[Sync] Add SyncEncryptionHandler

sync/internal_api/sync_manager_impl_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Unit tests for the SyncApi. Note that a lot of the underlying
 // functionality is provided by the Syncable layer, which has its own
 // unit tests. We'll test SyncApi specific things in this harness.
 
 #include <cstddef>
 #include <map>
@@ skipping 18 matching lines @@
 #include "sync/internal_api/public/engine/model_safe_worker.h"
 #include "sync/internal_api/public/engine/polling_constants.h"
 #include "sync/internal_api/public/http_post_provider_factory.h"
 #include "sync/internal_api/public/http_post_provider_interface.h"
 #include "sync/internal_api/public/read_node.h"
 #include "sync/internal_api/public/read_transaction.h"
 #include "sync/internal_api/public/test/test_internal_components_factory.h"
 #include "sync/internal_api/public/test/test_user_share.h"
 #include "sync/internal_api/public/write_node.h"
 #include "sync/internal_api/public/write_transaction.h"
+#include "sync/internal_api/sync_encryption_handler_impl.h"
 #include "sync/internal_api/sync_manager_impl.h"
 #include "sync/internal_api/syncapi_internal.h"
 #include "sync/js/js_arg_list.h"
 #include "sync/js/js_backend.h"
 #include "sync/js/js_event_handler.h"
 #include "sync/js/js_reply_handler.h"
 #include "sync/js/js_test_util.h"
 #include "sync/notifier/sync_notifier.h"
 #include "sync/notifier/sync_notifier_observer.h"
 #include "sync/protocol/bookmark_specifics.pb.h"
@@ skipping 21 matching lines @@
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 using base::ExpectDictStringValue;
 using testing::_;
 using testing::AnyNumber;
 using testing::AtLeast;
 using testing::DoAll;
 using testing::InSequence;
 using testing::Invoke;
+using testing::NiceMock;
 using testing::Return;
 using testing::SaveArg;
 using testing::StrictMock;
 
 namespace syncer {
 
 using sessions::SyncSessionSnapshot;
 using syncable::IS_DEL;
 using syncable::IS_UNSYNCED;
 using syncable::kEncryptedString;
@@ skipping 128 matching lines @@
   entry.Put(syncable::SPECIFICS, specifics);
   return entry.Get(syncable::META_HANDLE);
 }
 
 }  // namespace
 
 class SyncApiTest : public testing::Test {
  public:
   virtual void SetUp() {
     test_user_share_.SetUp();
+    SetUpEncryption();
   }
 
   virtual void TearDown() {
     test_user_share_.TearDown();
   }
 
+  void SetUpEncryption() {
+    ReadTransaction trans(FROM_HERE, test_user_share_.user_share());
+    encryption_handler_.reset(
+        new SyncEncryptionHandlerImpl(test_user_share_.user_share(),
+                                      trans.GetCryptographer()));
+    trans.GetCryptographer()->SetSyncEncryptionHandlerDelegate(
+        encryption_handler_.get());
+  }
+
  protected:
   MessageLoop message_loop_;
   TestUserShare test_user_share_;
+  scoped_ptr<SyncEncryptionHandler> encryption_handler_;
 };
 
 TEST_F(SyncApiTest, SanityCheckTest) {
   {
     ReadTransaction trans(FROM_HERE, test_user_share_.user_share());
     EXPECT_TRUE(trans.GetWrappedTrans() != NULL);
   }
   {
     WriteTransaction trans(FROM_HERE, test_user_share_.user_share());
     EXPECT_TRUE(trans.GetWrappedTrans() != NULL);
@@ skipping 218 matching lines @@
         password_node.GetPasswordSpecifics();
     EXPECT_EQ("secret", data.password_value());
   }
 }
 
 TEST_F(SyncApiTest, WriteEncryptedTitle) {
   KeyParams params = {"localhost", "username", "passphrase"};
   {
     ReadTransaction trans(FROM_HERE, test_user_share_.user_share());
     trans.GetCryptographer()->AddKey(params);
-    trans.GetCryptographer()->set_encrypt_everything();
   }
+  encryption_handler_->EnableEncryptEverything();
   {
     WriteTransaction trans(FROM_HERE, test_user_share_.user_share());
     ReadNode root_node(&trans);
     root_node.InitByRootLookup();
 
     WriteNode bookmark_node(&trans);
     WriteNode::InitUniqueByCreationResult result =
         bookmark_node.InitUniqueByCreation(BOOKMARKS,
                                            root_node, "foo");
     EXPECT_EQ(WriteNode::INIT_SUCCESS, result);
@@ skipping 186 matching lines @@
 };
 
 class SyncManagerObserverMock : public SyncManager::Observer {
  public:
   MOCK_METHOD1(OnSyncCycleCompleted,
                void(const SyncSessionSnapshot&));  // NOLINT
   MOCK_METHOD3(OnInitializationComplete,
                void(const WeakHandle<JsBackend>&, bool,
                     syncer::ModelTypeSet));  // NOLINT
   MOCK_METHOD1(OnConnectionStatusChange, void(ConnectionStatus));  // NOLINT
+  MOCK_METHOD0(OnStopSyncingPermanently, void());  // NOLINT
+  MOCK_METHOD1(OnUpdatedToken, void(const std::string&));  // NOLINT
+  MOCK_METHOD1(OnActionableError,
+               void(const SyncProtocolError&));  // NOLINT
+};
+
+class SyncEncryptionHandlerObserverMock
+    : public SyncEncryptionHandler::Observer {
+ public:
   MOCK_METHOD2(OnPassphraseRequired,
                void(PassphraseRequiredReason,
                     const sync_pb::EncryptedData&));  // NOLINT
   MOCK_METHOD0(OnPassphraseAccepted, void());  // NOLINT
   MOCK_METHOD1(OnBootstrapTokenUpdated, void(const std::string&));  // NOLINT
-  MOCK_METHOD0(OnStopSyncingPermanently, void());  // NOLINT
-  MOCK_METHOD1(OnUpdatedToken, void(const std::string&));  // NOLINT
   MOCK_METHOD2(OnEncryptedTypesChanged,
                void(ModelTypeSet, bool));  // NOLINT
   MOCK_METHOD0(OnEncryptionComplete, void());  // NOLINT
-  MOCK_METHOD1(OnActionableError,
-               void(const SyncProtocolError&));  // NOLINT
+  MOCK_METHOD1(OnCryptographerStateChanged, void(Cryptographer*));  // NOLINT
 };
 
 class SyncNotifierMock : public SyncNotifier {
  public:
   MOCK_METHOD2(UpdateRegisteredIds,
                void(SyncNotifierObserver*, const ObjectIdSet&));
   MOCK_METHOD1(SetUniqueId, void(const std::string&));
   MOCK_METHOD1(SetStateDeprecated, void(const std::string&));
   MOCK_METHOD2(UpdateCredentials,
                void(const std::string&, const std::string&));
@@ skipping 31 matching lines @@
     SyncCredentials credentials;
     credentials.email = "foo@bar.com";
     credentials.sync_token = "sometoken";
 
     sync_notifier_mock_ = new StrictMock<SyncNotifierMock>();
     EXPECT_CALL(*sync_notifier_mock_, SetUniqueId(_));
     EXPECT_CALL(*sync_notifier_mock_, SetStateDeprecated(""));
     EXPECT_CALL(*sync_notifier_mock_,
                 UpdateCredentials(credentials.email, credentials.sync_token));
 
-    sync_manager_.AddObserver(&observer_);
-    EXPECT_CALL(observer_, OnInitializationComplete(_, _, _)).
+    sync_manager_.AddObserver(&manager_observer_);
+    EXPECT_CALL(manager_observer_, OnInitializationComplete(_, _, _)).
         WillOnce(SaveArg<0>(&js_backend_));
 
     EXPECT_FALSE(js_backend_.IsInitialized());
 
     std::vector<ModelSafeWorker*> workers;
     ModelSafeRoutingInfo routing_info;
     GetModelSafeRoutingInfo(&routing_info);
 
     // Takes ownership of |sync_notifier_mock_|.
     sync_manager_.Init(temp_dir_.path(),
                        WeakHandle<JsEventHandler>(),
                        "bogus", 0, false,
                        base::MessageLoopProxy::current(),
                        scoped_ptr<HttpPostProviderFactory>(
                            new TestHttpPostProviderFactory()),
                        workers, &extensions_activity_monitor_, this,
                        credentials,
                        scoped_ptr<SyncNotifier>(sync_notifier_mock_),
                        "", "",  // bootstrap tokens
                        true,  // enable keystore encryption
                        scoped_ptr<InternalComponentsFactory>(GetFactory()),
                        &encryptor_,
                        &handler_,
                        NULL);
 
+    sync_manager_.GetEncryptionHandler()->AddObserver(&encryption_observer_);
+
     EXPECT_TRUE(js_backend_.IsInitialized());
 
     for (ModelSafeRoutingInfo::iterator i = routing_info.begin();
          i != routing_info.end(); ++i) {
       type_roots_[i->first] = MakeServerNodeForType(
           sync_manager_.GetUserShare(), i->first);
     }
     PumpLoop();
   }
 
   void TearDown() {
-    sync_manager_.RemoveObserver(&observer_);
+    sync_manager_.RemoveObserver(&manager_observer_);
     EXPECT_CALL(*sync_notifier_mock_, UpdateRegisteredIds(_, ObjectIdSet()));
     sync_manager_.ShutdownOnSyncThread();
     sync_notifier_mock_ = NULL;
     PumpLoop();
   }
 
   void GetModelSafeRoutingInfo(ModelSafeRoutingInfo* out) {
     (*out)[NIGORI] = GROUP_PASSIVE;
     (*out)[BOOKMARKS] = GROUP_PASSIVE;
     (*out)[THEMES] = GROUP_PASSIVE;
@@ skipping 14 matching lines @@
                        EncryptionStatus encryption_status) {
     UserShare* share = sync_manager_.GetUserShare();
     share->directory->set_initial_sync_ended_for_type(NIGORI, true);
 
     // We need to create the nigori node as if it were an applied server update.
     int64 nigori_id = GetIdForDataType(NIGORI);
     if (nigori_id == kInvalidId)
       return false;
 
     // Set the nigori cryptographer information.
+    if (encryption_status == FULL_ENCRYPTION)
+      sync_manager_.GetEncryptionHandler()->EnableEncryptEverything();
+
     WriteTransaction trans(FROM_HERE, share);
     Cryptographer* cryptographer = trans.GetCryptographer();
     if (!cryptographer)
       return false;
     if (encryption_status != UNINITIALIZED) {
       KeyParams params = {"localhost", "dummy", "foobar"};
       cryptographer->AddKey(params);
     } else {
       DCHECK_NE(nigori_status, WRITE_TO_NIGORI);
     }
-    if (encryption_status == FULL_ENCRYPTION)
-      cryptographer->set_encrypt_everything();
     if (nigori_status == WRITE_TO_NIGORI) {
       sync_pb::NigoriSpecifics nigori;
       cryptographer->GetKeys(nigori.mutable_encrypted());
       cryptographer->UpdateNigoriFromEncryptedTypes(&nigori);
       WriteNode node(&trans);
       EXPECT_EQ(BaseNode::INIT_OK, node.InitByIdLookup(nigori_id));
       node.SetNigoriSpecifics(nigori);
     }
     return cryptographer->is_ready();
   }
@@ skipping 39 matching lines @@
     return true;
   }
 
   virtual InternalComponentsFactory* GetFactory() {
     return new TestInternalComponentsFactory(STORAGE_IN_MEMORY);
   }
 
   // Returns true if we are currently encrypting all sync data.  May
   // be called on any thread.
   bool EncryptEverythingEnabledForTest() {
-    ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
-    return trans.GetCryptographer()->encrypt_everything();
+    return sync_manager_.GetEncryptionHandler()->EncryptEverythingEnabled();
   }
 
   // Gets the set of encrypted types from the cryptographer
   // Note: opens a transaction.  May be called from any thread.
   syncer::ModelTypeSet GetEncryptedDataTypesForTest() {
     ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     return GetEncryptedTypes(&trans);
   }
 
   void SimulateEnableNotificationsForTest() {
@@ skipping 40 matching lines @@
   // Sync Id's for the roots of the enabled datatypes.
   std::map<ModelType, int64> type_roots_;
   FakeExtensionsActivityMonitor extensions_activity_monitor_;
 
  protected:
   FakeEncryptor encryptor_;
   TestUnrecoverableErrorHandler handler_;
   StrictMock<SyncNotifierMock>* sync_notifier_mock_;
   SyncManagerImpl sync_manager_;
   WeakHandle<JsBackend> js_backend_;
-  StrictMock<SyncManagerObserverMock> observer_;
+  StrictMock<SyncManagerObserverMock> manager_observer_;
+  StrictMock<SyncEncryptionHandlerObserverMock> encryption_observer_;
 };
 
 TEST_F(SyncManagerTest, UpdateEnabledTypes) {
   ModelSafeRoutingInfo routes;
   GetModelSafeRoutingInfo(&routes);
   const ModelTypeSet enabled_types = GetRoutingInfoTypes(routes);
 
   EXPECT_CALL(*sync_notifier_mock_,
               UpdateRegisteredIds(
                   _, ModelTypeSetToObjectIdSet(enabled_types)));
@@ skipping 360 matching lines @@
 
   TriggerOnIncomingNotificationForTest(empty_model_types);
   TriggerOnIncomingNotificationForTest(model_types);
 
   // Should trigger the replies.
   PumpLoop();
 }
 
 TEST_F(SyncManagerTest, RefreshEncryptionReady) {
   EXPECT_TRUE(SetUpEncryption(WRITE_TO_NIGORI, DEFAULT_ENCRYPTION));
-  EXPECT_CALL(observer_, OnEncryptionComplete());
+  EXPECT_CALL(encryption_observer_, OnEncryptionComplete());
+  EXPECT_CALL(encryption_observer_, OnCryptographerStateChanged(_));
 
-  sync_manager_.RefreshNigori(kTestChromeVersion, base::Bind(&DoNothing));
+  sync_manager_.GetEncryptionHandler()->ReloadNigori();
   PumpLoop();
 
   const ModelTypeSet encrypted_types = GetEncryptedDataTypesForTest();
   EXPECT_TRUE(encrypted_types.Has(PASSWORDS));
   EXPECT_FALSE(EncryptEverythingEnabledForTest());
 
   {
     ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     ReadNode node(&trans);
     EXPECT_EQ(BaseNode::INIT_OK,
               node.InitByIdLookup(GetIdForDataType(NIGORI)));
     sync_pb::NigoriSpecifics nigori = node.GetNigoriSpecifics();
     EXPECT_TRUE(nigori.has_encrypted());
     Cryptographer* cryptographer = trans.GetCryptographer();
     EXPECT_TRUE(cryptographer->is_ready());
     EXPECT_TRUE(cryptographer->CanDecrypt(nigori.encrypted()));
   }
 }
 
 // Attempt to refresh encryption when nigori not downloaded.
 TEST_F(SyncManagerTest, RefreshEncryptionNotReady) {
   // Don't set up encryption (no nigori node created).
 
-  // Should fail.
-  sync_manager_.RefreshNigori(kTestChromeVersion, base::Bind(&DoNothing));
+  // Should fail. Triggers an OnPassphraseRequired because the cryptographer
+  // is not ready.
+  EXPECT_CALL(encryption_observer_, OnPassphraseRequired(_, _)).Times(1);
+  EXPECT_CALL(encryption_observer_, OnCryptographerStateChanged(_));
+  sync_manager_.GetEncryptionHandler()->ReloadNigori();
   PumpLoop();
 
   const ModelTypeSet encrypted_types = GetEncryptedDataTypesForTest();
   EXPECT_TRUE(encrypted_types.Has(PASSWORDS));  // Hardcoded.
   EXPECT_FALSE(EncryptEverythingEnabledForTest());
 }
 
 // Attempt to refresh encryption when nigori is empty.
 TEST_F(SyncManagerTest, RefreshEncryptionEmptyNigori) {
   EXPECT_TRUE(SetUpEncryption(DONT_WRITE_NIGORI, DEFAULT_ENCRYPTION));
-  EXPECT_CALL(observer_, OnEncryptionComplete());
+  EXPECT_CALL(encryption_observer_, OnEncryptionComplete()).Times(1);
+  EXPECT_CALL(encryption_observer_, OnCryptographerStateChanged(_));
 
   // Should write to nigori.
-  sync_manager_.RefreshNigori(kTestChromeVersion, base::Bind(&DoNothing));
+  sync_manager_.GetEncryptionHandler()->ReloadNigori();
   PumpLoop();
 
   const ModelTypeSet encrypted_types = GetEncryptedDataTypesForTest();
   EXPECT_TRUE(encrypted_types.Has(PASSWORDS));  // Hardcoded.
   EXPECT_FALSE(EncryptEverythingEnabledForTest());
 
   {
     ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     ReadNode node(&trans);
     EXPECT_EQ(BaseNode::INIT_OK,
               node.InitByIdLookup(GetIdForDataType(NIGORI)));
     sync_pb::NigoriSpecifics nigori = node.GetNigoriSpecifics();
     EXPECT_TRUE(nigori.has_encrypted());
     Cryptographer* cryptographer = trans.GetCryptographer();
     EXPECT_TRUE(cryptographer->is_ready());
     EXPECT_TRUE(cryptographer->CanDecrypt(nigori.encrypted()));
   }
 }
 
 TEST_F(SyncManagerTest, EncryptDataTypesWithNoData) {
   EXPECT_TRUE(SetUpEncryption(WRITE_TO_NIGORI, DEFAULT_ENCRYPTION));
-  EXPECT_CALL(observer_,
+  EXPECT_CALL(encryption_observer_,
               OnEncryptedTypesChanged(
                   HasModelTypes(ModelTypeSet::All()), true));
-  EXPECT_CALL(observer_, OnEncryptionComplete());
-  sync_manager_.EnableEncryptEverything();
+  EXPECT_CALL(encryption_observer_, OnEncryptionComplete());
+  sync_manager_.GetEncryptionHandler()->EnableEncryptEverything();
   EXPECT_TRUE(EncryptEverythingEnabledForTest());
 }
 
 TEST_F(SyncManagerTest, EncryptDataTypesWithData) {
   size_t batch_size = 5;
   EXPECT_TRUE(SetUpEncryption(WRITE_TO_NIGORI, DEFAULT_ENCRYPTION));
 
   // Create some unencrypted unsynced data.
   int64 folder = MakeFolderWithParent(sync_manager_.GetUserShare(),
                                       BOOKMARKS,
@@ skipping 14 matching lines @@
   // Last batch_size nodes are a third type that will not need encryption.
   for (; i < 3*batch_size; ++i) {
     MakeNodeWithParent(sync_manager_.GetUserShare(), THEMES,
                        base::StringPrintf("%"PRIuS"", i),
                        GetIdForDataType(THEMES));
   }
 
   {
     ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     EXPECT_TRUE(GetEncryptedTypes(&trans).Equals(
-        Cryptographer::SensitiveTypes()));
+        SyncEncryptionHandler::SensitiveTypes()));
     EXPECT_TRUE(syncable::VerifyDataTypeEncryptionForTest(
         trans.GetWrappedTrans(),
         trans.GetCryptographer(),
         BOOKMARKS,
         false /* not encrypted */));
     EXPECT_TRUE(syncable::VerifyDataTypeEncryptionForTest(
         trans.GetWrappedTrans(),
         trans.GetCryptographer(),
         SESSIONS,
         false /* not encrypted */));
     EXPECT_TRUE(syncable::VerifyDataTypeEncryptionForTest(
         trans.GetWrappedTrans(),
         trans.GetCryptographer(),
         THEMES,
         false /* not encrypted */));
   }
 
-  EXPECT_CALL(observer_,
+  EXPECT_CALL(encryption_observer_,
               OnEncryptedTypesChanged(
                   HasModelTypes(ModelTypeSet::All()), true));
-  EXPECT_CALL(observer_, OnEncryptionComplete());
-  sync_manager_.EnableEncryptEverything();
+  EXPECT_CALL(encryption_observer_, OnEncryptionComplete());
+  sync_manager_.GetEncryptionHandler()->EnableEncryptEverything();
   EXPECT_TRUE(EncryptEverythingEnabledForTest());
   {
     ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     EXPECT_TRUE(GetEncryptedTypes(&trans).Equals(
         ModelTypeSet::All()));
     EXPECT_TRUE(syncable::VerifyDataTypeEncryptionForTest(
         trans.GetWrappedTrans(),
         trans.GetCryptographer(),
         BOOKMARKS,
         true /* is encrypted */));
     EXPECT_TRUE(syncable::VerifyDataTypeEncryptionForTest(
         trans.GetWrappedTrans(),
         trans.GetCryptographer(),
         SESSIONS,
         true /* is encrypted */));
     EXPECT_TRUE(syncable::VerifyDataTypeEncryptionForTest(
         trans.GetWrappedTrans(),
         trans.GetCryptographer(),
         THEMES,
         true /* is encrypted */));
   }
 
   // Trigger's a ReEncryptEverything with new passphrase.
-  testing::Mock::VerifyAndClearExpectations(&observer_);
-  EXPECT_CALL(observer_, OnBootstrapTokenUpdated(_));
-  EXPECT_CALL(observer_, OnPassphraseAccepted());
-  EXPECT_CALL(observer_, OnEncryptionComplete());
-  sync_manager_.SetEncryptionPassphrase("new_passphrase", true);
+  testing::Mock::VerifyAndClearExpectations(&encryption_observer_);
+  EXPECT_CALL(encryption_observer_, OnBootstrapTokenUpdated(_));
+  EXPECT_CALL(encryption_observer_, OnPassphraseAccepted());
+  EXPECT_CALL(encryption_observer_, OnEncryptionComplete());
+  EXPECT_CALL(encryption_observer_, OnCryptographerStateChanged(_));
+  sync_manager_.GetEncryptionHandler()->SetEncryptionPassphrase(
+      "new_passphrase", true);
   EXPECT_TRUE(EncryptEverythingEnabledForTest());
   {
     ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     EXPECT_TRUE(GetEncryptedTypes(&trans).Equals(ModelTypeSet::All()));
     EXPECT_TRUE(syncable::VerifyDataTypeEncryptionForTest(
         trans.GetWrappedTrans(),
         trans.GetCryptographer(),
         BOOKMARKS,
         true /* is encrypted */));
     EXPECT_TRUE(syncable::VerifyDataTypeEncryptionForTest(
         trans.GetWrappedTrans(),
         trans.GetCryptographer(),
         SESSIONS,
         true /* is encrypted */));
     EXPECT_TRUE(syncable::VerifyDataTypeEncryptionForTest(
         trans.GetWrappedTrans(),
         trans.GetCryptographer(),
         THEMES,
         true /* is encrypted */));
   }
   // Calling EncryptDataTypes with an empty encrypted types should not trigger
   // a reencryption and should just notify immediately.
-  // TODO(zea): add logic to ensure nothing was written.
-  testing::Mock::VerifyAndClearExpectations(&observer_);
-  EXPECT_CALL(observer_, OnBootstrapTokenUpdated(_)).Times(0);
-  EXPECT_CALL(observer_, OnPassphraseAccepted()).Times(0);
-  EXPECT_CALL(observer_, OnEncryptionComplete());
-  sync_manager_.EnableEncryptEverything();
+  testing::Mock::VerifyAndClearExpectations(&encryption_observer_);
+  EXPECT_CALL(encryption_observer_, OnBootstrapTokenUpdated(_)).Times(0);
+  EXPECT_CALL(encryption_observer_, OnPassphraseAccepted()).Times(0);
+  EXPECT_CALL(encryption_observer_, OnEncryptionComplete()).Times(0);
+  sync_manager_.GetEncryptionHandler()->EnableEncryptEverything();
 }
 
 // Test that when there are no pending keys and the cryptographer is not
 // initialized, we add a key based on the current GAIA password.
 // (case 1 in SyncManager::SyncInternal::SetEncryptionPassphrase)
 TEST_F(SyncManagerTest, SetInitialGaiaPass) {
   EXPECT_FALSE(SetUpEncryption(DONT_WRITE_NIGORI, UNINITIALIZED));
-  EXPECT_CALL(observer_, OnBootstrapTokenUpdated(_));
-  EXPECT_CALL(observer_, OnPassphraseAccepted());
-  EXPECT_CALL(observer_, OnEncryptionComplete());
-  sync_manager_.SetEncryptionPassphrase("new_passphrase", false);
+  EXPECT_CALL(encryption_observer_, OnBootstrapTokenUpdated(_));
+  EXPECT_CALL(encryption_observer_, OnPassphraseAccepted());
+  EXPECT_CALL(encryption_observer_, OnEncryptionComplete());
+  EXPECT_CALL(encryption_observer_, OnCryptographerStateChanged(_));
+  sync_manager_.GetEncryptionHandler()->SetEncryptionPassphrase(
+      "new_passphrase",
+      false);
+  EXPECT_FALSE(
+      sync_manager_.GetEncryptionHandler()->IsUsingExplicitPassphrase());
   EXPECT_FALSE(EncryptEverythingEnabledForTest());
   {
     ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     ReadNode node(&trans);
     EXPECT_EQ(BaseNode::INIT_OK, node.InitByTagLookup(kNigoriTag));
     sync_pb::NigoriSpecifics nigori = node.GetNigoriSpecifics();
     Cryptographer* cryptographer = trans.GetCryptographer();
     EXPECT_TRUE(cryptographer->is_ready());
     EXPECT_TRUE(cryptographer->CanDecrypt(nigori.encrypted()));
   }
 }
 
 // Test that when there are no pending keys and we have on the old GAIA
 // password, we update and re-encrypt everything with the new GAIA password.
 // (case 1 in SyncManager::SyncInternal::SetEncryptionPassphrase)
 TEST_F(SyncManagerTest, UpdateGaiaPass) {
   EXPECT_TRUE(SetUpEncryption(WRITE_TO_NIGORI, DEFAULT_ENCRYPTION));
   Cryptographer verifier(&encryptor_);
   {
     ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     Cryptographer* cryptographer = trans.GetCryptographer();
     std::string bootstrap_token;
     cryptographer->GetBootstrapToken(&bootstrap_token);
     verifier.Bootstrap(bootstrap_token);
   }
-  EXPECT_CALL(observer_, OnBootstrapTokenUpdated(_));
-  EXPECT_CALL(observer_, OnPassphraseAccepted());
-  EXPECT_CALL(observer_, OnEncryptionComplete());
-  sync_manager_.SetEncryptionPassphrase("new_passphrase", false);
+  EXPECT_CALL(encryption_observer_, OnBootstrapTokenUpdated(_));
+  EXPECT_CALL(encryption_observer_, OnPassphraseAccepted());
+  EXPECT_CALL(encryption_observer_, OnEncryptionComplete());
+  EXPECT_CALL(encryption_observer_, OnCryptographerStateChanged(_));
+  sync_manager_.GetEncryptionHandler()->SetEncryptionPassphrase(
+      "new_passphrase",
+      false);
+  EXPECT_FALSE(
+      sync_manager_.GetEncryptionHandler()->IsUsingExplicitPassphrase());
   EXPECT_FALSE(EncryptEverythingEnabledForTest());
   {
     ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     Cryptographer* cryptographer = trans.GetCryptographer();
     EXPECT_TRUE(cryptographer->is_ready());
     // Verify the default key has changed.
     sync_pb::EncryptedData encrypted;
     cryptographer->GetKeys(&encrypted);
     EXPECT_FALSE(verifier.CanDecrypt(encrypted));
   }
@@ skipping 18 matching lines @@
 
     WriteNode password_node(&trans);
     WriteNode::InitUniqueByCreationResult result =
         password_node.InitUniqueByCreation(PASSWORDS,
                                            root_node, "foo");
     EXPECT_EQ(WriteNode::INIT_SUCCESS, result);
     sync_pb::PasswordSpecificsData data;
     data.set_password_value("secret");
     password_node.SetPasswordSpecifics(data);
   }
-  EXPECT_CALL(observer_, OnBootstrapTokenUpdated(_));
-  EXPECT_CALL(observer_, OnPassphraseAccepted());
-  EXPECT_CALL(observer_, OnEncryptionComplete());
-  sync_manager_.SetEncryptionPassphrase("new_passphrase", true);
+  EXPECT_CALL(encryption_observer_, OnBootstrapTokenUpdated(_));
+  EXPECT_CALL(encryption_observer_, OnPassphraseAccepted());
+  EXPECT_CALL(encryption_observer_, OnEncryptionComplete());
+  EXPECT_CALL(encryption_observer_, OnCryptographerStateChanged(_));
+  sync_manager_.GetEncryptionHandler()->SetEncryptionPassphrase(
+      "new_passphrase",
+      true);
+  EXPECT_TRUE(
+      sync_manager_.GetEncryptionHandler()->IsUsingExplicitPassphrase());
   EXPECT_FALSE(EncryptEverythingEnabledForTest());
   {
     ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     Cryptographer* cryptographer = trans.GetCryptographer();
     EXPECT_TRUE(cryptographer->is_ready());
     // Verify the default key has changed.
     sync_pb::EncryptedData encrypted;
     cryptographer->GetKeys(&encrypted);
     EXPECT_FALSE(verifier.CanDecrypt(encrypted));
 
@@ skipping 22 matching lines @@
     other_cryptographer.Bootstrap(bootstrap_token);
 
     // Now update the nigori to reflect the new keys, and update the
     // cryptographer to have pending keys.
     KeyParams params = {"localhost", "dummy", "passphrase2"};
     other_cryptographer.AddKey(params);
     WriteNode node(&trans);
     EXPECT_EQ(BaseNode::INIT_OK, node.InitByTagLookup(kNigoriTag));
     sync_pb::NigoriSpecifics nigori;
     other_cryptographer.GetKeys(nigori.mutable_encrypted());
-    cryptographer->Update(nigori);
+    cryptographer->SetPendingKeys(nigori.encrypted());
     EXPECT_TRUE(cryptographer->has_pending_keys());
     node.SetNigoriSpecifics(nigori);
   }
-  EXPECT_CALL(observer_, OnBootstrapTokenUpdated(_));
-  EXPECT_CALL(observer_, OnPassphraseAccepted());
-  EXPECT_CALL(observer_, OnEncryptionComplete());
-  sync_manager_.SetDecryptionPassphrase("passphrase2");
+  EXPECT_CALL(encryption_observer_, OnBootstrapTokenUpdated(_));
+  EXPECT_CALL(encryption_observer_, OnPassphraseAccepted());
+  EXPECT_CALL(encryption_observer_, OnEncryptionComplete());
+  EXPECT_CALL(encryption_observer_, OnCryptographerStateChanged(_));
+  sync_manager_.GetEncryptionHandler()->SetDecryptionPassphrase("passphrase2");
+  EXPECT_FALSE(
+      sync_manager_.GetEncryptionHandler()->IsUsingExplicitPassphrase());
   EXPECT_FALSE(EncryptEverythingEnabledForTest());
   {
     ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     Cryptographer* cryptographer = trans.GetCryptographer();
     EXPECT_TRUE(cryptographer->is_ready());
     // Verify we're encrypting with the new key.
     sync_pb::EncryptedData encrypted;
     cryptographer->GetKeys(&encrypted);
     EXPECT_TRUE(other_cryptographer.CanDecrypt(encrypted));
   }
@@ skipping 17 matching lines @@
 
     // Now update the nigori to reflect the new keys, and update the
     // cryptographer to have pending keys.
     KeyParams params = {"localhost", "dummy", "old_gaia"};
     other_cryptographer.AddKey(params);
     WriteNode node(&trans);
     EXPECT_EQ(BaseNode::INIT_OK, node.InitByTagLookup(kNigoriTag));
     sync_pb::NigoriSpecifics nigori;
     other_cryptographer.GetKeys(nigori.mutable_encrypted());
     node.SetNigoriSpecifics(nigori);
-    cryptographer->Update(nigori);
+    cryptographer->SetPendingKeys(nigori.encrypted());
 
     // other_cryptographer now contains all encryption keys, and is encrypting
     // with the newest gaia.
     KeyParams new_params = {"localhost", "dummy", "new_gaia"};
     other_cryptographer.AddKey(new_params);
   }
   // The bootstrap token should have been updated. Save it to ensure it's based
   // on the new GAIA password.
   std::string bootstrap_token;
-  EXPECT_CALL(observer_, OnBootstrapTokenUpdated(_))
+  EXPECT_CALL(encryption_observer_, OnBootstrapTokenUpdated(_))
       .WillOnce(SaveArg<0>(&bootstrap_token));
-  EXPECT_CALL(observer_, OnPassphraseRequired(_,_));
-  sync_manager_.SetEncryptionPassphrase("new_gaia", false);
+  EXPECT_CALL(encryption_observer_, OnPassphraseRequired(_,_));
+  EXPECT_CALL(encryption_observer_, OnCryptographerStateChanged(_));
+  sync_manager_.GetEncryptionHandler()->SetEncryptionPassphrase(
+      "new_gaia",
+      false);
+  EXPECT_FALSE(
+      sync_manager_.GetEncryptionHandler()->IsUsingExplicitPassphrase());
   EXPECT_FALSE(EncryptEverythingEnabledForTest());
-  testing::Mock::VerifyAndClearExpectations(&observer_);
+  testing::Mock::VerifyAndClearExpectations(&encryption_observer_);
   {
     ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     Cryptographer* cryptographer = trans.GetCryptographer();
     EXPECT_TRUE(cryptographer->is_initialized());
     EXPECT_FALSE(cryptographer->is_ready());
     // Verify we're encrypting with the new key, even though we have pending
     // keys.
     sync_pb::EncryptedData encrypted;
     other_cryptographer.GetKeys(&encrypted);
     EXPECT_TRUE(cryptographer->CanDecrypt(encrypted));
   }
-  EXPECT_CALL(observer_, OnBootstrapTokenUpdated(_));
-  EXPECT_CALL(observer_, OnPassphraseAccepted());
-  EXPECT_CALL(observer_, OnEncryptionComplete());
-  sync_manager_.SetEncryptionPassphrase("old_gaia", false);
+  EXPECT_CALL(encryption_observer_, OnBootstrapTokenUpdated(_));
+  EXPECT_CALL(encryption_observer_, OnPassphraseAccepted());
+  EXPECT_CALL(encryption_observer_, OnEncryptionComplete());
+  EXPECT_CALL(encryption_observer_, OnCryptographerStateChanged(_));
+  sync_manager_.GetEncryptionHandler()->SetEncryptionPassphrase(
+      "old_gaia",
+      false);
+  EXPECT_FALSE(
+      sync_manager_.GetEncryptionHandler()->IsUsingExplicitPassphrase());
   {
     ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     Cryptographer* cryptographer = trans.GetCryptographer();
     EXPECT_TRUE(cryptographer->is_ready());
 
     // Verify we're encrypting with the new key.
     sync_pb::EncryptedData encrypted;
     other_cryptographer.GetKeys(&encrypted);
     EXPECT_TRUE(cryptographer->CanDecrypt(encrypted));
 
@@ skipping 19 matching lines @@
     other_cryptographer.Bootstrap(bootstrap_token);
 
     // Now update the nigori to reflect the new keys, and update the
     // cryptographer to have pending keys.
     KeyParams params = {"localhost", "dummy", "explicit"};
     other_cryptographer.AddKey(params);
     WriteNode node(&trans);
     EXPECT_EQ(BaseNode::INIT_OK, node.InitByTagLookup(kNigoriTag));
     sync_pb::NigoriSpecifics nigori;
     other_cryptographer.GetKeys(nigori.mutable_encrypted());
-    cryptographer->Update(nigori);
+    cryptographer->SetPendingKeys(nigori.encrypted());
     EXPECT_TRUE(cryptographer->has_pending_keys());
     nigori.set_using_explicit_passphrase(true);
     node.SetNigoriSpecifics(nigori);
   }
-  EXPECT_CALL(observer_, OnBootstrapTokenUpdated(_));
-  EXPECT_CALL(observer_, OnPassphraseAccepted());
-  EXPECT_CALL(observer_, OnEncryptionComplete());
-  sync_manager_.SetDecryptionPassphrase("explicit");
+  EXPECT_CALL(encryption_observer_, OnBootstrapTokenUpdated(_));
+  EXPECT_CALL(encryption_observer_, OnPassphraseAccepted());
+  EXPECT_CALL(encryption_observer_, OnEncryptionComplete());
+  EXPECT_CALL(encryption_observer_, OnCryptographerStateChanged(_));
+  sync_manager_.GetEncryptionHandler()->SetDecryptionPassphrase("explicit");
+  EXPECT_TRUE(
+      sync_manager_.GetEncryptionHandler()->IsUsingExplicitPassphrase());
   EXPECT_FALSE(EncryptEverythingEnabledForTest());
   {
     ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     Cryptographer* cryptographer = trans.GetCryptographer();
     EXPECT_TRUE(cryptographer->is_ready());
     // Verify we're encrypting with the new key.
     sync_pb::EncryptedData encrypted;
     cryptographer->GetKeys(&encrypted);
     EXPECT_TRUE(other_cryptographer.CanDecrypt(encrypted));
   }
@@ skipping 11 matching lines @@
     Cryptographer* cryptographer = trans.GetCryptographer();
     // Now update the nigori to reflect the new keys, and update the
     // cryptographer to have pending keys.
     KeyParams params = {"localhost", "dummy", "passphrase"};
     other_cryptographer.AddKey(params);
     WriteNode node(&trans);
     EXPECT_EQ(BaseNode::INIT_OK, node.InitByTagLookup(kNigoriTag));
     sync_pb::NigoriSpecifics nigori;
     other_cryptographer.GetKeys(nigori.mutable_encrypted());
     node.SetNigoriSpecifics(nigori);
-    cryptographer->Update(nigori);
+    cryptographer->SetPendingKeys(nigori.encrypted());
     EXPECT_FALSE(cryptographer->is_ready());
   }
-  EXPECT_CALL(observer_, OnBootstrapTokenUpdated(_));
-  EXPECT_CALL(observer_, OnPassphraseAccepted());
-  EXPECT_CALL(observer_, OnEncryptionComplete());
-  sync_manager_.SetEncryptionPassphrase("passphrase", false);
+  EXPECT_CALL(encryption_observer_, OnBootstrapTokenUpdated(_));
+  EXPECT_CALL(encryption_observer_, OnPassphraseAccepted());
+  EXPECT_CALL(encryption_observer_, OnEncryptionComplete());
+  EXPECT_CALL(encryption_observer_, OnCryptographerStateChanged(_));
+  sync_manager_.GetEncryptionHandler()->SetEncryptionPassphrase(
+      "passphrase",
+      false);
+  EXPECT_FALSE(
+      sync_manager_.GetEncryptionHandler()->IsUsingExplicitPassphrase());
   EXPECT_FALSE(EncryptEverythingEnabledForTest());
   {
     ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     Cryptographer* cryptographer = trans.GetCryptographer();
     EXPECT_TRUE(cryptographer->is_ready());
   }
 }
 
 TEST_F(SyncManagerTest, SetPassphraseWithEmptyPasswordNode) {
   EXPECT_TRUE(SetUpEncryption(WRITE_TO_NIGORI, DEFAULT_ENCRYPTION));
   int64 node_id = 0;
   std::string tag = "foo";
   {
     WriteTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     ReadNode root_node(&trans);
     root_node.InitByRootLookup();
 
     WriteNode password_node(&trans);
     WriteNode::InitUniqueByCreationResult result =
         password_node.InitUniqueByCreation(PASSWORDS, root_node, tag);
     EXPECT_EQ(WriteNode::INIT_SUCCESS, result);
     node_id = password_node.GetId();
   }
-  EXPECT_CALL(observer_, OnBootstrapTokenUpdated(_));
-  EXPECT_CALL(observer_, OnPassphraseAccepted());
-  EXPECT_CALL(observer_, OnEncryptionComplete());
-  sync_manager_.SetEncryptionPassphrase("new_passphrase", true);
+  EXPECT_CALL(encryption_observer_, OnBootstrapTokenUpdated(_));
+  EXPECT_CALL(encryption_observer_, OnPassphraseAccepted());
+  EXPECT_CALL(encryption_observer_, OnEncryptionComplete());
+  EXPECT_CALL(encryption_observer_, OnCryptographerStateChanged(_));
+  sync_manager_.GetEncryptionHandler()->SetEncryptionPassphrase(
+      "new_passphrase",
+      true);
+  EXPECT_TRUE(
+      sync_manager_.GetEncryptionHandler()->IsUsingExplicitPassphrase());
   EXPECT_FALSE(EncryptEverythingEnabledForTest());
   {
     ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     ReadNode password_node(&trans);
     EXPECT_EQ(BaseNode::INIT_FAILED_DECRYPT_IF_NECESSARY,
               password_node.InitByClientTagLookup(PASSWORDS,
                                                   tag));
   }
   {
     ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
@@ skipping 81 matching lines @@
 
   {
     ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     EXPECT_TRUE(syncable::VerifyDataTypeEncryptionForTest(
         trans.GetWrappedTrans(),
         trans.GetCryptographer(),
         BOOKMARKS,
         false /* not encrypted */));
   }
 
-  EXPECT_CALL(observer_,
+  EXPECT_CALL(encryption_observer_,
               OnEncryptedTypesChanged(
                   HasModelTypes(ModelTypeSet::All()), true));
-  EXPECT_CALL(observer_, OnEncryptionComplete());
-  sync_manager_.EnableEncryptEverything();
+  EXPECT_CALL(encryption_observer_, OnEncryptionComplete());
+  sync_manager_.GetEncryptionHandler()->EnableEncryptEverything();
   EXPECT_TRUE(EncryptEverythingEnabledForTest());
 
   {
     ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     EXPECT_TRUE(GetEncryptedTypes(&trans).Equals(ModelTypeSet::All()));
     EXPECT_TRUE(syncable::VerifyDataTypeEncryptionForTest(
         trans.GetWrappedTrans(),
         trans.GetCryptographer(),
         BOOKMARKS,
         true /* is encrypted */));
@@ skipping 63 matching lines @@
   {
     WriteTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     WriteNode node(&trans);
     EXPECT_EQ(BaseNode::INIT_OK,
               node.InitByClientTagLookup(BOOKMARKS, client_tag));
     node.SetEntitySpecifics(entity_specifics);
   }
   EXPECT_FALSE(ResetUnsyncedEntry(BOOKMARKS, client_tag));
 
   // Encrypt the datatatype, should set is_unsynced.
-  EXPECT_CALL(observer_,
+  EXPECT_CALL(encryption_observer_,
               OnEncryptedTypesChanged(
                   HasModelTypes(ModelTypeSet::All()), true));
-  EXPECT_CALL(observer_, OnEncryptionComplete());
+  EXPECT_CALL(encryption_observer_, OnEncryptionComplete());
   EXPECT_TRUE(SetUpEncryption(WRITE_TO_NIGORI, FULL_ENCRYPTION));
 
-  sync_manager_.RefreshNigori(kTestChromeVersion, base::Bind(&DoNothing));
+  EXPECT_CALL(encryption_observer_, OnCryptographerStateChanged(_));
+  sync_manager_.GetEncryptionHandler()->ReloadNigori();
   PumpLoop();
   {
     ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     ReadNode node(&trans);
     EXPECT_EQ(BaseNode::INIT_OK,
               node.InitByClientTagLookup(BOOKMARKS, client_tag));
     const syncable::Entry* node_entry = node.GetEntry();
     const sync_pb::EntitySpecifics& specifics = node_entry->Get(SPECIFICS);
     EXPECT_TRUE(specifics.has_encrypted());
     EXPECT_EQ(kEncryptedString, node_entry->Get(NON_UNIQUE_NAME));
     Cryptographer* cryptographer = trans.GetCryptographer();
     EXPECT_TRUE(cryptographer->is_ready());
     EXPECT_TRUE(cryptographer->CanDecryptUsingDefaultKey(
         specifics.encrypted()));
   }
   EXPECT_TRUE(ResetUnsyncedEntry(BOOKMARKS, client_tag));
 
   // Set a new passphrase. Should set is_unsynced.
-  testing::Mock::VerifyAndClearExpectations(&observer_);
-  EXPECT_CALL(observer_, OnBootstrapTokenUpdated(_));
-  EXPECT_CALL(observer_, OnPassphraseAccepted());
-  EXPECT_CALL(observer_, OnEncryptionComplete());
-  sync_manager_.SetEncryptionPassphrase("new_passphrase", true);
+  testing::Mock::VerifyAndClearExpectations(&encryption_observer_);
+  EXPECT_CALL(encryption_observer_, OnBootstrapTokenUpdated(_));
+  EXPECT_CALL(encryption_observer_, OnPassphraseAccepted());
+  EXPECT_CALL(encryption_observer_, OnEncryptionComplete());
+  EXPECT_CALL(encryption_observer_, OnCryptographerStateChanged(_));
+  sync_manager_.GetEncryptionHandler()->SetEncryptionPassphrase(
+      "new_passphrase",
+      true);
   {
     ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     ReadNode node(&trans);
     EXPECT_EQ(BaseNode::INIT_OK,
               node.InitByClientTagLookup(BOOKMARKS, client_tag));
     const syncable::Entry* node_entry = node.GetEntry();
     const sync_pb::EntitySpecifics& specifics = node_entry->Get(SPECIFICS);
     EXPECT_TRUE(specifics.has_encrypted());
     EXPECT_EQ(kEncryptedString, node_entry->Get(NON_UNIQUE_NAME));
     Cryptographer* cryptographer = trans.GetCryptographer();
     EXPECT_TRUE(cryptographer->is_ready());
     EXPECT_TRUE(cryptographer->CanDecryptUsingDefaultKey(
         specifics.encrypted()));
   }
   EXPECT_TRUE(ResetUnsyncedEntry(BOOKMARKS, client_tag));
 
   // Force a re-encrypt everything. Should not set is_unsynced.
-  testing::Mock::VerifyAndClearExpectations(&observer_);
-  EXPECT_CALL(observer_, OnEncryptionComplete());
+  testing::Mock::VerifyAndClearExpectations(&encryption_observer_);
+  EXPECT_CALL(encryption_observer_, OnEncryptionComplete());
+  EXPECT_CALL(encryption_observer_, OnCryptographerStateChanged(_));
 
-  sync_manager_.RefreshNigori(kTestChromeVersion, base::Bind(&DoNothing));
+  sync_manager_.GetEncryptionHandler()->ReloadNigori();
   PumpLoop();
 
   {
     ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     ReadNode node(&trans);
     EXPECT_EQ(BaseNode::INIT_OK,
               node.InitByClientTagLookup(BOOKMARKS, client_tag));
     const syncable::Entry* node_entry = node.GetEntry();
     const sync_pb::EntitySpecifics& specifics = node_entry->Get(SPECIFICS);
     EXPECT_TRUE(specifics.has_encrypted());
@@ skipping 145 matching lines @@
         entity_specifics.mutable_password()->mutable_encrypted());
   }
   MakeServerNode(sync_manager_.GetUserShare(), PASSWORDS, client_tag,
                  BaseNode::GenerateSyncableHash(PASSWORDS,
                                                 client_tag),
                  entity_specifics);
   // New node shouldn't start off unsynced.
   EXPECT_FALSE(ResetUnsyncedEntry(PASSWORDS, client_tag));
 
   // Set a new passphrase. Should set is_unsynced.
-  testing::Mock::VerifyAndClearExpectations(&observer_);
-  EXPECT_CALL(observer_, OnBootstrapTokenUpdated(_));
-  EXPECT_CALL(observer_, OnPassphraseAccepted());
-  EXPECT_CALL(observer_, OnEncryptionComplete());
-  sync_manager_.SetEncryptionPassphrase("new_passphrase", true);
+  testing::Mock::VerifyAndClearExpectations(&encryption_observer_);
+  EXPECT_CALL(encryption_observer_, OnBootstrapTokenUpdated(_));
+  EXPECT_CALL(encryption_observer_, OnPassphraseAccepted());
+  EXPECT_CALL(encryption_observer_, OnEncryptionComplete());
+  EXPECT_CALL(encryption_observer_, OnCryptographerStateChanged(_));
+  sync_manager_.GetEncryptionHandler()->SetEncryptionPassphrase(
+      "new_passphrase",
+      true);
+  EXPECT_TRUE(
+      sync_manager_.GetEncryptionHandler()->IsUsingExplicitPassphrase());
   EXPECT_TRUE(ResetUnsyncedEntry(PASSWORDS, client_tag));
 }
 
 // Passwords have their own handling for encryption. Verify it does not result
 // in unnecessary writes via ReencryptEverything.
 TEST_F(SyncManagerTest, UpdatePasswordReencryptEverything) {
   std::string client_tag = "title";
   EXPECT_TRUE(SetUpEncryption(WRITE_TO_NIGORI, DEFAULT_ENCRYPTION));
   sync_pb::EntitySpecifics entity_specifics;
   {
     ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     Cryptographer* cryptographer = trans.GetCryptographer();
     sync_pb::PasswordSpecificsData data;
     data.set_password_value("secret");
     cryptographer->Encrypt(
         data,
         entity_specifics.mutable_password()->mutable_encrypted());
   }
   MakeServerNode(sync_manager_.GetUserShare(), PASSWORDS, client_tag,
                  BaseNode::GenerateSyncableHash(PASSWORDS,
                                                 client_tag),
                  entity_specifics);
   // New node shouldn't start off unsynced.
   EXPECT_FALSE(ResetUnsyncedEntry(PASSWORDS, client_tag));
 
   // Force a re-encrypt everything. Should not set is_unsynced.
-  testing::Mock::VerifyAndClearExpectations(&observer_);
-  EXPECT_CALL(observer_, OnEncryptionComplete());
-  sync_manager_.RefreshNigori(kTestChromeVersion, base::Bind(&DoNothing));
+  testing::Mock::VerifyAndClearExpectations(&encryption_observer_);
+  EXPECT_CALL(encryption_observer_, OnEncryptionComplete());
+  EXPECT_CALL(encryption_observer_, OnCryptographerStateChanged(_));
+  sync_manager_.GetEncryptionHandler()->ReloadNigori();
   PumpLoop();
   EXPECT_FALSE(ResetUnsyncedEntry(PASSWORDS, client_tag));
 }
 
 // Verify SetTitle(..) doesn't unnecessarily set IS_UNSYNCED for bookmarks
 // when we write the same data, but does set it when we write new data.
 TEST_F(SyncManagerTest, SetBookmarkTitle) {
   std::string client_tag = "title";
   sync_pb::EntitySpecifics entity_specifics;
   entity_specifics.mutable_bookmark()->set_url("url");
@@ skipping 35 matching lines @@
   entity_specifics.mutable_bookmark()->set_url("url");
   entity_specifics.mutable_bookmark()->set_title("title");
   MakeServerNode(sync_manager_.GetUserShare(), BOOKMARKS, client_tag,
                  BaseNode::GenerateSyncableHash(BOOKMARKS,
                                                 client_tag),
                  entity_specifics);
   // New node shouldn't start off unsynced.
   EXPECT_FALSE(ResetUnsyncedEntry(BOOKMARKS, client_tag));
 
   // Encrypt the datatatype, should set is_unsynced.
-  EXPECT_CALL(observer_,
+  EXPECT_CALL(encryption_observer_,
               OnEncryptedTypesChanged(
                   HasModelTypes(ModelTypeSet::All()), true));
-  EXPECT_CALL(observer_, OnEncryptionComplete());
+  EXPECT_CALL(encryption_observer_, OnEncryptionComplete());
   EXPECT_TRUE(SetUpEncryption(WRITE_TO_NIGORI, FULL_ENCRYPTION));
-  sync_manager_.RefreshNigori(kTestChromeVersion, base::Bind(&DoNothing));
+  EXPECT_CALL(encryption_observer_, OnCryptographerStateChanged(_));
+  sync_manager_.GetEncryptionHandler()->ReloadNigori();
   PumpLoop();
   EXPECT_TRUE(ResetUnsyncedEntry(BOOKMARKS, client_tag));
 
   // Manually change to the same title. Should not set is_unsynced.
   // NON_UNIQUE_NAME should be kEncryptedString.
   {
     WriteTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     WriteNode node(&trans);
     EXPECT_EQ(BaseNode::INIT_OK,
               node.InitByClientTagLookup(BOOKMARKS, client_tag));
@@ skipping 69 matching lines @@
   MakeServerNode(sync_manager_.GetUserShare(),
                  PREFERENCES,
                  client_tag,
                  BaseNode::GenerateSyncableHash(PREFERENCES,
                                                 client_tag),
                  entity_specifics);
   // New node shouldn't start off unsynced.
   EXPECT_FALSE(ResetUnsyncedEntry(PREFERENCES, client_tag));
 
   // Encrypt the datatatype, should set is_unsynced.
-  EXPECT_CALL(observer_,
+  EXPECT_CALL(encryption_observer_,
               OnEncryptedTypesChanged(
                   HasModelTypes(ModelTypeSet::All()), true));
-  EXPECT_CALL(observer_, OnEncryptionComplete());
+  EXPECT_CALL(encryption_observer_, OnEncryptionComplete());
   EXPECT_TRUE(SetUpEncryption(WRITE_TO_NIGORI, FULL_ENCRYPTION));
-  sync_manager_.RefreshNigori(kTestChromeVersion, base::Bind(&DoNothing));
+  EXPECT_CALL(encryption_observer_, OnCryptographerStateChanged(_));
+  sync_manager_.GetEncryptionHandler()->ReloadNigori();
   PumpLoop();
   EXPECT_TRUE(ResetUnsyncedEntry(PREFERENCES, client_tag));
 
   // Manually change to the same title. Should not set is_unsynced.
   // NON_UNIQUE_NAME should be kEncryptedString.
   {
     WriteTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     WriteNode node(&trans);
     EXPECT_EQ(BaseNode::INIT_OK,
               node.InitByClientTagLookup(PREFERENCES, client_tag));
@@ skipping 351 matching lines @@
 
   // Verify only the non-disabled types remain after cleanup.
   sync_manager_.PurgeDisabledTypes(enabled_types, new_enabled_types);
   EXPECT_TRUE(new_enabled_types.Equals(
       Union(sync_manager_.InitialSyncEndedTypes(), partial_enabled_types)));
   EXPECT_TRUE(disabled_types.Equals(
       sync_manager_.GetTypesWithEmptyProgressMarkerToken(ModelTypeSet::All())));
 }
 
 }  // namespace