orinium_browser/browser/core/

tab.rs

//! ブラウザのタブ機能。WebView を保持し、ページのタイトルや URL などのメタ情報を管理する。

use std::sync::Arc;

use crate::{
    browser::core::{
        resource_loader::{BrowserNetworkError, BrowserResponse},
        webview::JsPolicy,
    },
    engine::{
        html::HtmlNodeType,
        input::HitItem,
        js::JsFetchResponse,
        layouter::{
            self,
            types::{ColorScheme, ContainerRole, CursorStyle, InfoNode, NodeKind},
        },
        origin::Origin,
        permissions::Permissions,
        renderer_model::{self, DrawCommand},
        tree::TreeNode,
        ui::{CustomNode, PointerEvent, input_text_types::InputTextEvent},
    },
};
use ui_layout::LayoutNode;
use url::Url;
use winit::event::ElementState;

pub use super::webview::{CssApplicationStrategy, FetchKind, WebView, WebViewTask};

pub enum TabTask {
    Fetch {
        url: Url,
        kind: FetchKind,
        /// The origin of the document that requested this resource.
        origin: Origin,
        /// The effective capabilities of the requesting frame.
        permissions: Permissions,
        /// Monotonic generation of the document that issued the fetch.
        generation: u64,
    },
    NeedsRedraw,
    /// A page asked the DevTools bridge to inspect rendered state.
    DevToolsRequest {
        id: u64,
        method: String,
        params: String,
    },
}

#[derive(Debug)]
enum TabError {
    NetworkError(BrowserNetworkError),
}

#[derive(Debug)]
enum TabState {
    Loading,
    Loaded,
    Error(TabError, Option<Url>), // エラーの種類と、失敗した URL（ある場合）
}

/// Tab はブラウザで開かれた 1 つのページを表す構造体です。
///
/// 主な責務:
/// - 現在表示しているページのタイトルの保持
/// - ページ内容を扱う WebView の保持
///
/// WebView が「ページそのもの」の状態を管理するのに対し、
/// Tab は UI 上のタブとしてのメタ情報（タイトルなど）を管理します。
pub struct Tab {
    title: Option<String>,
    base_url: Option<Url>,
    document_url: Option<Url>,
    webview: Option<WebView>,

    system_color_scheme: ColorScheme,

    /// Policy controlling whether page scripts are executed and how
    /// `<noscript>` contents are parsed.
    js_policy: JsPolicy,

    /// Whether this tab is a browser-created chrome context (the shell or the
    /// DevTools pane). Only chrome contexts hold [`Permissions::chrome`].
    privileged: bool,

    /// Text measurer shared by every [`WebView`] this tab has created.
    ///
    /// Reusing one measurer keeps its shaping cache warm across navigations, so
    /// text shared between documents (chrome, common markup, repeated phrases)
    /// is not re-shaped from scratch on each page load.
    text_measurer: Option<Arc<crate::platform::renderer::text_measurer::PlatformTextMeasurer>>,

    state: TabState,
    /// Monotonically increasing generation for the current document.
    document_generation: u64,
    /// Previously visited URLs, most recent last. Used by the back button.
    history: Vec<Url>,

    /// The custom node currently under the pointer, if any.
    hovered: Option<Arc<dyn CustomNode>>,
    /// DOM path (root-to-target) currently under the pointer.
    hovered_dom_path: Vec<u32>,
    /// DOM path (root-to-target) for the active/pressed target.
    active_dom_path: Vec<u32>,
    /// The DOM node under the pointer when the left button was pressed.
    ///
    /// Used to detect a completed click (press and release on the same node),
    /// which is forwarded to the page's JS `onclick` handler.
    pressed_dom_id: Option<u32>,
}

impl std::fmt::Debug for Tab {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.debug_struct("Tab")
            .field("title", &self.title)
            .field("base_url", &self.base_url)
            .field("document_url", &self.document_url)
            .field("system_color_scheme", &self.system_color_scheme)
            .field("js_policy", &self.js_policy)
            .field("state", &self.state)
            .field("history", &self.history)
            .finish()
    }
}

impl Default for Tab {
    fn default() -> Self {
        Self::new(ColorScheme::default(), JsPolicy::default())
    }
}

impl Tab {
    pub fn new(system_color_scheme: ColorScheme, js_policy: JsPolicy) -> Self {
        Self {
            title: None,
            base_url: None,
            document_url: None,
            webview: None,

            system_color_scheme,

            js_policy,

            privileged: false,

            text_measurer: None,

            state: TabState::Loading,
            document_generation: 0,
            history: Vec::new(),

            hovered: None,
            hovered_dom_path: Vec::new(),
            active_dom_path: Vec::new(),
            pressed_dom_id: None,
        }
    }

    /// Marks this tab as a browser-created chrome context, granting it
    /// [`Permissions::chrome`]. Only the shell and the DevTools pane should.
    pub fn set_privileged(&mut self, privileged: bool) {
        self.privileged = privileged;
    }

    /// The tab's root origin.
    ///
    /// Chrome contexts are internal; ordinary tabs derive their origin from the
    /// loaded document, and a tab with no document yet is opaque.
    fn root_origin(&self) -> Origin {
        if self.privileged {
            return Origin::internal();
        }
        self.document_url
            .as_ref()
            .map(Origin::from_url)
            .unwrap_or_else(Origin::opaque)
    }

    /// The effective capabilities of the tab's top-level document.
    fn root_permissions(&self) -> Permissions {
        if self.privileged {
            return Permissions::chrome();
        }
        self.document_url
            .as_ref()
            .map(Permissions::content_for)
            .unwrap_or_else(Permissions::none)
    }

    pub(crate) fn document_generation(&self) -> u64 {
        self.document_generation
    }

    /// Whether a `fetch()`/`XMLHttpRequest` response may be read by the given
    /// frame.
    ///
    /// Read authority is decided by exactly two things: whether the frame is
    /// privileged (chrome, which bypasses CORS entirely) and, otherwise, CORS
    /// (same-origin or `Access-Control-Allow-Origin`). The scheme capabilities
    /// in `permissions` are deliberately ignored here: reaching a URL and being
    /// allowed to read its response are separate questions, so a response header
    /// can never substitute for a missing scheme capability, nor a scheme
    /// capability for CORS.
    fn may_read_fetch_response(
        &self,
        initiator: &Origin,
        permissions: Permissions,
        url: &Url,
        headers: &[(String, String)],
    ) -> bool {
        if permissions.is_chrome() {
            return true;
        }
        match url.scheme() {
            "http" | "https" => {
                let response_origin = Origin::from_url_string(url.as_str());
                initiator.same_origin(&response_origin) || headers_allow_cors(headers, initiator)
            }
            "data" => true,
            _ => false,
        }
    }

    /// Tab 内の状態を 1 ステップ進める
    ///
    /// - WebView.tick() を呼び出す
    /// - 発生した Task を BrowserApp に返す
    pub(crate) fn set_animation_visible(&mut self, visible: bool) {
        if let Some(wv) = self.webview.as_mut() {
            wv.set_animation_visible(visible);
        }
    }

    pub fn tick(&mut self) -> Vec<TabTask> {
        let mut tasks = Vec::new();
        let page_origin = self.root_origin();
        let page_permissions = self.root_permissions();
        let Some(wv) = self.webview.as_mut() else {
            return tasks;
        };

        // Handle navigations after the loop: they replace the webview, which
        // would invalidate the `wv` borrow mid-iteration.
        let mut navigation: Option<Url> = None;
        for task in wv.tick() {
            match task {
                WebViewTask::Fetch { url, kind } => {
                    log::info!("Fetch requested in Tab: url={}", url);
                    tasks.push(TabTask::Fetch {
                        url,
                        kind,
                        origin: page_origin.clone(),
                        permissions: page_permissions,
                        generation: self.document_generation,
                    });
                }
                WebViewTask::Navigate { url } => {
                    // Script-initiated navigation (form submit): replace the
                    // document URL and restart the load cycle.
                    log::info!("Navigating (script): {url}");
                    navigation = Some(url);
                }
                WebViewTask::AskTabHtml => {
                    tasks.push(TabTask::Fetch {
                        url: self.document_url.as_ref().unwrap().clone(),
                        kind: FetchKind::Html,
                        origin: page_origin.clone(),
                        permissions: page_permissions,
                        generation: self.document_generation,
                    });
                }
                WebViewTask::DevToolsRequest { id, method, params } => {
                    tasks.push(TabTask::DevToolsRequest { id, method, params });
                }
            }
        }

        if wv.needs_redraw() {
            tasks.push(TabTask::NeedsRedraw);
        }

        // Apply the navigation last: it drops `wv`, so this must be after all
        // other uses of the borrow above.
        if let Some(url) = navigation {
            self.navigate(url);
            return tasks;
        }

        tasks
    }

    /// Delivers the result of a resource fetch to this tab.
    ///
    /// This is shared by regular browser tabs and the DevTools tab embedded in
    /// the browser chrome so both follow the same loading and error handling
    /// path.
    ///
    /// `generation` identifies the document that issued the fetch. Results from
    /// a previous navigation (generation mismatch) are dropped so stale
    /// resources cannot mutate the current document state.
    pub(crate) fn deliver_fetch(
        &mut self,
        kind: FetchKind,
        url: Url,
        origin: Origin,
        permissions: Permissions,
        response: Result<BrowserResponse, BrowserNetworkError>,
        generation: u64,
    ) {
        if generation != self.document_generation {
            log::info!(
                "Dropping stale fetch delivery for generation={} (current={}) url={}",
                generation,
                self.document_generation,
                url
            );
            return;
        }
        match response {
            Ok(resp) => match kind {
                FetchKind::Html => {
                    let html = String::from_utf8_lossy(&resp.body).to_string();
                    self.on_fetch_succeeded_html(html);
                }
                FetchKind::Css => {
                    let css = String::from_utf8_lossy(&resp.body).to_string();
                    self.on_fetch_succeeded_css_from(css, &url);
                }
                FetchKind::Script { index } => {
                    let source = String::from_utf8_lossy(&resp.body).to_string();
                    self.on_fetch_succeeded_script(index, source);
                }
                FetchKind::DynamicScript { node_id } => {
                    let source = String::from_utf8_lossy(&resp.body).to_string();
                    self.on_fetch_succeeded_dynamic_script(node_id, source, &url);
                }
                FetchKind::DynamicCss { node_id } => {
                    let source = String::from_utf8_lossy(&resp.body).to_string();
                    self.on_fetch_succeeded_dynamic_style(node_id, source, &url);
                }
                FetchKind::CssImport { target } => {
                    let source = String::from_utf8_lossy(&resp.body).to_string();
                    self.on_fetch_succeeded_css_import(source, &target);
                }
                FetchKind::Image { source } => {
                    self.on_fetch_succeeded_image(source, &resp.body);
                }
                FetchKind::Audio { source } => {
                    self.on_fetch_succeeded_audio(source, &resp.body);
                }
                FetchKind::Iframe { dom_id } => {
                    let html = String::from_utf8_lossy(&resp.body).to_string();
                    match Url::parse(&resp.url) {
                        Ok(final_url) => self.on_fetch_succeeded_iframe(dom_id, html, final_url),
                        Err(error) => {
                            log::warn!(
                                "Iframe response has invalid final URL {}: {error}",
                                resp.url
                            );
                            self.on_fetch_failed_iframe(dom_id);
                        }
                    }
                }
                FetchKind::JavaScript { request_id, .. } => {
                    let response_url = Url::parse(&resp.url);
                    if response_url.as_ref().is_ok_and(|response_url| {
                        self.may_read_fetch_response(
                            &origin,
                            permissions,
                            response_url,
                            &resp.headers,
                        )
                    }) {
                        let redirected = resp.url != url.as_str();
                        self.on_fetch_succeeded_js(request_id, resp, redirected);
                    } else {
                        log::warn!(
                            "Blocked CORS read of {} from {}",
                            resp.url,
                            origin.ascii_serialization()
                        );
                        self.on_fetch_failed_js(
                            request_id,
                            "Cross-origin response blocked by CORS policy".to_string(),
                        );
                    }
                }
            },
            Err(err) => match kind {
                FetchKind::Image { .. } | FetchKind::Audio { .. } => {
                    log::warn!("Media fetch failed without aborting page load: {url}");
                }
                FetchKind::Iframe { dom_id } => {
                    log::warn!("Iframe fetch failed without aborting page load: {url}");
                    self.on_fetch_failed_iframe(dom_id);
                }
                FetchKind::Script { index } => {
                    log::warn!("Classic script fetch failed without aborting page load: {url}");
                    self.on_fetch_failed_script(index);
                }
                FetchKind::DynamicScript { node_id } => {
                    log::warn!("Dynamic script fetch failed without aborting page load: {url}");
                    self.on_fetch_failed_dynamic_script(node_id);
                }
                FetchKind::DynamicCss { node_id } => {
                    log::warn!("Dynamic stylesheet fetch failed without aborting page load: {url}");
                    self.on_fetch_failed_dynamic_style(node_id);
                }
                FetchKind::CssImport { target } => {
                    log::warn!("CSS import fetch failed without aborting page load: {url}");
                    self.on_fetch_failed_css_import(&target);
                }
                FetchKind::JavaScript { request_id, .. } => {
                    self.on_fetch_failed_js(request_id, err.to_string());
                }
                FetchKind::Html | FetchKind::Css => self.on_fetch_failed(err, url),
            },
        }
    }

    /// BrowserApp から CSS fetch 完了を通知
    pub fn on_css_fetched(&mut self, css: String) {
        log::info!("CSS fetched in Tab");
        if let Some(webview) = self.webview.as_mut() {
            webview.on_css_fetched(css);
        }
    }

    /// BrowserApp からの HTML fetch 完了を通知
    pub fn on_fetch_succeeded_html(&mut self, html: String) {
        let Some(wv) = self.webview.as_mut() else {
            return;
        };

        wv.on_html_fetched(html, self.document_url.as_ref().unwrap().clone());
        self.title = wv.title().cloned();
        let base_url = wv.base_url().unwrap().clone();
        log::info!("HTML fetched, base_url={}", base_url);
        self.base_url = Some(base_url);

        if let TabState::Error(TabError::NetworkError(err), url_opt) = &self.state {
            let error_message = match url_opt {
                Some(url) => format!("Failed to load {}: {}", url, err),
                None => format!("Failed to load page: {}", err),
            };

            let error_message_element = wv
                .document_info()
                .unwrap()
                .dom
                .get_elements_by_class_name("error-message");
            let error_message_element = error_message_element.first().unwrap();
            let new_child = TreeNode::new(HtmlNodeType::Text(error_message));
            TreeNode::replace_child(error_message_element, 0, new_child);

            // Update page to show error message
            // This is a stub implementation for now as you can see in WebView.update_page().
            wv.update_page();
        } else {
            self.state = TabState::Loaded;
        }
    }

    pub fn on_fetch_succeeded_css(&mut self, css: String) {
        let Some(wv) = self.webview.as_mut() else {
            return;
        };

        wv.on_css_fetched(css);
    }

    pub fn on_fetch_succeeded_css_from(&mut self, css: String, stylesheet_url: &Url) {
        let Some(wv) = self.webview.as_mut() else {
            return;
        };
        wv.on_css_fetched_from(css, stylesheet_url);
    }

    /// Delivers encoded image bytes to the page that requested them.
    pub fn on_fetch_succeeded_image(&mut self, source: String, bytes: &[u8]) {
        let Some(wv) = self.webview.as_mut() else {
            return;
        };
        if let Err(error) = wv.on_image_fetched(source, bytes) {
            log::warn!("Failed to decode fetched image: {error}");
        }
    }

    /// Delivers encoded audio bytes to the page that requested them.
    pub fn on_fetch_succeeded_audio(&mut self, source: String, bytes: &[u8]) {
        if let Some(webview) = self.webview.as_mut() {
            webview.on_audio_fetched(source, bytes);
        }
    }

    /// Delivers a fetched external classic script in document order.
    pub fn on_fetch_succeeded_script(&mut self, index: usize, source: String) {
        if let Some(webview) = self.webview.as_mut() {
            webview.on_script_fetched(index, source);
        }
    }

    /// Skips a failed external classic script without replacing the page.
    pub fn on_fetch_failed_script(&mut self, index: usize) {
        if let Some(webview) = self.webview.as_mut() {
            webview.on_script_fetch_failed(index);
        }
    }

    pub fn on_fetch_succeeded_dynamic_script(&mut self, node_id: u64, source: String, url: &Url) {
        if let Some(webview) = self.webview.as_mut() {
            webview.on_dynamic_script_fetched(node_id, source, url);
        }
    }

    pub fn on_fetch_failed_dynamic_script(&mut self, node_id: u64) {
        if let Some(webview) = self.webview.as_mut() {
            webview.on_dynamic_script_fetch_failed(node_id);
        }
    }

    pub fn on_fetch_succeeded_dynamic_style(&mut self, node_id: u64, source: String, url: &Url) {
        if let Some(webview) = self.webview.as_mut() {
            webview.on_dynamic_style_fetched(node_id, source, url);
        }
    }

    pub fn on_fetch_failed_dynamic_style(&mut self, node_id: u64) {
        if let Some(webview) = self.webview.as_mut() {
            webview.on_dynamic_style_fetch_failed(node_id);
        }
    }

    /// Records a fetched `@import`-ed stylesheet against its own URL.
    pub fn on_fetch_succeeded_css_import(&mut self, source: String, url: &Url) {
        if let Some(webview) = self.webview.as_mut() {
            webview.on_css_import_fetched(source, url);
        }
    }

    /// Records a failed `@import` fetch so importers settle without the sheet.
    pub fn on_fetch_failed_css_import(&mut self, url: &Url) {
        if let Some(webview) = self.webview.as_mut() {
            webview.on_css_import_fetch_failed(url);
        }
    }

    /// Installs fetched HTML as an `<iframe>` element's `contentDocument`.
    pub fn on_fetch_succeeded_iframe(&mut self, dom_id: u64, html: String, final_url: Url) {
        if let Some(webview) = self.webview.as_mut() {
            webview.on_iframe_fetched(dom_id, html, final_url);
        }
    }

    /// Marks an iframe load as failed so later `contentDocument` accesses do
    /// not keep re-queuing a fetch.
    pub fn on_fetch_failed_iframe(&mut self, dom_id: u64) {
        if let Some(webview) = self.webview.as_mut() {
            webview.on_iframe_fetch_failed(dom_id);
        }
    }

    /// Delivers a completed JavaScript `fetch()` response.
    pub fn on_fetch_succeeded_js(
        &mut self,
        request_id: u64,
        response: BrowserResponse,
        redirected: bool,
    ) {
        if let Some(webview) = self.webview.as_mut() {
            webview.on_js_fetch_succeeded(
                request_id,
                JsFetchResponse {
                    url: response.url,
                    status: response.status.as_u16(),
                    status_text: response.status_text,
                    redirected,
                    body: response.body,
                    headers: response.headers,
                },
            );
        }
    }

    /// Delivers a JavaScript `fetch()` network failure without navigating away.
    pub fn on_fetch_failed_js(&mut self, request_id: u64, reason: String) {
        if let Some(webview) = self.webview.as_mut() {
            webview.on_js_fetch_failed(request_id, reason);
        }
    }

    /// Answers a DevTools inspection query against this tab's page.
    pub fn inspect(&mut self, method: &str, params: &str) -> Result<serde_json::Value, String> {
        match self.webview.as_mut() {
            Some(webview) => webview.inspect(method, params),
            None => Err("no page".to_string()),
        }
    }

    pub fn draw(&mut self, cmd_buf: &mut Vec<DrawCommand>, width: f32, height: f32) {
        self.relayout((width, height));

        if let Some((layout, info)) = self.layout_and_info() {
            renderer_model::generate_draw_commands(cmd_buf, layout, info, (width, height));
            self.clear_redraw_flag();
        } else {
            log::debug!(target: "Tab", "No layout/info available for tab");
        }
    }

    pub fn handle_mouse_input(&mut self, px: f32, py: f32, state: ElementState) -> (bool, bool) {
        // Hit-test the content area, dispatch the pointer event to custom
        // nodes, and remember which DOM element the press/release landed on.
        let Some((_, info)) = self.layout_and_info() else {
            return (false, false);
        };

        let path = self.hit_test(px, py);
        let dom_id = crate::engine::input::hit_dom_id(&path);

        let mut repaint = false;

        match state {
            ElementState::Pressed => {
                let dismiss_path = path.clone();
                let pointer_consumed = crate::engine::input::dispatch_pointer(
                    &path,
                    PointerEvent::Down { x: px, y: py },
                );
                // Only dismiss popups when the press was not consumed by an
                // open popup. Presses inside a popup (or on its owner) are
                // handled by dispatch_pointer via on_popup_pointer_event.
                if !pointer_consumed {
                    repaint |= crate::engine::input::dismiss_open_popups(info, &dismiss_path, px, py);
                }

                let input_target = path.iter().find_map(|hit| {
                    if let layouter::types::NodeKind::Custom { node, .. } = &hit.info.kind
                        && node.accepts_text_input()
                    {
                        Some(Arc::clone(node))
                    } else {
                        None
                    }
                });

                let input_focused =
                    crate::engine::input::focus_text_input(info, input_target.as_ref());

                let href = path.iter().find_map(|hit| {
                    if let layouter::types::NodeKind::Container { role, .. } = &hit.info.kind
                        && let layouter::types::ContainerRole::Link { href } = role
                    {
                        Some(href.clone())
                    } else {
                        None
                    }
                });
                let active_dom_path = crate::engine::input::hit_dom_path(&path);

                repaint |= input_focused | pointer_consumed;

                if let Some(href) = href {
                    self.move_to(&href);
                }

                self.pressed_dom_id = dom_id;
                self.active_dom_path = active_dom_path;
                if let Some(wv) = self.webview.as_mut() {
                    repaint |= wv.set_interaction_paths(
                        self.hovered_dom_path.clone(),
                        self.active_dom_path.clone(),
                    );
                }
            }

            ElementState::Released => {
                repaint |= crate::engine::input::dispatch_pointer(
                    &path,
                    PointerEvent::Up { x: px, y: py },
                );

                let pressed = self.pressed_dom_id.take();
                if let (Some(pressed), Some(released)) = (pressed, dom_id)
                    && pressed == released
                {
                    repaint |= self.on_js_click(released);
                }
                if !self.active_dom_path.is_empty() {
                    self.active_dom_path.clear();
                    if let Some(wv) = self.webview.as_mut() {
                        repaint |= wv.clear_active_interaction();
                    }
                }
            }
        }

        let (move_repaint, move_focused) = self.handle_pointer_move(px, py);
        repaint |= move_repaint;

        (repaint, move_focused)
    }

    /// Dispatches a pointer move and updates hover state without touching
    /// click bookkeeping. Unlike [`Tab::handle_mouse_input`] it never
    /// synthesizes press/release events, so it is safe to call on every
    /// cursor movement.
    pub fn handle_pointer_move(&mut self, px: f32, py: f32) -> (bool, bool) {
        let move_path = self.hit_test(px, py);

        let input_focused =
            crate::engine::input::dispatch_pointer(&move_path, PointerEvent::Move { x: px, y: py });

        let previous = self.hovered.as_ref();
        let hover_changed = crate::engine::input::update_hover(&move_path, previous);
        let next_hovered = crate::engine::input::hit_custom_node(&move_path).cloned();
        let hovered_dom_path = crate::engine::input::hit_dom_path(&move_path);

        let mut repaint = false;
        if hover_changed {
            repaint = true;
        }
        self.hovered = next_hovered;

        if hovered_dom_path != self.hovered_dom_path {
            self.hovered_dom_path = hovered_dom_path;
            if let Some(wv) = self.webview.as_mut() {
                repaint |= wv.set_interaction_paths(
                    self.hovered_dom_path.clone(),
                    self.active_dom_path.clone(),
                );
            }
        }

        (repaint, input_focused)
    }

    /// Clears pointer interaction state when the pointer leaves the content.
    pub fn handle_pointer_leave(&mut self) -> bool {
        let mut repaint = false;
        if let Some(prev) = self.hovered.take() {
            prev.set_hovered(false);
            repaint = true;
        }
        if !self.hovered_dom_path.is_empty() || !self.active_dom_path.is_empty() {
            self.hovered_dom_path.clear();
            self.active_dom_path.clear();
            if let Some(wv) = self.webview.as_mut() {
                repaint |= wv.set_interaction_paths(Vec::new(), Vec::new());
            }
        }
        self.pressed_dom_id = None;
        repaint
    }

    /// Whether a press is waiting for its release to complete a click.
    #[cfg(test)]
    pub(crate) fn has_pending_press(&self) -> bool {
        self.pressed_dom_id.is_some()
    }

    /// Sends a text-input event (key, insert, composition) to the focused
    /// text input, if one exists.
    pub fn dispatch_text_input(&self, event: InputTextEvent) -> bool {
        let Some((_, info)) = self.layout_and_info() else {
            return false;
        };
        crate::engine::input::dispatch_text_input(info, event)
    }

    /// Defocuses any focused text input.
    pub fn defocus_text_input(&self) -> bool {
        let Some((_, info)) = self.layout_and_info() else {
            return false;
        };
        crate::engine::input::focus_text_input(info, None)
    }

    /// Returns the href of the link under the given page coordinates, if any.
    pub fn link_at(&self, px: f32, py: f32) -> Option<String> {
        let (layout, info) = self.layout_and_info()?;
        let path = crate::engine::input::hit_test(layout, info, px, py);
        path.iter().find_map(|hit| {
            if let NodeKind::Container {
                role: ContainerRole::Link { href },
                ..
            } = &hit.info.kind
            {
                Some(href.clone())
            } else {
                None
            }
        })
    }

    /// Scrolls the scrollable container under the cursor.
    pub fn scroll_at(&mut self, px: f32, py: f32, dx: f32, dy: f32, viewport: (f32, f32)) {
        let Some(scrolled_id) = self.layout_and_info_mut().and_then(|(layout, info)| {
            crate::engine::input::scroll_at(layout, info, viewport, px, py, dx, dy)
        }) else {
            return;
        };
        if scrolled_id != crate::engine::input::NO_SCROLL_DOM_ID
            && let Some(wv) = self.webview.as_mut()
        {
            wv.on_js_scroll(scrolled_id);
        }
    }

    /// Whether this tab has a layout tree ready for drawing or hit-testing.
    pub fn has_layout(&self) -> bool {
        self.layout_and_info().is_some()
    }

    /// Whether the currently focused text input is in the middle of a
    /// composition (e.g. IME preedit).
    pub fn is_text_input_composing(&self) -> bool {
        let Some((_, info)) = self.layout_and_info() else {
            return false;
        };
        crate::engine::input::focused_text_input_is_composing(info)
    }

    fn hit_test<'a>(&'a self, px: f32, py: f32) -> Vec<HitItem<'a>> {
        let Some((layout, info)) = self.layout_and_info() else {
            return vec![];
        };

        crate::engine::input::hit_test(layout, info, px, py)
    }

    /// Settles a DevTools inspection request with its JSON envelope.
    pub fn on_devtools_response(&mut self, id: u64, result: String) {
        if let Some(webview) = self.webview.as_mut() {
            webview.on_devtools_response(id, result);
        }
    }

    /// Display error page on fetch failure
    pub fn on_fetch_failed(&mut self, err: BrowserNetworkError, failed_url: Url) {
        self.navigate("resource:///error.html".parse().unwrap());
        self.state = TabState::Error(TabError::NetworkError(err), Some(failed_url));
    }

    /// Returns the cursor style for the element under the given point, if any.
    ///
    /// The point is in CSS pixels relative to the viewport origin.
    pub fn cursor_at(&self, x: f32, y: f32) -> Option<CursorStyle> {
        self.webview.as_ref().and_then(|wv| wv.cursor_at(x, y))
    }

    pub fn navigate(&mut self, url: Url) {
        self.navigate_internal(url, true);
    }

    /// Navigates to the previous URL in the history, if any.
    ///
    /// Returns `false` when there is no history to go back to.
    pub fn go_back(&mut self) -> bool {
        let Some(previous) = self.history.pop() else {
            return false;
        };
        self.navigate_internal(previous, false);
        true
    }

    /// Reloads the current document, if one is loaded.
    pub fn reload(&mut self) {
        if let Some(url) = self.document_url.clone() {
            self.navigate_internal(url, false);
        }
    }

    /// Returns whether the back button can navigate to a previous page.
    pub fn can_go_back(&self) -> bool {
        !self.history.is_empty()
    }

    /// Creates this tab's shared text measurer on first use.
    ///
    /// Failure to initialize a system font leaves the slot empty, and the web
    /// view falls back to creating its own measurer.
    fn ensure_text_measurer(&mut self) {
        if self.text_measurer.is_none() {
            self.text_measurer =
                crate::platform::renderer::text_measurer::PlatformTextMeasurer::new()
                    .ok()
                    .map(Arc::new);
        }
    }

    fn navigate_internal(&mut self, url: Url, record_history: bool) {
        if record_history
            && self.document_url.as_ref() != Some(&url)
            && let Some(previous) = self.document_url.clone()
        {
            self.history.push(previous);
        }
        self.document_generation = self.document_generation.saturating_add(1);
        self.document_url = Some(url);
        self.ensure_text_measurer();
        let mut webview = WebView::new(self.system_color_scheme, self.js_policy);
        webview.set_privileged(self.privileged);
        webview.set_text_measurer(self.text_measurer.clone());
        webview.navigate();
        self.webview = Some(webview);
        self.state = TabState::Loading;
        self.title = None;
        self.base_url = None;
        self.hovered = None;
        self.hovered_dom_path.clear();
        self.active_dom_path.clear();
        self.pressed_dom_id = None;
    }

    pub fn move_to(&mut self, href: &str) {
        let Some(base_url) = self.base_url.clone() else {
            return;
        };

        let url = super::webview::resolve_url(&base_url, href).unwrap();

        // Same-document anchor navigation (`<a href="#id">`): scroll in place
        // instead of reloading the page, and record the new URL with a history
        // entry like a real browser does.
        if same_document_navigation(self.document_url.as_ref(), &url) {
            if self.document_url.as_ref() != Some(&url)
                && let Some(previous) = self.document_url.clone()
            {
                self.history.push(previous);
            }
            self.document_url = Some(url.clone());
            if let Some(webview) = self.webview.as_mut() {
                webview.scroll_to_fragment(&url);
            }
            return;
        }

        // navigate と同じ扱い
        self.navigate(url)
    }

    pub fn relayout(&mut self, viewport: (f32, f32)) {
        if let Some(wv) = self.webview.as_mut() {
            wv.relayout(viewport);
        }
    }

    /// Returns layout_and_info
    /// Only InfoNode will be mutable.
    pub(crate) fn layout_and_info_mut(&mut self) -> Option<(&LayoutNode, &mut InfoNode)> {
        self.webview
            .as_mut()
            .and_then(|wv| wv.layout_and_info_mut())
    }

    /// Dispatches a click on a DOM node to the page's JS `onclick` handler.
    ///
    /// Returns whether the click mutated the DOM and needs a redraw.
    pub fn on_js_click(&mut self, dom_id: u32) -> bool {
        self.webview
            .as_mut()
            .is_some_and(|wv| wv.on_js_click(dom_id))
    }

    pub fn set_system_color_scheme(&mut self, scheme: ColorScheme) {
        self.system_color_scheme = scheme;
        if let Some(wv) = self.webview.as_mut() {
            wv.set_system_color_scheme(scheme)
        }
    }

    /// Returns title of the document
    pub fn title(&self) -> Option<String> {
        self.title.clone()
    }

    /// Returns document url
    pub fn document_url(&self) -> Option<Url> {
        self.document_url.clone()
    }

    pub(crate) fn layout_and_info(&self) -> Option<(&LayoutNode, &InfoNode)> {
        self.webview.as_ref().and_then(|wv| wv.layout_and_info())
    }

    pub fn needs_redraw(&self) -> bool {
        self.webview.as_ref().is_some_and(|wv| wv.needs_redraw())
    }

    pub fn clear_redraw_flag(&mut self) {
        if let Some(wv) = self.webview.as_mut() {
            wv.clear_redraw_flag();
        }
    }

    pub fn set_js_policy(&mut self, policy: JsPolicy) {
        self.js_policy = policy;
        if let Some(wv) = self.webview.as_mut() {
            wv.set_js_policy(policy);
        }
    }
}

/// Whether the response headers allow `initiator` to read the response.
///
/// Credentials are not tracked, so a wildcard `*` grants access exactly as an
/// explicit origin would.
fn headers_allow_cors(headers: &[(String, String)], initiator: &Origin) -> bool {
    let serialized = initiator.ascii_serialization();
    headers
        .iter()
        .find(|(name, _)| name.eq_ignore_ascii_case("access-control-allow-origin"))
        .is_some_and(|(_, value)| value == "*" || value == &serialized)
}

/// Returns whether `next` differs from `current` only in its URL fragment,
/// i.e. navigating to `next` stays on the same already-loaded document.
fn same_document_navigation(current: Option<&Url>, next: &Url) -> bool {
    let Some(current) = current else {
        return false;
    };
    fn identity(url: &Url) -> (String, Option<String>, Option<u16>, String, Option<String>) {
        (
            url.scheme().to_string(),
            url.host_str().map(str::to_string),
            url.port(),
            url.path().to_string(),
            url.query().map(str::to_string),
        )
    }
    identity(next) == identity(current)
}

#[cfg(test)]
mod tests {
    use super::*;
    use crate::test_support::parse_url as url;

    #[test]
    fn navigate_records_history() {
        let mut tab = Tab::default();
        tab.navigate(url("https://example.test/a"));
        tab.navigate(url("https://example.test/b"));

        assert!(tab.can_go_back());
        assert_eq!(
            tab.document_url().as_ref().map(Url::as_str),
            Some("https://example.test/b")
        );
    }

    #[test]
    fn navigating_to_same_url_does_not_duplicate_history() {
        let mut tab = Tab::default();
        tab.navigate(url("https://example.test/a"));
        tab.navigate(url("https://example.test/a"));
        assert!(!tab.can_go_back());
    }

    #[test]
    fn go_back_restores_previous_url() {
        let mut tab = Tab::default();
        tab.navigate(url("https://example.test/a"));
        tab.navigate(url("https://example.test/b"));

        assert!(tab.go_back());
        assert_eq!(
            tab.document_url().as_ref().map(Url::as_str),
            Some("https://example.test/a")
        );
        assert!(!tab.can_go_back());
        // No history left: going back again reports failure.
        assert!(!tab.go_back());
    }

    #[test]
    fn reload_keeps_url_without_recording_history() {
        let mut tab = Tab::default();
        tab.navigate(url("https://example.test/a"));
        tab.reload();
        assert_eq!(
            tab.document_url().as_ref().map(Url::as_str),
            Some("https://example.test/a")
        );
        assert!(!tab.can_go_back());
    }

    #[test]
    fn fragment_only_url_change_is_a_same_document_navigation() {
        assert!(same_document_navigation(
            Some(&url("https://example.test/a#one")),
            &url("https://example.test/a#two"),
        ));
        assert!(same_document_navigation(
            Some(&url("https://example.test/a?q=1#one")),
            &url("https://example.test/a?q=1#two"),
        ));
        assert!(same_document_navigation(
            Some(&url("https://example.test/a")),
            &url("https://example.test/a"),
        ));
        assert!(!same_document_navigation(
            Some(&url("https://example.test/a")),
            &url("https://example.test/b"),
        ));
        assert!(!same_document_navigation(
            Some(&url("https://www.example.test/a#one")),
            &url("https://example.test/a#one"),
        ));
        assert!(!same_document_navigation(
            Some(&url("https://example.test/a?q=1")),
            &url("https://example.test/a?q=2#x"),
        ));
        assert!(!same_document_navigation(
            None,
            &url("https://example.test/a#x")
        ));
    }

    #[test]
    fn pointer_move_between_press_and_release_keeps_click_pending() {
        let mut tab = Tab::default();
        tab.navigate(url("https://example.test/a"));
        tab.on_fetch_succeeded_html("<html><body><p>click me</p></body></html>".to_string());

        // Force a relayout, wait for the background layout thread, then draw
        // again so the applied tree gets its boxes positioned.
        let mut buf = Vec::new();
        tab.draw(&mut buf, 800.0, 600.0);
        for _ in 0..500 {
            for _ in tab.tick() {}
            if tab.layout_and_info().is_some() {
                break;
            }
            std::thread::sleep(std::time::Duration::from_millis(2));
        }
        tab.draw(&mut buf, 800.0, 600.0);

        // Press on the page, move before releasing: the move must not
        // complete or cancel the in-flight press.
        tab.handle_mouse_input(400.0, 12.0, ElementState::Pressed);
        assert!(tab.has_pending_press(), "press should land on an element");

        tab.handle_pointer_move(401.0, 13.0);
        assert!(
            tab.has_pending_press(),
            "a pointer move must not cancel an in-flight press"
        );

        // The release completes the click and clears the pending press.
        tab.handle_mouse_input(401.0, 13.0, ElementState::Released);
        assert!(!tab.has_pending_press());
    }

    #[test]
    fn select_click_lands_on_custom_node() {
        use crate::engine::layouter::types::{InfoNode, NodeKind, TextFlowStyle, TextStyle};

        let mut tab = Tab::default();
        tab.navigate(url("https://example.test/a"));
        tab.on_fetch_succeeded_html(
            "<html><body><select id=\"sel\"><option>One</option><option>Two</option></select></body></html>"
                .to_string(),
        );

        // Force a relayout, wait for the background layout thread, then draw
        // again so the applied tree gets its boxes positioned.
        let mut buf = Vec::new();
        tab.draw(&mut buf, 800.0, 600.0);
        for _ in 0..500 {
            for _ in tab.tick() {}
            if tab.layout_and_info().is_some() {
                break;
            }
            std::thread::sleep(std::time::Duration::from_millis(2));
        }
        tab.draw(&mut buf, 800.0, 600.0);

        let (cx_base, cy_base, width, height, select_node) = {
            let (layout, info) = tab.layout_and_info().unwrap();

            // Find the select custom node in the layout tree and its box position.
            fn find_custom_box<'a>(
                layout: &'a ui_layout::LayoutNode,
                info: &'a InfoNode,
            ) -> Option<(f32, f32, f32, f32, &'a Arc<dyn CustomNode>)> {
                if let NodeKind::Custom { node, .. } = &info.kind {
                    if let Some(bm) = layout.layout_box.iter().next() {
                        let (x, y, w, h) = (
                            bm.content_box.x,
                            bm.content_box.y,
                            bm.border_box.width,
                            bm.border_box.height,
                        );
                        return Some((x, y, w, h, &node));
                    }
                }
                for (child_layout, child_info) in layout.children.iter().zip(&info.children) {
                    if let Some(child_node) = child_layout.node() {
                        if let Some(result) = find_custom_box(child_node, child_info) {
                            return Some(result);
                        }
                    }
                }
                None
            }

            let Some((cx_base, cy_base, width, height, select_node)) =
                find_custom_box(layout, info)
            else {
                panic!("select custom node not found in layout tree");
            };
            (cx_base, cy_base, width, height, Arc::clone(select_node))
        };

        // Popup should be closed initially.
        assert!(
            select_node
                .popup(&TextStyle::default(), &TextFlowStyle::default())
                .is_none(),
            "popup should start closed"
        );

        // Click at the center of the select box to open the popup.
        let cx = cx_base + width / 2.0;
        let cy = cy_base + height / 2.0;
        tab.handle_mouse_input(cx, cy, ElementState::Pressed);
        assert!(
            tab.has_pending_press(),
            "press should land on the select element"
        );
        tab.handle_mouse_input(cx, cy, ElementState::Released);
        assert!(!tab.has_pending_press());

        // Popup should be open after clicking the select box.
        assert!(
            select_node
                .popup(&TextStyle::default(), &TextFlowStyle::default())
                .is_some(),
            "popup should be open after clicking select box"
        );

        // Popup should be open after clicking the select box.
        assert!(
            select_node
                .popup(&TextStyle::default(), &TextFlowStyle::default())
                .is_some(),
            "popup should be open after clicking select box"
        );

        // Clicking on the select box again should toggle the popup closed.
        tab.handle_mouse_input(cx, cy, ElementState::Pressed);
        assert!(tab.has_pending_press());
        tab.handle_mouse_input(cx, cy, ElementState::Released);
        assert!(!tab.has_pending_press());
        assert!(
            select_node
                .popup(&TextStyle::default(), &TextFlowStyle::default())
                .is_none(),
            "popup should close when clicking select box again (toggle)"
        );
    }

    #[test]
    fn cross_origin_fetch_requires_matching_cors_header() {
        let tab = Tab::default();
        let web_origin = Origin::from_url_string("https://example.test/index.html");
        let permissions = Permissions::content_for_str("https://example.test/index.html");
        let url = Url::parse("https://other.test/data.json").unwrap();

        assert!(!tab.may_read_fetch_response(&web_origin, permissions, &url, &[]));

        let wildcard = vec![("Access-Control-Allow-Origin".to_string(), "*".to_string())];
        assert!(tab.may_read_fetch_response(&web_origin, permissions, &url, &wildcard));

        let matching = vec![(
            "Access-Control-Allow-Origin".to_string(),
            "https://example.test".to_string(),
        )];
        assert!(tab.may_read_fetch_response(&web_origin, permissions, &url, &matching));

        let other = vec![(
            "Access-Control-Allow-Origin".to_string(),
            "https://other.test".to_string(),
        )];
        assert!(!tab.may_read_fetch_response(&web_origin, permissions, &url, &other));
    }

    #[test]
    fn same_origin_fetch_is_readable_without_cors_header() {
        let tab = Tab::default();
        let web_origin = Origin::from_url_string("https://example.test/");
        let permissions = Permissions::content_for_str("https://example.test/");
        let url = Url::parse("https://example.test:443/api").unwrap();
        assert!(tab.may_read_fetch_response(&web_origin, permissions, &url, &[]));
    }

    #[test]
    fn internal_page_reads_any_response_without_cors() {
        let tab = Tab::default();
        let internal = Origin::internal();
        let url = Url::parse("https://other.test/api").unwrap();
        assert!(tab.may_read_fetch_response(&internal, Permissions::chrome(), &url, &[]));
    }

    #[test]
    fn data_page_cannot_read_internal_scheme_responses() {
        let tab = Tab::default();
        let data_origin = Origin::from_url(&Url::parse("data:text/html,test").unwrap());
        let permissions = Permissions::content_for_str("data:text/html,test");
        let resource_url = Url::parse("resource:///devtools/index.html").unwrap();
        assert!(!tab.may_read_fetch_response(&data_origin, permissions, &resource_url, &[]));
        let file_url = Url::parse("file:///etc/passwd").unwrap();
        assert!(!tab.may_read_fetch_response(&data_origin, permissions, &file_url, &[]));
    }

    #[test]
    fn opaque_origin_cannot_read_internal_scheme_responses() {
        let tab = Tab::default();
        let opaque = Origin::opaque();
        let resource_url = Url::parse("resource:///devtools/index.html").unwrap();
        assert!(!tab.may_read_fetch_response(&opaque, Permissions::none(), &resource_url, &[]));
        let file_url = Url::parse("file:///etc/passwd").unwrap();
        assert!(!tab.may_read_fetch_response(&opaque, Permissions::none(), &file_url, &[]));
    }

    #[test]
    fn web_page_reads_internal_scheme_responses_without_cors() {
        // The resource loader refuses to serve internal schemes to web origins,
        // so such responses never reach this check in practice.
        let tab = Tab::default();
        let web_origin = Origin::from_url_string("https://example.test/");
        let permissions = Permissions::content_for_str("https://example.test/");
        let url = Url::parse("data:text/plain,hello").unwrap();
        assert!(tab.may_read_fetch_response(&web_origin, permissions, &url, &[]));
    }

    #[test]
    fn privileged_tab_holds_chrome_permissions() {
        let mut tab = Tab::default();
        tab.set_privileged(true);
        tab.navigate("resource:///devtools/index.html".parse().unwrap());
        assert_eq!(tab.root_permissions(), Permissions::chrome());
        assert!(tab.root_origin().is_internal());
    }

    #[test]
    fn ordinary_resource_page_gets_no_chrome_permissions() {
        let mut tab = Tab::default();
        tab.navigate("resource:///test/index.html".parse().unwrap());
        let permissions = tab.root_permissions();
        assert!(!permissions.is_chrome());
        assert!(!permissions.file);
        assert!(permissions.resource);
        assert!(!tab.root_origin().is_internal());
    }

    #[test]
    fn navigating_bumps_document_generation() {
        // The generation a fetch is tagged with must change on every
        // navigation, so results from a previous document are detectable.
        let mut tab = Tab::default();
        let before = tab.document_generation();
        tab.navigate("resource:///test/a.html".parse().unwrap());
        assert_eq!(tab.document_generation(), before + 1);
        tab.navigate("resource:///test/b.html".parse().unwrap());
        assert_eq!(tab.document_generation(), before + 2);
    }

    #[test]
    fn navigation_reuses_the_same_text_measurer() {
        // A tab shares one measurer across its web views so the shaping cache
        // survives navigation. Skip when no system font is available, since
        // then there is nothing to share.
        let mut tab = Tab::default();
        tab.navigate("resource:///test/a.html".parse().unwrap());
        let Some(first) = tab.text_measurer.clone() else {
            return;
        };
        tab.navigate("resource:///test/b.html".parse().unwrap());
        let Some(second) = tab.text_measurer.clone() else {
            panic!("the measurer must outlive a navigation");
        };
        assert!(Arc::ptr_eq(&first, &second));
        // The live web view must be using the shared instance, not its own.
        assert!(Arc::ptr_eq(
            &first,
            tab.webview.as_ref().unwrap().text_measurer().unwrap()
        ));
    }

    #[test]
    fn headers_allow_cors_requires_exact_origin_value() {
        let initiator = Origin::from_url_string("https://example.test/");
        assert!(headers_allow_cors(
            &[("Access-Control-Allow-Origin".to_string(), "*".to_string())],
            &initiator
        ));
        assert!(headers_allow_cors(
            &[(
                "ACCEss-cOntRoL-aLLow-orIgIn".to_string(),
                "https://example.test".to_string()
            )],
            &initiator
        ));
        assert!(!headers_allow_cors(
            &[(
                "Access-Control-Allow-Origin".to_string(),
                "https://other.test".to_string()
            )],
            &initiator
        ));
    }

    #[test]
    fn scheme_capabilities_do_not_bypass_cors() {
        // Every scheme capability present, but not privileged: a cross-origin
        // response is still unreadable without CORS.
        let tab = Tab::default();
        let initiator = Origin::from_url_string("https://a.test/");
        let permissions = Permissions {
            network: true,
            resource: true,
            file: true,
            privileged: false,
        };
        let url = Url::parse("https://b.test/x").unwrap();

        assert!(!tab.may_read_fetch_response(&initiator, permissions, &url, &[]));
        assert!(tab.may_read_fetch_response(
            &initiator,
            permissions,
            &url,
            &[(
                "Access-Control-Allow-Origin".to_string(),
                "https://a.test".to_string()
            )],
        ));
    }

    #[test]
    fn privilege_is_the_only_cors_bypass() {
        let tab = Tab::default();
        let initiator = Origin::from_url_string("https://a.test/");
        let url = Url::parse("https://b.test/x").unwrap();

        let privileged = Permissions {
            network: true,
            resource: true,
            file: true,
            privileged: true,
        };
        assert!(tab.may_read_fetch_response(&initiator, privileged, &url, &[]));

        let unprivileged = Permissions {
            privileged: false,
            ..privileged
        };
        assert!(!tab.may_read_fetch_response(&initiator, unprivileged, &url, &[]));
    }

    #[test]
    fn cors_headers_do_not_grant_local_file_read() {
        // A response header can never establish access to a non-http scheme.
        let tab = Tab::default();
        let initiator = Origin::from_url_string("https://a.test/");
        let permissions = Permissions::content_for_str("https://a.test/");
        let url = Url::parse("file:///etc/passwd").unwrap();

        assert!(!tab.may_read_fetch_response(
            &initiator,
            permissions,
            &url,
            &[("Access-Control-Allow-Origin".to_string(), "*".to_string())],
        ));
    }
}