Restructure chooser object for site_settings

This change implements two new helper methods for site settings that
organize the chooser exceptions in a way that allows their corresponding
site exceptions to be grouped under the same exception. The structure of
the objects returned by GetChooserExceptionListFromProfile(), described
in jsdoc notation, is the following:

{
  chooserType: string,
  displayName: string,
  object: Object,
  sites: Array<!SiteException>
}

The objects in the sites array follow the same structure as the
non-chooser exceptions.

Design doc:
https://docs.google.com/document/d/1MPvsrWiVD_jAC8ELyk8njFpy6j1thfVU5aWT3TCWE8w

Bug: 854329
Change-Id: I92a654da2ef9d1d0f045df0a35eaf70a1940b44e
Reviewed-on: https://chromium-review.googlesource.com/c/1357605
Commit-Queue: Ovidio Henriquez <odejesush@chromium.org>
Reviewed-by: Dan Beam <dbeam@chromium.org>
Cr-Commit-Position: refs/heads/master@{#613280}

chrome/browser/ui/webui/site_settings_helper.cc

@@ -6,6 +6,8 @@
 
 #include <algorithm>
 #include <functional>
+#include <set>
+#include <string>
 
 #include "base/feature_list.h"
 #include "base/values.h"
@@ -31,7 +33,6 @@ namespace site_settings {
 
 constexpr char kAppName[] = "appName";
 constexpr char kAppId[] = "appId";
-constexpr char kObject[] = "object";
 constexpr char kObjectName[] = "objectName";
 
 namespace {
@@ -669,4 +670,104 @@ void GetChooserExceptionsFromProfile(Profile* profile,
   }
 }
 
+// Create a DictionaryValue* that will act as a data source for a single row
+// in a chooser permission exceptions table. The chooser permission will contain
+// a list of site exceptions that correspond to the exception.
+std::unique_ptr<base::DictionaryValue> CreateChooserExceptionObject(
+    const std::string& display_name,
+    const base::Value& object,
+    const std::string& chooser_type,
+    const ChooserExceptionDetails& chooser_exception_details,
+    bool incognito) {
+  auto exception = std::make_unique<base::DictionaryValue>();
+
+  std::string setting_string =
+      content_settings::ContentSettingToString(CONTENT_SETTING_DEFAULT);
+  DCHECK(!setting_string.empty());
+
+  exception->SetString(kDisplayName, display_name);
+  exception->SetKey(kObject, object.Clone());
+  exception->SetString(kChooserType, chooser_type);
+
+  // Order the sites by the provider precedence order.
+  std::vector<std::unique_ptr<base::Value>>
+      all_provider_sites[HostContentSettingsMap::NUM_PROVIDER_TYPES];
+  for (const auto& details : chooser_exception_details) {
+    const GURL& requesting_origin = details.first.first;
+    const std::string& source = details.first.second;
+
+    auto& this_provider_sites =
+        all_provider_sites[HostContentSettingsMap::GetProviderTypeFromSource(
+            source)];
+
+    for (const GURL& embedding_origin : details.second) {
+      auto site = std::make_unique<base::DictionaryValue>();
+
+      site->SetString(kOrigin, requesting_origin.spec());
+      site->SetString(kDisplayName, requesting_origin.spec());
+      site->SetString(kEmbeddingOrigin, embedding_origin.is_empty()
+                                            ? std::string()
+                                            : embedding_origin.spec());
+      site->SetString(kSetting, setting_string);
+      site->SetString(kSource, source);
+      site->SetBoolean(kIncognito, incognito);
+      this_provider_sites.push_back(std::move(site));
+    }
+  }
+
+  auto sites = std::make_unique<base::ListValue>();
+  for (auto& one_provider_sites : all_provider_sites) {
+    for (auto& site : one_provider_sites) {
+      sites->Append(std::move(site));
+    }
+  }
+
+  exception->SetList(kSites, std::move(sites));
+  return exception;
+}
+
+std::unique_ptr<base::ListValue> GetChooserExceptionListFromProfile(
+    Profile* profile,
+    bool incognito,
+    const ChooserTypeNameEntry& chooser_type) {
+  auto exceptions = std::make_unique<base::ListValue>();
+
+  if (incognito) {
+    if (!profile->HasOffTheRecordProfile())
+      return exceptions;
+    profile = profile->GetOffTheRecordProfile();
+  }
+
+  ChooserContextBase* chooser_context = chooser_type.get_context(profile);
+  std::vector<std::unique_ptr<ChooserContextBase::Object>> objects =
+      chooser_context->GetAllGrantedObjects();
+  AllChooserObjects all_chooser_objects;
+
+  for (const auto& object : objects) {
+    if (object->incognito == incognito) {
+      std::string name = chooser_context->GetObjectName(object->object);
+      auto& chooser_exception_details =
+          all_chooser_objects[std::make_pair(name, object->object.Clone())];
+
+      const auto requesting_origin_source_pair =
+          std::make_pair(object->requesting_origin, object->source);
+      auto& embedding_origin_set =
+          chooser_exception_details[requesting_origin_source_pair];
+
+      embedding_origin_set.insert(object->embedding_origin);
+    }
+  }
+
+  for (const auto& all_chooser_objects_entry : all_chooser_objects) {
+    const std::string& name = all_chooser_objects_entry.first.first;
+    const base::Value& object = all_chooser_objects_entry.first.second;
+    const ChooserExceptionDetails& chooser_exception_details =
+        all_chooser_objects_entry.second;
+    exceptions->Append(CreateChooserExceptionObject(
+        name, object, chooser_type.name, chooser_exception_details, incognito));
+  }
+
+  return exceptions;
+}
+
 }  // namespace site_settings

chrome/browser/ui/webui/site_settings_helper.h

@@ -7,6 +7,7 @@
 
 #include <map>
 #include <memory>
+#include <set>
 #include <string>
 #include <utility>
 #include <vector>
@@ -40,12 +41,29 @@ typedef std::map<std::pair<ContentSettingsPattern, std::string>,
                  OnePatternSettings>
     AllPatternsSettings;
 
+// TODO(https://crbug.com/854329): Once the Site Settings WebUI is capable of
+// displaying the new chooser exception object format, remove the typedefs that
+// are currently used for organizing the chooser exceptions.
+// Maps from a primary URL pattern/source pair to a set of secondary URL
+// patterns.
+using ChooserExceptionDetails =
+    std::map<std::pair<GURL, std::string>, std::set<GURL>>;
+
+// Maps from a chooser exception name/object pair to a ChooserExceptionDetails.
+// This will group and sort the exceptions by the UI string and object for
+// display.
+using AllChooserObjects =
+    std::map<std::pair<std::string, base::Value>, ChooserExceptionDetails>;
+
+constexpr char kChooserType[] = "chooserType";
 constexpr char kDisplayName[] = "displayName";
 constexpr char kEmbeddingOrigin[] = "embeddingOrigin";
 constexpr char kIncognito[] = "incognito";
+constexpr char kObject[] = "object";
 constexpr char kOrigin[] = "origin";
 constexpr char kOriginForFavicon[] = "originForFavicon";
 constexpr char kSetting[] = "setting";
+constexpr char kSites[] = "sites";
 constexpr char kSource[] = "source";
 
 // Group types.
@@ -150,6 +168,31 @@ void GetChooserExceptionsFromProfile(Profile* profile,
                                      const ChooserTypeNameEntry& chooser_type,
                                      base::ListValue* exceptions);
 
+// TODO(https://crbug.com/854329): Once the Site Settings WebUI is capable of
+// displaying the new chooser exception object format, replace the existing
+// chooser exception methods with these methods.
+
+// Creates a chooser exception object for the object with |display_name|. The
+// object contains the following properties
+// * displayName: string,
+// * object: Object,
+// * chooserType: string,
+// * sites: Array<SiteException>
+// The structure of the SiteException objects is the same as the objects
+// returned by GetExceptionForPage().
+std::unique_ptr<base::DictionaryValue> CreateChooserExceptionObject(
+    const std::string& display_name,
+    const base::Value& object,
+    const std::string& chooser_type,
+    const ChooserExceptionDetails& chooser_exception_details,
+    bool incognito);
+
+// Returns an array of chooser exception objects.
+std::unique_ptr<base::ListValue> GetChooserExceptionListFromProfile(
+    Profile* profile,
+    bool incognito,
+    const ChooserTypeNameEntry& chooser_type);
+
 }  // namespace site_settings
 
 #endif  // CHROME_BROWSER_UI_WEBUI_SITE_SETTINGS_HELPER_H_

chrome/browser/ui/webui/site_settings_helper_unittest.cc

@@ -4,15 +4,23 @@
 
 #include "chrome/browser/ui/webui/site_settings_helper.h"
 
+#include "base/guid.h"
+#include "base/json/json_reader.h"
 #include "chrome/browser/content_settings/host_content_settings_map_factory.h"
+#include "chrome/browser/permissions/chooser_context_base.h"
+#include "chrome/browser/usb/usb_chooser_context.h"
+#include "chrome/browser/usb/usb_chooser_context_factory.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/test/base/testing_profile.h"
+#include "components/content_settings/core/browser/content_settings_utils.h"
 #include "components/content_settings/core/browser/host_content_settings_map.h"
 #include "components/content_settings/core/common/content_settings_utils.h"
+#include "components/content_settings/core/common/pref_names.h"
 #include "components/content_settings/core/test/content_settings_mock_provider.h"
 #include "components/content_settings/core/test/content_settings_test_utils.h"
 #include "components/prefs/pref_service.h"
 #include "content/public/test/test_browser_thread_bundle.h"
+#include "device/usb/public/cpp/fake_usb_device_manager.h"
 #include "extensions/browser/extension_registry.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/gurl.h"
@@ -223,4 +231,385 @@ TEST_F(SiteSettingsHelperTest, ContentSettingSource) {
   EXPECT_EQ(CONTENT_SETTING_BLOCK, content_setting);
 }
 
+namespace {
+
+// Test GURLs
+const GURL kGoogleOrigin("https://google.com");
+const GURL kChromiumOrigin("https://chromium.org");
+const GURL kAndroidOrigin("https://android.com");
+
+void ExpectValidChooserExceptionObject(
+    const base::Value& actual_exception_object,
+    const std::string& chooser_type,
+    const std::string& display_name,
+    const base::Value& chooser_object) {
+  const base::Value* chooser_type_value = actual_exception_object.FindKeyOfType(
+      kChooserType, base::Value::Type::STRING);
+  ASSERT_TRUE(chooser_type_value);
+  EXPECT_EQ(chooser_type_value->GetString(), chooser_type);
+
+  const base::Value* display_name_value = actual_exception_object.FindKeyOfType(
+      kDisplayName, base::Value::Type::STRING);
+  ASSERT_TRUE(display_name_value);
+  EXPECT_EQ(display_name_value->GetString(), display_name);
+
+  const base::Value* object_value = actual_exception_object.FindKeyOfType(
+      kObject, base::Value::Type::DICTIONARY);
+  ASSERT_TRUE(object_value);
+  EXPECT_EQ(*object_value, chooser_object);
+
+  const base::Value* sites_value =
+      actual_exception_object.FindKeyOfType(kSites, base::Value::Type::LIST);
+  ASSERT_TRUE(sites_value);
+}
+
+void ExpectValidSiteExceptionObject(const base::Value& actual_site_object,
+                                    const GURL& origin,
+                                    const GURL& embedding_origin,
+                                    const std::string source,
+                                    bool incognito) {
+  ASSERT_TRUE(actual_site_object.is_dict());
+
+  const base::Value* display_name_value =
+      actual_site_object.FindKeyOfType(kDisplayName, base::Value::Type::STRING);
+  ASSERT_TRUE(display_name_value);
+  EXPECT_EQ(display_name_value->GetString(), origin.GetOrigin().spec());
+
+  const base::Value* origin_value =
+      actual_site_object.FindKeyOfType(kOrigin, base::Value::Type::STRING);
+  ASSERT_TRUE(origin_value);
+  EXPECT_EQ(origin_value->GetString(), origin.GetOrigin().spec());
+
+  const base::Value* embedding_origin_value = actual_site_object.FindKeyOfType(
+      kEmbeddingOrigin, base::Value::Type::STRING);
+  ASSERT_TRUE(embedding_origin_value);
+  EXPECT_EQ(embedding_origin_value->GetString(),
+            embedding_origin.GetOrigin().spec());
+
+  const base::Value* setting_value =
+      actual_site_object.FindKeyOfType(kSetting, base::Value::Type::STRING);
+  ASSERT_TRUE(setting_value);
+  EXPECT_EQ(setting_value->GetString(),
+            content_settings::ContentSettingToString(CONTENT_SETTING_DEFAULT));
+
+  const base::Value* source_value =
+      actual_site_object.FindKeyOfType(kSource, base::Value::Type::STRING);
+  ASSERT_TRUE(source_value);
+  EXPECT_EQ(source_value->GetString(), source);
+
+  const base::Value* incognito_value =
+      actual_site_object.FindKeyOfType(kIncognito, base::Value::Type::BOOLEAN);
+  ASSERT_TRUE(incognito_value);
+  EXPECT_EQ(incognito_value->GetBool(), incognito);
+}
+
+void ExpectValidSiteExceptionObject(const base::Value& actual_site_object,
+                                    const GURL& origin,
+                                    const std::string source,
+                                    bool incognito) {
+  ExpectValidSiteExceptionObject(actual_site_object, origin, GURL::EmptyGURL(),
+                                 source, incognito);
+}
+
+}  // namespace
+
+TEST_F(SiteSettingsHelperTest, CreateChooserExceptionObject) {
+  const std::string& kPolicySource =
+      SiteSettingSourceToString(SiteSettingSource::kPolicy);
+  const std::string& kPreferenceSource =
+      SiteSettingSourceToString(SiteSettingSource::kPreference);
+  const char kObjectName[] = "Gadget";
+  ChooserExceptionDetails exception_details;
+
+  // Create a chooser object for testing.
+  auto chooser_object = std::make_unique<base::DictionaryValue>();
+  chooser_object->SetKey("name", base::Value(kObjectName));
+
+  // Add a user permission for a requesting origin of |kGoogleOrigin| and an
+  // embedding origin of |kChromiumOrigin|.
+  exception_details[std::make_pair(kGoogleOrigin.GetOrigin(),
+                                   kPreferenceSource)]
+      .insert(kChromiumOrigin.GetOrigin());
+
+  {
+    auto exception = CreateChooserExceptionObject(
+        /*display_name=*/kObjectName,
+        /*object=*/*chooser_object,
+        /*chooser_type=*/kGroupTypeUsb,
+        /*chooser_exception_details=*/exception_details,
+        /*incognito=*/false);
+    ExpectValidChooserExceptionObject(
+        *exception, /*chooser_type=*/kGroupTypeUsb,
+        /*display_name=*/kObjectName, *chooser_object);
+
+    const auto& sites_list = exception->FindKey(kSites)->GetList();
+    ExpectValidSiteExceptionObject(/*actual_site_object=*/sites_list[0],
+                                   /*origin=*/kGoogleOrigin,
+                                   /*embedding_origin=*/kChromiumOrigin,
+                                   /*source=*/kPreferenceSource,
+                                   /*incognito=*/false);
+  }
+
+  // Add a user permissions for a requesting and embedding origin pair of
+  // |kAndroidOrigin|.
+  exception_details[std::make_pair(kAndroidOrigin.GetOrigin(),
+                                   kPreferenceSource)]
+      .insert(kAndroidOrigin.GetOrigin());
+
+  {
+    auto exception = CreateChooserExceptionObject(
+        /*display_name=*/kObjectName,
+        /*object=*/*chooser_object,
+        /*chooser_type=*/kGroupTypeUsb,
+        /*chooser_exception_details=*/exception_details,
+        /*incognito=*/true);
+    ExpectValidChooserExceptionObject(*exception,
+                                      /*chooser_type=*/kGroupTypeUsb,
+                                      /*display_name=*/kObjectName,
+                                      *chooser_object);
+
+    // The map sorts the sites by requesting origin, so |kAndroidOrigin| should
+    // be first, followed by the origin pair (kGoogleOrigin, kChromiumOrigin).
+    const auto& sites_list = exception->FindKey(kSites)->GetList();
+    ExpectValidSiteExceptionObject(/*actual_site_object=*/sites_list[0],
+                                   /*origin=*/kAndroidOrigin,
+                                   /*embedding_origin=*/kAndroidOrigin,
+                                   /*source=*/kPreferenceSource,
+                                   /*incognito=*/true);
+    ExpectValidSiteExceptionObject(/*actual_site_object=*/sites_list[1],
+                                   /*origin=*/kGoogleOrigin,
+                                   /*embedding_origin=*/kChromiumOrigin,
+                                   /*source=*/kPreferenceSource,
+                                   /*incognito=*/true);
+  }
+
+  // Add a policy permission for a requesting origin of |kGoogleOrigin| with a
+  // wildcard embedding origin.
+  exception_details[std::make_pair(kGoogleOrigin.GetOrigin(), kPolicySource)]
+      .insert(GURL::EmptyGURL());
+  {
+    auto exception = CreateChooserExceptionObject(
+        /*display_name=*/kObjectName,
+        /*object=*/*chooser_object,
+        /*chooser_type=*/kGroupTypeUsb,
+        /*chooser_exception_details=*/exception_details,
+        /*incognito=*/false);
+    ExpectValidChooserExceptionObject(*exception,
+                                      /*chooser_type=*/kGroupTypeUsb,
+                                      /*display_name=*/kObjectName,
+                                      *chooser_object);
+
+    // The map sorts the sites by requesting origin, but the
+    // CreateChooserExceptionObject method sorts the sites further by the
+    // source. Therefore, policy granted sites are listed before user granted
+    // sites.
+    const auto& sites_list = exception->FindKey(kSites)->GetList();
+    ExpectValidSiteExceptionObject(/*actual_site_object=*/sites_list[0],
+                                   /*origin=*/kGoogleOrigin,
+                                   /*embedding_origin=*/GURL::EmptyGURL(),
+                                   /*source=*/kPolicySource,
+                                   /*incognito=*/false);
+    ExpectValidSiteExceptionObject(/*actual_site_object=*/sites_list[1],
+                                   /*origin=*/kAndroidOrigin,
+                                   /*embedding_origin=*/kAndroidOrigin,
+                                   /*source=*/kPreferenceSource,
+                                   /*incognito=*/false);
+    ExpectValidSiteExceptionObject(/*actual_site_object=*/sites_list[2],
+                                   /*origin=*/kGoogleOrigin,
+                                   /*embedding_origin=*/kChromiumOrigin,
+                                   /*source=*/kPreferenceSource,
+                                   /*incognito=*/false);
+  }
+}
+
+namespace {
+
+constexpr char kUsbPolicySetting[] = R"(
+    [
+      {
+        "devices": [{ "vendor_id": 6353, "product_id": 5678 }],
+        "urls": ["https://chromium.org"]
+      }, {
+        "devices": [{ "vendor_id": 6353 }],
+        "urls": ["https://google.com,https://android.com"]
+      }, {
+        "devices": [{ "vendor_id": 6354 }],
+        "urls": ["https://android.com,"]
+      }, {
+        "devices": [{}],
+        "urls": ["https://google.com,https://google.com"]
+      }
+    ])";
+
+class SiteSettingsHelperChooserExceptionTest : public testing::Test {
+ protected:
+  Profile* profile() { return &profile_; }
+
+  void SetUp() override { SetUpUsbChooserContext(); }
+
+  // Sets up the UsbChooserContext with two devices and permissions for these
+  // devices. It also adds three policy defined permissions. The two devices
+  // represent the two types of USB devices, persistent and ephemeral, that can
+  // be granted permission.
+  void SetUpUsbChooserContext() {
+    device::mojom::UsbDeviceInfoPtr persistent_device_info =
+        device_manager_.CreateAndAddDevice(6353, 5678, "Google", "Gizmo",
+                                           "123ABC");
+    device::mojom::UsbDeviceInfoPtr ephemeral_device_info =
+        device_manager_.CreateAndAddDevice(6354, 0, "Google", "Gadget", "");
+
+    auto* chooser_context = UsbChooserContextFactory::GetForProfile(profile());
+    device::mojom::UsbDeviceManagerPtr device_manager_ptr;
+    device_manager_.AddBinding(mojo::MakeRequest(&device_manager_ptr));
+    chooser_context->SetDeviceManagerForTesting(std::move(device_manager_ptr));
+    chooser_context->GetDevices(
+        base::DoNothing::Once<std::vector<device::mojom::UsbDeviceInfoPtr>>());
+    base::RunLoop().RunUntilIdle();
+
+    // Add the user granted permissions for testing.
+    // These two persistent device permissions should be lumped together with
+    // the policy permissions, since they apply to the same device and URL.
+    chooser_context->GrantDevicePermission(kChromiumOrigin, kChromiumOrigin,
+                                           *persistent_device_info);
+    chooser_context->GrantDevicePermission(kChromiumOrigin, kGoogleOrigin,
+                                           *persistent_device_info);
+    chooser_context->GrantDevicePermission(kAndroidOrigin, kChromiumOrigin,
+                                           *persistent_device_info);
+    chooser_context->GrantDevicePermission(kAndroidOrigin, kAndroidOrigin,
+                                           *ephemeral_device_info);
+
+    // Add the policy granted permissions for testing.
+    auto policy_value = base::JSONReader::Read(kUsbPolicySetting);
+    DCHECK(policy_value);
+    profile()->GetPrefs()->Set(prefs::kManagedWebUsbAllowDevicesForUrls,
+                               *policy_value);
+  }
+
+  device::FakeUsbDeviceManager device_manager_;
+
+ private:
+  content::TestBrowserThreadBundle thread_bundle_;
+  TestingProfile profile_;
+};
+
+void ExpectDisplayNameEq(const base::Value& actual_exception_object,
+                         const std::string& display_name) {
+  const base::Value* display_name_value = actual_exception_object.FindKeyOfType(
+      kDisplayName, base::Value::Type::STRING);
+  ASSERT_TRUE(display_name_value);
+  EXPECT_EQ(display_name_value->GetString(), display_name);
+}
+
+}  // namespace
+
+// At the moment, UI strings to describe wildcard device permissions have not
+// been added yet. As a result, the names are inaccurate. Once the strings are
+// added, the device names for policy defined devices will change, and so will
+// the order in which GetChooserExceptionListFromProfile returns these chooser
+// exceptions.
+// TODO(https://crbug.com/854320): Update this unit test when the UI strings are
+// added for the wildcard devices with the new chooser exception order.
+TEST_F(SiteSettingsHelperChooserExceptionTest,
+       GetChooserExceptionListFromProfile) {
+  const ChooserTypeNameEntry* chooser_type =
+      ChooserTypeFromGroupName(kGroupTypeUsb);
+  const std::string& kPolicySource =
+      SiteSettingSourceToString(SiteSettingSource::kPolicy);
+  const std::string& kPreferenceSource =
+      SiteSettingSourceToString(SiteSettingSource::kPreference);
+
+  // The chooser exceptions are ordered by display name. Their corresponding
+  // sites are ordered by permission source precedence, then by the requesting
+  // origin and the embedding origin. User granted permissions that are also
+  // granted by policy are combined with the policy so that duplicate
+  // permissions are not displayed.
+  std::unique_ptr<base::ListValue> exceptions =
+      GetChooserExceptionListFromProfile(profile(), /*incognito=*/false,
+                                         *chooser_type);
+  ASSERT_EQ(exceptions->GetSize(), 4ul);
+  auto& exceptions_list = exceptions->GetList();
+
+  // This exception should describe the permissions for the "Gizmo" device.
+  // The user granted permissions are the following:
+  // * ("https://chromium.org", "https://chromium.org")
+  // * ("https://chromium.org", "https://google.com")
+  // * ("https://android.com", "https://chromium.org")
+  // The policy granted permission is the following:
+  // * ("https://chromium.org", "")
+  // The embedding origin is a wildcard, so the policy granted permission covers
+  // any user granted permissions that contain a requesting origin of
+  // "https://chromium.org", so the site list for this exception will only have
+  // the following permissions:
+  // * ("https://chromium.org", "")
+  // * ("https://android.com", "https://chromium.org")
+  {
+    const auto& exception = exceptions_list[0];
+    ExpectDisplayNameEq(exception, /*display_name=*/"Gizmo");
+
+    const auto& sites_list = exception.FindKey(kSites)->GetList();
+    ASSERT_EQ(sites_list.size(), 2ul);
+    ExpectValidSiteExceptionObject(sites_list[0],
+                                   /*origin=*/kChromiumOrigin,
+                                   /*source=*/kPolicySource,
+                                   /*incognito=*/false);
+    ExpectValidSiteExceptionObject(sites_list[1],
+                                   /*origin=*/kAndroidOrigin,
+                                   /*embedding_origin=*/kChromiumOrigin,
+                                   /*source=*/kPreferenceSource,
+                                   /*incognito=*/false);
+  }
+
+  // This exception should describe the permissions for any device with the
+  // vendor ID 6354. There is a user granted permission for a device with that
+  // vendor ID, so the site list for this exception will only have the policy
+  // granted permission, which is the following:
+  // * ("https://android.com", "")
+  {
+    const auto& exception = exceptions_list[1];
+    ExpectDisplayNameEq(exception,
+                        /*display_name=*/"Unknown device [18d2:ffffffff]");
+
+    const auto& sites_list = exception.FindKey(kSites)->GetList();
+    ExpectValidSiteExceptionObject(sites_list[0],
+                                   /*origin=*/kAndroidOrigin,
+                                   /*source=*/kPolicySource,
+                                   /*incognito=*/false);
+  }
+
+  // This exception should describe the permissions for any device.
+  // There are no user granted permissions that intersect with this permission,
+  // and this policy only grants one permission to the following site pair:
+  // * ("https://google.com", "https://google.com")
+  {
+    const auto& exception = exceptions_list[2];
+    ExpectDisplayNameEq(exception,
+                        /*display_name=*/"Unknown device [ffffffff:ffffffff]");
+
+    const auto& sites_list = exception.FindKey(kSites)->GetList();
+    ExpectValidSiteExceptionObject(sites_list[0],
+                                   /*origin=*/kGoogleOrigin,
+                                   /*embedding_origin=*/kGoogleOrigin,
+                                   /*source=*/kPolicySource,
+                                   /*incognito=*/false);
+  }
+
+  // This exception should describe the permissions for any device with the
+  // vendor ID corresponding to "Google Inc.". There are no user granted
+  // permissions that intersect with this permission, and this policy only
+  // grants one permission to the following site pair:
+  // * ("https://google.com", "https://android.com")
+  {
+    const auto& exception = exceptions_list[3];
+    ExpectDisplayNameEq(exception,
+                        /*display_name=*/"Unknown device from Google Inc.");
+
+    const auto& sites_list = exception.FindKey(kSites)->GetList();
+    ExpectValidSiteExceptionObject(sites_list[0],
+                                   /*origin=*/kGoogleOrigin,
+                                   /*embedding_origin=*/kAndroidOrigin,
+                                   /*source=*/kPolicySource,
+                                   /*incognito=*/false);
+  }
+}
+
 }  // namespace site_settings