Public Sessions: fetch device robot api token during enterprise enrollment.

chrome/browser/policy/cloud/proto/device_management_backend.proto

Index: chrome/browser/policy/cloud/proto/device_management_backend.proto
diff --git a/chrome/browser/policy/cloud/proto/device_management_backend.proto b/chrome/browser/policy/cloud/proto/device_management_backend.proto
index 2c46a3778f6416a66a02f7e01cb2c462b3c3950e..bee07f282fbb64a1f612addc04f2eef65c353a56 100644
--- a/chrome/browser/policy/cloud/proto/device_management_backend.proto
+++ b/chrome/browser/policy/cloud/proto/device_management_backend.proto
@@ -91,6 +91,17 @@ message DevicePolicySettingRequest {
   optional string watermark = 2;
 }
 
+// Request to access a Google service with the given scope.
+message DeviceServiceApiAccessRequest {
+  // The list of auth scopes the device requests from DMServer.
+  repeated string auth_scope = 1;
+}
+
+message DeviceServiceApiAccessResponse {
+  // The OAuth2 authorization code for the requested scope(s).
+  optional string auth_code = 3;
+}
+
 message PolicyFetchRequest {
   // This is the policy type, which maps to D3 policy type internally.
   // By convention, we use "/" as separator to create policy namespace.
@@ -433,6 +444,7 @@ message DeviceAutoEnrollmentResponse {
 //     * register
 //     * status
 //     * unregister
+//     * api_authorization
 //
 //   * devicetype: MUST BE "1" for Android or "2" for Chrome OS.
 //   * apptype: MUST BE Android or Chrome.
@@ -475,6 +487,9 @@ message DeviceManagementRequest {
 
   // Auto-enrollment detection.
   optional DeviceAutoEnrollmentRequest auto_enrollment_request = 6;
+
+  // Request for OAuth2 authorization codes to access Google services.
+  optional DeviceServiceApiAccessRequest service_api_access_request = 7;
 }
 
 // Response from server to device.
@@ -514,4 +529,7 @@ message DeviceManagementResponse {
 
   // Auto-enrollment detection response.
   optional DeviceAutoEnrollmentResponse auto_enrollment_response = 8;
+
+  // Response to OAuth2 authorization code request.
+  optional DeviceServiceApiAccessResponse service_api_access_response = 9;
 }