Add a SigninAllowed policy.

chrome/browser/ui/sync/one_click_signin_helper.cc

Index: chrome/browser/ui/sync/one_click_signin_helper.cc
diff --git a/chrome/browser/ui/sync/one_click_signin_helper.cc b/chrome/browser/ui/sync/one_click_signin_helper.cc
index c3524fd0f3cae9456c51804ff38d786520ea1e44..2dfcded92db6ccc3397157892143564a0c936f93 100644
--- a/chrome/browser/ui/sync/one_click_signin_helper.cc
+++ b/chrome/browser/ui/sync/one_click_signin_helper.cc
@@ -390,7 +390,7 @@ bool OneClickSigninHelper::CanOffer(content::WebContents* web_contents,
 
   Profile* profile =
       Profile::FromBrowserContext(web_contents->GetBrowserContext());
-  if (!profile)
+  if (!profile || !profile->IsSigninAllowed())
     return false;
 
   if (can_offer_for == CAN_OFFER_FOR_INTERSTITAL_ONLY &&
@@ -499,6 +499,9 @@ OneClickSigninHelper::Offer OneClickSigninHelper::CanOfferOnIOThreadImpl(
   if (io_data->is_incognito())
     return DONT_OFFER;
 
+  if (!SigninManager::IsSigninAllowedOnIOThread(io_data))
+    return DONT_OFFER;
+
   if (!io_data->reverse_autologin_enabled()->GetValue())
     return DONT_OFFER;