This mechanism was
    // introduced when moving the permissions manager from on-demand startup to
    // always being initialized. This is not guarded by a pref because it's not
    // dangerous to reload permissions from disk, just bad for performance.
    RemoveAllFromMemory();
    CloseDB(eNone);
    InitDB(false);
  } else if (!nsCRT::strcmp(aTopic, OBSERVER_TOPIC_IDLE_DAILY)) {
    PerformIdleDailyMaintenance();
  }

  return NS_OK;
}

nsresult PermissionManager::RemoveAllModifiedSince(int64_t aModificationTime) {
  ENSURE_NOT_CHILD_PROCESS;
  // Skip remove calls for default permissions to avoid
  // creating UNKNOWN_ACTION overrides in AddInternal
  return RemovePermissionEntries(
      [aModificationTime](const PermissionEntry& aPermEntry) {
        return aModificationTime <= aPermEntry.mModificationTime &&
               aPermEntry.mID != cIDPermissionIsDefault;
      });
}

NS_IMETHODIMP
PermissionManager::RemovePermissionsWithAttributes(const nsAString& aPattern) {
  ENSURE_NOT_CHILD_PROCESS;
  OriginAttributesPattern pattern;
  if (!pattern.Init(aPattern)) {
    return NS_ERROR_INVALID_ARG;
  }

  return RemovePermissionsWithAttributes(pattern);
}

nsresult PermissionManager::RemovePermissionsWithAttributes(
    OriginAttributesPattern& aPattern) {
  EnsureReadCompleted();

  Vector<std::tuple<nsCOMPtr<nsIPrincipal>, nsCString, nsCString>, 10>
      permissions;
  for (const PermissionHashKey& entry : mPermissionTable) {
    nsCOMPtr<nsIPrincipal> principal;
    nsresult rv = GetPrincipalFromOrigin(entry.GetKey()->mOrigin, false,
                                         getter_AddRefs(principal));
    if (NS_FAILED(rv)) {
      continue;
    }

    if (!aPattern.Matches(principal->OriginAttributesRef())) {
      continue;
    }

    for (const auto& permEntry : entry.GetPermissions()) {
      if (!permissions.emplaceBack(principal, mTypeArray[permEntry.mType],
                                   entry.GetKey()->mOrigin)) {
        continue;
      }
    }
  }

  for (auto& i : permissions) {
    AddInternal(
        std::get<0>(i), std::get<1>(i), nsIPermissionManager::UNKNOWN_ACTION, 0,
        nsIPermissionManager::EXPIRE_NEVER, 0, 0, PermissionManager::eNotify,
        PermissionManager::eWriteToDB, false, &std::get<2>(i));
  }

  return NS_OK;
}

nsresult PermissionManager::GetStripPermsForPrincipal(
    nsIPrincipal* aPrincipal, bool aSiteScopePermissions,
    nsTArray<PermissionEntry>& aResult) {
  aResult.Clear();
  aResult.SetCapacity(kStripOAPermissions.size());

#ifdef __clang__
#  pragma clang diagnostic push
#  pragma clang diagnostic ignored "-Wunreachable-code-return"
#endif
  // No special strip permissions
  if (kStripOAPermissions.empty()) {
    return NS_OK;
  }
#ifdef __clang__
#  pragma clang diagnostic pop
#endif

  nsresult rv;
  // Create a key for the principal, but strip any origin attributes.
  // The key must be created aware of whether or not we are scoping to site.
  RefPtr<PermissionKey> key = PermissionKey::CreateFromPrincipal(
      aPrincipal, true, aSiteScopePermissions, rv);
  if (!key) {
    MOZ_ASSERT(NS_FAILED(rv));
    return rv;
  }

  PermissionHashKey* hashKey = mPermissionTable.GetEntry(key);
  if (!hashKey) {
    return NS_OK;
  }

  for (const auto& permType : kStripOAPermissions) {
    // if the permission type's site scoping does not match this function call,
    // we don't care about it, so continue.
    // As of time of writing, this never happens when aSiteScopePermissions
    // is true because there is no common permission between kStripOAPermissions
    // and kSiteScopedPermissions
    if (aSiteScopePermissions != IsSiteScopedPermission(permType)) {
      continue;
    }
    int32_t index = GetTypeIndex(permType, false);
    if (index == -1) {
      continue;
    }
    PermissionEntry perm = hashKey->GetPermission(index);
    if (perm.mPermission == nsIPermissionManager::UNKNOWN_ACTION) {
      continue;
    }
    aResult.AppendElement(perm);
  }

  return NS_OK;
}

int32_t PermissionManager::GetTypeIndex(const nsACString& aType, bool aAdd) {
  for (uint32_t i = 0; i < mTypeArray.length(); ++i) {
    if (mTypeArray[i].Equals(aType)) {
      return i;
    }
  }

  if (!aAdd) {
    // Not found, but that is ok - we were just looking.
    return -1;
  }

  // This type was not registered before.
  // append it to the array, without copy-constructing the string
  if (!mTypeArray.emplaceBack(aType)) {
    return -1;
  }

  return mTypeArray.length() - 1;
}

PermissionManager::PermissionHashKey* PermissionManager::GetPermissionHashKey(
    nsIPrincipal* aPrincipal, uint32_t aType, bool aExactHostMatch) {
  EnsureReadCompleted();

  MOZ_ASSERT(PermissionAvailable(aPrincipal, mTypeArray[aType]));

  nsresult rv;
  RefPtr<PermissionKey> key = PermissionKey::CreateFromPrincipal(
      aPrincipal, IsOAForceStripPermission(mTypeArray[aType]),
      IsSiteScopedPermission(mTypeArray[aType]), rv);
  if (!key) {
    return nullptr;
  }

  PermissionHashKey* entry = mPermissionTable.GetEntry(key);

  if (entry) {
    PermissionEntry permEntry = entry->GetPermission(aType);

    // if the entry is expired, remove and keep looking for others.
    if (HasExpired(permEntry.mExpireType, permEntry.mExpireTime)) {
      entry = nullptr;
      RemoveFromPrincipal(aPrincipal, mTypeArray[aType]);
    } else if (permEntry.mPermission == nsIPermissionManager::UNKNOWN_ACTION) {
      entry = nullptr;
    }
  }

  if (entry) {
    return entry;
  }

  // If aExactHostMatch wasn't true, we can check if the base domain has a
  // permission entry.
  if (!aExactHostMatch) {
    nsCOMPtr<nsIPrincipal> principal = aPrincipal->GetNextSubDomainPrincipal();
    if (principal) {
      return GetPermissionHashKey(principal, aType, aExactHostMatch);
    }
  }

  // No entry, really...
  return nullptr;
}

PermissionManager::PermissionHashKey* PermissionManager::GetPermissionHashKey(
    nsIURI* aURI, const OriginAttributes* aOriginAttributes, uint32_t aType,
    bool aExactHostMatch) {
  MOZ_ASSERT(aURI);

#ifdef DEBUG
  {
    nsCOMPtr<nsIPrincipal> principal;
    nsresult rv = NS_OK;
    if (aURI) {
      rv = GetPrincipal(aURI, getter_AddRefs(principal));
    }
    MOZ_ASSERT_IF(NS_SUCCEEDED(rv),
                  PermissionAvailable(principal, mTypeArray[aType]));
  }
#endif

  nsresult rv;
  RefPtr<PermissionKey> key;

  if (aOriginAttributes) {
    key = PermissionKey::CreateFromURIAndOriginAttributes(
        aURI, aOriginAttributes, IsOAForceStripPermission(mTypeArray[aType]),
        rv);
  } else {
    key = PermissionKey::CreateFromURI(aURI, rv);
  }

  if (!key) {
    return nullptr;
  }

  PermissionHashKey* entry = mPermissionTable.GetEntry(key);

  if (entry) {
    PermissionEntry permEntry = entry->GetPermission(aType);

    // if the entry is expired, remove and keep looking for others.
    if (HasExpired(permEntry.mExpireType, permEntry.mExpireTime)) {
      entry = nullptr;
      // If we need to remove a permission we mint a principal.  This is a bit
      // inefficient, but hopefully this code path isn't super common.
      nsCOMPtr<nsIPrincipal> principal;
      if (aURI) {
        nsresult rv = GetPrincipal(aURI, getter_AddRefs(principal));
        if (NS_WARN_IF(NS_FAILED(rv))) {
          return nullptr;
        }
      }
      RemoveFromPrincipal(principal, mTypeArray[aType]);
    } else if (permEntry.mPermission == nsIPermissionManager::UNKNOWN_ACTION) {
      entry = nullptr;
    }
  }

  if (entry) {
    return entry;
  }

  // If aExactHostMatch wasn't true, we can check if the base domain has a
  // permission entry.
  if (!aExactHostMatch) {
    nsCOMPtr<nsIURI> uri;
    if (aURI) {
      uri = GetNextSubDomainURI(aURI);
    }
    if (uri) {
      return GetPermissionHashKey(uri, aOriginAttributes, aType,
                                  aExactHostMatch);
    }
  }

  // No entry, really...
  return nullptr;
}

nsresult PermissionManager::RemoveAllFromMemory() {
  mLargestID = 0;
  mTypeArray.clear();
  mPermissionTable.Clear();

  return NS_OK;
}

// wrapper function for mangling (host,type,perm,expireType,expireTime)
// set into an nsIPermission.
void PermissionManager::NotifyObserversWithPermission(
    nsIPrincipal* aPrincipal, const nsACString& aType, uint32_t aPermission,
    uint32_t aExpireType, int64_t aExpireTime, int64_t aModificationTime,
    const char16_t* aData) {
  nsCOMPtr<nsIPermission> permission =
      Permission::Create(aPrincipal, aType, aPermission, aExpireType,
                         aExpireTime, aModificationTime);
  if (permission) NotifyObservers(permission, aData);
}

// notify observers that the permission list changed. there are four possible
// values for aData:
// "deleted" means a permission was deleted. aPermission is the deleted
// permission. "added"   means a permission was added. aPermission is the added
// permission. "changed" means a permission was altered. aPermission is the new
// permission. "cleared" means the entire permission list was cleared.
// aPermission is null.
void PermissionManager::NotifyObservers(nsIPermission* aPermission,
                                        const char16_t* aData) {
  nsCOMPtr<nsIObserverService> observerService = services::GetObserverService();
  if (observerService)
    observerService->NotifyObservers(aPermission, kPermissionChangeNotification,
                                     aData);
}

nsresult PermissionManager::Read(const MonitorAutoLock& aProofOfLock) {
  ENSURE_NOT_CHILD_PROCESS;

  MOZ_ASSERT(!NS_IsMainThread());
  auto data = mThreadBoundData.Access();

  nsresult rv;
  bool hasResult;
  nsCOMPtr<mozIStorageStatement> stmt;

  // Let's retrieve the last used ID.
  rv = data->mDBConn->CreateStatement(
      nsLiteralCString("SELECT MAX(id) FROM moz_perms"), getter_AddRefs(stmt));
  NS_ENSURE_SUCCESS(rv, rv);

  while (NS_SUCCEEDED(stmt->ExecuteStep(&hasResult)) && hasResult) {
    int64_t id = stmt->AsInt64(0);
    mLargestID = id;
  }

  rv = data->mDBConn->CreateStatement(
      nsLiteralCString(
          "SELECT id, origin, type, permission, expireType, "
          "expireTime, modificationTime "
          "FROM moz_perms WHERE expireType != ?1 OR expireTime > ?2"),
      getter_AddRefs(stmt));
  NS_ENSURE_SUCCESS(rv, rv);

  rv = stmt->BindInt32ByIndex(0, nsIPermissionManager::EXPIRE_TIME);
  NS_ENSURE_SUCCESS(rv, rv);

  rv = stmt->BindInt64ByIndex(1, EXPIRY_NOW);
  NS_ENSURE_SUCCESS(rv, rv);

  bool readError = false;

  while (NS_SUCCEEDED(stmt->ExecuteStep(&hasResult)) && hasResult) {
    ReadEntry entry;

    // explicitly set our entry id counter for use in AddInternal(),
    // and keep track of the largest id so we know where to pick up.
    entry.mId = stmt->AsInt64(0);
    MOZ_ASSERT(entry.mId <= mLargestID);

    rv = stmt->GetUTF8String(1, entry.mOrigin);
    if (NS_FAILED(rv)) {
      readError = true;
      continue;
    }

    rv = stmt->GetUTF8String(2, entry.mType);
    if (NS_FAILED(rv)) {
      readError = true;
      continue;
    }

    entry.mPermission = stmt->AsInt32(3);
    entry.mExpireType = stmt->AsInt32(4);

    // convert into int64_t values (milliseconds)
    entry.mExpireTime = stmt->AsInt64(5);
    entry.mModificationTime = stmt->AsInt64(6);

    entry.mFromMigration = false;

    mReadEntries.AppendElement(entry);
  }

  if (readError) {
    NS_ERROR("Error occured while reading the permissions database!");
    return NS_ERROR_FAILURE;
  }

  return NS_OK;
}

void PermissionManager::CompleteMigrations() {
  MOZ_ASSERT(NS_IsMainThread());
  MOZ_ASSERT(mState == eReady);

  nsresult rv;

  nsTArray<MigrationEntry> entries;
  {
    MonitorAutoLock lock(mMonitor);
    entries = std::move(mMigrationEntries);
  }

  for (const MigrationEntry& entry : entries) {
    rv = UpgradeHostToOriginAndInsert(
        entry.mHost, entry.mType, entry.mPermission, entry.mExpireType,
        entry.mExpireTime, entry.mModificationTime,
        [&](const nsACString& aOrigin, const nsCString& aType,
            uint32_t aPermission, uint32_t aExpireType, int64_t aExpireTime,
            int64_t aModificationTime) {
          MaybeAddReadEntryFromMigration(aOrigin, aType, aPermission,
                                         aExpireType, aExpireTime,
                                         aModificationTime, entry.mId);
          return NS_OK;
        });
    Unused << NS_WARN_IF(NS_FAILED(rv));
  }
}

void PermissionManager::CompleteRead() {
  MOZ_ASSERT(NS_IsMainThread());
  MOZ_ASSERT(mState == eReady);

  nsresult rv;

  nsTArray<ReadEntry> entries;
  {
    MonitorAutoLock lock(mMonitor);
    entries = std::move(mReadEntries);
  }

  for (const ReadEntry& entry : entries) {
    nsCOMPtr<nsIPrincipal> principal;
    rv = GetPrincipalFromOrigin(entry.mOrigin,
                                IsOAForceStripPermission(entry.mType),
                                getter_AddRefs(principal));
    if (NS_WARN_IF(NS_FAILED(rv))) {
      continue;
    }

    DBOperationType op = entry.mFromMigration ? eWriteToDB : eNoDBOperation;

    rv = AddInternal(principal, entry.mType, entry.mPermission, entry.mId,
                     entry.mExpireType, entry.mExpireTime,
                     entry.mModificationTime, eDontNotify, op, false,
                     &entry.mOrigin);
    Unused << NS_WARN_IF(NS_FAILED(rv));
  }
}

void PermissionManager::MaybeAddReadEntryFromMigration(
    const nsACString& aOrigin, const nsCString& aType, uint32_t aPermission,
    uint32_t aExpireType, int64_t aExpireTime, int64_t aModificationTime,
    int64_t aId) {
  MonitorAutoLock lock(mMonitor);

  // We convert a migration to a ReadEntry only if we don't have an existing
  // ReadEntry for the same origin + type.
  for (const ReadEntry& entry : mReadEntries) {
    if (entry.mOrigin == aOrigin && entry.mType == aType) {
      return;
    }
  }

  ReadEntry entry;
  entry.mId = aId;
  entry.mOrigin = aOrigin;
  entry.mType = aType;
  entry.mPermission = aPermission;
  entry.mExpireType = aExpireType;
  entry.mExpireTime = aExpireTime;
  entry.mModificationTime = aModificationTime;
  entry.mFromMigration = true;

  mReadEntries.AppendElement(entry);
}

void PermissionManager::UpdateDB(OperationType aOp, int64_t aID,
                                 const nsACString& aOrigin,
                                 const nsACString& aType, uint32_t aPermission,
                                 uint32_t aExpireType, int64_t aExpireTime,
                                 int64_t aModificationTime) {
  ENSURE_NOT_CHILD_PROCESS_NORET;

  MOZ_ASSERT(NS_IsMainThread());
  EnsureReadCompleted();

  nsCString origin(aOrigin);
  nsCString type(aType);

  RefPtr<PermissionManager> self = this;
  mThread->Dispatch(NS_NewRunnableFunction(
      "PermissionManager::UpdateDB",
      [self, aOp, aID, origin, type, aPermission, aExpireType, aExpireTime,
       aModificationTime] {
        nsresult rv;

        auto data = self->mThreadBoundData.Access();

        if (self->mState == eClosed || !data->mDBConn) {
          // no statement is ok - just means we don't have a profile
          return;
        }

        mozIStorageStatement* stmt = nullptr;
        switch (aOp) {
          case eOperationAdding: {
            stmt = data->mStmtInsert;

            rv = stmt->BindInt64ByIndex(0, aID);
            if (NS_FAILED(rv)) break;

            rv = stmt->BindUTF8StringByIndex(1, origin);
            if (NS_FAILED(rv)) break;

            rv = stmt->BindUTF8StringByIndex(2, type);
            if (NS_FAILED(rv)) break;

            rv = stmt->BindInt32ByIndex(3, aPermission);
            if (NS_FAILED(rv)) break;

            rv = stmt->BindInt32ByIndex(4, aExpireType);
            if (NS_FAILED(rv)) break;

            rv = stmt->BindInt64ByIndex(5, aExpireTime);
            if (NS_FAILED(rv)) break;

            rv = stmt->BindInt64ByIndex(6, aModificationTime);
            break;
          }

          case eOperationRemoving: {
            stmt = data->mStmtDelete;
            rv = stmt->BindInt64ByIndex(0, aID);
            break;
          }

          case eOperationChanging: {
            stmt = data->mStmtUpdate;

            rv = stmt->BindInt64ByIndex(0, aID);
            if (NS_FAILED(rv)) break;

            rv = stmt->BindInt32ByIndex(1, aPermission);
            if (NS_FAILED(rv)) break;

            rv = stmt->BindInt32ByIndex(2, aExpireType);
            if (NS_FAILED(rv)) break;

            rv = stmt->BindInt64ByIndex(3, aExpireTime);
            if (NS_FAILED(rv)) break;

            rv = stmt->BindInt64ByIndex(4, aModificationTime);
            break;
          }

          default: {
            MOZ_ASSERT_UNREACHABLE("need a valid operation in UpdateDB()!");
            rv = NS_ERROR_UNEXPECTED;
            break;
          }
        }

        if (NS_FAILED(rv)) {
          NS_WARNING("db change failed!");
          return;
        }

        rv = stmt->Execute();
        MOZ_ASSERT(NS_SUCCEEDED(rv));
      }));
}

bool PermissionManager::GetPermissionsFromOriginOrKey(
    const nsACString& aOrigin, const nsACString& aKey,
    nsTArray<IPC::Permission>& aPerms) {
  EnsureReadCompleted();

  aPerms.Clear();
  if (NS_WARN_IF(XRE_IsContentProcess())) {
    return false;
  }

  for (const PermissionHashKey& entry : mPermissionTable) {
    nsAutoCString permissionKey;
    if (aOrigin.IsEmpty()) {
      // We can't check for individual OA strip perms here.
      // Don't force strip origin attributes.
      GetKeyForOrigin(entry.GetKey()->mOrigin, false, false, permissionKey);

      // If the keys don't match, and we aren't getting the default "" key, then
      // we can exit early. We have to keep looking if we're getting the default
      // key, as we may see a preload permission which should be transmitted.
      if (aKey != permissionKey && !aKey.IsEmpty()) {
        continue;
      }
    } else if (aOrigin != entry.GetKey()->mOrigin) {
      // If the origins don't match, then we can exit early. We have to keep
      // looking if we're getting the default origin, as we may see a preload
      // permission which should be transmitted.
      continue;
    }

    for (const auto& permEntry : entry.GetPermissions()) {
      // Given how "default" permissions work and the possibility of them
      // being overridden with UNKNOWN_ACTION, we might see this value here -
      // but we do not want to send it to the content process.
      if (permEntry.mPermission == nsIPermissionManager::UNKNOWN_ACTION) {
        continue;
      }

      bool isPreload = IsPreloadPermission(mTypeArray[permEntry.mType]);
      bool shouldAppend;
      if (aOrigin.IsEmpty()) {
        shouldAppend = (isPreload && aKey.IsEmpty()) ||
                       (!isPreload && aKey == permissionKey);
      } else {
        shouldAppend = (!isPreload && aOrigin == entry.GetKey()->mOrigin);
      }
      if (shouldAppend) {
        aPerms.AppendElement(
            IPC::Permission(entry.GetKey()->mOrigin,
                            mTypeArray[permEntry.mType], permEntry.mPermission,
                            permEntry.mExpireType, permEntry.mExpireTime));
      }
    }
  }

  return true;
}

void PermissionManager::SetPermissionsWithKey(
    const nsACString& aPermissionKey, nsTArray<IPC::Permission>& aPerms) {
  if (NS_WARN_IF(XRE_IsParentProcess())) {
    return;
  }

  RefPtr<GenericNonExclusivePromise::Private> promise;
  bool foundKey =
      mPermissionKeyPromiseMap.Get(aPermissionKey, getter_AddRefs(promise));
  if (promise) {
    MOZ_ASSERT(foundKey);
    // NOTE: This will resolve asynchronously, so we can mark it as resolved
    // now, and be confident that we will have filled in the database before any
    // callbacks run.
    promise->Resolve(true, __func__);
  } else if (foundKey) {
    // NOTE: We shouldn't be sent two InitializePermissionsWithKey for the same
    // key, but it's possible.
    return;
  }
  mPermissionKeyPromiseMap.InsertOrUpdate(
      aPermissionKey, RefPtr<GenericNonExclusivePromise::Private>{});

  // Add the permissions locally to our process
  for (IPC::Permission& perm : aPerms) {
    nsCOMPtr<nsIPrincipal> principal;
    nsresult rv =
        GetPrincipalFromOrigin(perm.origin, IsOAForceStripPermission(perm.type),
                               getter_AddRefs(principal));
    if (NS_WARN_IF(NS_FAILED(rv))) {
      continue;
    }

#ifdef DEBUG
    nsAutoCString permissionKey;
    GetKeyForPermission(principal, perm.type, permissionKey);
    MOZ_ASSERT(permissionKey == aPermissionKey,
               "The permission keys which were sent over should match!");
#endif

    // The child process doesn't care about modification times - it neither
    // reads nor writes, nor removes them based on the date - so 0 (which
    // will end up as now()) is fine.
    uint64_t modificationTime = 0;
    AddInternal(principal, perm.type, perm.capability, 0, perm.expireType,
                perm.expireTime, modificationTime, eNotify, eNoDBOperation,
                true /* ignoreSessionPermissions */);
  }
}

/* static */
nsresult PermissionManager::GetKeyForOrigin(const nsACString& aOrigin,
                                            bool aForceStripOA,
                                            bool aSiteScopePermissions,
                                            nsACString& aKey) {
  aKey.Truncate();

  // We only key origins for http, https URIs. All origins begin with
  // the URL which they apply to, which means that they should begin with their
  // scheme in the case where they are one of these interesting URIs. We don't
  // want to actually parse the URL here however, because this can be called on
  // hot paths.
  if (!StringBeginsWith(aOrigin, "http:"_ns) &&
      !StringBeginsWith(aOrigin, "https:"_ns)) {
    return NS_OK;
  }

  // We need to look at the originAttributes if they are present, to make sure
  // to remove any which we don't want. We put the rest of the origin, not
  // including the attributes, into the key.
  OriginAttributes attrs;
  if (!attrs.PopulateFromOrigin(aOrigin, aKey)) {
    aKey.Truncate();
    return NS_OK;
  }

  MaybeStripOriginAttributes(aForceStripOA, attrs);

#ifdef DEBUG
  // Parse the origin string into a principal, and extract some useful
  // information from it for assertions.
  nsCOMPtr<nsIPrincipal> dbgPrincipal;
  MOZ_ALWAYS_SUCCEEDS(GetPrincipalFromOrigin(aOrigin, aForceStripOA,
                                             getter_AddRefs(dbgPrincipal)));
  MOZ_ASSERT(dbgPrincipal->SchemeIs("http") || dbgPrincipal->SchemeIs("https"));
  MOZ_ASSERT(dbgPrincipal->OriginAttributesRef() == attrs);
#endif

  // If it is needed, turn the origin into its site-origin
  if (aSiteScopePermissions) {
    nsCOMPtr<nsIURI> uri;
    nsresult rv = NS_NewURI(getter_AddRefs(uri), aKey);
    if (!NS_WARN_IF(NS_FAILED(rv))) {
      nsCString site;
      rv = nsEffectiveTLDService::GetInstance()->GetSite(uri, site);
      if (!NS_WARN_IF(NS_FAILED(rv))) {
        aKey = site;
      }
    }
  }

  // Append the stripped suffix to the output origin key.
  nsAutoCString suffix;
  attrs.CreateSuffix(suffix);
  aKey.Append(suffix);

  return NS_OK;
}

/* static */
nsresult PermissionManager::GetKeyForPrincipal(nsIPrincipal* aPrincipal,
                                               bool aForceStripOA,
                                               bool aSiteScopePermissions,
                                               nsACString& aKey) {
  nsAutoCString origin;
  nsresult rv = aPrincipal->GetOrigin(origin);
  if (NS_WARN_IF(NS_FAILED(rv))) {
    aKey.Truncate();
    return rv;
  }
  return GetKeyForOrigin(origin, aForceStripOA, aSiteScopePermissions, aKey);
}

/* static */
nsresult PermissionManager::GetKeyForPermission(nsIPrincipal* aPrincipal,
                                                const nsACString& aType,
                                                nsACString& aKey) {
  // Preload permissions have the "" key.
  if (IsPreloadPermission(aType)) {
    aKey.Truncate();
    return NS_OK;
  }

  return GetKeyForPrincipal(aPrincipal, IsOAForceStripPermission(aType),
                            IsSiteScopedPermission(aType), aKey);
}

/* static */
nsTArray<std::pair<nsCString, nsCString>>
PermissionManager::GetAllKeysForPrincipal(nsIPrincipal* aPrincipal) {
  MOZ_ASSERT(aPrincipal);

  nsTArray<std::pair<nsCString, nsCString>> pairs;
  nsCOMPtr<nsIPrincipal> prin = aPrincipal;

  while (prin) {
    // Add the pair to the list
    std::pair<nsCString, nsCString>* pair =
        pairs.AppendElement(std::make_pair(""_ns, ""_ns));
    // We can't check for individual OA strip perms here.
    // Don't force strip origin attributes.
    GetKeyForPrincipal(prin, false, false, pair->first);

    // On origins with a derived key set to an empty string
    // (basically any non-web URI scheme), we want to make sure
    // to return earlier, and leave [("", "")] as the resulting
    // pairs (but still run the same debug assertions near the
    // end of this method).
    if (pair->first.IsEmpty()) {
      break;
    }

    Unused << GetOriginFromPrincipal(prin, false, pair->second);
    prin = prin->GetNextSubDomainPrincipal();
    // Get the next subdomain principal and loop back around.
  }

  MOZ_ASSERT(pairs.Length() >= 1,
             "Every principal should have at least one pair item.");
  return pairs;
}

bool PermissionManager::PermissionAvailable(nsIPrincipal* aPrincipal,
                                            const nsACString& aType) {
  EnsureReadCompleted();

  if (XRE_IsContentProcess()) {
    nsAutoCString permissionKey;
    // NOTE: GetKeyForPermission accepts a null aType.
    GetKeyForPermission(aPrincipal, aType, permissionKey);

    // If we have a pending promise for the permission key in question, we don't
    // have the permission available, so report a warning and return false.
    RefPtr<GenericNonExclusivePromise::Private> promise;
    if (!mPermissionKeyPromiseMap.Get(permissionKey, getter_AddRefs(promise)) ||
        promise) {
      // Emit a useful diagnostic warning with the permissionKey for the process
      // which hasn't received permissions yet.
      NS_WARNING(nsPrintfCString("This content process hasn't received the "
                                 "permissions for %s yet",
                                 permissionKey.get())
                     .get());
      return false;
    }
  }
  return true;
}

void PermissionManager::WhenPermissionsAvailable(nsIPrincipal* aPrincipal,
                                                 nsIRunnable* aRunnable) {
  MOZ_ASSERT(aRunnable);

  if (!XRE_IsContentProcess()) {
    aRunnable->Run();
    return;
  }

  nsTArray<RefPtr<GenericNonExclusivePromise>> promises;
  for (auto& pair : GetAllKeysForPrincipal(aPrincipal)) {
    RefPtr<GenericNonExclusivePromise::Private> promise;
    if (!mPermissionKeyPromiseMap.Get(pair.first, getter_AddRefs(promise))) {
      // In this case we have found a permission which isn't available in the
      // content process and hasn't been requested yet. We need to create a new
      // promise, and send the request to the parent (if we have not already
      // done so).
      promise = new GenericNonExclusivePromise::Private(__func__);
      mPermissionKeyPromiseMap.InsertOrUpdate(pair.first, RefPtr{promise});
    }

    if (promise) {
      promises.AppendElement(std::move(promise));
    }
  }

  // If all of our permissions are available, immediately run the runnable. This
  // avoids any extra overhead during fetch interception which is performance
  // sensitive.
  if (promises.IsEmpty()) {
    aRunnable->Run();
    return;
  }

  auto* thread = AbstractThread::MainThread();

  RefPtr<nsIRunnable> runnable = aRunnable;
  GenericNonExclusivePromise::All(thread, promises)
      ->Then(
          thread, __func__, [runnable]() { runnable->Run(); },
          []() {
            NS_WARNING(
                "PermissionManager permission promise rejected. We're "
                "probably shutting down.");
          });
}

void PermissionManager::EnsureReadCompleted() {
  MOZ_ASSERT(NS_IsMainThread());

  if (mState == eInitializing) {
    MonitorAutoLock lock(mMonitor);

    while (mState == eInitializing) {
      mMonitor.Wait();
    }
  }

  switch (mState) {
    case eInitializing:
      MOZ_CRASH("This state is impossible!");

    case eDBInitialized:
      mState = eReady;

      CompleteMigrations();
      ImportLatestDefaults();
      CompleteRead();

      [[fallthrough]];

    case eReady:
      [[fallthrough]];

    case eClosed:
      return;

    default:
      MOZ_CRASH("Invalid state");
  }
}

already_AddRefed<nsIInputStream> PermissionManager::GetDefaultsInputStream() {
  MOZ_ASSERT(NS_IsMainThread());

  nsAutoCString defaultsURL;
  Preferences::GetCString(kDefaultsUrlPrefName, defaultsURL);
  if (defaultsURL.IsEmpty()) {  // == Don't use built-in permissions.
    return nullptr;
  }

  nsCOMPtr<nsIURI> defaultsURI;
  nsresult rv = NS_NewURI(getter_AddRefs(defaultsURI), defaultsURL);
  NS_ENSURE_SUCCESS(rv, nullptr);

  nsCOMPtr<nsIChannel> channel;
  rv = NS_NewChannel(getter_AddRefs(channel), defaultsURI,
                     nsContentUtils::GetSystemPrincipal(),
                     nsILoadInfo::SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULL,
                     nsIContentPolicy::TYPE_OTHER);
  NS_ENSURE_SUCCESS(rv, nullptr);

  nsCOMPtr<nsIInputStream> inputStream;
  rv = channel->Open(getter_AddRefs(inputStream));
  NS_ENSURE_SUCCESS(rv, nullptr);

  return inputStream.forget();
}

void PermissionManager::ConsumeDefaultsInputStream(
    nsIInputStream* aInputStream, const MonitorAutoLock& aProofOfLock) {
  MOZ_ASSERT(!NS_IsMainThread());

  constexpr char kMatchTypeHost[] = "host";
  constexpr char kMatchTypeOrigin[] = "origin";

  mDefaultEntries.Clear();

  if (!aInputStream) {
    return;
  }

  nsresult rv;

  /* format is:
   * matchtype \t type \t permission \t host
   * Only "host" is supported for matchtype
   * type is a string that identifies the type of permission (e.g. "cookie")
   * permission is an integer between 1 and 15
   */

  // Ideally we'd do this with nsILineInputString, but this is called with an
  // nsIInputStream that comes from a resource:// URI, which doesn't support
  // that interface.  So NS_ReadLine to the rescue...
  nsLineBuffer<char> lineBuffer;
  nsCString line;
  bool isMore = true;
  do {
    rv = NS_ReadLine(aInputStream, &lineBuffer, line, &isMore);
    NS_ENSURE_SUCCESS_VOID(rv);

    if (line.IsEmpty() || line.First() == '#') {
      continue;
    }

    nsTArray<nsCString> lineArray;

    // Split the line at tabs
    ParseString(line, '\t', lineArray);

    if (lineArray.Length() != 4) {
      continue;
    }

    nsresult error = NS_OK;
    uint32_t permission = lineArray[2].ToInteger(&error);
    if (NS_FAILED(error)) {
      continue;
    }

    DefaultEntry::Op op;

    if (lineArray[0].EqualsLiteral(kMatchTypeHost)) {
      op = DefaultEntry::eImportMatchTypeHost;
    } else if (lineArray[0].EqualsLiteral(kMatchTypeOrigin)) {
      op = DefaultEntry::eImportMatchTypeOrigin;
    } else {
      continue;
    }

    DefaultEntry* entry = mDefaultEntries.AppendElement();
    MOZ_ASSERT(entry);

    entry->mOp = op;
    entry->mPermission = permission;
    entry->mHostOrOrigin = lineArray[3];
    entry->mType = lineArray[1];
  } while (isMore);
}

// ImportLatestDefaults will import the latest default cookies read during the
// last DB initialization.
nsresult PermissionManager::ImportLatestDefaults() {
  MOZ_ASSERT(NS_IsMainThread());
  MOZ_ASSERT(mState == eReady);

  nsresult rv;

  MonitorAutoLock lock(mMonitor);

  for (const DefaultEntry& entry : mDefaultEntries) {
    if (entry.mOp == DefaultEntry::eImportMatchTypeHost) {
      // the import file format doesn't handle modification times, so we use
      // 0, which AddInternal will convert to now()
      int64_t modificationTime = 0;

      rv = UpgradeHostToOriginAndInsert(
          entry.mHostOrOrigin, entry.mType, entry.mPermission,
          nsIPermissionManager::EXPIRE_NEVER, 0, modificationTime,
          [&](const nsACString& aOrigin, const nsCString& aType,
              uint32_t aPermission, uint32_t aExpireType, int64_t aExpireTime,
              int64_t aModificationTime) {
            nsCOMPtr<nsIPrincipal> principal;
            nsresult rv =
                GetPrincipalFromOrigin(aOrigin, IsOAForceStripPermission(aType),
                                       getter_AddRefs(principal));
            NS_ENSURE_SUCCESS(rv, rv);
            rv =
                AddInternal(principal, aType, aPermission,
                            cIDPermissionIsDefault, aExpireType, aExpireTime,
                            aModificationTime, PermissionManager::eDontNotify,
                            PermissionManager::eNoDBOperation, false, &aOrigin);
            NS_ENSURE_SUCCESS(rv, rv);

            if (StaticPrefs::permissions_isolateBy_privateBrowsing()) {
              // Also import the permission for private browsing.
              OriginAttributes attrs =
                  OriginAttributes(principal->OriginAttributesRef());
              attrs.mPrivateBrowsingId = 1;
              nsCOMPtr<nsIPrincipal> pbPrincipal =
                  BasePrincipal::Cast(principal)->CloneForcingOriginAttributes(
                      attrs);

              rv = AddInternal(
                  pbPrincipal, aType, aPermission, cIDPermissionIsDefault,
                  aExpireType, aExpireTime, aModificationTime,
                  PermissionManager::eDontNotify,
                  PermissionManager::eNoDBOperation, false, &aOrigin);
              NS_ENSURE_SUCCESS(rv, rv);
            }

            return NS_OK;
          });

      if (NS_FAILED(rv)) {
        NS_WARNING("There was a problem importing a host permission");
      }
      continue;
    }

    MOZ_ASSERT(entry.mOp == DefaultEntry::eImportMatchTypeOrigin);

    nsCOMPtr<nsIPrincipal> principal;
    rv = GetPrincipalFromOrigin(entry.mHostOrOrigin,
                                IsOAForceStripPermission(entry.mType),
                                getter_AddRefs(principal));
    if (NS_FAILED(rv)) {
      NS_WARNING("Couldn't import an origin permission - malformed origin");
      continue;
    }

    // the import file format doesn't handle modification times, so we use
    // 0, which AddInternal will convert to now()
    int64_t modificationTime = 0;

    rv = AddInternal(principal, entry.mType, entry.mPermission,
                     cIDPermissionIsDefault, nsIPermissionManager::EXPIRE_NEVER,
                     0, modificationTime, eDontNotify, eNoDBOperation);
    if (NS_FAILED(rv)) {
      NS_WARNING("There was a problem importing an origin permission");
    }

    if (StaticPrefs::permissions_isolateBy_privateBrowsing()) {
      // Also import the permission for private browsing.
      OriginAttributes attrs =
          OriginAttributes(principal->OriginAttributesRef());
      attrs.mPrivateBrowsingId = 1;
      nsCOMPtr<nsIPrincipal> pbPrincipal =
          BasePrincipal::Cast(principal)->CloneForcingOriginAttributes(attrs);
      // May return nullptr if clone fails.
      NS_ENSURE_TRUE(pbPrincipal, NS_ERROR_FAILURE);

      rv = AddInternal(pbPrincipal, entry.mType, entry.mPermission,
                       cIDPermissionIsDefault,
                       nsIPermissionManager::EXPIRE_NEVER, 0, modificationTime,
                       eDontNotify, eNoDBOperation);
      if (NS_FAILED(rv)) {
        NS_WARNING(
            "There was a problem importing an origin permission for private "
            "browsing");
      }
    }
  }

  return NS_OK;
}

/**
 * Perform the early steps of a permission check and determine whether we need
 * to call CommonTestPermissionInternal() for the actual permission check.
 *
 * @param aPrincipal optional principal argument to check the permission for,
 *                   can be nullptr if we aren't performing a principal-based
 *                   check.
 * @param aTypeIndex if the caller isn't sure what the index of the permission
 *                   type to check for is in the mTypeArray member variable,
 *                   it should pass -1, otherwise this would be the index of
 *                   the type inside mTypeArray.  This would only be something
 *                   other than -1 in recursive invocations of this function.
 * @param aType      the permission type to test.
 * @param aPermission out argument which will be a permission type that we
 *                    will return from this function once the function is
 *                    done.
 * @param aDefaultPermission the default permission to be used if we can't
 *                           determine the result of the permission check.
 * @param aDefaultPermissionIsValid whether the previous argument contains a
 *                                  valid value.
 * @param aExactHostMatch whether to look for the exact host name or also for
 *                        subdomains that can have the same permission.
 * @param aIncludingSession whether to include session permissions when
 *                          testing for the permission.
 */
PermissionManager::TestPreparationResult
PermissionManager::CommonPrepareToTestPermission(
    nsIPrincipal* aPrincipal, int32_t aTypeIndex, const nsACString& aType,
    uint32_t* aPermission, uint32_t aDefaultPermission,
    bool aDefaultPermissionIsValid, bool aExactHostMatch,
    bool aIncludingSession) {
  auto* basePrin = BasePrincipal::Cast(aPrincipal);
  if (basePrin && basePrin->IsSystemPrincipal()) {
    *aPermission = ALLOW_ACTION;
    return AsVariant(NS_OK);
  }

  EnsureReadCompleted();

  // For some permissions, query the default from a pref. We want to avoid
  // doing this for all permissions so that permissions can opt into having
  // the pref lookup overhead on each call.
  int32_t defaultPermission =
      aDefaultPermissionIsValid ? aDefaultPermission : UNKNOWN_ACTION;
  if (!aDefaultPermissionIsValid && HasDefaultPref(aType)) {
    Unused << mDefaultPrefBranch->GetIntPref(PromiseFlatCString(aType).get(),
                                             &defaultPermission);
  }

  // Set the default.
  *aPermission = defaultPermission;

  int32_t typeIndex =
      aTypeIndex == -1 ? GetTypeIndex(aType, false) : aTypeIndex;

  // For expanded principals, we want to iterate over the allowlist and see
  // if the permission is granted for any of them.
  if (basePrin && basePrin->Is<ExpandedPrincipal>()) {
    auto ep = basePrin->As<ExpandedPrincipal>();
    for (auto& prin : ep->AllowList()) {
      uint32_t perm;
      nsresult rv =
          CommonTestPermission(prin, typeIndex, aType, &perm, defaultPermission,
                               true, aExactHostMatch, aIncludingSession);
      if (NS_WARN_IF(NS_FAILED(rv))) {
        return AsVariant(rv);
      }

      if (perm == nsIPermissionManager::ALLOW_ACTION) {
        *aPermission = perm;
        return AsVariant(NS_OK);
      }
      if (perm == nsIPermissionManager::PROMPT_ACTION) {
        // Store it, but keep going to see if we can do better.
        *aPermission = perm;
      }
    }

    return AsVariant(NS_OK);
  }

  // If type == -1, the type isn't known, just signal that we are done.
  if (typeIndex == -1) {
    return AsVariant(NS_OK);
  }

  return AsVariant(typeIndex);
}

// If aTypeIndex is passed -1, we try to inder the type index from aType.
nsresult PermissionManager::CommonTestPermission(
    nsIPrincipal* aPrincipal, int32_t aTypeIndex, const nsACString& aType,
    uint32_t* aPermission, uint32_t aDefaultPermission,
    bool aDefaultPermissionIsValid, bool aExactHostMatch,
    bool aIncludingSession) {
  auto preparationResult = CommonPrepareToTestPermission(
      aPrincipal, aTypeIndex, aType, aPermission, aDefaultPermission,
      aDefaultPermissionIsValid, aExactHostMatch, aIncludingSession);
  if (preparationResult.is<nsresult>()) {
    return preparationResult.as<nsresult>();
  }

  return CommonTestPermissionInternal(
      aPrincipal, nullptr, nullptr, preparationResult.as<int32_t>(), aType,
      aPermission, aExactHostMatch, aIncludingSession);
}

// If aTypeIndex is passed -1, we try to inder the type index from aType.
nsresult PermissionManager::CommonTestPermission(
    nsIURI* aURI, int32_t aTypeIndex, const nsACString& aType,
    uint32_t* aPermission, uint32_t aDefaultPermission,
    bool aDefaultPermissionIsValid, bool aExactHostMatch,
    bool aIncludingSession) {
  auto preparationResult = CommonPrepareToTestPermission(
      nullptr, aTypeIndex, aType, aPermission, aDefaultPermission,
      aDefaultPermissionIsValid, aExactHostMatch, aIncludingSession);
  if (preparationResult.is<nsresult>()) {
    return preparationResult.as<nsresult>();
  }

  return CommonTestPermissionInternal(
      nullptr, aURI, nullptr, preparationResult.as<int32_t>(), aType,
      aPermission, aExactHostMatch, aIncludingSession);
}

nsresult PermissionManager::CommonTestPermission(
    nsIURI* aURI, const OriginAttributes* aOriginAttributes, int32_t aTypeIndex,
    const nsACString& aType, uint32_t* aPermission, uint32_t aDefaultPermission,
    bool aDefaultPermissionIsValid, bool aExactHostMatch,
    bool aIncludingSession) {
  auto preparationResult = CommonPrepareToTestPermission(
      nullptr, aTypeIndex, aType, aPermission, aDefaultPermission,
      aDefaultPermissionIsValid, aExactHostMatch, aIncludingSession);
  if (preparationResult.is<nsresult>()) {
    return preparationResult.as<nsresult>();
  }

  return CommonTestPermissionInternal(
      nullptr, aURI, aOriginAttributes, preparationResult.as<int32_t>(), aType,
      aPermission, aExactHostMatch, aIncludingSession);
}

nsresult PermissionManager::TestPermissionWithoutDefaultsFromPrincipal(
    nsIPrincipal* aPrincipal, const nsACString& aType, uint32_t* aPermission) {
  MOZ_ASSERT(!HasDefaultPref(aType));

  return CommonTestPermission(aPrincipal, -1, aType, aPermission,
                              nsIPermissionManager::UNKNOWN_ACTION, true, false,
                              true);
}

void PermissionManager::MaybeCompleteShutdown() {
  MOZ_ASSERT(NS_IsMainThread());

  nsCOMPtr<nsIAsyncShutdownClient> asc = GetAsyncShutdownBarrier();
  MOZ_ASSERT(asc);

  DebugOnly<nsresult> rv = asc->RemoveBlocker(this);
  MOZ_ASSERT(NS_SUCCEEDED(rv));
}

// Async shutdown blocker methods

NS_IMETHODIMP PermissionManager::GetName(nsAString& aName) {
  aName = u"PermissionManager: Flushing data"_ns;
  return NS_OK;
}

NS_IMETHODIMP PermissionManager::BlockShutdown(
    nsIAsyncShutdownClient* aClient) {
  RemoveIdleDailyMaintenanceJob();
  RemoveAllFromMemory();
  CloseDB(eShutdown);

  gPermissionManager = nullptr;
  return NS_OK;
}

NS_IMETHODIMP
PermissionManager::GetState(nsIPropertyBag** aBagOut) {
  nsCOMPtr<nsIWritablePropertyBag2> propertyBag =
      do_CreateInstance("@mozilla.org/hash-property-bag;1");

  nsresult rv = propertyBag->SetPropertyAsInt32(u"state"_ns, mState);
  if (NS_WARN_IF(NS_FAILED(rv))) {
    return rv;
  }

  propertyBag.forget(aBagOut);

  return NS_OK;
}

nsCOMPtr<nsIAsyncShutdownClient> PermissionManager::GetAsyncShutdownBarrier()
    const {
  nsresult rv;
  nsCOMPtr<nsIAsyncShutdownService> svc =
      do_GetService("@mozilla.org/async-shutdown-service;1", &rv);
  if (NS_FAILED(rv)) {
    return nullptr;
  }

  nsCOMPtr<nsIAsyncShutdownClient> client;
  // This feels very late but there seem to be other services that rely on
  // us later than "profile-before-change".
  rv = svc->GetXpcomWillShutdown(getter_AddRefs(client));
  MOZ_DIAGNOSTIC_ASSERT(NS_SUCCEEDED(rv));

  return client;
}

void PermissionManager::MaybeStripOriginAttributes(
    bool aForceStrip, OriginAttributes& aOriginAttributes) {
  uint32_t flags = 0;

  if (aForceStrip || !StaticPrefs::permissions_isolateBy_privateBrowsing()) {
    flags |= OriginAttributes::STRIP_PRIVATE_BROWSING_ID;
  }

  if (aForceStrip || !StaticPrefs::permissions_isolateBy_userContext()) {
    flags |= OriginAttributes::STRIP_USER_CONTEXT_ID;
  }

  if (flags != 0) {
    aOriginAttributes.StripAttributes(flags);
  }
}

}  // namespace mozilla