Prevent ONC-pushed certificates from being used with multiprofiles.

chrome/browser/chromeos/policy/policy_cert_service_factory.h

Index: chrome/browser/chromeos/policy/policy_cert_service_factory.h
diff --git a/chrome/browser/chromeos/policy/policy_cert_service_factory.h b/chrome/browser/chromeos/policy/policy_cert_service_factory.h
index dc945aa606669c0ea5a40b9530abf69d1e0c24a0..eaa269b92150a22ca3790f299e990e68bf8c1065 100644
--- a/chrome/browser/chromeos/policy/policy_cert_service_factory.h
+++ b/chrome/browser/chromeos/policy/policy_cert_service_factory.h
@@ -5,6 +5,8 @@
 #ifndef CHROME_BROWSER_CHROMEOS_POLICY_POLICY_CERT_SERVICE_FACTORY_H_
 #define CHROME_BROWSER_CHROMEOS_POLICY_POLICY_CERT_SERVICE_FACTORY_H_
 
+#include <string>
+
 #include "base/basictypes.h"
 #include "base/compiler_specific.h"
 #include "base/memory/scoped_ptr.h"
@@ -12,6 +14,7 @@
 
 template <typename T> struct DefaultSingletonTraits;
 
+class PrefRegistrySimple;
 class Profile;
 
 namespace policy {
@@ -37,6 +40,14 @@ class PolicyCertServiceFactory : public BrowserContextKeyedServiceFactory {
 
   static PolicyCertServiceFactory* GetInstance();
 
+  // Used to mark or clear |user_id| as having used certificates pushed by

[pneubeck (no reviews), 2013/12/17 15:25:31]

instead of having this here, it could be moved to something like
used_policy_certs_preference.h

however, I don't feel strong about this.

[Joao da Silva, 2013/12/17 16:36:41]

I'd keep it here, because this is backed by a pref shared by all profiles and
that pref gets set by the services created by this factory.

+  // policy before.
+  static void SetUsedPolicyCertificates(const std::string& user_id);
+  static void ClearUsedPolicyCertificates(const std::string& user_id);
+  static bool UsedPolicyCertificates(const std::string& user_id);
+
+  static void RegisterPrefs(PrefRegistrySimple* local_state);
+
  private:
   friend struct DefaultSingletonTraits<PolicyCertServiceFactory>;