Added code to persist downloaded cloud policy to disk.

chrome/browser/policy/user_policy_signin_service.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/policy/user_policy_signin_service.h"
 
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/policy/browser_policy_connector.h"
 #include "chrome/browser/policy/cloud_policy_service.h"
 #include "chrome/browser/policy/user_cloud_policy_manager.h"
@@ skipping 107 matching lines @@
               kPolicyServiceInitializationDelayMilliseconds);
       // Initialize the UserCloudPolicyManager if it isn't already initialized.
       policy::DeviceManagementService* service = g_browser_process->
           browser_policy_connector()->device_management_service();
       manager_->Initialize(g_browser_process->local_state(),
                            service,
                            policy::USER_AFFILIATION_NONE);
       DCHECK(manager_->cloud_policy_service());
     }
 
-    // Register the CloudPolicyService if needed.
-    if (!manager_->IsClientRegistered())
+    // Register the CloudPolicyService if the cloud policy store is complete.
+    // TODO(atwilson): If there's a problem loading the stored policy, we could
+    // be left with no policy, so we should move this code to
+    // UserCloudPolicyManager and have it initiate a DMToken fetch only once
+    // the policy load is complete (http://crbug.com/143187).
+    if (!manager_->IsClientRegistered() &&
+        manager_->cloud_policy_service()->store()->is_initialized()) {

[Mattias Nissler (ping if slow), 2012/08/20 15:29:30]

Isn't this racy? What if the store just hasn't initialized yet?

[Andrew T Wilson (Slow), 2012/08/20 18:04:37]

It is indeed racy. The solution is to move the registration code into
UserCloudPolicyManager, per the TODO. I didn't want to bother trying to address
the race condition in this code, only to have to re-address it a different way
when I move it to UCPM.

The race condition is OK for now, since there are basically only 3 situations:

a) there are no downloaded policies yet - in this case, it seems that we always
initialize the store before the token DB finishes loading (since they share the
same thread). Obviously this is fragile, but it's good enough until we address
the TODO.
b) There are stored policies, and they fail to validate
c) There are stored policies, and they don't fail to validate - in that case,
when the store finishes initializing, the CloudPolicyService will register the
client using the DM token from the policy.

So the only case that fails currently is b), which I've mentioned in the
comment. I think this is fine for now, but obviously the TODO must be addressed
in short order/before launch.

[Mattias Nissler (ping if slow), 2012/08/21 10:45:16]

Fair enough. Also mention a) in the comment?

[Andrew T Wilson (Slow), 2012/08/21 23:18:19]

Done.

       RegisterCloudPolicyService();
+    }
   }
 }
 
 void UserPolicySigninService::RegisterCloudPolicyService() {
+  DVLOG(1) << "Fetching new DM Token";
   // TODO(atwilson): Move the code to mint the devicemanagement token into
   // TokenService.
   std::string token = TokenServiceFactory::GetForProfile(profile_)->
                           GetOAuth2LoginRefreshToken();
   if (token.empty()) {
     DLOG(WARNING) << "No OAuth Refresh Token - delaying policy download";
     return;
   }
 
   // Do nothing if already fetching an access token.
@@ skipping 18 matching lines @@
   DLOG(WARNING) << "Could not fetch access token for "
                 << kServiceScopeChromeOSDeviceManagement;
   oauth2_access_token_fetcher_.reset();
   manager_->CancelWaitForPolicyFetch();
 }
 
 void UserPolicySigninService::OnGetTokenSuccess(
     const std::string& access_token,
     const base::Time& expiration_time) {
   // Pass along the new access token to the CloudPolicyClient.
+  DVLOG(1) << "Fetched new scoped OAuth token:" << access_token;
   manager_->RegisterClient(access_token);
   oauth2_access_token_fetcher_.reset();
 }
 
 }  // namespace policy