Allow trusted brokers to restrict connections for spawned applications to whitelisted applications …

mojo/application/public/cpp/application_connection.h

Index: mojo/application/public/cpp/application_connection.h
diff --git a/mojo/application/public/cpp/application_connection.h b/mojo/application/public/cpp/application_connection.h
index 921462f12405f35e88a146400f31a747d744f089..22986d50f359132af93b5534e52477428f0b52c5 100644
--- a/mojo/application/public/cpp/application_connection.h
+++ b/mojo/application/public/cpp/application_connection.h
@@ -56,9 +56,11 @@ class ApplicationConnection {
 
   // Makes Interface available as a service to the remote application.
   // |factory| will create implementations of Interface on demand.
+  // Returns true if the service was exposed, false if capability filtering
+  // from the shell prevented the service from being exposed.
   template <typename Interface>
-  void AddService(InterfaceFactory<Interface>* factory) {
-    SetServiceConnectorForName(
+  bool AddService(InterfaceFactory<Interface>* factory) {
+    return SetServiceConnectorForName(
         new internal::InterfaceFactoryConnector<Interface>(factory),
         Interface::Name_);
   }
@@ -99,6 +101,11 @@ class ApplicationConnection {
   // value is owned by this connection.
   virtual ServiceProvider* GetLocalServiceProvider() = 0;
 
+  // Register a handler to receive an error notification on the pipe to the
+  // remote application's service provider. Use as a proxy for knowledge of when
+  // the underlying application connection is destroyed.
+  virtual void SetConnectionErrorHandler(const Closure& handler) = 0;

[sky, 2015/07/24 15:36:55]

Do you think this should be SetServiceProviderConnectionHandler() to reinforce
what it relates to? The reason I suggest this name is your comment and name
imply the connection is no longer valid, which isn't right. For example, any
services vended from the remove service provider may still be valid. This error
handler just means the remote service provider is no longer valid.

+
  protected:
   virtual ~ApplicationConnection();
 
@@ -106,7 +113,7 @@ class ApplicationConnection {
   virtual void OnCloseConnection() = 0;
 
  private:
-  virtual void SetServiceConnectorForName(ServiceConnector* service_connector,
+  virtual bool SetServiceConnectorForName(ServiceConnector* service_connector,

[sky, 2015/07/24 15:36:55]

Document return value.

                                           const std::string& name) = 0;
 
   // Ensures that CloseConnection can only be called once and the