Add source column to chrome://policy showing the origins of policies.

chrome/browser/policy/policy_browsertest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <algorithm>
 #include <string>
 #include <vector>
 
 #include "ash/display/display_manager.h"
 #include "base/bind.h"
@@ skipping 82 matching lines @@
 #include "components/omnibox/browser/autocomplete_controller.h"
 #include "components/omnibox/browser/omnibox_edit_model.h"
 #include "components/omnibox/browser/omnibox_view.h"
 #include "components/policy/core/browser/browser_policy_connector.h"
 #include "components/policy/core/common/external_data_fetcher.h"
 #include "components/policy/core/common/mock_configuration_policy_provider.h"
 #include "components/policy/core/common/policy_map.h"
 #include "components/policy/core/common/policy_pref_names.h"
 #include "components/policy/core/common/policy_service.h"
 #include "components/policy/core/common/policy_service_impl.h"
+#include "components/policy/core/common/policy_types.h"
 #include "components/search/search.h"
 #include "components/search_engines/template_url.h"
 #include "components/search_engines/template_url_service.h"
 #include "components/translate/core/browser/language_state.h"
 #include "components/translate/core/browser/translate_infobar_delegate.h"
 #include "components/variations/service/variations_service.h"
 #include "components/version_info/version_info.h"
 #include "content/public/browser/browser_child_process_host_iterator.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_thread.h"
@@ skipping 554 matching lines @@
                    make_scoped_refptr(BrowserThread::GetBlockingPool())),
         base::MessageLoop::current()->QuitWhenIdleClosure());
     content::RunMessageLoop();
   }
 
   void SetScreenshotPolicy(bool enabled) {
     PolicyMap policies;
     policies.Set(key::kDisableScreenshots,
                  POLICY_LEVEL_MANDATORY,
                  POLICY_SCOPE_USER,
+                 POLICY_SOURCE_CLOUD,
                  new base::FundamentalValue(!enabled),
                  NULL);
     UpdateProviderPolicy(policies);
   }
 
 #if defined(OS_CHROMEOS)
   class QuitMessageLoopAfterScreenshot : public ui::ScreenshotGrabberObserver {
    public:
     void OnScreenshotCompleted(
         ScreenshotGrabberObserver::Result screenshot_result,
@@ skipping 128 matching lines @@
     contents->GetRenderViewHost()->ForwardMouseEvent(click_event);
     click_event.type = blink::WebInputEvent::MouseUp;
     contents->GetRenderViewHost()->ForwardMouseEvent(click_event);
   }
 
   void SetPolicy(PolicyMap* policies, const char* key, base::Value* value) {
     if (value) {
       policies->Set(key,
                     POLICY_LEVEL_MANDATORY,
                     POLICY_SCOPE_USER,
+                    POLICY_SOURCE_CLOUD,
                     value,
                     nullptr);
     } else {
       policies->Erase(key);
     }
   }
 
   void ApplySafeSearchPolicy(base::FundamentalValue* legacy_safe_search,
                              base::FundamentalValue* google_safe_search,
                              base::FundamentalValue* youtube_safety_mode) {
@@ skipping 38 matching lines @@
  public:
   LocalePolicyTest() {}
   ~LocalePolicyTest() override {}
 
   void SetUpInProcessBrowserTestFixture() override {
     PolicyTest::SetUpInProcessBrowserTestFixture();
     PolicyMap policies;
     policies.Set(key::kApplicationLocaleValue,
                  POLICY_LEVEL_MANDATORY,
                  POLICY_SCOPE_USER,
+                 POLICY_SOURCE_CLOUD,
                  new base::StringValue("fr"),
                  NULL);
     provider_.UpdateChromePolicy(policies);
     // The "en-US" ResourceBundle is always loaded before this step for tests,
     // but in this test we want the browser to load the bundle as it
     // normally would.
     ResourceBundle::CleanupSharedInstance();
   }
 };
 
@@ skipping 28 matching lines @@
   // Test starts in about:blank.
   PrefService* prefs = browser()->profile()->GetPrefs();
   EXPECT_FALSE(prefs->IsManagedPreference(bookmarks::prefs::kShowBookmarkBar));
   EXPECT_FALSE(prefs->GetBoolean(bookmarks::prefs::kShowBookmarkBar));
   EXPECT_EQ(BookmarkBar::HIDDEN, browser()->bookmark_bar_state());
 
   PolicyMap policies;
   policies.Set(key::kBookmarkBarEnabled,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(true),
                NULL);
   UpdateProviderPolicy(policies);
   EXPECT_TRUE(prefs->IsManagedPreference(bookmarks::prefs::kShowBookmarkBar));
   EXPECT_TRUE(prefs->GetBoolean(bookmarks::prefs::kShowBookmarkBar));
   EXPECT_EQ(BookmarkBar::SHOW, browser()->bookmark_bar_state());
 
   // The NTP has special handling of the bookmark bar.
   ui_test_utils::NavigateToURL(browser(), GURL(chrome::kChromeUINewTabURL));
   EXPECT_EQ(BookmarkBar::SHOW, browser()->bookmark_bar_state());
 
   policies.Set(key::kBookmarkBarEnabled,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(false),
                NULL);
   UpdateProviderPolicy(policies);
   EXPECT_TRUE(prefs->IsManagedPreference(bookmarks::prefs::kShowBookmarkBar));
   EXPECT_FALSE(prefs->GetBoolean(bookmarks::prefs::kShowBookmarkBar));
   // The bookmark bar is hidden in the NTP when disabled by policy.
   EXPECT_EQ(BookmarkBar::HIDDEN, browser()->bookmark_bar_state());
 
   policies.Clear();
   UpdateProviderPolicy(policies);
@@ skipping 19 matching lines @@
 }
 
 IN_PROC_BROWSER_TEST_F(PolicyTest, PRE_DefaultCookiesSetting) {
   // Verify that the cookie persists across restarts.
   EXPECT_EQ(kCookieValue, GetCookies(browser()->profile(), GURL(kURL)));
   // Now set the policy and the cookie should be gone after another restart.
   PolicyMap policies;
   policies.Set(key::kDefaultCookiesSetting,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(4),
                NULL);
   UpdateProviderPolicy(policies);
 }
 
 IN_PROC_BROWSER_TEST_F(PolicyTest, DefaultCookiesSetting) {
   // Verify that the cookie is gone.
   EXPECT_TRUE(GetCookies(browser()->profile(), GURL(kURL)).empty());
 }
 
@@ skipping 28 matching lines @@
         kSearchTermsReplacementKey &&
     default_search->image_url() == kImageURL &&
     default_search->image_url_post_params() == kImageURLPostParams &&
     default_search->new_tab_url() == kNewTabURL);
 
   // Override the default search provider using policies.
   PolicyMap policies;
   policies.Set(key::kDefaultSearchProviderEnabled,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(true),
                NULL);
   policies.Set(key::kDefaultSearchProviderKeyword,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::StringValue(kKeyword),
                NULL);
   policies.Set(key::kDefaultSearchProviderSearchURL,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::StringValue(kSearchURL),
                NULL);
   base::ListValue* alternate_urls = new base::ListValue();
   alternate_urls->AppendString(kAlternateURL0);
   alternate_urls->AppendString(kAlternateURL1);
   policies.Set(key::kDefaultSearchProviderAlternateURLs, POLICY_LEVEL_MANDATORY,
-               POLICY_SCOPE_USER, alternate_urls, NULL);
+               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD, alternate_urls, nullptr);
   policies.Set(key::kDefaultSearchProviderSearchTermsReplacementKey,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::StringValue(kSearchTermsReplacementKey),
                NULL);
   policies.Set(key::kDefaultSearchProviderImageURL,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::StringValue(kImageURL),
                NULL);
   policies.Set(key::kDefaultSearchProviderImageURLPostParams,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::StringValue(kImageURLPostParams),
                NULL);
   policies.Set(key::kDefaultSearchProviderNewTabURL,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::StringValue(kNewTabURL),
                NULL);
   UpdateProviderPolicy(policies);
   default_search = service->GetDefaultSearchProvider();
   ASSERT_TRUE(default_search);
   EXPECT_EQ(kKeyword, default_search->keyword());
   EXPECT_EQ(kSearchURL, default_search->url());
   EXPECT_EQ(2U, default_search->alternate_urls().size());
   EXPECT_EQ(kAlternateURL0, default_search->alternate_urls()[0]);
   EXPECT_EQ(kAlternateURL1, default_search->alternate_urls()[1]);
@@ skipping 12 matching lines @@
   content::WebContents* web_contents =
       browser()->tab_strip_model()->GetActiveWebContents();
   GURL expected("http://search.example/search?q=stuff+to+search+for");
   EXPECT_EQ(expected, web_contents->GetURL());
 
   // Verify that searching from the omnibox can be disabled.
   ui_test_utils::NavigateToURL(browser(), GURL(url::kAboutBlankURL));
   policies.Set(key::kDefaultSearchProviderEnabled,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(false),
                NULL);
   EXPECT_TRUE(service->GetDefaultSearchProvider());
   UpdateProviderPolicy(policies);
   EXPECT_FALSE(service->GetDefaultSearchProvider());
   ui_test_utils::SendToOmniboxAndSubmit(location_bar, "should not work");
   // This means that submitting won't trigger any action.
   EXPECT_FALSE(model->CurrentMatch(NULL).destination_url.is_valid());
   EXPECT_EQ(GURL(url::kAboutBlankURL), web_contents->GetURL());
 }
 
 IN_PROC_BROWSER_TEST_F(PolicyTest, PolicyPreprocessing) {
   // Add an individual proxy policy value.
   PolicyMap policies;
   policies.Set(key::kProxyServerMode,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(3),
                NULL);
   UpdateProviderPolicy(policies);
 
   // It should be removed and replaced with a dictionary.
   PolicyMap expected;
   scoped_ptr<base::DictionaryValue> expected_value(new base::DictionaryValue);
   expected_value->SetInteger(key::kProxyServerMode, 3);
   expected.Set(key::kProxySettings,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                expected_value.release(),
                NULL);
 
   // Check both the browser and the profile.
   const PolicyMap& actual_from_browser =
       g_browser_process->browser_policy_connector()
           ->GetPolicyService()
           ->GetPolicies(PolicyNamespace(POLICY_DOMAIN_CHROME, std::string()));
   EXPECT_TRUE(expected.Equals(actual_from_browser));
   const PolicyMap& actual_from_profile =
@@ skipping 72 matching lines @@
   EXPECT_FALSE(
     default_search->alternate_urls().size() == 2 &&
     default_search->alternate_urls()[0] == kAlternateURL0 &&
     default_search->alternate_urls()[1] == kAlternateURL1);
 
   // Override the default search provider using policies.
   PolicyMap policies;
   policies.Set(key::kDefaultSearchProviderEnabled,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(true),
                NULL);
   policies.Set(key::kDefaultSearchProviderKeyword,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::StringValue(kKeyword),
                NULL);
   policies.Set(key::kDefaultSearchProviderSearchURL,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::StringValue(kSearchURL),
                NULL);
   policies.Set(key::kDefaultSearchProviderInstantURL,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::StringValue(kInstantURL),
                NULL);
   base::ListValue* alternate_urls = new base::ListValue();
   alternate_urls->AppendString(kAlternateURL0);
   alternate_urls->AppendString(kAlternateURL1);
   policies.Set(key::kDefaultSearchProviderAlternateURLs, POLICY_LEVEL_MANDATORY,
-               POLICY_SCOPE_USER, alternate_urls, NULL);
+               POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD, alternate_urls, nullptr);
   policies.Set(key::kDefaultSearchProviderSearchTermsReplacementKey,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::StringValue(kSearchTermsReplacementKey),
                NULL);
   UpdateProviderPolicy(policies);
   default_search = service->GetDefaultSearchProvider();
   ASSERT_TRUE(default_search);
   EXPECT_EQ(kKeyword, default_search->keyword());
   EXPECT_EQ(kSearchURL, default_search->url());
   EXPECT_EQ(kInstantURL, default_search->instant_url());
   EXPECT_EQ(2U, default_search->alternate_urls().size());
   EXPECT_EQ(kAlternateURL0, default_search->alternate_urls()[0]);
@@ skipping 61 matching lines @@
   ui_test_utils::NavigateToURL(browser(), GURL(url::kAboutBlankURL));
   // WebGL is enabled by default.
   content::WebContents* contents =
       browser()->tab_strip_model()->GetActiveWebContents();
   EXPECT_TRUE(IsWebGLEnabled(contents));
   // Disable with a policy.
   PolicyMap policies;
   policies.Set(key::kDisable3DAPIs,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(true),
                NULL);
   UpdateProviderPolicy(policies);
   // Crash and reload the tab to get a new renderer.
   content::CrashTab(contents);
   EXPECT_TRUE(chrome::ExecuteCommand(browser(), IDC_RELOAD));
   EXPECT_FALSE(IsWebGLEnabled(contents));
   // Enable with a policy.
   policies.Set(key::kDisable3DAPIs,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(false),
                NULL);
   UpdateProviderPolicy(policies);
   content::CrashTab(contents);
   EXPECT_TRUE(chrome::ExecuteCommand(browser(), IDC_RELOAD));
   EXPECT_TRUE(IsWebGLEnabled(contents));
 }
 
 IN_PROC_BROWSER_TEST_F(PolicyTest, DisableSpdy) {
   // Verifies that SPDY can be disable by policy.
   EXPECT_TRUE(net::HttpStreamFactory::spdy_enabled());
   PolicyMap policies;
   policies.Set(key::kDisableSpdy,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(true),
                NULL);
   UpdateProviderPolicy(policies);
   content::RunAllPendingInMessageLoop();
   EXPECT_FALSE(net::HttpStreamFactory::spdy_enabled());
   // Verify that it can be force-enabled too.
   browser()->profile()->GetPrefs()->SetBoolean(prefs::kDisableSpdy, true);
   policies.Set(key::kDisableSpdy,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(false),
                NULL);
   UpdateProviderPolicy(policies);
   content::RunAllPendingInMessageLoop();
   EXPECT_TRUE(net::HttpStreamFactory::spdy_enabled());
 }
 
 IN_PROC_BROWSER_TEST_F(PolicyTest, DisabledPlugins) {
   // Verifies that plugins can be forced to be disabled by policy.
 
   // Verify that the Flash plugin exists and that it can be enabled and disabled
   // by the user.
   std::vector<content::WebPluginInfo> plugins;
   GetPluginList(&plugins);
   const content::WebPluginInfo* flash = GetFlashPlugin(plugins);
   if (!flash)
     return;
   PluginPrefs* plugin_prefs =
       PluginPrefs::GetForProfile(browser()->profile()).get();
   EXPECT_TRUE(plugin_prefs->IsPluginEnabled(*flash));
   EXPECT_TRUE(SetPluginEnabled(plugin_prefs, flash, false));
   EXPECT_FALSE(plugin_prefs->IsPluginEnabled(*flash));
   EXPECT_TRUE(SetPluginEnabled(plugin_prefs, flash, true));
   EXPECT_TRUE(plugin_prefs->IsPluginEnabled(*flash));
 
   // Now disable it with a policy.
   base::ListValue disabled_plugins;
   disabled_plugins.Append(new base::StringValue("*Flash*"));
   PolicyMap policies;
-  policies.Set(key::kDisabledPlugins, POLICY_LEVEL_MANDATORY,
-               POLICY_SCOPE_USER, disabled_plugins.DeepCopy(), NULL);
+  policies.Set(key::kDisabledPlugins, POLICY_LEVEL_MANDATORY, POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD, disabled_plugins.DeepCopy(), nullptr);
   UpdateProviderPolicy(policies);
   EXPECT_FALSE(plugin_prefs->IsPluginEnabled(*flash));
   // The user shouldn't be able to enable it.
   EXPECT_FALSE(SetPluginEnabled(plugin_prefs, flash, true));
   EXPECT_FALSE(plugin_prefs->IsPluginEnabled(*flash));
 }
 
 IN_PROC_BROWSER_TEST_F(PolicyTest, DisabledPluginsExceptions) {
   // Verifies that plugins with an exception in the blacklist can be enabled.
 
   // Verify that the Flash plugin exists and that it can be enabled and disabled
   // by the user.
   std::vector<content::WebPluginInfo> plugins;
   GetPluginList(&plugins);
   const content::WebPluginInfo* flash = GetFlashPlugin(plugins);
   if (!flash)
     return;
   PluginPrefs* plugin_prefs =
       PluginPrefs::GetForProfile(browser()->profile()).get();
   EXPECT_TRUE(plugin_prefs->IsPluginEnabled(*flash));
 
   // Disable all plugins.
   base::ListValue disabled_plugins;
   disabled_plugins.Append(new base::StringValue("*"));
   PolicyMap policies;
-  policies.Set(key::kDisabledPlugins, POLICY_LEVEL_MANDATORY,
-               POLICY_SCOPE_USER, disabled_plugins.DeepCopy(), NULL);
+  policies.Set(key::kDisabledPlugins, POLICY_LEVEL_MANDATORY, POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD, disabled_plugins.DeepCopy(), nullptr);
   UpdateProviderPolicy(policies);
   EXPECT_FALSE(plugin_prefs->IsPluginEnabled(*flash));
   // The user shouldn't be able to enable it.
   EXPECT_FALSE(SetPluginEnabled(plugin_prefs, flash, true));
   EXPECT_FALSE(plugin_prefs->IsPluginEnabled(*flash));
 
   // Now open an exception for flash.
   base::ListValue disabled_plugins_exceptions;
   disabled_plugins_exceptions.Append(new base::StringValue("*Flash*"));
   policies.Set(key::kDisabledPluginsExceptions, POLICY_LEVEL_MANDATORY,
-               POLICY_SCOPE_USER, disabled_plugins_exceptions.DeepCopy(), NULL);
+               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD,
+               disabled_plugins_exceptions.DeepCopy(), nullptr);
   UpdateProviderPolicy(policies);
   // It should revert to the user's preference automatically.
   EXPECT_TRUE(plugin_prefs->IsPluginEnabled(*flash));
   // And the user should be able to disable and enable again.
   EXPECT_TRUE(SetPluginEnabled(plugin_prefs, flash, false));
   EXPECT_FALSE(plugin_prefs->IsPluginEnabled(*flash));
   EXPECT_TRUE(SetPluginEnabled(plugin_prefs, flash, true));
   EXPECT_TRUE(plugin_prefs->IsPluginEnabled(*flash));
 }
 
 IN_PROC_BROWSER_TEST_F(PolicyTest, EnabledPlugins) {
   // Verifies that a plugin can be force-installed with a policy.
   std::vector<content::WebPluginInfo> plugins;
   GetPluginList(&plugins);
   const content::WebPluginInfo* flash = GetFlashPlugin(plugins);
   if (!flash)
     return;
   PluginPrefs* plugin_prefs =
       PluginPrefs::GetForProfile(browser()->profile()).get();
   EXPECT_TRUE(plugin_prefs->IsPluginEnabled(*flash));
 
   // The user disables it and then a policy forces it to be enabled.
   EXPECT_TRUE(SetPluginEnabled(plugin_prefs, flash, false));
   EXPECT_FALSE(plugin_prefs->IsPluginEnabled(*flash));
   base::ListValue plugin_list;
   plugin_list.Append(new base::StringValue(content::kFlashPluginName));
   PolicyMap policies;
   policies.Set(key::kEnabledPlugins, POLICY_LEVEL_MANDATORY,
-               POLICY_SCOPE_USER, plugin_list.DeepCopy(), NULL);
+               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD, plugin_list.DeepCopy(),
+               nullptr);
   UpdateProviderPolicy(policies);
   EXPECT_TRUE(plugin_prefs->IsPluginEnabled(*flash));
   // The user can't disable it anymore.
   EXPECT_FALSE(SetPluginEnabled(plugin_prefs, flash, false));
   EXPECT_TRUE(plugin_prefs->IsPluginEnabled(*flash));
 
   // When a plugin is both enabled and disabled, the whitelist takes precedence.
   policies.Set(key::kDisabledPlugins, POLICY_LEVEL_MANDATORY,
-               POLICY_SCOPE_USER, plugin_list.DeepCopy(), NULL);
+               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD, plugin_list.DeepCopy(),
+               nullptr);
   UpdateProviderPolicy(policies);
   EXPECT_TRUE(plugin_prefs->IsPluginEnabled(*flash));
 }
 
 IN_PROC_BROWSER_TEST_F(PolicyTest, AlwaysAuthorizePlugins) {
   // Verifies that dangerous plugins can be always authorized to run with
   // a policy.
 
   // Verify that the test page exists. It is only present in checkouts with
   // src-internal.
@@ skipping 24 matching lines @@
   EXPECT_TRUE(
       infobar_service->infobar_at(0)->delegate()->AsConfirmInfoBarDelegate());
   // And the plugin isn't running.
   EXPECT_EQ(0, CountPlugins());
 
   // Now set a policy to always authorize this.
   PolicyMap policies;
   policies.Set(key::kAlwaysAuthorizePlugins,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(true),
                NULL);
   UpdateProviderPolicy(policies);
   // Reloading the page shouldn't trigger the infobar this time.
   ui_test_utils::NavigateToURL(browser(), url);
   EXPECT_EQ(0u, infobar_service->infobar_count());
   // And the plugin started automatically.
   EXPECT_EQ(1, CountPlugins());
 }
 
 IN_PROC_BROWSER_TEST_F(PolicyTest, DeveloperToolsDisabled) {
   // Verifies that access to the developer tools can be disabled.
 
   // Open devtools.
   EXPECT_TRUE(chrome::ExecuteCommand(browser(), IDC_DEV_TOOLS));
   content::WebContents* contents =
       browser()->tab_strip_model()->GetActiveWebContents();
   DevToolsWindow* devtools_window =
       DevToolsWindow::GetInstanceForInspectedWebContents(contents);
   EXPECT_TRUE(devtools_window);
 
   // Disable devtools via policy.
   PolicyMap policies;
   policies.Set(key::kDeveloperToolsDisabled,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(true),
                NULL);
   content::WindowedNotificationObserver close_observer(
       content::NOTIFICATION_WEB_CONTENTS_DESTROYED,
       content::Source<content::WebContents>(
           DevToolsWindowTesting::Get(devtools_window)->main_web_contents()));
   UpdateProviderPolicy(policies);
   // wait for devtools close
   close_observer.Wait();
   // The existing devtools window should have closed.
@@ skipping 27 matching lines @@
 
   // The next NTP has no footer.
   if (ContainsVisibleElement(contents, "footer"))
     EXPECT_TRUE(ContainsVisibleElement(contents, "chrome-web-store-link"));
 
   // Turn off the web store icons.
   PolicyMap policies;
   policies.Set(key::kHideWebStoreIcon,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(true),
                NULL);
   UpdateProviderPolicy(policies);
 
   // The web store icons should now be hidden.
   ui_test_utils::NavigateToURL(browser(), GURL(chrome::kChromeUINewTabURL));
   EXPECT_FALSE(ContainsVisibleElement(contents,
                                       "ahfgeienlihckogmohjhadlkjgocpleb"));
   EXPECT_FALSE(ContainsVisibleElement(contents, "chrome-web-store-link"));
 }
@@ skipping 15 matching lines @@
   DownloadAndVerifyFile(browser(), initial_dir.path(), file);
   base::DieFileDie(initial_dir.path().Append(file), false);
 
   // Override the download directory with the policy and verify a download.
   base::ScopedTempDir forced_dir;
   ASSERT_TRUE(forced_dir.CreateUniqueTempDir());
   PolicyMap policies;
   policies.Set(key::kDownloadDirectory,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::StringValue(forced_dir.path().value()),
                NULL);
   UpdateProviderPolicy(policies);
   DownloadAndVerifyFile(browser(), forced_dir.path(), file);
   // Verify that the first download location wasn't affected.
   EXPECT_FALSE(base::PathExists(initial_dir.path().Append(file)));
 }
 
 IN_PROC_BROWSER_TEST_F(PolicyTest, ExtensionInstallBlacklistSelective) {
   // Verifies that blacklisted extensions can't be installed.
   ExtensionService* service = extension_service();
   ASSERT_FALSE(service->GetExtensionById(kGoodCrxId, true));
   ASSERT_FALSE(service->GetExtensionById(kAdBlockCrxId, true));
   base::ListValue blacklist;
   blacklist.Append(new base::StringValue(kGoodCrxId));
   PolicyMap policies;
   policies.Set(key::kExtensionInstallBlacklist, POLICY_LEVEL_MANDATORY,
-               POLICY_SCOPE_USER, blacklist.DeepCopy(), NULL);
+               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD, blacklist.DeepCopy(),
+               nullptr);
   UpdateProviderPolicy(policies);
 
   // "good.crx" is blacklisted.
   EXPECT_FALSE(InstallExtension(kGoodCrxName));
   EXPECT_FALSE(service->GetExtensionById(kGoodCrxId, true));
 
   // "adblock.crx" is not.
   const extensions::Extension* adblock = InstallExtension(kAdBlockCrxName);
   ASSERT_TRUE(adblock);
   EXPECT_EQ(kAdBlockCrxId, adblock->id());
@@ skipping 10 matching lines @@
 IN_PROC_BROWSER_TEST_F(PolicyTest, MAYBE_ExtensionInstallBlacklistWildcard) {
   // Verify that a wildcard blacklist takes effect.
   EXPECT_TRUE(InstallExtension(kAdBlockCrxName));
   ExtensionService* service = extension_service();
   ASSERT_FALSE(service->GetExtensionById(kGoodCrxId, true));
   ASSERT_TRUE(service->GetExtensionById(kAdBlockCrxId, true));
   base::ListValue blacklist;
   blacklist.Append(new base::StringValue("*"));
   PolicyMap policies;
   policies.Set(key::kExtensionInstallBlacklist, POLICY_LEVEL_MANDATORY,
-               POLICY_SCOPE_USER, blacklist.DeepCopy(), NULL);
+               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD, blacklist.DeepCopy(),
+               nullptr);
   UpdateProviderPolicy(policies);
 
   // AdBlock was automatically removed.
   ASSERT_FALSE(service->GetExtensionById(kAdBlockCrxId, true));
 
   // And can't be installed again, nor can good.crx.
   EXPECT_FALSE(InstallExtension(kAdBlockCrxName));
   EXPECT_FALSE(service->GetExtensionById(kAdBlockCrxId, true));
   EXPECT_FALSE(InstallExtension(kGoodCrxName));
   EXPECT_FALSE(service->GetExtensionById(kGoodCrxId, true));
@@ skipping 26 matching lines @@
 
   // Blacklist "*" but force-install the importer extension. The shared module
   // should be automatically installed too.
   base::ListValue blacklist;
   blacklist.AppendString("*");
   base::ListValue forcelist;
   forcelist.AppendString(
       base::StringPrintf("%s;%s", kImporterId, update_xml_url.spec().c_str()));
   PolicyMap policies;
   policies.Set(key::kExtensionInstallBlacklist, POLICY_LEVEL_MANDATORY,
-               POLICY_SCOPE_USER, blacklist.DeepCopy(), NULL);
+               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD, blacklist.DeepCopy(),
+               nullptr);
   policies.Set(key::kExtensionInstallForcelist, POLICY_LEVEL_MANDATORY,
-               POLICY_SCOPE_USER, forcelist.DeepCopy(), NULL);
+               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD, forcelist.DeepCopy(),
+               nullptr);
 
   extensions::ExtensionRegistry* registry =
       extensions::ExtensionRegistry::Get(browser()->profile());
   extensions::TestExtensionRegistryObserver observe_importer(
       registry, kImporterId);
   extensions::TestExtensionRegistryObserver observe_shared_module(
       registry, kSharedModuleId);
   UpdateProviderPolicy(policies);
   observe_importer.WaitForExtensionLoaded();
   observe_shared_module.WaitForExtensionLoaded();
@@ skipping 26 matching lines @@
   // Verifies that the whitelist can open exceptions to the blacklist.
   ExtensionService* service = extension_service();
   ASSERT_FALSE(service->GetExtensionById(kGoodCrxId, true));
   ASSERT_FALSE(service->GetExtensionById(kAdBlockCrxId, true));
   base::ListValue blacklist;
   blacklist.Append(new base::StringValue("*"));
   base::ListValue whitelist;
   whitelist.Append(new base::StringValue(kGoodCrxId));
   PolicyMap policies;
   policies.Set(key::kExtensionInstallBlacklist, POLICY_LEVEL_MANDATORY,
-               POLICY_SCOPE_USER, blacklist.DeepCopy(), NULL);
+               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD, blacklist.DeepCopy(),
+               nullptr);
   policies.Set(key::kExtensionInstallWhitelist, POLICY_LEVEL_MANDATORY,
-               POLICY_SCOPE_USER, whitelist.DeepCopy(), NULL);
+               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD, whitelist.DeepCopy(),
+               nullptr);
   UpdateProviderPolicy(policies);
   // "adblock.crx" is blacklisted.
   EXPECT_FALSE(InstallExtension(kAdBlockCrxName));
   EXPECT_FALSE(service->GetExtensionById(kAdBlockCrxId, true));
   // "good.crx" has a whitelist exception.
   const extensions::Extension* good = InstallExtension(kGoodCrxName);
   ASSERT_TRUE(good);
   EXPECT_EQ(kGoodCrxId, good->id());
   EXPECT_EQ(good, service->GetExtensionById(kGoodCrxId, true));
   // The user can also remove this extension.
@@ skipping 12 matching lines @@
   base::FilePath path =
       base::FilePath(kTestExtensionsDir).Append(kGoodV1CrxManifestName);
   GURL url(URLRequestMockHTTPJob::GetMockUrl(path));
 
   // Setting the forcelist extension should install "good_v1.crx".
   base::ListValue forcelist;
   forcelist.Append(new base::StringValue(
       base::StringPrintf("%s;%s", kGoodCrxId, url.spec().c_str())));
   PolicyMap policies;
   policies.Set(key::kExtensionInstallForcelist, POLICY_LEVEL_MANDATORY,
-               POLICY_SCOPE_USER, forcelist.DeepCopy(), NULL);
+               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD, forcelist.DeepCopy(),
+               nullptr);
   content::WindowedNotificationObserver observer(
       extensions::NOTIFICATION_EXTENSION_WILL_BE_INSTALLED_DEPRECATED,
       content::NotificationService::AllSources());
   UpdateProviderPolicy(policies);
   observer.Wait();
   // Note: Cannot check that the notification details match the expected
   // exception, since the details object has already been freed prior to
   // the completion of observer.Wait().
 
   EXPECT_TRUE(service->GetExtensionById(kGoodCrxId, true));
@@ skipping 98 matching lines @@
   dict_value.SetString(std::string(kGoodCrxId) + "." +
                            extensions::schema_constants::kInstallationMode,
                        extensions::schema_constants::kNormalInstalled);
   dict_value.SetString(
       std::string(kGoodCrxId) + "." + extensions::schema_constants::kUpdateUrl,
       url.spec());
   PolicyMap policies;
   policies.Set(key::kExtensionSettings,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                dict_value.DeepCopy(),
                NULL);
   content::WindowedNotificationObserver observer(
       extensions::NOTIFICATION_EXTENSION_WILL_BE_INSTALLED_DEPRECATED,
       content::NotificationService::AllSources());
   UpdateProviderPolicy(policies);
   observer.Wait();
 
   EXPECT_TRUE(service->GetExtensionById(kGoodCrxId, true));
 
@@ skipping 13 matching lines @@
   // Verifies that extensions are blocked if policy specifies an allowed types
   // list and the extension's type is not on that list.
   ExtensionService* service = extension_service();
   ASSERT_FALSE(service->GetExtensionById(kGoodCrxId, true));
   ASSERT_FALSE(service->GetExtensionById(kHostedAppCrxId, true));
 
   base::ListValue allowed_types;
   allowed_types.AppendString("hosted_app");
   PolicyMap policies;
   policies.Set(key::kExtensionAllowedTypes, POLICY_LEVEL_MANDATORY,
-               POLICY_SCOPE_USER, allowed_types.DeepCopy(), NULL);
+               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD, allowed_types.DeepCopy(),
+               nullptr);
   UpdateProviderPolicy(policies);
 
   // "good.crx" is blocked.
   EXPECT_FALSE(InstallExtension(kGoodCrxName));
   EXPECT_FALSE(service->GetExtensionById(kGoodCrxId, true));
 
   // "hosted_app.crx" is of a whitelisted type.
   const extensions::Extension* hosted_app = InstallExtension(kHostedAppCrxName);
   ASSERT_TRUE(hosted_app);
   EXPECT_EQ(kHostedAppCrxId, hosted_app->id());
@@ skipping 37 matching lines @@
       content::DownloadTestObserver::ON_DANGEROUS_DOWNLOAD_DENY);
   PerformClick(0, 0);
   download_observer.WaitForFinished();
 
   // Install the policy and trigger another download.
   base::ListValue install_sources;
   install_sources.AppendString(install_source_url.spec());
   install_sources.AppendString(referrer_url.spec());
   PolicyMap policies;
   policies.Set(key::kExtensionInstallSources, POLICY_LEVEL_MANDATORY,
-               POLICY_SCOPE_USER, install_sources.DeepCopy(), NULL);
+               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD,
+               install_sources.DeepCopy(), nullptr);
   UpdateProviderPolicy(policies);
 
   content::WindowedNotificationObserver observer(
       extensions::NOTIFICATION_EXTENSION_WILL_BE_INSTALLED_DEPRECATED,
       content::NotificationService::AllSources());
   PerformClick(1, 0);
   observer.Wait();
   // Note: Cannot check that the notification details match the expected
   // exception, since the details object has already been freed prior to
   // the completion of observer.Wait().
@@ skipping 209 matching lines @@
       browser()->tab_strip_model()->GetActiveWebContents();
   EXPECT_EQ(GURL(url::kAboutBlankURL), contents->GetURL());
   EXPECT_TRUE(chrome::ExecuteCommand(browser(), IDC_HOME));
   EXPECT_EQ(GURL(chrome::kChromeUIPolicyURL), contents->GetURL());
 
   // Now override with policy.
   PolicyMap policies;
   policies.Set(key::kHomepageLocation,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::StringValue(chrome::kChromeUICreditsURL),
                NULL);
   UpdateProviderPolicy(policies);
   EXPECT_TRUE(chrome::ExecuteCommand(browser(), IDC_HOME));
   content::WaitForLoadStop(contents);
   EXPECT_EQ(GURL(chrome::kChromeUICreditsURL), contents->GetURL());
 
   policies.Set(key::kHomepageIsNewTabPage,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(true),
                NULL);
   UpdateProviderPolicy(policies);
   EXPECT_TRUE(chrome::ExecuteCommand(browser(), IDC_HOME));
   content::WaitForLoadStop(contents);
   EXPECT_EQ(GURL(chrome::kChromeUINewTabURL), contents->GetURL());
 }
 
 IN_PROC_BROWSER_TEST_F(PolicyTest, IncognitoEnabled) {
   // Verifies that incognito windows can't be opened when disabled by policy.
 
   const BrowserList* active_browser_list =
       BrowserList::GetInstance(chrome::GetActiveDesktop());
 
   // Disable incognito via policy and verify that incognito windows can't be
   // opened.
   EXPECT_EQ(1u, active_browser_list->size());
   EXPECT_FALSE(BrowserList::IsOffTheRecordSessionActive());
   PolicyMap policies;
   policies.Set(key::kIncognitoEnabled,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(false),
                NULL);
   UpdateProviderPolicy(policies);
   EXPECT_FALSE(chrome::ExecuteCommand(browser(), IDC_NEW_INCOGNITO_WINDOW));
   EXPECT_EQ(1u, active_browser_list->size());
   EXPECT_FALSE(BrowserList::IsOffTheRecordSessionActive());
 
   // Enable via policy and verify that incognito windows can be opened.
   policies.Set(key::kIncognitoEnabled,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(true),
                NULL);
   UpdateProviderPolicy(policies);
   EXPECT_TRUE(chrome::ExecuteCommand(browser(), IDC_NEW_INCOGNITO_WINDOW));
   EXPECT_EQ(2u, active_browser_list->size());
   EXPECT_TRUE(BrowserList::IsOffTheRecordSessionActive());
 }
 
 IN_PROC_BROWSER_TEST_F(PolicyTest, Javascript) {
   // Verifies that Javascript can be disabled.
   content::WebContents* contents =
       browser()->tab_strip_model()->GetActiveWebContents();
   EXPECT_TRUE(IsJavascriptEnabled(contents));
   EXPECT_TRUE(chrome::IsCommandEnabled(browser(), IDC_DEV_TOOLS));
   EXPECT_TRUE(chrome::IsCommandEnabled(browser(), IDC_DEV_TOOLS_CONSOLE));
   EXPECT_TRUE(chrome::IsCommandEnabled(browser(), IDC_DEV_TOOLS_DEVICES));
 
   // Disable Javascript via policy.
   PolicyMap policies;
   policies.Set(key::kJavascriptEnabled,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(false),
                NULL);
   UpdateProviderPolicy(policies);
   // Reload the page.
   ui_test_utils::NavigateToURL(browser(), GURL(url::kAboutBlankURL));
   EXPECT_FALSE(IsJavascriptEnabled(contents));
   // Developer tools still work when javascript is disabled.
   EXPECT_TRUE(chrome::IsCommandEnabled(browser(), IDC_DEV_TOOLS));
   EXPECT_TRUE(chrome::IsCommandEnabled(browser(), IDC_DEV_TOOLS_CONSOLE));
   EXPECT_TRUE(chrome::IsCommandEnabled(browser(), IDC_DEV_TOOLS_DEVICES));
   // Javascript is always enabled for the internal pages.
   ui_test_utils::NavigateToURL(browser(), GURL(chrome::kChromeUIAboutURL));
   EXPECT_TRUE(IsJavascriptEnabled(contents));
 
   // The javascript content setting policy overrides the javascript policy.
   ui_test_utils::NavigateToURL(browser(), GURL(url::kAboutBlankURL));
   EXPECT_FALSE(IsJavascriptEnabled(contents));
   policies.Set(key::kDefaultJavaScriptSetting,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(CONTENT_SETTING_ALLOW),
                NULL);
   UpdateProviderPolicy(policies);
   ui_test_utils::NavigateToURL(browser(), GURL(url::kAboutBlankURL));
   EXPECT_TRUE(IsJavascriptEnabled(contents));
 }
 
 IN_PROC_BROWSER_TEST_F(PolicyTest, NetworkPrediction) {
   PrefService* prefs = browser()->profile()->GetPrefs();
 
   // Enabled by default.
   EXPECT_TRUE(IsNetworkPredictionEnabled(prefs));
 
   // Disable by old, deprecated policy.
   PolicyMap policies;
   policies.Set(key::kDnsPrefetchingEnabled,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(false),
                NULL);
   UpdateProviderPolicy(policies);
 
   EXPECT_FALSE(IsNetworkPredictionEnabled(prefs));
 
   // Enabled by new policy, this should override old one.
   policies.Set(
       key::kNetworkPredictionOptions,
       POLICY_LEVEL_MANDATORY,
       POLICY_SCOPE_USER,
+      POLICY_SOURCE_CLOUD,
       new base::FundamentalValue(chrome_browser_net::NETWORK_PREDICTION_ALWAYS),
       NULL);
   UpdateProviderPolicy(policies);
 
   EXPECT_TRUE(IsNetworkPredictionEnabled(prefs));
 }
 
 IN_PROC_BROWSER_TEST_F(PolicyTest, SavingBrowserHistoryDisabled) {
   // Verifies that browsing history is not saved.
   PolicyMap policies;
   policies.Set(key::kSavingBrowserHistoryDisabled,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(true),
                NULL);
   UpdateProviderPolicy(policies);
   GURL url = ui_test_utils::GetTestUrl(
       base::FilePath(base::FilePath::kCurrentDirectory),
       base::FilePath(FILE_PATH_LITERAL("empty.html")));
   ui_test_utils::NavigateToURL(browser(), url);
   // Verify that the navigation wasn't saved in the history.
   ui_test_utils::HistoryEnumerator enumerator1(browser()->profile());
   EXPECT_EQ(0u, enumerator1.urls().size());
 
   // Now flip the policy and try again.
   policies.Set(key::kSavingBrowserHistoryDisabled,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(false),
                NULL);
   UpdateProviderPolicy(policies);
   ui_test_utils::NavigateToURL(browser(), url);
   // Verify that the navigation was saved in the history.
   ui_test_utils::HistoryEnumerator enumerator2(browser()->profile());
   ASSERT_EQ(1u, enumerator2.urls().size());
   EXPECT_EQ(url, enumerator2.urls()[0]);
 }
 
@@ skipping 15 matching lines @@
   ASSERT_TRUE(contents);
   InfoBarService* infobar_service = InfoBarService::FromWebContents(contents);
   ASSERT_TRUE(infobar_service);
   EXPECT_EQ(0u, infobar_service->infobar_count());
 
   // Force enable the translate feature.
   PolicyMap policies;
   policies.Set(key::kTranslateEnabled,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(true),
                NULL);
   UpdateProviderPolicy(policies);
   // Instead of waiting for NOTIFICATION_TAB_CONTENTS_INFOBAR_ADDED, this test
   // waits for NOTIFICATION_TAB_LANGUAGE_DETERMINED because that's what the
   // TranslateManager observes. This allows checking that an infobar is NOT
   // shown below, without polling for infobars for some indeterminate amount
   // of time.
   GURL url = ui_test_utils::GetTestUrl(
       base::FilePath(),
@@ skipping 25 matching lines @@
   EXPECT_EQ(translate::TRANSLATE_STEP_BEFORE_TRANSLATE,
             translate_infobar_delegate->translate_step());
   EXPECT_EQ("fr", translate_infobar_delegate->original_language_code());
 
   // Now force disable translate.
   infobar_service->RemoveInfoBar(infobar);
   EXPECT_EQ(0u, infobar_service->infobar_count());
   policies.Set(key::kTranslateEnabled,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(false),
                NULL);
   UpdateProviderPolicy(policies);
   // Navigating to the same URL now doesn't trigger an infobar.
   content::WindowedNotificationObserver language_observer2(
       chrome::NOTIFICATION_TAB_LANGUAGE_DETERMINED,
       content::NotificationService::AllSources());
   ui_test_utils::NavigateToURL(browser(), url);
   language_observer2.Wait();
   EXPECT_EQ(0u, infobar_service->infobar_count());
@@ skipping 22 matching lines @@
   }
 
   // Verify that "bbb.com" opens before applying the blacklist.
   CheckCanOpenURL(browser(), kURLS[1]);
 
   // Set a blacklist.
   base::ListValue blacklist;
   blacklist.Append(new base::StringValue("bbb.com"));
   PolicyMap policies;
   policies.Set(key::kURLBlacklist, POLICY_LEVEL_MANDATORY,
-               POLICY_SCOPE_USER, blacklist.DeepCopy(), NULL);
+               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD, blacklist.DeepCopy(),
+               nullptr);
   UpdateProviderPolicy(policies);
   FlushBlacklistPolicy();
   // All bbb.com URLs are blocked, and "aaa.com" is still unblocked.
   CheckCanOpenURL(browser(), kURLS[0]);
   for (size_t i = 1; i < arraysize(kURLS); ++i)
     CheckURLIsBlocked(browser(), kURLS[i]);
 
   // Whitelist some sites of bbb.com.
   base::ListValue whitelist;
   whitelist.Append(new base::StringValue("sub.bbb.com"));
   whitelist.Append(new base::StringValue("bbb.com/policy"));
   policies.Set(key::kURLWhitelist, POLICY_LEVEL_MANDATORY,
-               POLICY_SCOPE_USER, whitelist.DeepCopy(), NULL);
+               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD, whitelist.DeepCopy(),
+               nullptr);
   UpdateProviderPolicy(policies);
   FlushBlacklistPolicy();
   CheckURLIsBlocked(browser(), kURLS[1]);
   CheckCanOpenURL(browser(), kURLS[2]);
   CheckCanOpenURL(browser(), kURLS[3]);
   CheckCanOpenURL(browser(), kURLS[4]);
 
   {
     base::RunLoop loop;
     BrowserThread::PostTaskAndReply(
@@ skipping 15 matching lines @@
   GURL subframe_url = URLRequestMockHTTPJob::GetMockUrl(
       base::FilePath(FILE_PATH_LITERAL("policy/blank.html")));
 
   // Set a blacklist containing the image and the iframe which are used by the
   // main document.
   base::ListValue blacklist;
   blacklist.Append(new base::StringValue(image_url.spec().c_str()));
   blacklist.Append(new base::StringValue(subframe_url.spec().c_str()));
   PolicyMap policies;
   policies.Set(key::kURLBlacklist, POLICY_LEVEL_MANDATORY,
-               POLICY_SCOPE_USER, blacklist.DeepCopy(), NULL);
+               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD, blacklist.DeepCopy(),
+               nullptr);
   UpdateProviderPolicy(policies);
   FlushBlacklistPolicy();
 
   std::string blacklisted_image_load_result;
   ui_test_utils::NavigateToURL(browser(), main_url);
   ASSERT_TRUE(content::ExecuteScriptAndExtractString(
       browser()->tab_strip_model()->GetActiveWebContents(),
       "window.domAutomationController.send(imageLoadResult)",
       &blacklisted_image_load_result));
   EXPECT_EQ("success", blacklisted_image_load_result);
@@ skipping 25 matching lines @@
   const std::string file_path2 = folder_path + "basic.html";
 
   CheckCanOpenURL(browser(), file_path1.c_str());
   CheckCanOpenURL(browser(), file_path2.c_str());
 
   // Set a blacklist for all the files.
   base::ListValue blacklist;
   blacklist.Append(new base::StringValue("file://*"));
   PolicyMap policies;
   policies.Set(key::kURLBlacklist, POLICY_LEVEL_MANDATORY,
-               POLICY_SCOPE_USER, blacklist.DeepCopy(), NULL);
+               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD, blacklist.DeepCopy(),
+               nullptr);
   UpdateProviderPolicy(policies);
   FlushBlacklistPolicy();
 
   CheckURLIsBlocked(browser(), file_path1.c_str());
   CheckURLIsBlocked(browser(), file_path2.c_str());
 
   // Replace the URLblacklist with disabling the file scheme.
   blacklist.Remove(base::StringValue("file://*"), NULL);
   policies.Set(key::kURLBlacklist, POLICY_LEVEL_MANDATORY,
-               POLICY_SCOPE_USER, blacklist.DeepCopy(), NULL);
+               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD, blacklist.DeepCopy(),
+               nullptr);
   UpdateProviderPolicy(policies);
   FlushBlacklistPolicy();
 
   PrefService* prefs = browser()->profile()->GetPrefs();
   const base::ListValue* list_url = prefs->GetList(policy_prefs::kUrlBlacklist);
   EXPECT_EQ(list_url->Find(base::StringValue("file://*")),
             list_url->end());
 
   base::ListValue disabledscheme;
   disabledscheme.Append(new base::StringValue("file"));
   policies.Set(key::kDisabledSchemes, POLICY_LEVEL_MANDATORY,
-               POLICY_SCOPE_USER, disabledscheme.DeepCopy(), NULL);
+               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD,
+               disabledscheme.DeepCopy(), nullptr);
   UpdateProviderPolicy(policies);
   FlushBlacklistPolicy();
 
   list_url = prefs->GetList(policy_prefs::kUrlBlacklist);
   EXPECT_NE(list_url->Find(base::StringValue("file://*")),
             list_url->end());
 
   // Whitelist one folder and blacklist an another just inside.
   base::ListValue whitelist;
   whitelist.Append(new base::StringValue(base_path));
   policies.Set(key::kURLWhitelist, POLICY_LEVEL_MANDATORY,
-               POLICY_SCOPE_USER, whitelist.DeepCopy(), NULL);
+               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD, whitelist.DeepCopy(),
+               nullptr);
   blacklist.Append(new base::StringValue(folder_path));
   policies.Set(key::kURLBlacklist, POLICY_LEVEL_MANDATORY,
-               POLICY_SCOPE_USER, blacklist.DeepCopy(), NULL);
+               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD, blacklist.DeepCopy(),
+               nullptr);
   UpdateProviderPolicy(policies);
   FlushBlacklistPolicy();
 
   CheckCanOpenURL(browser(), file_path1.c_str());
   CheckURLIsBlocked(browser(), file_path2.c_str());
 }
 
 namespace {
 
 void GetSSLVersionFallbackMinOnIOThread(
@@ skipping 28 matching lines @@
       prefs->GetString(prefs::kSSLVersionFallbackMin));
 
   EXPECT_NE(default_value, new_value);
   EXPECT_NE(net::SSL_PROTOCOL_VERSION_TLS1_2,
             GetSSLVersionFallbackMin(browser()->profile()));
 
   PolicyMap policies;
   policies.Set(key::kSSLVersionFallbackMin,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::StringValue(new_value),
                NULL);
   UpdateProviderPolicy(policies);
 
   EXPECT_EQ(net::SSL_PROTOCOL_VERSION_TLS1_2,
             GetSSLVersionFallbackMin(browser()->profile()));
 }
 
 #if !defined(OS_MACOSX)
 IN_PROC_BROWSER_TEST_F(PolicyTest, FullscreenAllowedBrowser) {
   PolicyMap policies;
   policies.Set(key::kFullscreenAllowed,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(false),
                NULL);
   UpdateProviderPolicy(policies);
 
   BrowserWindow* browser_window = browser()->window();
   ASSERT_TRUE(browser_window);
 
   EXPECT_FALSE(browser_window->IsFullscreen());
   chrome::ToggleFullscreenMode(browser());
   EXPECT_FALSE(browser_window->IsFullscreen());
 }
 
 IN_PROC_BROWSER_TEST_F(PolicyTest, FullscreenAllowedApp) {
   PolicyMap policies;
   policies.Set(key::kFullscreenAllowed,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(false),
                NULL);
   UpdateProviderPolicy(policies);
 
   const extensions::Extension* extension =
       LoadUnpackedExtension(kUnpackedFullscreenAppName, true);
   ASSERT_TRUE(extension);
 
   // Launch an app that tries to open a fullscreen window.
   TestAddAppWindowObserver add_window_observer(
@@ skipping 51 matching lines @@
   bool prior_state = audio_handler->IsOutputMuted();
   // Make sure the audio is not muted and then toggle the policy and observe
   // if the output mute changed event is fired.
   audio_handler->SetOutputMute(false);
   EXPECT_FALSE(audio_handler->IsOutputMuted());
   EXPECT_EQ(1, test_observer->output_mute_changed_count());
   PolicyMap policies;
   policies.Set(key::kAudioOutputAllowed,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(false),
                NULL);
   UpdateProviderPolicy(policies);
   EXPECT_TRUE(audio_handler->IsOutputMuted());
   // This should not change the state now and should not trigger output mute
   // changed event.
   audio_handler->SetOutputMute(false);
   EXPECT_TRUE(audio_handler->IsOutputMuted());
   EXPECT_EQ(1, test_observer->output_mute_changed_count());
 
   // Toggle back and observe if the output mute changed event is fired.
   policies.Set(key::kAudioOutputAllowed,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(true),
                NULL);
   UpdateProviderPolicy(policies);
   EXPECT_FALSE(audio_handler->IsOutputMuted());
   EXPECT_EQ(1, test_observer->output_mute_changed_count());
   audio_handler->SetOutputMute(true);
   EXPECT_TRUE(audio_handler->IsOutputMuted());
   EXPECT_EQ(2, test_observer->output_mute_changed_count());
   // Revert the prior state.
   audio_handler->SetOutputMute(prior_state);
@@ skipping 19 matching lines @@
                 content::NotificationService::AllSources());
 
   // Set the session length limit to 3 hours. Verify that the session is not
   // terminated.
   EXPECT_CALL(observer, Observe(chrome::NOTIFICATION_APP_TERMINATING, _, _))
       .Times(0);
   PolicyMap policies;
   policies.Set(key::kSessionLengthLimit,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(kThreeHoursInMs),
                NULL);
   UpdateProviderPolicy(policies);
   base::RunLoop().RunUntilIdle();
   Mock::VerifyAndClearExpectations(&observer);
 
   // Decrease the session length limit to 1 hour. Verify that the session is
   // terminated immediately.
   EXPECT_CALL(observer, Observe(chrome::NOTIFICATION_APP_TERMINATING, _, _));
   policies.Set(key::kSessionLengthLimit,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(kOneHourInMs),
                NULL);
   UpdateProviderPolicy(policies);
   base::RunLoop().RunUntilIdle();
   Mock::VerifyAndClearExpectations(&observer);
 }
 
 // Disabled, see http://crbug.com/315308.
 IN_PROC_BROWSER_TEST_F(PolicyTest,
                        DISABLED_PRE_WaitForInitialUserActivityUsatisfied) {
@@ skipping 11 matching lines @@
   content::MockNotificationObserver observer;
   content::NotificationRegistrar registrar;
   registrar.Add(&observer,
                 chrome::NOTIFICATION_APP_TERMINATING,
                 content::NotificationService::AllSources());
 
   // Require initial user activity.
   PolicyMap policies;
   policies.Set(key::kWaitForInitialUserActivity, POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(true),
                NULL);
   UpdateProviderPolicy(policies);
   base::RunLoop().RunUntilIdle();
 
   // Set the session length limit to 1 hour. Verify that the session is not
   // terminated.
   EXPECT_CALL(observer, Observe(chrome::NOTIFICATION_APP_TERMINATING, _, _))
       .Times(0);
   policies.Set(key::kSessionLengthLimit,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(kOneHourInMs),
                NULL);
   UpdateProviderPolicy(policies);
   base::RunLoop().RunUntilIdle();
   Mock::VerifyAndClearExpectations(&observer);
 }
 
 // Disabled, see http://crbug.com/315308.
 IN_PROC_BROWSER_TEST_F(PolicyTest,
                        DISABLED_PRE_WaitForInitialUserActivitySatisfied) {
@@ skipping 16 matching lines @@
                 chrome::NOTIFICATION_APP_TERMINATING,
                 content::NotificationService::AllSources());
 
   // Require initial user activity and set the session length limit to 3 hours.
   // Verify that the session is not terminated.
   EXPECT_CALL(observer, Observe(chrome::NOTIFICATION_APP_TERMINATING, _, _))
       .Times(0);
   PolicyMap policies;
   policies.Set(key::kWaitForInitialUserActivity, POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(true),
                NULL);
   policies.Set(key::kSessionLengthLimit,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(kThreeHoursInMs),
                NULL);
   UpdateProviderPolicy(policies);
   base::RunLoop().RunUntilIdle();
   Mock::VerifyAndClearExpectations(&observer);
 
   // Decrease the session length limit to 1 hour. Verify that the session is
   // terminated immediately.
   EXPECT_CALL(observer, Observe(chrome::NOTIFICATION_APP_TERMINATING, _, _));
   policies.Set(key::kSessionLengthLimit,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(kOneHourInMs),
                NULL);
   UpdateProviderPolicy(policies);
   base::RunLoop().RunUntilIdle();
   Mock::VerifyAndClearExpectations(&observer);
 }
 
 IN_PROC_BROWSER_TEST_F(PolicyTest, LargeCursorEnabled) {
   // Verifies that the large cursor accessibility feature can be controlled
   // through policy.
   chromeos::AccessibilityManager* accessibility_manager =
       chromeos::AccessibilityManager::Get();
 
   // Manually enable the large cursor.
   accessibility_manager->EnableLargeCursor(true);
   EXPECT_TRUE(accessibility_manager->IsLargeCursorEnabled());
 
   // Verify that policy overrides the manual setting.
   PolicyMap policies;
   policies.Set(key::kLargeCursorEnabled,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(false),
                NULL);
   UpdateProviderPolicy(policies);
   EXPECT_FALSE(accessibility_manager->IsLargeCursorEnabled());
 
   // Verify that the large cursor cannot be enabled manually anymore.
   accessibility_manager->EnableLargeCursor(true);
   EXPECT_FALSE(accessibility_manager->IsLargeCursorEnabled());
 }
 
 IN_PROC_BROWSER_TEST_F(PolicyTest, SpokenFeedbackEnabled) {
   // Verifies that the spoken feedback accessibility feature can be controlled
   // through policy.
   chromeos::AccessibilityManager* accessibility_manager =
       chromeos::AccessibilityManager::Get();
 
   // Manually enable spoken feedback.
   accessibility_manager->EnableSpokenFeedback(
       true, ui::A11Y_NOTIFICATION_NONE);
   EXPECT_TRUE(accessibility_manager->IsSpokenFeedbackEnabled());
 
   // Verify that policy overrides the manual setting.
   PolicyMap policies;
   policies.Set(key::kSpokenFeedbackEnabled,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(false),
                NULL);
   UpdateProviderPolicy(policies);
   EXPECT_FALSE(accessibility_manager->IsSpokenFeedbackEnabled());
 
   // Verify that spoken feedback cannot be enabled manually anymore.
   accessibility_manager->EnableSpokenFeedback(
       true, ui::A11Y_NOTIFICATION_NONE);
   EXPECT_FALSE(accessibility_manager->IsSpokenFeedbackEnabled());
 }
 
 IN_PROC_BROWSER_TEST_F(PolicyTest, HighContrastEnabled) {
   // Verifies that the high contrast mode accessibility feature can be
   // controlled through policy.
   chromeos::AccessibilityManager* accessibility_manager =
       chromeos::AccessibilityManager::Get();
 
   // Manually enable high contrast mode.
   accessibility_manager->EnableHighContrast(true);
   EXPECT_TRUE(accessibility_manager->IsHighContrastEnabled());
 
   // Verify that policy overrides the manual setting.
   PolicyMap policies;
   policies.Set(key::kHighContrastEnabled,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(false),
                NULL);
   UpdateProviderPolicy(policies);
   EXPECT_FALSE(accessibility_manager->IsHighContrastEnabled());
 
   // Verify that high contrast mode cannot be enabled manually anymore.
   accessibility_manager->EnableHighContrast(true);
   EXPECT_FALSE(accessibility_manager->IsHighContrastEnabled());
 }
 
 IN_PROC_BROWSER_TEST_F(PolicyTest, ScreenMagnifierTypeNone) {
   // Verifies that the screen magnifier can be disabled through policy.
   chromeos::MagnificationManager* magnification_manager =
       chromeos::MagnificationManager::Get();
 
   // Manually enable the full-screen magnifier.
   magnification_manager->SetMagnifierType(ui::MAGNIFIER_FULL);
   magnification_manager->SetMagnifierEnabled(true);
   EXPECT_EQ(ui::MAGNIFIER_FULL, magnification_manager->GetMagnifierType());
   EXPECT_TRUE(magnification_manager->IsMagnifierEnabled());
 
   // Verify that policy overrides the manual setting.
   PolicyMap policies;
   policies.Set(key::kScreenMagnifierType,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(0),
                NULL);
   UpdateProviderPolicy(policies);
   EXPECT_FALSE(magnification_manager->IsMagnifierEnabled());
 
   // Verify that the screen magnifier cannot be enabled manually anymore.
   magnification_manager->SetMagnifierEnabled(true);
   EXPECT_FALSE(magnification_manager->IsMagnifierEnabled());
 }
 
 IN_PROC_BROWSER_TEST_F(PolicyTest, ScreenMagnifierTypeFull) {
   // Verifies that the full-screen magnifier can be enabled through policy.
   chromeos::MagnificationManager* magnification_manager =
       chromeos::MagnificationManager::Get();
 
   // Verify that the screen magnifier is initially disabled.
   EXPECT_FALSE(magnification_manager->IsMagnifierEnabled());
 
   // Verify that policy can enable the full-screen magnifier.
   PolicyMap policies;
   policies.Set(key::kScreenMagnifierType,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(ui::MAGNIFIER_FULL),
                NULL);
   UpdateProviderPolicy(policies);
   EXPECT_EQ(ui::MAGNIFIER_FULL, magnification_manager->GetMagnifierType());
   EXPECT_TRUE(magnification_manager->IsMagnifierEnabled());
 
   // Verify that the screen magnifier cannot be disabled manually anymore.
   magnification_manager->SetMagnifierEnabled(false);
   EXPECT_TRUE(magnification_manager->IsMagnifierEnabled());
 }
 
 IN_PROC_BROWSER_TEST_F(PolicyTest, AccessibilityVirtualKeyboardEnabled) {
   // Verifies that the on-screen keyboard accessibility feature can be
   // controlled through policy.
   chromeos::AccessibilityManager* accessibility_manager =
       chromeos::AccessibilityManager::Get();
 
   // Manually enable the on-screen keyboard.
   accessibility_manager->EnableVirtualKeyboard(true);
   EXPECT_TRUE(accessibility_manager->IsVirtualKeyboardEnabled());
 
   // Verify that policy overrides the manual setting.
   PolicyMap policies;
   policies.Set(key::kVirtualKeyboardEnabled,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(false),
                NULL);
   UpdateProviderPolicy(policies);
   EXPECT_FALSE(accessibility_manager->IsVirtualKeyboardEnabled());
 
   // Verify that the on-screen keyboard cannot be enabled manually anymore.
   accessibility_manager->EnableVirtualKeyboard(true);
   EXPECT_FALSE(accessibility_manager->IsVirtualKeyboardEnabled());
 }
 
 IN_PROC_BROWSER_TEST_F(PolicyTest, VirtualKeyboardEnabled) {
   // Verify keyboard disabled by default.
   EXPECT_FALSE(keyboard::IsKeyboardEnabled());
   // Verify keyboard can be toggled by default.
   keyboard::SetTouchKeyboardEnabled(true);
   EXPECT_TRUE(keyboard::IsKeyboardEnabled());
   keyboard::SetTouchKeyboardEnabled(false);
   EXPECT_FALSE(keyboard::IsKeyboardEnabled());
 
   // Verify enabling the policy takes effect immediately and that that user
   // cannot disable the keyboard..
   PolicyMap policies;
   policies.Set(key::kTouchVirtualKeyboardEnabled,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(true),
                NULL);
   UpdateProviderPolicy(policies);
   EXPECT_TRUE(keyboard::IsKeyboardEnabled());
   keyboard::SetTouchKeyboardEnabled(false);
   EXPECT_TRUE(keyboard::IsKeyboardEnabled());
 
   // Verify that disabling the policy takes effect immediately and that the user
   // cannot enable the keyboard.
   policies.Set(key::kTouchVirtualKeyboardEnabled,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(false),
                NULL);
   UpdateProviderPolicy(policies);
   EXPECT_FALSE(keyboard::IsKeyboardEnabled());
   keyboard::SetTouchKeyboardEnabled(true);
   EXPECT_FALSE(keyboard::IsKeyboardEnabled());
 }
 
 #endif
 
@@ skipping 54 matching lines @@
   }
 
   void HomepageIsNotNTP() {
     // Verifies that policy can set the startup pages to the homepage, when
     // the homepage is not the NTP.
     PolicyMap policies;
     policies.Set(
         key::kRestoreOnStartup,
         POLICY_LEVEL_MANDATORY,
         POLICY_SCOPE_USER,
+        POLICY_SOURCE_CLOUD,
         new base::FundamentalValue(SessionStartupPref::kPrefValueHomePage),
         NULL);
     policies.Set(key::kHomepageIsNewTabPage,
                  POLICY_LEVEL_MANDATORY,
                  POLICY_SCOPE_USER,
+                 POLICY_SOURCE_CLOUD,
                  new base::FundamentalValue(false),
                  NULL);
     policies.Set(key::kHomepageLocation,
                  POLICY_LEVEL_MANDATORY,
                  POLICY_SCOPE_USER,
+                 POLICY_SOURCE_CLOUD,
                  new base::StringValue(kRestoredURLs[1]),
                  NULL);
     provider_.UpdateChromePolicy(policies);
 
     expected_urls_.push_back(GURL(kRestoredURLs[1]));
   }
 
   void HomepageIsNTP() {
     // Verifies that policy can set the startup pages to the homepage, when
     // the homepage is the NTP.
     PolicyMap policies;
     policies.Set(
         key::kRestoreOnStartup,
         POLICY_LEVEL_MANDATORY,
         POLICY_SCOPE_USER,
+        POLICY_SOURCE_CLOUD,
         new base::FundamentalValue(SessionStartupPref::kPrefValueHomePage),
         NULL);
     policies.Set(key::kHomepageIsNewTabPage,
                  POLICY_LEVEL_MANDATORY,
                  POLICY_SCOPE_USER,
+                 POLICY_SOURCE_CLOUD,
                  new base::FundamentalValue(true),
                  NULL);
     provider_.UpdateChromePolicy(policies);
 
     expected_urls_.push_back(GURL(chrome::kChromeUINewTabURL));
   }
 
   void ListOfURLs() {
     // Verifies that policy can set the startup pages to a list of URLs.
     base::ListValue urls;
     for (size_t i = 0; i < arraysize(kRestoredURLs); ++i) {
       urls.Append(new base::StringValue(kRestoredURLs[i]));
       expected_urls_.push_back(GURL(kRestoredURLs[i]));
     }
     PolicyMap policies;
     policies.Set(key::kRestoreOnStartup,
                  POLICY_LEVEL_MANDATORY,
                  POLICY_SCOPE_USER,
+                 POLICY_SOURCE_CLOUD,
                  new base::FundamentalValue(SessionStartupPref::kPrefValueURLs),
                  NULL);
     policies.Set(
         key::kRestoreOnStartupURLs, POLICY_LEVEL_MANDATORY, POLICY_SCOPE_USER,
-        urls.DeepCopy(), NULL);
+        POLICY_SOURCE_CLOUD, urls.DeepCopy(), nullptr);
     provider_.UpdateChromePolicy(policies);
   }
 
   void NTP() {
     // Verifies that policy can set the startup page to the NTP.
     PolicyMap policies;
     policies.Set(
         key::kRestoreOnStartup,
         POLICY_LEVEL_MANDATORY,
         POLICY_SCOPE_USER,
+        POLICY_SOURCE_CLOUD,
         new base::FundamentalValue(SessionStartupPref::kPrefValueNewTab),
         NULL);
     provider_.UpdateChromePolicy(policies);
     expected_urls_.push_back(GURL(chrome::kChromeUINewTabURL));
   }
 
   void Last() {
     // Verifies that policy can set the startup pages to the last session.
     PolicyMap policies;
     policies.Set(key::kRestoreOnStartup,
                  POLICY_LEVEL_MANDATORY,
                  POLICY_SCOPE_USER,
+                 POLICY_SOURCE_CLOUD,
                  new base::FundamentalValue(SessionStartupPref::kPrefValueLast),
                  NULL);
     provider_.UpdateChromePolicy(policies);
     // This should restore the tabs opened at PRE_RunTest below.
     for (size_t i = 0; i < arraysize(kRestoredURLs); ++i)
       expected_urls_.push_back(GURL(kRestoredURLs[i]));
   }
 
   std::vector<GURL> expected_urls_;
 };
@@ skipping 44 matching lines @@
  public:
   PolicyStatisticsCollectorTest() {}
   ~PolicyStatisticsCollectorTest() override {}
 
   void SetUpInProcessBrowserTestFixture() override {
     PolicyTest::SetUpInProcessBrowserTestFixture();
     PolicyMap policies;
     policies.Set(key::kShowHomeButton,
                  POLICY_LEVEL_MANDATORY,
                  POLICY_SCOPE_USER,
+                 POLICY_SOURCE_CLOUD,
                  new base::FundamentalValue(true),
                  NULL);
     policies.Set(key::kBookmarkBarEnabled,
                  POLICY_LEVEL_MANDATORY,
                  POLICY_SCOPE_USER,
+                 POLICY_SOURCE_CLOUD,
                  new base::FundamentalValue(false),
                  NULL);
     policies.Set(key::kHomepageLocation,
                  POLICY_LEVEL_MANDATORY,
                  POLICY_SCOPE_USER,
+                 POLICY_SOURCE_CLOUD,
                  new base::StringValue("http://chromium.org"),
                  NULL);
     provider_.UpdateChromePolicy(policies);
   }
 };
 
 IN_PROC_BROWSER_TEST_F(PolicyStatisticsCollectorTest, Startup) {
   // Verifies that policy usage histograms are collected at startup.
 
   // BrowserPolicyConnector::Init() has already been called. Make sure the
@@ skipping 47 matching lines @@
   // audio or video capture allow policy and must never be NULL.
   // |whitelist_policy| and |allow_rule| are optional.  If NULL, no whitelist
   // policy is set.  If non-NULL, the whitelist policy is set to contain either
   // the |allow_rule| (if non-NULL) or an "allow all" wildcard.
   void ConfigurePolicyMap(PolicyMap* policies, const char* policy_name,
                           const char* whitelist_policy,
                           const char* allow_rule) {
     policies->Set(policy_name,
                   POLICY_LEVEL_MANDATORY,
                   POLICY_SCOPE_USER,
+                  POLICY_SOURCE_CLOUD,
                   new base::FundamentalValue(policy_value_),
                   NULL);
 
     if (whitelist_policy) {
       // Add an entry to the whitelist that allows the specified URL regardless
       // of the setting of kAudioCapturedAllowed.
       base::ListValue* list = new base::ListValue();
       if (allow_rule) {
         list->AppendString(allow_rule);
         request_url_allowed_via_whitelist_ = true;
       } else {
         list->AppendString(ContentSettingsPattern::Wildcard().ToString());
         // We should ignore all wildcard entries in the whitelist, so even
         // though we've added an entry, it should be ignored and our expectation
         // is that the request has not been allowed via the whitelist.
         request_url_allowed_via_whitelist_ = false;
       }
-      policies->Set(whitelist_policy, POLICY_LEVEL_MANDATORY,
-                    POLICY_SCOPE_USER, list, NULL);
+      policies->Set(whitelist_policy, POLICY_LEVEL_MANDATORY, POLICY_SCOPE_USER,
+                    POLICY_SOURCE_CLOUD, list, nullptr);
     }
   }
 
   void Accept(const content::MediaStreamDevices& devices,
               content::MediaStreamRequestResult result,
               scoped_ptr<content::MediaStreamUI> ui) {
     if (policy_value_ || request_url_allowed_via_whitelist_) {
       ASSERT_EQ(1U, devices.size());
       ASSERT_EQ("fake_dev", devices[0].id);
     } else {
@@ skipping 174 matching lines @@
           net::SpawnedTestServer::SSLOptions::CERT_EXPIRED),
       base::FilePath(FILE_PATH_LITERAL("chrome/test/data")));
   ASSERT_TRUE(https_server_expired.Start());
 
   // Set the enterprise policy to disallow opt-in.
   const PrefService* const prefs = browser()->profile()->GetPrefs();
   EXPECT_TRUE(
       prefs->GetBoolean(prefs::kSafeBrowsingExtendedReportingOptInAllowed));
   PolicyMap policies;
   policies.Set(key::kSafeBrowsingExtendedReportingOptInAllowed,
-               POLICY_LEVEL_MANDATORY, POLICY_SCOPE_USER,
-               new base::FundamentalValue(false), NULL);
+               POLICY_LEVEL_MANDATORY, POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD,
+               new base::FundamentalValue(false), nullptr);
   UpdateProviderPolicy(policies);
   EXPECT_FALSE(
       prefs->GetBoolean(prefs::kSafeBrowsingExtendedReportingOptInAllowed));
 
   // Navigate to an SSL error page.
   ui_test_utils::NavigateToURL(browser(), https_server_expired.GetURL("/"));
 
   const content::InterstitialPage* const interstitial =
       content::InterstitialPage::GetInterstitialPage(
           browser()->tab_strip_model()->GetActiveWebContents());
@@ skipping 62 matching lines @@
           net::SpawnedTestServer::SSLOptions::CERT_EXPIRED),
       base::FilePath(FILE_PATH_LITERAL("chrome/test/data")));
   ASSERT_TRUE(https_server_expired.Start());
 
   const PrefService* const prefs = browser()->profile()->GetPrefs();
   EXPECT_TRUE(prefs->GetBoolean(prefs::kSSLErrorOverrideAllowed));
 
   // Disallowing the proceed link by setting the policy to |false|.
   PolicyMap policies;
   policies.Set(key::kSSLErrorOverrideAllowed, POLICY_LEVEL_MANDATORY,
-               POLICY_SCOPE_USER, new base::FundamentalValue(false), NULL);
+               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD,
+               new base::FundamentalValue(false), nullptr);
   UpdateProviderPolicy(policies);
 
   // Policy should not allow overriding anymore.
   EXPECT_FALSE(prefs->GetBoolean(prefs::kSSLErrorOverrideAllowed));
 
   // Policy disallows overriding - navigate to an SSL error page and expect no
   // proceed link.
   ui_test_utils::NavigateToURL(browser(), https_server_expired.GetURL("/"));
   const content::InterstitialPage* const interstitial =
       content::InterstitialPage::GetInterstitialPage(
@@ skipping 28 matching lines @@
 // Similar to PolicyTest but sets the proper policy before the browser is
 // started.
 class PolicyVariationsServiceTest : public PolicyTest {
  public:
   void SetUpInProcessBrowserTestFixture() override {
     PolicyTest::SetUpInProcessBrowserTestFixture();
     PolicyMap policies;
     policies.Set(key::kVariationsRestrictParameter,
                  POLICY_LEVEL_MANDATORY,
                  POLICY_SCOPE_USER,
+                 POLICY_SOURCE_CLOUD,
                  new base::StringValue("restricted"),
                  NULL);
     provider_.UpdateChromePolicy(policies);
   }
 };
 
 IN_PROC_BROWSER_TEST_F(PolicyVariationsServiceTest, VariationsURLIsValid) {
   const std::string default_variations_url =
       variations::VariationsService::GetDefaultVariationsServerURLForTesting();
 
@@ skipping 11 matching lines @@
   std::string value;
   EXPECT_TRUE(net::GetValueForKeyInQuery(url, "restrict", &value));
   EXPECT_EQ("restricted", value);
 }
 
 IN_PROC_BROWSER_TEST_F(PolicyTest, NativeMessagingBlacklistSelective) {
   base::ListValue blacklist;
   blacklist.Append(new base::StringValue("host.name"));
   PolicyMap policies;
   policies.Set(key::kNativeMessagingBlacklist, POLICY_LEVEL_MANDATORY,
-               POLICY_SCOPE_USER, blacklist.DeepCopy(), NULL);
+               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD, blacklist.DeepCopy(),
+               nullptr);
   UpdateProviderPolicy(policies);
 
   PrefService* prefs = browser()->profile()->GetPrefs();
   EXPECT_FALSE(extensions::MessageService::IsNativeMessagingHostAllowed(
       prefs, "host.name"));
   EXPECT_TRUE(extensions::MessageService::IsNativeMessagingHostAllowed(
       prefs, "other.host.name"));
 }
 
 IN_PROC_BROWSER_TEST_F(PolicyTest, NativeMessagingBlacklistWildcard) {
   base::ListValue blacklist;
   blacklist.Append(new base::StringValue("*"));
   PolicyMap policies;
   policies.Set(key::kNativeMessagingBlacklist, POLICY_LEVEL_MANDATORY,
-               POLICY_SCOPE_USER, blacklist.DeepCopy(), NULL);
+               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD, blacklist.DeepCopy(),
+               nullptr);
   UpdateProviderPolicy(policies);
 
   PrefService* prefs = browser()->profile()->GetPrefs();
   EXPECT_FALSE(extensions::MessageService::IsNativeMessagingHostAllowed(
       prefs, "host.name"));
   EXPECT_FALSE(extensions::MessageService::IsNativeMessagingHostAllowed(
       prefs, "other.host.name"));
 }
 
 IN_PROC_BROWSER_TEST_F(PolicyTest, NativeMessagingWhitelist) {
   base::ListValue blacklist;
   blacklist.Append(new base::StringValue("*"));
   base::ListValue whitelist;
   whitelist.Append(new base::StringValue("host.name"));
   PolicyMap policies;
   policies.Set(key::kNativeMessagingBlacklist, POLICY_LEVEL_MANDATORY,
-               POLICY_SCOPE_USER, blacklist.DeepCopy(), NULL);
+               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD, blacklist.DeepCopy(),
+               nullptr);
   policies.Set(key::kNativeMessagingWhitelist, POLICY_LEVEL_MANDATORY,
-               POLICY_SCOPE_USER, whitelist.DeepCopy(), NULL);
+               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD, whitelist.DeepCopy(),
+               nullptr);
   UpdateProviderPolicy(policies);
 
   PrefService* prefs = browser()->profile()->GetPrefs();
   EXPECT_TRUE(extensions::MessageService::IsNativeMessagingHostAllowed(
       prefs, "host.name"));
   EXPECT_FALSE(extensions::MessageService::IsNativeMessagingHostAllowed(
       prefs, "other.host.name"));
 }
 
 #endif  // !defined(CHROME_OS)
 
 
 #if !defined(OS_CHROMEOS) && !defined(OS_ANDROID)
 // Sets the hardware acceleration mode policy before the browser is started.
 class HardwareAccelerationModePolicyTest : public PolicyTest {
  public:
   HardwareAccelerationModePolicyTest() {}
 
   void SetUpInProcessBrowserTestFixture() override {
     PolicyTest::SetUpInProcessBrowserTestFixture();
     PolicyMap policies;
     policies.Set(key::kHardwareAccelerationModeEnabled,
                  POLICY_LEVEL_MANDATORY,
                  POLICY_SCOPE_USER,
+                 POLICY_SOURCE_CLOUD,
                  new base::FundamentalValue(false),
                  NULL);
     provider_.UpdateChromePolicy(policies);
   }
 };
 
 IN_PROC_BROWSER_TEST_F(HardwareAccelerationModePolicyTest,
                        HardwareAccelerationDisabled) {
   // Verifies that hardware acceleration can be disabled with policy.
   EXPECT_FALSE(
@@ skipping 11 matching lines @@
   // The policy description promises that Unified Desktop is not available
   // unless the policy is set (or a command line or an extension is used). If
   // this default behaviour changes, please change the description at
   // components/policy/resources/policy_templates.json.
   EXPECT_FALSE(display_manager->unified_desktop_enabled());
   // Now set the policy and check that unified desktop is turned on.
   PolicyMap policies;
   policies.Set(key::kUnifiedDesktopEnabledByDefault,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(true),
                NULL);
   UpdateProviderPolicy(policies);
   EXPECT_TRUE(display_manager->unified_desktop_enabled());
   policies.Set(key::kUnifiedDesktopEnabledByDefault,
                POLICY_LEVEL_MANDATORY,
                POLICY_SCOPE_USER,
+               POLICY_SOURCE_CLOUD,
                new base::FundamentalValue(false),
                NULL);
   UpdateProviderPolicy(policies);
   EXPECT_FALSE(display_manager->unified_desktop_enabled());
 }
 #endif // defined(OS_CHROMEOS)
 
 }  // namespace policy