Need tests for (likely not a complete list): * Test how InterestGroup values affected by k-anon checks are passed to generateBid. * adSizes, sizeGroups, ads, and adComponents all need such tests. * adSizes and sizeGroups currently have no tests, since they are incorectly currently not passed to generateBid at all. * Test empty ads array: Maybe simplest to test its numBids is empty? Hard to test a script isn't run. * directFromSellerSignals. * The expected order when both responses use the same ad slot is currently undefined. However, we are in the process of resolving this matter by implementing a LIFO approach, as outlined in progress at crrev.com/c/4930438. Once this solution is in place, a test case will be created by fetching two different URLs with signals that share the same ad slot. * After adding new test cases for the component auction, test the directFromSellerSignals function with component auctions. Consider to set up one auction in the top frame and two component auctions. Send three fetch requests to retrieve three different AdAuctionSignals headers. Ensure that you use three different seller origins for the auctions and a different one for the buyer origin. * All generateBid() and scoreAd() input parameters. * All interest group fields (passed to auction, have effect on auction). Very few fields covered. Should be sure to cover buyerAndSellerReportingId and buyerReportingId for component ads, as they should not be settable. Already covered: Validation when joining/leaving interest group. renderURL and metadata for component ads (only integers covered, but probably not worth covering all types, if we have coverage for the main renderURL). * Filtering/prioritization (including bidding signals influencing priorities) * Size restrictions / ad and component ad sizes. * additionalBids. * adCost. * bidCurrency. * modellingSignals. * Updates (both after auction and triggered). * All auctionConfig parameters (including invalid auctionConfigs, and ones with no buyers). * Joining interest group with duration of 0 should just leave the IG (not currently guaranteed to work, due to potential time skew between processes). * Multiple buyers. * Multiple interest groups with same owner. * Multiple frame tests (including loading component ad URNs in fenced frames of other frames, etc) * adAuctionConfig passed to reportResult(). * Component auctions. * Including cross-origin sellers. * Timeouts (seller timeout, buyer timeout, reporting timeout). * browserSignals fields in scoring/bidding methods. * In reporting methods, browserSignals fields: topLevelSeller, componentSeller, modifiedBid, adCost, madeHighestScoringOtherBid (with interest group from another origin). * Loading ads in iframes. * In fencedframes window.fence.setReportEventDataForAutomaticBeacons() * Automatic beacons (e.g., reserved.top_navigation) * Network timeouts. * Validate specific escaping behavior logic (still under discussion). There are a number of different rules for which characters are escaped, and whether spaces are escaped as "%20" or "+". * Reports not sent if ad not used. * Interactions with local network access API, which requires public networks to send CORS preflights for requests made over local networks. Needs testing with public publisher pages running auctions with sellers / buyers / update URLs on local networks. * Calling FLEDGE APIs (or at least leaveAdInterestGroup() with no args) in a non-ad FencedFrame. * Promise AuctionConfig parameters * Test network requests in terms of fetch behavior * Network partition (not yet specced). * Test that await is not needed for same-origin interest groups * Verify that's still in the spec/explainer first. * executionMode * Including cross-origin join/leave behavior with "group-by-origin" mode. * Make sure state is not shared. * Across scoreAd() / generateBid() calls, and with report calls. * In "group-by-origin" execution mode across IGs joined from different origins, and between generateBid() and reportWin(). * Test Content-Type headers allowed in responess for script/wasm/JSON fetches. * Test WASM support, updating createBiddingWasmHelperURL(). * Remaining interest group updates. * Check that an update with one valid field and one invalid one fails. * Test that an update works if owner and/or name match those in the interest group. * Test updating the update URL and bidding script URL so they are all the same origin (requires updating test fixture to handle multiple updates). * Test when Ads is null. * Test updating a cross origin interest group. * Test fields that are updatable but do not make it to 'generateBid'. If possible: * Aggregate reporting. * Join/leave permission delegation via .well-known files * Including tests for clearOriginJoinedInterestGroups(). * Include tests for HTTP-y/fetch-y things (e.g., whether they have cookies) * k-anonymity. * Signals request batching. This is an optional feature, so can't require it, but maybe a test where batching could be used, and make sure things work, whether batching is used or not? * reporting timeout being 0.