<!DOCTYPE html>
<html>
<script src=/resources/testharness.js></script>
<script src=/resources/testharnessreport.js></script>
<script src=/fetch/metadata/resources/helper.js></script>
<script src=/fetch/metadata/resources/redirectTestHelper.sub.js></script>
<script src=/common/security-features/resources/common.sub.js></script>
<script src=/common/utils.js></script>
<style>
  @font-face {
    font-family: myDowngradeUpgradeFont;
    src: url(https://{{host}}:{{ports[https][0]}}/fetch/api/resources/redirect.py?location=http%3A%2F%2F{{host}}%3A{{ports[http][0]}}%2Ffetch%2Fapi%2Fresources%2Fredirect.py%3Flocation%3Dhttps%253A%252F%252F{{host}}%253A{{ports[https][0]}}%252Ffetch%252Fmetadata%252Fresources%252Frecord-header.py%253Ffile%253Dfont-https-downgrade-upgrade{{$id:uuid()}});
  }
  #fontTest {
    font-family: myDowngradeUpgradeFont;
  }
</style>
<body>
<div id="fontTest">Downgraded then upgraded font</div>
<script>
  let nonce = "{{$id}}";
  let expected = {"site": "cross-site", "user": "", "mode": "cors", "dest": "font"};

  // Validate various scenarios handle a request that redirects from https => http => https
  // correctly and avoids disclosure of any Sec- headers.
  RunCommonRedirectTests("Https downgrade-upgrade", MultipleRedirectTo, expected);

  document.fonts.ready.then(function () {
    promise_test(t => {
      return new Promise((resolve, reject) => {
        let key = "font-https-downgrade-upgrade{{$id}}";
        return validate_expectations(key, expected, "Https downgrade-upgrade font => No headers")
            .then(_ => resolve())
            .catch(e => reject(e));
      });
    }, "Https downgrade-upgrade font => No headers");
  });

  promise_test(() => {
    return requestViaImage(secureRedirectURL + encodeURIComponent(
        insecureRedirectURL + encodeURIComponent(
        "https://{{host}}:{{ports[https][0]}}/common/security-features/subresource/image.py")))
        .then(result => {
          headers = result.headers;
          got = {
            "mode": headers["sec-fetch-mode"],
            "site": headers["sec-fetch-site"],
            "user": headers["sec-fetch-user"],
            "dest": headers["sec-fetch-dest"]
          };
          assert_header_equals(got, {
            // Note that we're using `undefined` here, as opposed to "" elsewhere because of the way
            // that `image.py` encodes data.
            "site": "cross-site",
            "user": undefined,
            "mode": "cors",
            "dest": "image"
          }, "Https downgrade-upgrade image => No headers");
        });
  }, "Https downgrade-upgrade image => No headers");
</script>
<script
    src="https://{{host}}:{{ports[https][0]}}/fetch/api/resources/redirect.py?location=http%3A%2F%2F{{host}}%3A{{ports[http][0]}}%2Ffetch%2Fapi%2Fresources%2Fredirect.py%3Flocation%3Dhttps%253A%252F%252F{{host}}%253A{{ports[https][0]}}%252Ffetch%252Fmetadata%252Fresources%252Fecho-as-script.py"></script>
<script>
  test(t => {
    t.add_cleanup(_ => {
      header = null;
    });
    assert_header_equals(header, {"site": "cross-site", "user": "", "mode": "no-cors", "dest": "script"},
        "Https downgrade-upgrade script => No headers");
  }, "Https downgrade-upgrade script => No headers");
</script>
</body>