<!DOCTYPE html><!-- webkit-test-runner [ WebAuthenticationModernEnabled=true ] -->
<html>
<head>
    <meta charset="utf-8">
    <title>Web Authentication API: Tests that a frame that doesn't share the same origin with all its ancestors could not access the API.</title>
    <script src="/resources/testharness.js"></script>
    <script src="/resources/testharnessreport.js"></script>
    <script src="/common/utils.js"></script>
    <script src="/common/get-host-info.sub.js"></script>
    <script src="./resources/util.js"></script>
</head>
<body>
    <script>
        promise_test(t => {
            return withCrossOriginIframe("last-layer-frame.https.html?shouldFocus=true&exceptionMessage=The origin of the document is not the same as its ancestors.").then((message) => {
                assert_equals(message.data, "PASS.");
            });
        }, "Tests that a frame that doesn't share the same origin with all its ancestors could not access the API.");

        promise_test(t => {
            return withCrossOriginIframe("second-layer-frame.https.html").then((message) => {
                assert_equals(message.data, "PASS.");
            });
        }, "Tests that a frame that doesn't share the same origin with all its ancestors could not access the API. 2");

        promise_test(t => {
            return withSameSiteIframe("samesite-iframe.html").then((message) => {
                assert_equals(message.data, "Throw NotAllowedError: The origin of the document is not the same as its ancestors.");
            });
        }, "Tests that a frame that is same-site, cross-origin without publickey-credentials-get feature policy cannot use get().");

        promise_test(t => {
            return withSameSiteIframe("samesite-iframe.html", "publickey-credentials-get").then((message) => {
                assert_equals(message.data, "PASS!");
            });
        }, "Tests that a frame that is same-site, cross-origin with publickey-credentials-get feature policy can use get().");

        promise_test(t => {
            return withCrossOriginIframe("samesite-iframe.html", "publickey-credentials-get").then((message) => {
                assert_equals(message.data, "Throw NotAllowedError: The origin of the document is not the same as its ancestors.");
            });
        }, "Tests that a frame that is cross-origin, NOT same-site  with publickey-credentials-get feature policy cannot use get().");
    </script>
</body>
</html>