Refactor the various ways to control what users can do to extensions.

chrome/browser/extensions/installed_loader.cc

Index: chrome/browser/extensions/installed_loader.cc
===================================================================
--- chrome/browser/extensions/installed_loader.cc	(revision 138227)
+++ chrome/browser/extensions/installed_loader.cc	(working copy)
@@ -11,6 +11,7 @@
 #include "base/values.h"
 #include "chrome/browser/extensions/extension_prefs.h"
 #include "chrome/browser/extensions/extension_service.h"
+#include "chrome/browser/extensions/extension_system.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/extensions/extension.h"
 #include "chrome/common/extensions/extension_file_util.h"
@@ -68,13 +69,7 @@
 void InstalledLoader::Load(const ExtensionInfo& info, bool write_to_prefs) {
   std::string error;
   scoped_refptr<const Extension> extension(NULL);
-  // An explicit check against policy is required to behave correctly during
-  // startup.  This is because extensions that were previously OK might have
-  // been blacklisted in policy while Chrome was not running.
-  if (!extension_prefs_->IsExtensionAllowedByPolicy(info.extension_id,
-                                                    info.extension_location)) {
-    error = errors::kDisabledByPolicy;
-  } else if (info.extension_manifest.get()) {
+  if (info.extension_manifest.get()) {
     extension = Extension::Create(

[Pam (message me for reviews), 2012/05/22 12:51:07]

Is it permissible to Create the extension before checking the admin policy? It
looks safe, and doing that allows UserMayLoad() to take a full Extension*, which
may be useful to some providers.

         info.extension_path,
         info.extension_location,
@@ -96,6 +91,23 @@
     content::RecordAction(UserMetricsAction("Extensions.IDChangedError"));
   }
 
+  // An explicit check against policy is required to behave correctly during
+  // startup.  This is because extensions that were previously OK might have
+  // been blacklisted in policy while Chrome was not running.
+  // This isn't a new extension installation, so it's OK if some extension
+  // management policy delegates aren't yet registered with the
+  // ExtensionService. Admin policy is handled by the ExtensionPrefs class,
+  // which is created before the ExtensionService itself, so we have what we
+  // need here.
+  if (extension &&
+      !ExtensionSystem::Get(extension_service_->profile())->management_policy()
+          ->UserMayLoad(extension, info.extension_location, NULL)) {
+    // The error message from UserMayInstall() often contain the extension ID
+    // and is therefore not well suited to this UI.

[Pam (message me for reviews), 2012/05/22 12:51:07]

It is typically IDS_EXTENSION_CANT_INSTALL_POLICY_BLACKLIST, which contains the
extension ID. That's pretty ugly to have appear in user UI (as opposed to log
messages), but I'm willing to use it if you think it's good.

+    error = errors::kDisabledByPolicy;
+    extension = NULL;
+  }
+
   if (!extension) {
     extension_service_->
         ReportExtensionLoadError(info.extension_path, error, false);