Introduce CloudPolicyClient

chrome/browser/policy/cloud_policy_client.cc

+// Copyright (c) 2012 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/policy/cloud_policy_client.h"
+
+#include "base/bind.h"
+#include "base/logging.h"
+#include "chrome/browser/policy/device_management_service.h"
+#include "chrome/browser/policy/proto/device_management_backend.pb.h"
+#include "chrome/common/guid.h"
+
+namespace em = enterprise_management;
+
+namespace policy {
+
+CloudPolicyClient::PublicKeyVersion::PublicKeyVersion()
+    : valid_(false),
+      version_(-1) {}
+
+CloudPolicyClient::PublicKeyVersion::PublicKeyVersion(int version)
+    : valid_(true),
+      version_(version) {}
+
+CloudPolicyClient::PublicKeyVersion::PublicKeyVersion(
+    const PublicKeyVersion& other)
+    : valid_(other.valid_),
+      version_(other.version_) {}
+
+const CloudPolicyClient::PublicKeyVersion&
+    CloudPolicyClient::PublicKeyVersion::operator=(
+        const PublicKeyVersion& other) {
+  valid_ = other.valid_;
+  version_ = other.version_;
+  return *this;
+}
+
+CloudPolicyClient::Observer::~Observer() {}
+
+CloudPolicyClient::StatusProvider::~StatusProvider() {}
+
+CloudPolicyClient::CloudPolicyClient(const std::string& machine_id,
+                                     const std::string& machine_model,
+                                     UserAffiliation user_affiliation,
+                                     PolicyScope scope,
+                                     StatusProvider* status_provider,
+                                     DeviceManagementService* service)
+    : machine_id_(machine_id),
+      machine_model_(machine_model),
+      user_affiliation_(user_affiliation),
+      scope_(scope),
+      submit_machine_id_(false),
+      service_(service),
+      request_job_(NULL),

[Joao da Silva, 2012/05/22 20:59:30]

Nit: I wouldn't explicitly initialize a NULL scoped_ptr, your call

[Mattias Nissler (ping if slow), 2012/05/24 10:12:01]

Done.

+      status_provider_(status_provider),
+      status_(DM_STATUS_SUCCESS) {}
+
+CloudPolicyClient::~CloudPolicyClient() {}
+
+void CloudPolicyClient::SetupRegistration(const std::string& dm_token,
+                                          const std::string& client_id) {
+  DCHECK(!dm_token.empty());
+  DCHECK(!client_id.empty());
+

[Joao da Silva, 2012/05/22 20:59:30]

DCHECK(!is_registered()) ?

[Mattias Nissler (ping if slow), 2012/05/24 10:12:01]

Done.

[Joao da Silva, 2012/05/24 15:00:47]

I meant that as an additional DCHECK, not in place of the others. Can the
arguments be empty?

[Mattias Nissler (ping if slow), 2012/05/24 18:01:00]

Ah true, and we want to avoid the arguments to be empty. I restored the checks.

+  dm_token_ = dm_token;
+  client_id_ = client_id;
+  request_job_.reset();
+  policy_.reset();
+
+  NotifyRegistrationStateChanged();
+}
+
+void CloudPolicyClient::Register(const std::string& auth_token) {
+  DCHECK(!is_registered());
+  client_id_ = guid::GenerateGUID();

[Joao da Silva, 2012/05/22 20:59:30]

This is the same that the current code is doing, but it means a crazy client
that keeps registering (and failing) will use a different client_id per request.
Maybe generate the GUID at the ctor, or only if it's empty?

[Mattias Nissler (ping if slow), 2012/05/24 10:12:01]

There's a good reason to re-generate the ID: privacy. We should only keep the ID
if registration is successful. Added a comment to that effect.

[Joao da Silva, 2012/05/24 15:00:47]

Ah true. Thanks for the clarification.

+
+  request_job_.reset(
+      service_->CreateJob(DeviceManagementRequestJob::TYPE_REGISTRATION));
+  request_job_->SetOAuthToken(auth_token);
+  request_job_->SetClientID(client_id_);
+
+  em::DeviceRegisterRequest* request =
+      request_job_->GetRequest()->mutable_register_request();
+  SetRegistrationType(request);
+  if (!machine_id_.empty())
+    request->set_machine_id(machine_id_);
+  if (!machine_model_.empty())
+    request->set_machine_model(machine_model_);
+
+  request_job_->Start(base::Bind(&CloudPolicyClient::OnRegisterCompleted,
+                                 base::Unretained(this)));
+}
+
+void CloudPolicyClient::FetchPolicy() {
+  CHECK(!dm_token_.empty());

[Joao da Silva, 2012/05/22 20:59:30]

Rename to CHECK(is_registered()) ?

[Mattias Nissler (ping if slow), 2012/05/24 10:12:01]

Done.

+
+  request_job_.reset(
+      service_->CreateJob(DeviceManagementRequestJob::TYPE_POLICY_FETCH));
+  request_job_->SetDMToken(dm_token_);
+  request_job_->SetClientID(client_id_);
+  request_job_->SetUserAffiliation(user_affiliation_);
+
+  em::DeviceManagementRequest* request = request_job_->GetRequest();
+
+  // Build policy fetch request.
+  em::PolicyFetchRequest* policy_request =
+      request->mutable_policy_request()->add_request();
+  policy_request->set_signature_type(em::PolicyFetchRequest::SHA1_RSA);
+  SetPolicyType(policy_request);
+  if (!last_policy_timestamp_.is_null()) {
+    base::TimeDelta timestamp(last_policy_timestamp_ - base::Time::UnixEpoch());
+    policy_request->set_timestamp(timestamp.InMilliseconds());
+  }
+  if (submit_machine_id_ && !machine_id_.empty())
+    policy_request->set_machine_id(machine_id_);
+  if (public_key_version_.valid())
+    policy_request->set_public_key_version(public_key_version_.version());
+
+  // Add status data.
+  if (status_provider_) {
+    if (!status_provider_->GetDeviceStatus(
+            request->mutable_device_status_report_request())) {
+      request->clear_device_status_report_request();
+    }
+    if (!status_provider_->GetSessionStatus(
+            request->mutable_session_status_report_request())) {
+      request->clear_session_status_report_request();
+    }
+  }
+
+  // Fire the job.
+  request_job_->Start(base::Bind(&CloudPolicyClient::OnPolicyFetchCompleted,
+                                 base::Unretained(this)));
+}
+
+void CloudPolicyClient::Unregister() {
+  request_job_.reset(
+      service_->CreateJob(DeviceManagementRequestJob::TYPE_UNREGISTRATION));
+  request_job_->SetDMToken(dm_token_);
+  request_job_->SetClientID(client_id_);
+  request_job_->GetRequest()->mutable_unregister_request();
+  request_job_->Start(base::Bind(&CloudPolicyClient::OnUnregisterCompleted,
+                                 base::Unretained(this)));
+}
+
+void CloudPolicyClient::AddObserver(Observer* observer) {
+  observers_.AddObserver(observer);
+}
+
+void CloudPolicyClient::RemoveObserver(Observer* observer) {
+  observers_.RemoveObserver(observer);
+}
+
+void CloudPolicyClient::SetRegistrationType(
+    em::DeviceRegisterRequest* request) const {
+  switch (scope_) {
+    case POLICY_SCOPE_USER:
+      request->set_type(em::DeviceRegisterRequest::USER);
+      return;
+    case POLICY_SCOPE_MACHINE:
+      request->set_type(em::DeviceRegisterRequest::DEVICE);
+      return;
+  }
+  NOTREACHED() << "Invalid policy scope " << scope_;
+}
+
+void CloudPolicyClient::SetPolicyType(em::PolicyFetchRequest* request) const {
+  switch (scope_) {
+    case POLICY_SCOPE_USER:
+      request->set_policy_type(dm_protocol::kChromeUserPolicyType);
+      return;
+    case POLICY_SCOPE_MACHINE:
+      request->set_policy_type(dm_protocol::kChromeDevicePolicyType);
+      return;
+  }
+  NOTREACHED() << "Invalid policy scope " << scope_;
+}
+
+void CloudPolicyClient::OnRegisterCompleted(
+    DeviceManagementStatus status,
+    const em::DeviceManagementResponse& response) {
+  if (status == DM_STATUS_SUCCESS &&
+      (!response.has_register_response() ||
+       !response.register_response().has_device_management_token())) {
+    LOG(WARNING) << "Empty registration response.";
+    status = DM_STATUS_RESPONSE_DECODING_ERROR;
+  }
+
+  status_ = status;
+  if (status == DM_STATUS_SUCCESS) {
+    dm_token_ = response.register_response().device_management_token();
+    NotifyRegistrationStateChanged();
+  } else {
+    NotifyClientError();
+  }
+}
+
+void CloudPolicyClient::OnPolicyFetchCompleted(
+    DeviceManagementStatus status,
+    const em::DeviceManagementResponse& response) {
+  if (status == DM_STATUS_SUCCESS) {
+    if (!response.has_policy_response() ||
+        response.policy_response().response_size() == 0) {
+      LOG(WARNING) << "Empty policy response.";
+      status = DM_STATUS_RESPONSE_DECODING_ERROR;
+    } else if (response.policy_response().response_size() > 1) {
+      LOG(WARNING) << "More than one response entries, ignoring all but first.";
+    }
+  }
+
+  status_ = status;
+  if (status == DM_STATUS_SUCCESS) {
+    policy_.reset(new enterprise_management::PolicyFetchResponse(
+        response.policy_response().response(0)));

[Joao da Silva, 2012/05/22 20:59:30]

I'd like to avoid the copy if possible, and I think we could do this:

policy_.reset(response.policy_response().mutable_response()->ReleaseLast())

It'd also require swapping the first and last elements above, after checking
that response_size() > 1:

em::PolicyFetchResponse* r = response.policy_response().mutable_response();
r->SwapElements(0, r->size()-1);

Got this from [1]. I'm not sure the complication is worth the effort, so it's
your call :-)

[1]
https://developers.google.com/protocol-buffers/docs/reference/cpp/google.prot...

[Mattias Nissler (ping if slow), 2012/05/24 10:12:01]

That would require to pass |response| non-const. I'd rather keep the interface
clean as long as we don't run into performance issues here.

+    if (status_provider_)
+      status_provider_->OnSubmittedSuccessfully();

[Joao da Silva, 2012/05/22 20:59:30]

Will this be the right thing to do if FetchPolicy is called twice and the 2nd
call drops the first? The status_provider_ will be asked for data twice but this
callback only refers to the data from the 2nd call. I guess that is correct,
just checking :-)

[Mattias Nissler (ping if slow), 2012/05/24 10:12:01]

The idea is that the status provider should only flush state once it sees this
callback. If it has never seen a confirmation for the first request, it should
include the data shipped with the first request also in the second.

+    NotifyPolicyFetched();
+  } else {
+    NotifyClientError();
+  }
+}
+
+void CloudPolicyClient::OnUnregisterCompleted(
+    DeviceManagementStatus status,
+    const em::DeviceManagementResponse& response) {
+  if (status == DM_STATUS_SUCCESS && !response.has_unregister_response()) {
+    // Assume unregistration has succeeded either way.
+    LOG(WARNING) << "Empty unregistration response.";
+  }
+
+  status_ = status;
+  if (status == DM_STATUS_SUCCESS) {
+    dm_token_.clear();
+    NotifyRegistrationStateChanged();
+  } else {
+    NotifyClientError();
+  }
+}
+
+void CloudPolicyClient::NotifyPolicyFetched() {
+  FOR_EACH_OBSERVER(Observer, observers_, OnPolicyFetched(this));
+}
+
+void CloudPolicyClient::NotifyRegistrationStateChanged() {
+  FOR_EACH_OBSERVER(Observer, observers_, OnRegistrationStateChanged(this));
+}
+
+void CloudPolicyClient::NotifyClientError() {
+  FOR_EACH_OBSERVER(Observer, observers_, OnClientError(this));
+}
+
+}  // namespace policy