Send a notification when the signed-in user is about to sign out.

chrome/browser/signin/signin_manager.cc

Index: chrome/browser/signin/signin_manager.cc
diff --git a/chrome/browser/signin/signin_manager.cc b/chrome/browser/signin/signin_manager.cc
index 581414dabfc3fdee2d3cc7114ce1b2d95b60f4ad..0ed0500d64a163246d9cb7529863f852f25d26ef 100644
--- a/chrome/browser/signin/signin_manager.cc
+++ b/chrome/browser/signin/signin_manager.cc
@@ -361,6 +361,10 @@ void SigninManager::SignOut() {
 
   GoogleServiceSignoutDetails details(authenticated_username_);
 
+  content::NotificationService::current()->Notify(
+      chrome::NOTIFICATION_GOOGLE_WILL_SIGN_OUT,
+      content::Source<Profile>(profile_),
+      content::Details<const GoogleServiceSignoutDetails>(&details));

[Andrew T Wilson (Slow), 2012/11/08 13:43:54]

I'm not a huge fan of having this extra notification.

Instead, can we just move the calls to ResetCredentialsInMemory() and
EraseTokensFromDB() below until *after* GOOGLE_SIGNED_OUT is called?

Also, what if we change TokenService to invalidate its oauth login token when
the user logs out (as I think has been discussed) - will that impact services
that now rely on access tokens living past the logout process?

Finally, if that service has a cached access token, won't it do something like
this:

1) Get GOOGLE_SIGNED_OUT
2) Try using the access token (async network call)
3) TokenService blows away tokens
4) Server returns "token expired" error
5) Service tries to mint a new access token, but TokenService no longer has a
login token due to step #3, so it can't.

This attempt to hit the server after logout seems destined to be pretty
unreliable - so much so that I am unconvinced we should be doing it.

I don't see a downside to clearing the tokens post-notification, though, even
though I don't think your intended use is valid.

   ClearTransientSigninData();
   authenticated_username_.clear();
   profile_->GetPrefs()->ClearPref(prefs::kGoogleServicesUsername);