[Chrome OS ECHO] Add cookies permission to extension and change intent disposition to inline

[Chrome OS ECHO] Add cookies permission to extension and change intent disposition to inline

In the new UX flow, we will use the inline WebIntent tab modal dialog for user consent instead of the Info Bar. 

Also get rid of the actual extension code since it's been moved to
chromeos assets repository.

BUG=chromium-os:28353, chromium-os:27854, chromium-os:28484
TEST=make sure extension loads and handles intents correctly.

Committed: http://src.chromium.org/viewvc/chrome?view=rev&revision=129573

[gauravsh, 2012-03-27 02:46:13]

Jorge: Could you have a look at this extension manifest? I am having some
trouble getting CSP to work. In-spite of adding an exception for allowing
scripts to load from https://apis.google.com, I get an error on the JS console:

[11943:11943:1917365378146:INFO:CONSOLE(0)] "Refused to load script from
'https://apis.google.com/js/client.js' because of Content-Security-Policy.

Any idea what I might be doing wrong? For reference, the corresponding extension
is at: https://gerrit-int.chromium.org/#change,14561,patchset=1

[gauravsh, 2012-03-27 02:52:08]

Use this URL for the extension:

https://gerrit-int.chromium.org/14561

On 2012/03/27 02:46:13, gauravsh wrote:
> Jorge: Could you have a look at this extension manifest? I am having some
> trouble getting CSP to work. In-spite of adding an exception for allowing
> scripts to load from https://apis.google.com, I get an error on the JS
console:
> 
> [11943:11943:1917365378146:INFO:CONSOLE(0)] "Refused to load script from
> 'https://apis.google.com/js/client.js' because of Content-Security-Policy.
> 
> Any idea what I might be doing wrong? For reference, the corresponding
extension
> is at: https://gerrit-int.chromium.org/#change%2C14561%2Cpatchset=1

[Jorge Lucangeli Obes, 2012-03-27 16:22:58]

http://codereview.chromium.org/9865016/diff/1/chrome/browser/resources/chrome...
File chrome/browser/resources/chromeos/offers/manifest.json (right):

http://codereview.chromium.org/9865016/diff/1/chrome/browser/resources/chrome...
chrome/browser/resources/chromeos/offers/manifest.json:8:
"content_security_policy": "script-src 'self' https://apis.google.com/js/;
object-src 'self'",
I think this needs to be https://apis.google.com as is, no /js/ path.

[gauravsh, 2012-03-27 17:08:25]

http://codereview.chromium.org/9865016/diff/1/chrome/browser/resources/chrome...
File chrome/browser/resources/chromeos/offers/manifest.json (right):

http://codereview.chromium.org/9865016/diff/1/chrome/browser/resources/chrome...
chrome/browser/resources/chromeos/offers/manifest.json:8:
"content_security_policy": "script-src 'self' https://apis.google.com/js/;
object-src 'self'",
On 2012/03/27 16:22:58, Jorge Lucangeli Obes wrote:
> I think this needs to be https://apis.google.com as is, no /js/ path.

No dice. Still gives me the same error. You can repro this by downloading the
extension files, loading the unpacked extension, and then navigating to:

chrome-extension://dfgpjpjbeeflfdhdpabeeeheghdmeigc/main.html

[Jorge Lucangeli Obes, 2012-03-27 17:11:24]

On 2012/03/27 17:08:25, gauravsh wrote:
>
http://codereview.chromium.org/9865016/diff/1/chrome/browser/resources/chrome...
> File chrome/browser/resources/chromeos/offers/manifest.json (right):
> 
>
http://codereview.chromium.org/9865016/diff/1/chrome/browser/resources/chrome...
> chrome/browser/resources/chromeos/offers/manifest.json:8:
> "content_security_policy": "script-src 'self' https://apis.google.com/js/;
> object-src 'self'",
> On 2012/03/27 16:22:58, Jorge Lucangeli Obes wrote:
> > I think this needs to be https://apis.google.com as is, no /js/ path.
> 
> No dice. Still gives me the same error. You can repro this by downloading the
> extension files, loading the unpacked extension, and then navigating to:
> 
> chrome-extension://dfgpjpjbeeflfdhdpabeeeheghdmeigc/main.html

Are you sure? I've tried both accessing main.html using a chrome-extension URL,
as well as adding main.html as the main page of the app, and I don't see errors
on the console.

[gauravsh, 2012-03-27 19:48:28]

Jorge: Ready for another look. And review.

[Jorge Lucangeli Obes, 2012-03-27 19:59:59]

https://chromiumcodereview.appspot.com/9865016/diff/2004/chrome/browser/resou...
File chrome/browser/resources/chromeos/offers/manifest.json (right):

https://chromiumcodereview.appspot.com/9865016/diff/2004/chrome/browser/resou...
chrome/browser/resources/chromeos/offers/manifest.json:8:
"content_security_policy": "default-src 'self'; script-src 'self'
https://apis.google.com; frame-src 'self' https://www.googleapis.com
https://www-googleapis-test.sandbox.google.com; object-src 'self'",
We're going to get rid of "https://www-googleapis-test.sandbox.google.com"
eventually right?

[gauravsh, 2012-03-27 20:02:03]

https://chromiumcodereview.appspot.com/9865016/diff/2004/chrome/browser/resou...
File chrome/browser/resources/chromeos/offers/manifest.json (right):

https://chromiumcodereview.appspot.com/9865016/diff/2004/chrome/browser/resou...
chrome/browser/resources/chromeos/offers/manifest.json:8:
"content_security_policy": "default-src 'self'; script-src 'self'
https://apis.google.com; frame-src 'self' https://www.googleapis.com
https://www-googleapis-test.sandbox.google.com; object-src 'self'",
On 2012/03/27 20:00:00, Jorge Lucangeli Obes wrote:
> We're going to get rid of "https://www-googleapis-test.sandbox.google.com"
> eventually right?

Yes, right now the production server is not ready.

[Jorge Lucangeli Obes, 2012-03-27 20:06:54]

OK, please CC me in the future on the CL to remove that URL from the CSP line in
the manifest (whenever it happens).

LGTM

[jimhebert, 2012-03-27 20:14:23]

Do you want to track that TODO as part of
http://code.google.com/p/chromium-os/issues/detail?id=28353 or in a separate
bug?

On 2012/03/27 20:06:54, Jorge Lucangeli Obes wrote:
> OK, please CC me in the future on the CL to remove that URL from the CSP line
in
> the manifest (whenever it happens).
> 
> LGTM

[Jorge Lucangeli Obes, 2012-03-27 20:18:12]

On 2012/03/27 20:14:23, jimhebert wrote:
> Do you want to track that TODO as part of
> http://code.google.com/p/chromium-os/issues/detail?id=28353 or in a separate
> bug?
> 
> On 2012/03/27 20:06:54, Jorge Lucangeli Obes wrote:
> > OK, please CC me in the future on the CL to remove that URL from the CSP
line
> in
> > the manifest (whenever it happens).
> > 
> > LGTM

Let's do it as part of that bug. We shouldn't close it while the manifest has
pre-production info. I'll update it.

[gauravsh, 2012-03-27 22:02:24]

Added a TODO. Changed the intent dispositions to inline.

[gauravsh, 2012-03-27 22:03:33]

Zel/Steven for OWNERS approval: This is a change to the ECHO extensions manifest
for additional hardening, and adding the cookies permission. It also changes the
intent handler disposition to inline to support the new UX flow.

[gauravsh, 2012-03-27 23:39:29]

Jorge and I sat down to debug issues with loading Google APIs when CSP is
enabled. I have disabled CSP for now, and filed a release blocker bug for now.
This will at least unblock us in doing end-to-end testing with the ECHO server.

[gauravsh, 2012-03-28 20:42:39]

For now, we decided to stay on manifest version 1 with CSP enabled (and
unsafe-eval for script-src). Will move to v2 when Google API stops using unsafe
eval.

[Jorge Lucangeli Obes, 2012-03-28 21:16:05]

lgtm

[commit-bot: I haz the power, 2012-03-28 21:19:34]

No LGTM from a valid reviewer yet. Only full committers are accepted.
Even if an LGTM may have been provided, it was from a non-committer or
a lowly provisional committer, _not_ a full super star committer.
See http://www.chromium.org/getting-involved/become-a-committer
Note that this has nothing to do with OWNERS files.

[tbarzic, 2012-03-28 21:46:00]

lgtm

[commit-bot: I haz the power, 2012-03-28 21:47:03]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/gauravsh@chromium.org/9865016/12005

[commit-bot: I haz the power, 2012-03-29 01:13:24]

Try job failure for 9865016-12005 (retry) on win_rel for steps "browser_tests,
installer_util_unittests".
It's a second try, previously, steps "browser_tests, installer_util_unittests"
failed.
http://build.chromium.org/p/tryserver.chromium/buildstatus?builder=win_rel&nu...

[commit-bot: I haz the power, 2012-03-29 01:15:34]

CQ is trying da patch. Follow status at
https://chromium-status.appspot.com/cq/gauravsh@chromium.org/9865016/12005

[commit-bot: I haz the power, 2012-03-29 03:59:27]

Change committed as 129573