1 files changed, 55 insertions, 1 deletions

diff --git a/toolkit/components/antitracking/ContentBlockingAllowList.h b/toolkit/components/antitracking/ContentBlockingAllowList.h
index 2601173db7..1db29f3e35 100644
--- a/toolkit/components/antitracking/ContentBlockingAllowList.h
+++ b/toolkit/components/antitracking/ContentBlockingAllowList.h
@@ -9,6 +9,8 @@
 
 #include "mozilla/dom/BrowsingContext.h"
 #include "nsIContentBlockingAllowList.h"
+#include "nsIPermission.h"
+#include "nsTHashSet.h"
 
 class nsICookieJarSettings;
 class nsIHttpChannel;
@@ -19,7 +21,59 @@ class nsPIDOMWindowInner;
 namespace mozilla {
 
 class OriginAttributes;
-struct ContentBlockingAllowListCache;
+
+/**
+ * @class ContentBlockingAllowListCache
+ *
+ * @brief This class represents a cache for the content blocking allow list. It
+ *        is used for repeated lookups of the allow list for a specific base
+ *        domain. Only use it if you need base domain lookups. In most cases
+ *        this is not what you want. For regular allow-list checks by principal
+ *        please use ContentBlockingAllowList.
+ */
+class ContentBlockingAllowListCache final {
+ public:
+  /**
+   * @brief Checks if a given base domain is allow-listed. This method considers
+   * the domain to be allow list if either the base domain or any of its
+   * subdomains are allow-listed.
+   * This is different from regular allow-list checks,
+   * @see{ContentBlockingAllowList::Check} where allow-listed state is only
+   * inherited to subdomains if the base domain is allow-listed.
+   *
+   *  Example:
+   *  If "example.com" is allow-listed, then "www.example.com" is also
+   *  considered allow-listed.
+   *  If foobar.example.org is allow-listed, then "example.org" is not
+   *  considered allow-listed.
+   *
+   * @param aBaseDomain The base domain to check.
+   * @param aOriginAttributes The origin attributes associated with the base
+   * domain.
+   * @param aIsAllowListed [out] Set to true if the base domain is allow-listed,
+   * false otherwise.
+   *
+   * @return NS_OK if the check is successful, or an error code otherwise.
+   */
+  nsresult CheckForBaseDomain(const nsACString& aBaseDomain,
+                              const OriginAttributes& aOriginAttributes,
+                              bool& aIsAllowListed);
+
+ private:
+  bool mIsInitialized = false;
+
+  // The cache is a hash set of base domains. If a base domain is in the set, it
+  // is allow-listed for that context (normal browsing, private browsing.)
+  nsTHashSet<nsCString> mEntries;
+  nsTHashSet<nsCString> mEntriesPrivateBrowsing;
+
+  /**
+   * @brief Initializes the content blocking allow list cache if needed.
+   *
+   * @return NS_OK if initialization is successful, or an error code otherwise.
+   */
+  nsresult EnsureInit();
+};
 
 class ContentBlockingAllowList final : public nsIContentBlockingAllowList {
  public: