Refactor the various ways to control what users can do to extensions.

chrome/browser/extensions/installed_loader.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/installed_loader.h"
 
 #include "base/file_path.h"
 #include "base/metrics/histogram.h"
 #include "base/stringprintf.h"
 #include "base/utf_string_conversions.h"
 #include "base/values.h"
 #include "chrome/browser/extensions/extension_prefs.h"
 #include "chrome/browser/extensions/extension_service.h"
+#include "chrome/browser/extensions/extension_system.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/extensions/extension.h"
 #include "chrome/common/extensions/extension_file_util.h"
 #include "chrome/common/extensions/extension_l10n_util.h"
 #include "chrome/common/extensions/extension_manifest_constants.h"
 #include "chrome/common/extensions/manifest.h"
 #include "chrome/common/pref_names.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/user_metrics.h"
 
@@ skipping 37 matching lines @@
     : extension_service_(extension_service),
       extension_prefs_(extension_service->extension_prefs()) {
 }
 
 InstalledLoader::~InstalledLoader() {
 }
 
 void InstalledLoader::Load(const ExtensionInfo& info, bool write_to_prefs) {
   std::string error;
   scoped_refptr<const Extension> extension(NULL);
-  // An explicit check against policy is required to behave correctly during
-  // startup.  This is because extensions that were previously OK might have
-  // been blacklisted in policy while Chrome was not running.
-  if (!extension_prefs_->IsExtensionAllowedByPolicy(info.extension_id,
-                                                    info.extension_location)) {
-    error = errors::kDisabledByPolicy;
-  } else if (info.extension_manifest.get()) {
+  if (info.extension_manifest.get()) {
     extension = Extension::Create(

[Pam (message me for reviews), 2012/05/22 12:51:07]

Is it permissible to Create the extension before checking the admin policy? It
looks safe, and doing that allows UserMayLoad() to take a full Extension*, which
may be useful to some providers.

         info.extension_path,
         info.extension_location,
         *info.extension_manifest,
         GetCreationFlags(&info),
         &error);
   } else {
     error = errors::kManifestUnreadable;
   }
 
   // Once installed, non-unpacked extensions cannot change their IDs (e.g., by
   // updating the 'key' field in their manifest).
   // TODO(jstritar): migrate preferences when unpacked extensions change IDs.
   if (extension &&
       extension->location() != Extension::LOAD &&
       info.extension_id != extension->id()) {
     error = errors::kCannotChangeExtensionID;
     extension = NULL;
     content::RecordAction(UserMetricsAction("Extensions.IDChangedError"));
   }
 
+  // An explicit check against policy is required to behave correctly during
+  // startup.  This is because extensions that were previously OK might have
+  // been blacklisted in policy while Chrome was not running.
+  // This isn't a new extension installation, so it's OK if some extension
+  // management policy delegates aren't yet registered with the
+  // ExtensionService. Admin policy is handled by the ExtensionPrefs class,
+  // which is created before the ExtensionService itself, so we have what we
+  // need here.
+  if (extension &&
+      !ExtensionSystem::Get(extension_service_->profile())->management_policy()
+          ->UserMayLoad(extension, info.extension_location, NULL)) {
+    // The error message from UserMayInstall() often contain the extension ID
+    // and is therefore not well suited to this UI.

[Pam (message me for reviews), 2012/05/22 12:51:07]

It is typically IDS_EXTENSION_CANT_INSTALL_POLICY_BLACKLIST, which contains the
extension ID. That's pretty ugly to have appear in user UI (as opposed to log
messages), but I'm willing to use it if you think it's good.

+    error = errors::kDisabledByPolicy;
+    extension = NULL;
+  }
+
   if (!extension) {
     extension_service_->
         ReportExtensionLoadError(info.extension_path, error, false);
     return;
   }
 
   if (write_to_prefs)
     extension_prefs_->UpdateManifest(extension);
 
   extension_service_->AddExtension(extension);
@@ skipping 188 matching lines @@
   if (extension_prefs_->AllowFileAccess(info->extension_id))
     flags |= Extension::ALLOW_FILE_ACCESS;
   if (extension_prefs_->IsFromWebStore(info->extension_id))
     flags |= Extension::FROM_WEBSTORE;
   if (extension_prefs_->IsFromBookmark(info->extension_id))
     flags |= Extension::FROM_BOOKMARK;
   return flags;
 }
 
 }  // namespace extensions