DRM Policy: Add a DRM policy manager

[0nko]

Task/Issue URL: https://app.asana.com/1/137249556945/project/1207418217763355/task/1217678542848172?focus=true
Tech Design URL (if applicable): https://app.asana.com/1/137249556945/project/1207418217763355/task/1217623990825512

Description

This PR integrates the eme privacy config allow list and implements a central DRM policy manager.

Steps to test this PR

Setup

• Test privacy config URL: https://gist.githubusercontent.com/0nko/6ba6564e43ec35095a08c0e2288bbdde/raw/3eb9c38d461e73739ebc0d84f7c352cb9d7082d1/privacyconfig.json ("foxnews.com" in eme and "reference.dashif.org" in emeBlock)
• Install the internal build from this PR
• Run adb logcat | grep "drm policy decision" in a terminal and keep it open — every case below is verified by its log line, not by the absence of a dialog
• Note that the logged URL is the EME request origin, which is often a subdomain (Fox logs static.foxnews.com, not foxnews.com)

No rule matches (stock config, custom config URL OFF)

• Open https://reference.dashif.org/dash.js/latest/samples/drm/widevine.html
• Verify the DRM dialog appears
• Verify the log shows action=PROMPT, reason=NO_RULE

Session choice (stock config)

• Open https://reference.dashif.org/dash.js/latest/samples/drm/widevine.html
• On the dialog, tap Deny without ticking "Remember my choice"
• Reload the page
• Verify no dialog appears and the log shows action=DENY, reason=SESSION
• Open the same URL in a new tab and verify the dialog appears again
• Tap Deny
• Kill and reopen the app, load the same tab, and verify the choice is gone (reason=NO_RULE)

Remembered choice (stock config)

• Open https://reference.dashif.org/dash.js/latest/samples/drm/widevine.html
• On the DRM dialog, tick "Remember my choice" and tap Deny
• Reload and verify action=DENY, reason=USER_DENY_ALWAYS
• In Settings → Site Permissions, change that site's DRM to Allow
• Reload and verify action=GRANT, reason=USER_ALLOW_ALWAYS

Global DRM setting (stock config)

• Go to Settings → Site Permissions → DRM and turn it off
• Reload the page and verify action=DENY, reason=GLOBAL_OFF
• Confirm this wins even though the site is still set to Allow from the previous case

Allow list (switch to the test config now)

• Turn the global setting back on, and reset the site's DRM to "Ask every time"
• Go to Settings → Developer Settings → Override Privacy Remote Config URL → enable "Use Custom URL?", paste the test config URL, tap Force load config, confirm the "Remote Config Loaded" dialog
• Open https://www.foxnews.com and open an article with a video
• Verify no dialog and action=GRANT, reason=ALLOW_LIST
• Confirm the logged origin is static.foxnews.com — a subdomain matching the foxnews.com entry

Block list (test config now)

• Open https://reference.dashif.org/dash.js/latest/samples/drm/widevine.html
• Verify no dialog and action=DENY, reason=BLOCK_LIST
• Confirm playback fails

Protections off overrides the block list (test config)

• On the same page, open the privacy dashboard (shield icon) and turn Protections OFF
• Force-stop and reopen the app (clears any session choice), then reload the page
• Verify action=GRANT, reason=PROTECTIONS_OFF and that the video plays
• Turn protections back on afterwards

User choice beats the config lists (test config)

• Go to Settings -> Protections -> Open the dash.js page
• Set DRM to Allow
• Open https://reference.dashif.org/dash.js/latest/samples/drm/widevine.html
• Verify action=GRANT, reason=USER_ALLOW_ALWAYS — the block-list entry is overridden

Allow list in Fire mode (test config)

• Switch to Fire mode from the tab switcher
• Open https://www.foxnews.com and open an article with a video
• Verify no dialog and action=GRANT, reason=ALLOW_LIST
• Confirm the logged origin is static.foxnews.com — a subdomain matching the foxnews.com entry

Flag off (test config)

• Disable the centralPolicy flag in the Settings
• Open https://www.foxnews.com and open an article with a video
• Verify no drm policy decision lines appear at all
• Verify the DRM dialog appears as it does on develop, and that a session deny still holds for that tab

---

Note

Medium Risk
Changes how DRM (EME) is granted or denied, including auto-grant and auto-deny paths. Rollout is gated by an INTERNAL drmPolicy/centralPolicy flag with a legacy fallback.

Overview
Introduces a central DRM policy (behind drmPolicy / centralPolicy) that is the single GRANT / DENY / PROMPT decision for EME requests. First match wins: global off, remembered site setting, per-tab session, block list, protections-off, then the eme allow list; otherwise prompt.

When the flag is on, SitePermissionsManagerImpl applies that decision instead of the old ask/grant path, and the DRM dialog no longer re-checks session or the block list. Session choices move to a tab-scoped DrmSessionStore (cleared with fireproof wipe). Flag-off keeps the previous app-wide session map and exact-host matching.

Allow and block lists now match subdomains (sameOrSubdomain). User settings and “protections off” also walk parent hosts so a choice on the page host still applies to a subresource origin. eme defaults to disabled when the privacy-config toggle is unset, so leftover exceptions cannot keep granting DRM after the feature is dropped from config.

^{Reviewed by Cursor Bugbot for commit daaa1fc. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit afb17d1. Configure here.}

[anikiki]

Looks good and works a expected! 🎉