platformKeys: Add policy and corporate key tagging.

chrome/test/data/extensions/api_test/platform_keys/basic.js

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 'use strict';
 
 var systemTokenEnabled = (location.search.indexOf("systemTokenEnabled") != -1);
 var selectedTestSuite = location.hash.slice(1);
 console.log('[SELECTED TEST SUITE] ' + selectedTestSuite +
             ', systemTokenEnable ' + systemTokenEnabled);
@@ skipping 156 matching lines @@
   algorithm.name = null;
   algorithm.modulusLength = null;
   algorithm.publicExponent = null;
   assertEq(originalAlgorithm, key.algorithm);
 }
 
 function checkPropertyIsReadOnly(object, key) {
   var original = object[key];
   try {
     object[key] = {};
-    fail('Expected the property to be read-only and an exception to be thrown');
+    fail('Expected the property ' + key +
+         ' to be read-only and an exception to be thrown');
   } catch (error) {
     assertEq(original, object[key]);
   }
 }
 
 function checkPrivateKeyFormat(privateKey) {
   assertEq('private', privateKey.type);
   assertEq(false, privateKey.extractable);
   checkPropertyIsReadOnly(privateKey, 'algorithm');
   checkAlgorithmIsCopiedOnRead(privateKey);
@@ skipping 320 matching lines @@
 function testVerifyUntrusted() {
   var details = {
     serverCertificateChain: [data.client_1.buffer],
     hostname: "127.0.0.1"
   };
   chrome.platformKeys.verifyTLSServerCertificate(
       details, callbackPass(function(result) { assertFalse(result.trusted); }));
 }
 
 var testSuites = {
-  // These tests assume already granted permissions for client_1 and client_2.
   // On interactive selectClientCertificates calls, the simulated user does not
   // select any cert.
   basicTests: function() {
     var tests = [
       testStaticMethods,
 
       // Interactively select client_1 and client_2 to grant permissions for
       // these certificates.
       testInteractiveSelectClient1,
       testInteractiveSelectClient2,
@@ skipping 15 matching lines @@
       testSignSha1Client1,
       testVerifyTrusted,
       testVerifyTrustedChain,
       testVerifyCommonNameInvalid,
       testVerifyUntrusted,
     ];
 
     chrome.test.runTests(tests);
   },
 
-  // This test suite starts without any granted permissions.
   // On interactive selectClientCertificates calls, the simulated user selects
   // client_1, if matching.
   permissionTests: function() {
     var tests = [
       // Without permissions both sign attempts fail.
       testSignClient1Fails,
       testSignClient2Fails,
 
       // Without permissions, non-interactive select calls return no certs.
       testSelectAllReturnsNoCerts,
 
       testInteractiveSelectClient1,
       // Now the permission for client_1 is granted.
 
       // Verify that signing with client_1 is possible and with client_2 still
       // fails.
       testSignSha1Client1,
       testSignClient2Fails,
 
       // Verify that client_1 can still be selected interactively.
       testInteractiveSelectClient1,
 
       // Verify that client_1 but not client_2 is selected in non-interactive
       // calls.
       testSelectAllReturnsClient1,
     ];
 
     chrome.test.runTests(tests);
-  }
+  },
+
+  managedProfile: function() {
+    var tests = [
+      // If the profile is managed, the user cannot grant permissions for any
+      // certificates.
+      testInteractiveSelectNoCerts
+    ];
+    chrome.test.runTests(tests);
+  },
+
+  corporateKeyWithoutPermissionTests: function() {
+    var tests = [
+      // Directly trying to sign must fail
+      testSignClient1Fails,
+
+      // Interactively selecting must not show any cert to the user.
+      testInteractiveSelectNoCerts,
+    ];
+    chrome.test.runTests(tests);
+  },
+
+  corporateKeyWithPermissionTests: function() {
+    var tests = [
+      // The extension has non-interactive access to all corporate keys, even
+      // without previous additional consent of the user.
+      testSignSha1Client1,
+
+      // Interactively selecting for client_1 will work as well.
+      testInteractiveSelectClient1,
+    ];
+    chrome.test.runTests(tests);
+  },
+
+  untaggedKeyWithUnrelatedPermissionTests: function() {
+    // The permission from policy must not affect usage of non-corproate keys.
+    var tests = [
+      // Attempts to sign must fail.
+      testSignClient1Fails,
+
+      // Interactive selection must not prompt the user and not return any
+      // certificate.
+      testInteractiveSelectNoCerts,
+    ];
+    chrome.test.runTests(tests);
+  },
+
 };
 
 setUp(testSuites[selectedTestSuite]);