[Mac] Check if a profile is locked before allowing a new window to be opened.

chrome/browser/app_controller_mac.mm

Index: chrome/browser/app_controller_mac.mm
diff --git a/chrome/browser/app_controller_mac.mm b/chrome/browser/app_controller_mac.mm
index 79b2d8902c673089474f0415415b087702024cd8..e1e89205b9953cae7de11036b1524e75f6105d45 100644
--- a/chrome/browser/app_controller_mac.mm
+++ b/chrome/browser/app_controller_mac.mm
@@ -49,6 +49,7 @@
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_command_controller.h"
 #include "chrome/browser/ui/browser_commands.h"
+#include "chrome/browser/ui/browser_dialogs.h"
 #include "chrome/browser/ui/browser_finder.h"
 #include "chrome/browser/ui/browser_iterator.h"
 #include "chrome/browser/ui/browser_mac.h"
@@ -77,6 +78,7 @@
 #include "chrome/common/extensions/extension_constants.h"
 #include "chrome/common/mac/app_mode_common.h"
 #include "chrome/common/pref_names.h"
+#include "chrome/common/profile_management_switches.h"
 #include "chrome/common/service_messages.h"
 #include "chrome/common/url_constants.h"
 #include "content/public/browser/browser_thread.h"
@@ -189,6 +191,19 @@ void RecordLastRunAppBundlePath() {
       base::TimeDelta::FromMilliseconds(1500));
 }
 
+bool IsProfileSignedOut(Profile* profile) {
+  // The signed out status only makes sense at the moment in the context of the
+  // --new-profile-management flag.
+  if (!switches::IsNewProfileManagement())
+    return false;
+  ProfileInfoCache& cache =
+      g_browser_process->profile_manager()->GetProfileInfoCache();
+  size_t profile_index = cache.GetIndexOfProfileWithPath(profile->GetPath());
+  if (profile_index == std::string::npos)
+    return false;
+  return cache.ProfileIsSigninRequiredAtIndex(profile_index);
+}
+
 }  // anonymous namespace
 
 @interface AppController (Private)
@@ -972,6 +987,15 @@ class AppControllerProfileObserver : public ProfileInfoCacheObserver {
     return;
 
   NSInteger tag = [sender tag];
+
+  // If there are no browser windows, and we are trying to open a browser
+  // for a locked profile, we have to show the User Manager instead as the
+  // locked profile needs authentication.
+  if (IsProfileSignedOut(lastProfile)) {
+    chrome::ShowUserManager(lastProfile->GetPath());
+    return;
+  }
+
   switch (tag) {
     case IDC_NEW_TAB:
       // Create a new tab in an existing browser window (which we activate) if
@@ -1184,7 +1208,15 @@ class AppControllerProfileObserver : public ProfileInfoCacheObserver {
   }
 
   // Otherwise open a new window.
-  CreateBrowser([self lastProfile]);
+  // If the last profile was locked, we have to open the User Manager, as the
+  // profile requires authentication. Similarly, because guest mode is
+  // implemented as forced incognito, we can't open a new guest browser either,
+  // so we have to show the User Manager as well.
+  Profile* lastProfile = [self lastProfile];
+  if (lastProfile->IsGuestSession() || IsProfileSignedOut(lastProfile))
+    chrome::ShowUserManager(lastProfile->GetPath());
+  else
+    CreateBrowser(lastProfile);
 
   // We've handled the reopen event, so return NO to tell AppKit not
   // to do anything.