코드로 쓴 신뢰 구역

// Trust zones (architecture invariants 5 and 6). A zone is verified, never
// claimed: the verifier is handed in by whoever can check (the launch
// catalog for a home origin, the local tailscaled for a tailnet peer). Until
// one is handed in, every origin is the outside world.

import CwkKitCore
import Foundation

public enum TrustZone: String, Sendable, Codable {
    /// This Mac, and the exact origins the catalog lists for a fleet Mac.
    case home
    /// A host the local tailscaled names as a peer.
    case tailnet
    /// Everything else, and anything that cannot be verified.
    case outsideWorld
}

public struct TrustPolicy: Sendable {
    private let zoneOf: @Sendable (PageOrigin) -> TrustZone

    /// With no verifier, every origin is the outside world.
    public init(zoneOf: @escaping @Sendable (PageOrigin) -> TrustZone = { _ in .outsideWorld }) {
        self.zoneOf = zoneOf
    }

    public func zone(of origin: PageOrigin) -> TrustZone {
        zoneOf(origin)
    }

    /// Family zones use the microphone and camera without a prompt; the
    /// outside world is asked, as Safari asks. Nothing is ever granted to the
    /// outside world here, and nothing is refused on Dad's behalf.
    ///
    /// Both the frame that asks and the page it sits in must be family. An
    /// outside page cannot borrow a family frame's grant, and a family page
    /// cannot lend its own to a frame from outside.
    public func decision(for request: PermissionRequest) -> PermissionDecision {
        let zones = [zone(of: request.origin), zone(of: request.topOrigin)]
        return zones.contains(.outsideWorld) ? .ask : .grant
    }
}

extension TrustPolicy {
    /// The family's own origins, as Voyager verifies them today: this Mac
    /// (loopback, a secure context to WebKit) and the exact origins the family
    /// names, Firelink's catalog and the hub and Pippa that Settings reach. A
    /// tailnet host the catalog does not list stays the outside world: the
    /// local tailscaled is not asked yet. Before 2026-10-22 no verifier was
    /// installed at all, so every family app was asked like a stranger.
    public static func family(origins: Set<PageOrigin>) -> TrustPolicy {
        let listed = Set(origins.map(\.withoutDefaultPort))
        return TrustPolicy { origin in
            if ConnectionHint.isLoopback(origin.host) { return .home }
            return listed.contains(origin.withoutDefaultPort) ? .home : .outsideWorld
        }
    }
}

extension PageOrigin {
    /// The same origin with a port its scheme implies written as none: WebKit
    /// names https on 443 with no port, a catalog may write it out.
    public var withoutDefaultPort: PageOrigin {
        let implied = (scheme == "https" && port == 443) || (scheme == "http" && port == 80)
        return implied ? PageOrigin(scheme: scheme, host: host) : self
    }
}

    /// The microphone and camera without a prompt for the family's own
    /// origins (invariant 6): the catalog's web targets, the hub, Pippa. The
    /// shell calls it whenever the settings or the catalog move.
    public func applyFamilyTrust() {
        let settings = settings.value
        var origins = Set([settings.familyHub, settings.pippaBase].compactMap(PageOrigin.init(url:)))
        for item in familyCatalog.projection?.items ?? [] {
            if case .web(let url) = item.destination, let origin = PageOrigin(url: url) { origins.insert(origin) }
        }
        trust = .family(origins: origins)
    }