fix(cdp): advertise geolocation override methods in protocol + test denied path

src/browser/webapi/Geolocation.zig

@@ -39,8 +39,8 @@ pub const PositionOptions = struct {
 // existing js.Scheduler (frame.js.scheduler) — a simpler, already-proven
 // async primitive (see FileReader.ReadTask) that gives us "run later,
 // off this call stack" for free, including cleanup on frame teardown via
-// the finalizer. watchPosition (Task 4) can layer repeat-in-ms scheduling
-// on top of the same Task if it lands here.
+// the finalizer. watchPosition (a follow-up PR) can layer repeat-in-ms
+// scheduling on top of the same Task if it lands here.
 const Task = struct {
     success: js.Function.Global,
     error_cb: ?js.Function.Global,
@@ -138,7 +138,7 @@ pub fn getCurrentPosition(
     options: ?PositionOptions,
     frame: *Frame,
 ) !void {
-    _ = options; // unused until Task 3 (maximumAge/timeout) and watchPosition (Task 4)
+    _ = options; // unused until later work (maximumAge/timeout) and watchPosition (a follow-up PR)
 
     errdefer success.release();
     errdefer if (error_cb) |cb| cb.release();
@@ -165,7 +165,7 @@ pub const JsApi = struct {
         pub const empty_with_no_proto = true;
     };
     pub const getCurrentPosition = bridge.function(Geolocation.getCurrentPosition, .{});
-    // watchPosition / clearWatch come in Task 4
+    // watchPosition / clearWatch come in a follow-up
 };
 
 pub const GeolocationCoordinates = struct {

src/cdp/domains/emulation.zig

@@ -434,3 +434,58 @@ test "cdp.Emulation: navigator.geolocation reads the override" {
     const v = try ls.local.exec("window.__geo_ok", null);
     try testing.expect(v.isTrue());
 }
+
+test "cdp.Emulation: navigator.geolocation errors PERMISSION_DENIED when permission is denied" {
+    var ctx = try testing.context();
+    defer ctx.deinit();
+    const bc = try ctx.loadBrowserContext(.{ .id = "BID-GEO3", .url = "cdp/dom1.html" });
+
+    try ctx.processMessage(.{
+        .id = 1,
+        .method = "Browser.setPermission",
+        .params = .{ .permission = .{ .name = "geolocation" }, .setting = "denied" },
+    });
+    try ctx.expectSentResult(null, .{ .id = 1, .session_id = null });
+
+    // Denied is authoritative over the override: even though an override is
+    // set, the denied permission must still win and produce PERMISSION_DENIED.
+    try ctx.processMessage(.{
+        .id = 2,
+        .method = "Emulation.setGeolocationOverride",
+        .params = .{ .latitude = 48.0, .longitude = 2.0, .accuracy = 10 },
+    });
+    try ctx.expectSentResult(null, .{ .id = 2 });
+
+    const frame = bc.mainFrame() orelse unreachable;
+
+    {
+        // Registers the callback synchronously; getCurrentPosition schedules
+        // delivery on frame.js.scheduler and returns before it runs.
+        var ls: js.Local.Scope = undefined;
+        frame.js.localScope(&ls);
+        defer ls.deinit();
+
+        _ = try ls.local.exec(
+            \\ window.__geo_code = 0;
+            \\ navigator.geolocation.getCurrentPosition(p => {
+            \\   p;
+            \\ }, error => {
+            \\   window.__geo_code = error.code;
+            \\ });
+        , null);
+    }
+
+    // Drive the session loop so the scheduled Task fires: Runner._tick runs
+    // browser.runMacrotasks() (which drains frame.js.scheduler) on every tick
+    // for a loaded page, same primitive Runner.waitForSelector/waitForScript
+    // use to pump pending scheduler work under a CDP-loaded page.
+    var runner = bc.session.runner(.{});
+    _ = try runner.tickForFrame(bc.page_handle.?.frame_id, 1000, .{ .until = .done });
+
+    var ls: js.Local.Scope = undefined;
+    frame.js.localScope(&ls);
+    defer ls.deinit();
+
+    const v = try ls.local.exec("window.__geo_code === 1", null);
+    try testing.expect(v.isTrue());
+}