[Sync] Add intelligent re-encryption support.

chrome/browser/sync/internal_api/syncapi_unittest.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // Unit tests for the SyncApi. Note that a lot of the underlying
 // functionality is provided by the Syncable layer, which has its own
 // unit tests. We'll test SyncApi specific things in this harness.
 
 #include <cstddef>
 #include <map>
@@ skipping 55 matching lines @@
 using browser_sync::JsEventHandler;
 using browser_sync::JsReplyHandler;
 using browser_sync::MockJsEventHandler;
 using browser_sync::MockJsReplyHandler;
 using browser_sync::ModelSafeRoutingInfo;
 using browser_sync::ModelSafeWorker;
 using browser_sync::ModelSafeWorkerRegistrar;
 using browser_sync::sessions::SyncSessionSnapshot;
 using browser_sync::WeakHandle;
 using content::BrowserThread;
+using syncable::IS_DEL;
+using syncable::IS_UNSYNCED;
 using syncable::kEncryptedString;
 using syncable::ModelTypeSet;
 using syncable::ModelType;
+using syncable::NON_UNIQUE_NAME;
+using syncable::SPECIFICS;
 using test::ExpectDictStringValue;
 using testing::_;
 using testing::AnyNumber;
 using testing::AtLeast;
 using testing::InSequence;
 using testing::Invoke;
 using testing::SaveArg;
 using testing::StrictMock;
 
 namespace sync_api {
@@ skipping 83 matching lines @@
   entry.Put(syncable::SERVER_IS_DIR, true);
   entry.Put(syncable::IS_DIR, true);
   entry.Put(syncable::SERVER_SPECIFICS, specifics);
   entry.Put(syncable::UNIQUE_SERVER_TAG, type_tag);
   entry.Put(syncable::NON_UNIQUE_NAME, type_tag);
   entry.Put(syncable::IS_DEL, false);
   entry.Put(syncable::SPECIFICS, specifics);
   return entry.Get(syncable::META_HANDLE);
 }
 
+// Simulates creating a "synced" node as a child of the root datatype node.
+int64 MakeServerNode(UserShare* share, ModelType model_type,
+                     const std::string& client_tag,
+                     const std::string& hashed_tag,
+                     const sync_pb::EntitySpecifics& specifics) {
+  syncable::ScopedDirLookup dir(share->dir_manager.get(), share->name);
+  EXPECT_TRUE(dir.good());
+  syncable::WriteTransaction trans(FROM_HERE, syncable::UNITTEST, dir);
+  syncable::Entry root_entry(&trans, syncable::GET_BY_SERVER_TAG,
+                             syncable::ModelTypeToRootTag(model_type));
+  EXPECT_TRUE(root_entry.good());
+  syncable::Id root_id = root_entry.Get(syncable::ID);
+  syncable::Id node_id = syncable::Id::CreateFromServerId(client_tag);
+  syncable::MutableEntry entry(&trans, syncable::CREATE_NEW_UPDATE_ITEM,
+                               node_id);
+  EXPECT_TRUE(entry.good());
+  entry.Put(syncable::BASE_VERSION, 1);
+  entry.Put(syncable::SERVER_VERSION, 1);
+  entry.Put(syncable::IS_UNAPPLIED_UPDATE, false);
+  entry.Put(syncable::SERVER_PARENT_ID, root_id);
+  entry.Put(syncable::PARENT_ID, root_id);
+  entry.Put(syncable::SERVER_IS_DIR, false);
+  entry.Put(syncable::IS_DIR, false);
+  entry.Put(syncable::SERVER_SPECIFICS, specifics);
+  entry.Put(syncable::NON_UNIQUE_NAME, client_tag);
+  entry.Put(syncable::UNIQUE_CLIENT_TAG, hashed_tag);
+  entry.Put(syncable::IS_DEL, false);
+  entry.Put(syncable::SPECIFICS, specifics);
+  return entry.Get(syncable::META_HANDLE);
+}
+
 }  // namespace
 
 class SyncApiTest : public testing::Test {
  public:
   virtual void SetUp() {
     test_user_share_.SetUp();
   }
 
   virtual void TearDown() {
     test_user_share_.TearDown();
@@ skipping 452 matching lines @@
   MOCK_METHOD1(RemoveObserver, void(sync_notifier::SyncNotifierObserver*));
   MOCK_METHOD1(SetUniqueId, void(const std::string&));
   MOCK_METHOD1(SetState, void(const std::string&));
   MOCK_METHOD2(UpdateCredentials,
                void(const std::string&, const std::string&));
   MOCK_METHOD1(UpdateEnabledTypes,
                void(syncable::ModelTypeSet));
   MOCK_METHOD1(SendNotification, void(syncable::ModelTypeSet));
 };
 
+}  // namespace
+
 class SyncManagerTest : public testing::Test,
                         public ModelSafeWorkerRegistrar,
                         public SyncManager::ChangeDelegate {
  protected:
+  enum NigoriStatus {
+    DONT_WRITE_NIGORI,
+    WRITE_TO_NIGORI
+  };
+
+  enum EncryptionStatus {
+    DEFAULT_ENCRYPTION,
+    FULL_ENCRYPTION
+  };
+
   SyncManagerTest()
       : ui_thread_(BrowserThread::UI, &ui_loop_),
         sync_notifier_mock_(NULL),
         sync_manager_("Test sync manager"),
         sync_notifier_observer_(NULL),
         update_enabled_types_call_count_(0) {}
 
   virtual ~SyncManagerTest() {
     EXPECT_FALSE(sync_notifier_mock_);
   }
@@ skipping 72 matching lines @@
   }
 
   virtual void OnChangesApplied(
       syncable::ModelType model_type,
       const BaseTransaction* trans,
       const ImmutableChangeRecordList& changes) OVERRIDE {}
 
   virtual void OnChangesComplete(syncable::ModelType model_type) OVERRIDE {}
 
   // Helper methods.
-  bool SetUpEncryption(bool write_to_nigori) {
+  bool SetUpEncryption(NigoriStatus nigori_status,
+                       EncryptionStatus encryption_status) {
     // Mock the Mac Keychain service. The real Keychain can block on user input.
     #if defined(OS_MACOSX)
       Encryptor::UseMockKeychain(true);
     #endif
 
     UserShare* share = sync_manager_.GetUserShare();
     {
       syncable::ScopedDirLookup dir(share->dir_manager.get(), share->name);
       if (!dir.good())
         return false;
       dir->set_initial_sync_ended_for_type(syncable::NIGORI, true);
     }
 
     // We need to create the nigori node as if it were an applied server update.
     int64 nigori_id = GetIdForDataType(syncable::NIGORI);
     if (nigori_id == kInvalidId)
       return false;
 
     // Set the nigori cryptographer information.
     WriteTransaction trans(FROM_HERE, share);
     Cryptographer* cryptographer = trans.GetCryptographer();
     if (!cryptographer)
       return false;
     KeyParams params = {"localhost", "dummy", "foobar"};
     cryptographer->AddKey(params);
-    if (write_to_nigori) {
+    if (encryption_status == FULL_ENCRYPTION)
+      cryptographer->set_encrypt_everything();
+    if (nigori_status == WRITE_TO_NIGORI) {
       sync_pb::NigoriSpecifics nigori;
       cryptographer->GetKeys(nigori.mutable_encrypted());
+      cryptographer->UpdateNigoriFromEncryptedTypes(&nigori);
       WriteNode node(&trans);
       EXPECT_TRUE(node.InitByIdLookup(nigori_id));
       node.SetNigoriSpecifics(nigori);
     }
     return cryptographer->is_ready();
   }
 
   int64 GetIdForDataType(ModelType type) {
     if (type_roots_.count(type) == 0)
       return 0;
@@ skipping 31 matching lines @@
                      name, args, reply_handler);
     PumpLoop();
   }
 
   void SetJsEventHandler(const WeakHandle<JsEventHandler>& event_handler) {
     js_backend_.Call(FROM_HERE, &JsBackend::SetJsEventHandler,
                      event_handler);
     PumpLoop();
   }
 
+  // Looks up an entry by client tag and resets IS_UNSYNCED value to false.
+  // Returns true if entry was previously unsynced, false if IS_UNSYNCED was
+  // already false.
+  bool ResetUnsyncedEntry(syncable::ModelType type,
+                          const std::string& client_tag) {
+    UserShare* share = sync_manager_.GetUserShare();
+    syncable::ScopedDirLookup dir(share->dir_manager.get(), share->name);
+    EXPECT_TRUE(dir.good());
+    syncable::WriteTransaction trans(FROM_HERE, syncable::UNITTEST, dir);
+    const std::string hash = BaseNode::GenerateSyncableHash(type, client_tag);
+    syncable::MutableEntry entry(&trans, syncable::GET_BY_CLIENT_TAG,
+                                 hash);
+    EXPECT_TRUE(entry.good());
+    if (!entry.Get(IS_UNSYNCED))
+      return false;
+    entry.Put(IS_UNSYNCED, false);
+    return true;
+  }
+
  private:
   // Needed by |ui_thread_|.
   MessageLoopForUI ui_loop_;
   // Needed by |sync_manager_|.
   content::TestBrowserThread ui_thread_;
   // Needed by |sync_manager_|.
   ScopedTempDir temp_dir_;
   // Sync Id's for the roots of the enabled datatypes.
   std::map<ModelType, int64> type_roots_;
   StrictMock<SyncNotifierMock>* sync_notifier_mock_;
@@ skipping 348 matching lines @@
   SetJsEventHandler(WeakHandle<JsEventHandler>());
 
   sync_manager_.TriggerOnIncomingNotificationForTest(empty_model_types);
   sync_manager_.TriggerOnIncomingNotificationForTest(model_types);
 
   // Should trigger the replies.
   PumpLoop();
 }
 
 TEST_F(SyncManagerTest, RefreshEncryptionReady) {
-  EXPECT_TRUE(SetUpEncryption(true));
+  EXPECT_TRUE(SetUpEncryption(WRITE_TO_NIGORI, DEFAULT_ENCRYPTION));
   EXPECT_CALL(observer_, OnEncryptionComplete());
   sync_manager_.RefreshEncryption();
   const syncable::ModelTypeSet encrypted_types =
       sync_manager_.GetEncryptedDataTypesForTest();
   EXPECT_TRUE(encrypted_types.Has(syncable::PASSWORDS));
   EXPECT_FALSE(sync_manager_.EncryptEverythingEnabledForTest());
   {
     ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     ReadNode node(&trans);
     EXPECT_TRUE(node.InitByIdLookup(GetIdForDataType(syncable::NIGORI)));
@@ skipping 10 matching lines @@
   // Don't set up encryption (no nigori node created).
   sync_manager_.RefreshEncryption();  // Should fail.
   const syncable::ModelTypeSet encrypted_types =
       sync_manager_.GetEncryptedDataTypesForTest();
   EXPECT_TRUE(encrypted_types.Has(syncable::PASSWORDS));  // Hardcoded.
   EXPECT_FALSE(sync_manager_.EncryptEverythingEnabledForTest());
 }
 
 // Attempt to refresh encryption when nigori is empty.
 TEST_F(SyncManagerTest, RefreshEncryptionEmptyNigori) {
-  EXPECT_TRUE(SetUpEncryption(false));
+  EXPECT_TRUE(SetUpEncryption(DONT_WRITE_NIGORI, DEFAULT_ENCRYPTION));
   EXPECT_CALL(observer_, OnEncryptionComplete());
   sync_manager_.RefreshEncryption();  // Should write to nigori.
   const syncable::ModelTypeSet encrypted_types =
       sync_manager_.GetEncryptedDataTypesForTest();
   EXPECT_TRUE(encrypted_types.Has(syncable::PASSWORDS));  // Hardcoded.
   EXPECT_FALSE(sync_manager_.EncryptEverythingEnabledForTest());
   {
     ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     ReadNode node(&trans);
     EXPECT_TRUE(node.InitByIdLookup(GetIdForDataType(syncable::NIGORI)));
     sync_pb::NigoriSpecifics nigori = node.GetNigoriSpecifics();
     EXPECT_TRUE(nigori.has_encrypted());
     Cryptographer* cryptographer = trans.GetCryptographer();
     EXPECT_TRUE(cryptographer->is_ready());
     EXPECT_TRUE(cryptographer->CanDecrypt(nigori.encrypted()));
   }
 }
 
 TEST_F(SyncManagerTest, EncryptDataTypesWithNoData) {
-  EXPECT_TRUE(SetUpEncryption(true));
+  EXPECT_TRUE(SetUpEncryption(WRITE_TO_NIGORI, DEFAULT_ENCRYPTION));
   EXPECT_CALL(observer_,
               OnEncryptedTypesChanged(
                   HasModelTypes(syncable::ModelTypeSet::All()), true));
   EXPECT_CALL(observer_, OnEncryptionComplete());
   sync_manager_.EnableEncryptEverything();
   EXPECT_TRUE(sync_manager_.EncryptEverythingEnabledForTest());
 }
 
 TEST_F(SyncManagerTest, EncryptDataTypesWithData) {
   size_t batch_size = 5;
-  EXPECT_TRUE(SetUpEncryption(true));
+  EXPECT_TRUE(SetUpEncryption(WRITE_TO_NIGORI, DEFAULT_ENCRYPTION));
 
   // Create some unencrypted unsynced data.
   int64 folder = MakeFolderWithParent(sync_manager_.GetUserShare(),
                                       syncable::BOOKMARKS,
                                       GetIdForDataType(syncable::BOOKMARKS),
                                       NULL);
   // First batch_size nodes are children of folder.
   size_t i;
   for (i = 0; i < batch_size; ++i) {
     MakeNodeWithParent(sync_manager_.GetUserShare(), syncable::BOOKMARKS,
@@ skipping 89 matching lines @@
   // Calling EncryptDataTypes with an empty encrypted types should not trigger
   // a reencryption and should just notify immediately.
   // TODO(zea): add logic to ensure nothing was written.
   testing::Mock::VerifyAndClearExpectations(&observer_);
   EXPECT_CALL(observer_, OnPassphraseAccepted(_)).Times(0);
   EXPECT_CALL(observer_, OnEncryptionComplete());
   sync_manager_.EnableEncryptEverything();
 }
 
 TEST_F(SyncManagerTest, SetPassphraseWithPassword) {
-  EXPECT_TRUE(SetUpEncryption(true));
+  EXPECT_TRUE(SetUpEncryption(WRITE_TO_NIGORI, DEFAULT_ENCRYPTION));
   {
     WriteTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     ReadNode root_node(&trans);
     root_node.InitByRootLookup();
 
     WriteNode password_node(&trans);
     EXPECT_TRUE(password_node.InitUniqueByCreation(syncable::PASSWORDS,
                                                    root_node, "foo"));
     sync_pb::PasswordSpecificsData data;
     data.set_password_value("secret");
     password_node.SetPasswordSpecifics(data);
   }
   EXPECT_CALL(observer_, OnPassphraseAccepted(_));
   EXPECT_CALL(observer_, OnEncryptionComplete());
   sync_manager_.SetPassphrase("new_passphrase", true);
   EXPECT_FALSE(sync_manager_.EncryptEverythingEnabledForTest());
   {
     ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     ReadNode password_node(&trans);
     EXPECT_TRUE(password_node.InitByClientTagLookup(syncable::PASSWORDS,
                                                     "foo"));
     const sync_pb::PasswordSpecificsData& data =
         password_node.GetPasswordSpecifics();
     EXPECT_EQ("secret", data.password_value());
   }
 }
 
 TEST_F(SyncManagerTest, SetPassphraseWithEmptyPasswordNode) {
-  EXPECT_TRUE(SetUpEncryption(true));
+  EXPECT_TRUE(SetUpEncryption(WRITE_TO_NIGORI, DEFAULT_ENCRYPTION));
   int64 node_id = 0;
   std::string tag = "foo";
   {
     WriteTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     ReadNode root_node(&trans);
     root_node.InitByRootLookup();
 
     WriteNode password_node(&trans);
     EXPECT_TRUE(password_node.InitUniqueByCreation(syncable::PASSWORDS,
                                                    root_node, tag));
     node_id = password_node.GetId();
   }
   EXPECT_CALL(observer_, OnPassphraseAccepted(_));
   EXPECT_CALL(observer_, OnEncryptionComplete());
   sync_manager_.SetPassphrase("new_passphrase", true);
   EXPECT_FALSE(sync_manager_.EncryptEverythingEnabledForTest());
   {
     ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     ReadNode password_node(&trans);
     EXPECT_FALSE(password_node.InitByClientTagLookup(syncable::PASSWORDS,
                                                      tag));
   }
   {
     ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
     ReadNode password_node(&trans);
     EXPECT_FALSE(password_node.InitByIdLookup(node_id));
   }
 }
 
-}  // namespace
-
 // Friended by WriteNode, so can't be in an anonymouse namespace.
 TEST_F(SyncManagerTest, EncryptBookmarksWithLegacyData) {
-  EXPECT_TRUE(SetUpEncryption(true));
+  EXPECT_TRUE(SetUpEncryption(WRITE_TO_NIGORI, DEFAULT_ENCRYPTION));
   std::string title;
   SyncAPINameToServerName("Google", &title);
   std::string url = "http://www.google.com";
   std::string raw_title2 = "..";  // An invalid cosmo title.
   std::string title2;
   SyncAPINameToServerName(raw_title2, &title2);
   std::string url2 = "http://www.bla.com";
 
   // Create a bookmark using the legacy format.
   int64 node_id1 = MakeNode(sync_manager_.GetUserShare(),
@@ skipping 83 matching lines @@
     EXPECT_TRUE(node2.InitByIdLookup(node_id2));
     EXPECT_EQ(syncable::BOOKMARKS, node2.GetModelType());
     // We should de-canonicalize the title in GetTitle(), but the title in the
     // specifics should be stored in the server legal form.
     EXPECT_EQ(raw_title2, node2.GetTitle());
     EXPECT_EQ(title2, node2.GetBookmarkSpecifics().title());
     EXPECT_EQ(url2, node2.GetBookmarkSpecifics().url());
   }
 }
 
+// Verifies WriteNode::UpdateEntryWithEncryption does not make unnecessary
+// changes.
+TEST_F(SyncManagerTest, UpdateEntryWithEncryption) {
+  std::string client_tag = "title";
+  sync_pb::EntitySpecifics entity_specifics;
+  entity_specifics.MutableExtension(sync_pb::bookmark)->set_url("url");
+  entity_specifics.MutableExtension(sync_pb::bookmark)->set_title("title");
+  MakeServerNode(sync_manager_.GetUserShare(), syncable::BOOKMARKS, client_tag,
+                 BaseNode::GenerateSyncableHash(syncable::BOOKMARKS,
+                                                client_tag),
+                 entity_specifics);
+  // New node shouldn't start off unsynced.
+  EXPECT_FALSE(ResetUnsyncedEntry(syncable::BOOKMARKS, client_tag));
+  // Manually change to the same data. Should not set is_unsynced.
+  {
+    WriteTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
+    WriteNode node(&trans);
+    EXPECT_TRUE(node.InitByClientTagLookup(syncable::BOOKMARKS, client_tag));
+    node.SetEntitySpecifics(entity_specifics);
+  }
+  EXPECT_FALSE(ResetUnsyncedEntry(syncable::BOOKMARKS, client_tag));
+
+  // Encrypt the datatatype, should set is_unsynced.
+  EXPECT_CALL(observer_,
+              OnEncryptedTypesChanged(
+                  HasModelTypes(syncable::ModelEnumSet::All()), true));
+  EXPECT_CALL(observer_, OnEncryptionComplete());
+  EXPECT_TRUE(SetUpEncryption(WRITE_TO_NIGORI, FULL_ENCRYPTION));
+  sync_manager_.RefreshEncryption();
+  {
+    ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
+    ReadNode node(&trans);
+    EXPECT_TRUE(node.InitByClientTagLookup(syncable::BOOKMARKS, client_tag));
+    const syncable::Entry* node_entry = node.GetEntry();
+    const sync_pb::EntitySpecifics& specifics = node_entry->Get(SPECIFICS);
+    EXPECT_TRUE(specifics.has_encrypted());
+    EXPECT_EQ(kEncryptedString, node_entry->Get(NON_UNIQUE_NAME));
+    Cryptographer* cryptographer = trans.GetCryptographer();
+    EXPECT_TRUE(cryptographer->is_ready());
+    EXPECT_TRUE(cryptographer->CanDecryptUsingDefaultKey(
+        specifics.encrypted()));
+  }
+  EXPECT_TRUE(ResetUnsyncedEntry(syncable::BOOKMARKS, client_tag));
+
+  // Set a new passphrase. Should set is_unsynced.
+  testing::Mock::VerifyAndClearExpectations(&observer_);
+  EXPECT_CALL(observer_, OnPassphraseAccepted(_));
+  EXPECT_CALL(observer_, OnEncryptionComplete());
+  sync_manager_.SetPassphrase("new_passphrase", true);
+  {
+    ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
+    ReadNode node(&trans);
+    EXPECT_TRUE(node.InitByClientTagLookup(syncable::BOOKMARKS, client_tag));
+    const syncable::Entry* node_entry = node.GetEntry();
+    const sync_pb::EntitySpecifics& specifics = node_entry->Get(SPECIFICS);
+    EXPECT_TRUE(specifics.has_encrypted());
+    EXPECT_EQ(kEncryptedString, node_entry->Get(NON_UNIQUE_NAME));
+    Cryptographer* cryptographer = trans.GetCryptographer();
+    EXPECT_TRUE(cryptographer->is_ready());
+    EXPECT_TRUE(cryptographer->CanDecryptUsingDefaultKey(
+        specifics.encrypted()));
+  }
+  EXPECT_TRUE(ResetUnsyncedEntry(syncable::BOOKMARKS, client_tag));
+
+  // Force a re-encrypt everything. Should not set is_unsynced.
+  testing::Mock::VerifyAndClearExpectations(&observer_);
+  EXPECT_CALL(observer_, OnEncryptionComplete());
+  sync_manager_.RefreshEncryption();
+  {
+    ReadTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
+    ReadNode node(&trans);
+    EXPECT_TRUE(node.InitByClientTagLookup(syncable::BOOKMARKS, client_tag));
+    const syncable::Entry* node_entry = node.GetEntry();
+    const sync_pb::EntitySpecifics& specifics = node_entry->Get(SPECIFICS);
+    EXPECT_TRUE(specifics.has_encrypted());
+    EXPECT_EQ(kEncryptedString, node_entry->Get(NON_UNIQUE_NAME));
+    Cryptographer* cryptographer = trans.GetCryptographer();
+    EXPECT_TRUE(cryptographer->CanDecryptUsingDefaultKey(
+        specifics.encrypted()));
+  }
+  EXPECT_FALSE(ResetUnsyncedEntry(syncable::BOOKMARKS, client_tag));
+
+  // Manually change to the same data. Should not set is_unsynced.
+  {
+    WriteTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
+    WriteNode node(&trans);
+    EXPECT_TRUE(node.InitByClientTagLookup(syncable::BOOKMARKS, client_tag));
+    node.SetEntitySpecifics(entity_specifics);
+    const syncable::Entry* node_entry = node.GetEntry();
+    const sync_pb::EntitySpecifics& specifics = node_entry->Get(SPECIFICS);
+    EXPECT_TRUE(specifics.has_encrypted());
+    EXPECT_FALSE(node_entry->Get(IS_UNSYNCED));
+    EXPECT_EQ(kEncryptedString, node_entry->Get(NON_UNIQUE_NAME));
+    Cryptographer* cryptographer = trans.GetCryptographer();
+    EXPECT_TRUE(cryptographer->CanDecryptUsingDefaultKey(
+        specifics.encrypted()));
+  }
+  EXPECT_FALSE(ResetUnsyncedEntry(syncable::BOOKMARKS, client_tag));
+
+  // Manually change to different data. Should set is_unsynced.
+  {
+    entity_specifics.MutableExtension(sync_pb::bookmark)->set_url("url2");
+    entity_specifics.MutableExtension(sync_pb::bookmark)->set_title("title2");
+    WriteTransaction trans(FROM_HERE, sync_manager_.GetUserShare());
+    WriteNode node(&trans);
+    EXPECT_TRUE(node.InitByClientTagLookup(syncable::BOOKMARKS, client_tag));
+    node.SetEntitySpecifics(entity_specifics);
+    const syncable::Entry* node_entry = node.GetEntry();
+    const sync_pb::EntitySpecifics& specifics = node_entry->Get(SPECIFICS);
+    EXPECT_TRUE(specifics.has_encrypted());
+    EXPECT_TRUE(node_entry->Get(IS_UNSYNCED));
+    EXPECT_EQ(kEncryptedString, node_entry->Get(NON_UNIQUE_NAME));
+    Cryptographer* cryptographer = trans.GetCryptographer();
+    EXPECT_TRUE(cryptographer->CanDecryptUsingDefaultKey(
+                    specifics.encrypted()));
+  }
+}
+
 }  // namespace browser_sync