From f12d6603497c1c5551280670f1968af56a42a7a6 Mon Sep 17 00:00:00 2001
From: Christian Dullweber <dullweber@chromium.org>
Date: Wed, 20 May 2026 07:41:10 -0700
Subject: [PATCH] PrivateAi: Enforce HTTPS for proxy URLs and enable CT policy

Ensure that we can only connect to https proxies and enable certificate
transparency.

Bug: 513212892
Change-Id: Ic671b3f608335ff84632aa2753cf35e856b26906
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7857393
Commit-Queue: Christian Dullweber <dullweber@chromium.org>
Reviewed-by: Oleh Lamzin <lamzin@google.com>
Cr-Commit-Position: refs/heads/main@{#1633587}
---

diff --git a/components/private_ai/client.cc b/components/private_ai/client.cc
index c466ab6..66aee439 100644
--- a/components/private_ai/client.cc
+++ b/components/private_ai/client.cc
@@ -18,6 +18,7 @@
 #include "components/private_ai/phosphor/token_manager.h"
 #include "services/network/public/mojom/network_context.mojom.h"
 #include "url/gurl.h"
+#include "url/url_constants.h"
 
 namespace private_ai {
 
@@ -45,6 +46,11 @@
     if (!proxy_url.SchemeIsHTTPOrHTTPS()) {
       proxy_url = GURL(base::StrCat({"https://", proxy_url_string}));
     }
+    if (proxy_url.SchemeIs(url::kHttpScheme)) {
+      GURL::Replacements replacements;
+      replacements.SetSchemeStr(url::kHttpsScheme);
+      proxy_url = proxy_url.ReplaceComponents(replacements);
+    }
     connection_factory->EnableProxy(proxy_url);
   }
 
diff --git a/components/private_ai/connection_proxy.cc b/components/private_ai/connection_proxy.cc
index d10be5c..407cc2b 100644
--- a/components/private_ai/connection_proxy.cc
+++ b/components/private_ai/connection_proxy.cc
@@ -162,6 +162,7 @@
 
 
   auto context_params = network::mojom::NetworkContextParams::New();
+  context_params->enforce_chrome_ct_policy = true;
   context_params->cert_verifier_params = content::GetCertVerifierParams(
       cert_verifier::mojom::CertVerifierCreationParams::New());
   context_params->initial_custom_proxy_config =