Add a SigninAllowed policy.

chrome/browser/ui/sync/one_click_signin_helper.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/sync/one_click_signin_helper.h"
 
 #include <algorithm>
 #include <functional>
 #include <utility>
 #include <vector>
@@ skipping 521 matching lines @@
     return false;
 
   if (web_contents->GetBrowserContext()->IsOffTheRecord())
     return false;
 
   Profile* profile =
       Profile::FromBrowserContext(web_contents->GetBrowserContext());
   if (!profile)
     return false;
 
+  SigninManager* manager =
+      SigninManagerFactory::GetForProfile(profile);
+  if (manager && !manager->IsSigninAllowed())
+    return false;
+
   if (can_offer_for == CAN_OFFER_FOR_INTERSTITAL_ONLY &&
       !profile->GetPrefs()->GetBoolean(prefs::kReverseAutologinEnabled))
     return false;
 
   if (!SigninManager::AreSigninCookiesAllowed(profile))
     return false;
 
   if (!email.empty()) {
-    SigninManager* manager =
-        SigninManagerFactory::GetForProfile(profile);
     if (!manager)
       return false;
 
     // If the signin manager already has an authenticated name, then this is a
     // re-auth scenario.  Make sure the email just signed in corresponds to the
     // the one sign in manager expects.
     std::string current_email = manager->GetAuthenticatedUsername();
     const bool same_email = gaia::AreEmailsSame(current_email, email);
     if (!current_email.empty() && !same_email) {
       if (error_message) {
@@ skipping 88 matching lines @@
     return DONT_OFFER;
 
   if (!SyncPromoUI::UseWebBasedSigninFlow())
     return DONT_OFFER;
 
   // Check for incognito before other parts of the io_data, since those
   // members may not be initalized.
   if (io_data->is_incognito())
     return DONT_OFFER;
 
+  if (!SigninManager::IsSigninAllowedOnIOThread(io_data))
+    return DONT_OFFER;
+
   if (!io_data->reverse_autologin_enabled()->GetValue())
     return DONT_OFFER;
 
   if (!io_data->google_services_username()->GetValue().empty())
     return DONT_OFFER;
 
   if (!SigninManager::AreSigninCookiesAllowed(io_data->GetCookieSettings()))
     return DONT_OFFER;
 
   // The checks below depend on chrome already knowing what account the user
@@ skipping 524 matching lines @@
     }
   }
 
   RedirectToNTP();
   signin_tracker_.reset();
 }
 
 void OneClickSigninHelper::SigninSuccess() {
   signin_tracker_.reset();
 }