Add a centralized mechanism for whitelisting access to extension permissions.

chrome/common/extensions/extension.cc

Index: chrome/common/extensions/extension.cc
diff --git a/chrome/common/extensions/extension.cc b/chrome/common/extensions/extension.cc
index 04475081a52ddc8d892092fde25f1caeb48a4a19..84a10c9e1843a89684e5067d74c983ca55e9df16 100644
--- a/chrome/common/extensions/extension.cc
+++ b/chrome/common/extensions/extension.cc
@@ -2835,12 +2835,11 @@ bool Extension::ImplicitlyDelaysNetworkStartup() const {
 bool Extension::CanSpecifyAPIPermission(
     const ExtensionAPIPermission* permission,
     string16* error) const {
-  if (permission->is_component_only()) {
-    if (!CanSpecifyComponentOnlyPermission()) {
-      *error = ExtensionErrorUtils::FormatErrorMessageUTF16(
-          errors::kPermissionNotAllowed, permission->name());
-      return false;
-    }
+  if ((permission->is_component_only() && location_ != COMPONENT) ||

[Aaron Boodman, 2012/02/02 18:17:31]

I think this logic should be:

if (permission->is_component_only() && location_ == COMPONENT)
  return true;

if (permission->HasWhitelist() && permission->IsWhitelisted(id_))
 return true;

(and then get rid of the lines at 2852 and 2853.

+      (permission->HasWhitelist() && !permission->IsWhitelisted(id_))) {
+    *error = ExtensionErrorUtils::FormatErrorMessageUTF16(
+        errors::kPermissionNotAllowed, permission->name());
+    return false;
   }
 
   if (permission->id() == ExtensionAPIPermission::kExperimental) {
@@ -2892,13 +2891,6 @@ bool Extension::CanSpecifyAPIPermission(
   return true;
 }
 
-bool Extension::CanSpecifyComponentOnlyPermission() const {
-  // Only COMPONENT extensions can use private APIs.
-  // TODO(asargent) - We want a more general purpose mechanism for this,
-  // and better error messages. (http://crbug.com/54013)
-  return location_ == Extension::COMPONENT;
-}
-
 bool Extension::CanSpecifyExperimentalPermission() const {
   if (location_ == Extension::COMPONENT)
     return true;