Refactor the various ways to control what users can do to extensions.

chrome/browser/extensions/installed_loader.cc

Index: chrome/browser/extensions/installed_loader.cc
===================================================================
--- chrome/browser/extensions/installed_loader.cc	(revision 138227)
+++ chrome/browser/extensions/installed_loader.cc	(working copy)
@@ -11,6 +11,7 @@
 #include "base/values.h"
 #include "chrome/browser/extensions/extension_prefs.h"
 #include "chrome/browser/extensions/extension_service.h"
+#include "chrome/browser/extensions/extension_system.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/extensions/extension.h"
 #include "chrome/common/extensions/extension_file_util.h"
@@ -68,13 +69,7 @@
 void InstalledLoader::Load(const ExtensionInfo& info, bool write_to_prefs) {
   std::string error;
   scoped_refptr<const Extension> extension(NULL);
-  // An explicit check against policy is required to behave correctly during
-  // startup.  This is because extensions that were previously OK might have
-  // been blacklisted in policy while Chrome was not running.
-  if (!extension_prefs_->IsExtensionAllowedByPolicy(info.extension_id,
-                                                    info.extension_location)) {
-    error = errors::kDisabledByPolicy;
-  } else if (info.extension_manifest.get()) {
+  if (info.extension_manifest.get()) {
     extension = Extension::Create(
         info.extension_path,
         info.extension_location,
@@ -96,6 +91,24 @@
     content::RecordAction(UserMetricsAction("Extensions.IDChangedError"));
   }
 
+  // An explicit check against policy is required to behave correctly during

[Aaron Boodman, 2012/05/29 03:03:08]

Comment sounds a bit scarier than necessary. Suggest something softer, like:

// Check policy at every load because policies can change
// after extension installation.

+  // startup.  This is because extensions that were previously OK might have

[Aaron Boodman, 2012/05/29 03:03:08]

Remove one space after the period :)

+  // been blacklisted in policy while Chrome was not running.
+  // This isn't a new extension installation, so it's OK if some extension

[Aaron Boodman, 2012/05/29 03:03:08]

"so it's ok if some extension..."

But that's not actually the case here, right? They are registered at this point.
So can we just remove that caveat?

+  // management policy delegates aren't yet registered with the
+  // ExtensionService. Admin policy is handled by the ExtensionPrefs class,
+  // which is created before the ExtensionService itself, so we have what we
+  // need here.
+  const ManagementPolicy* policy = ExtensionSystem::Get(
+      extension_service_->profile())->management_policy();
+  if (extension &&
+      !policy->UserMayLoad(extension, NULL)) {
+    // The error message from UserMayInstall() often contains the extension ID
+    // and is therefore not well suited to this UI.
+    error = errors::kDisabledByPolicy;
+    extension = NULL;
+  }
+
   if (!extension) {
     extension_service_->
         ReportExtensionLoadError(info.extension_path, error, false);