White-listing Chrome Remote Desktop to use the identity API in Public Session

chrome/browser/extensions/api/identity/identity_api.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_EXTENSIONS_API_IDENTITY_IDENTITY_API_H_
 #define CHROME_BROWSER_EXTENSIONS_API_IDENTITY_IDENTITY_API_H_
 
 #include <map>
 #include <set>
 #include <string>
@@ skipping 245 matching lines @@
   void OnMintTokenSuccess(const std::string& access_token,
                           int time_to_live) override;
   void OnMintTokenFailure(const GoogleServiceAuthError& error) override;
   void OnIssueAdviceSuccess(const IssueAdviceInfo& issue_advice) override;
 
   // IdentityAPI::ShutdownObserver implementation:
   void OnShutdown() override;
 
 #if defined(OS_CHROMEOS)
   // Starts a login access token request for device robot account. This method
-  // will be called only in enterprise kiosk mode in ChromeOS.
+  // will be called only in ChromeOS for:

[bartfab (slow), 2015/09/18 12:24:57]

Nit: s/ChromeOS/Chrome OS/

[kelvinp, 2015/09/22 00:50:37]

Done.

+  // 1. Enterprise kiosk mode.
+  // 2. Whitelisted first party apps in public session.
   virtual void StartDeviceLoginAccessTokenRequest();
+

[Andrew T Wilson (Slow), 2015/09/18 07:13:29]

Two things:

1) This API should be private, not public.
2) This API should have a test (which maybe is a reason to make it public)

Having it public but not tested is the worst of both worlds :)

[kelvinp, 2015/09/22 00:50:37]

This function is private.  I have added a test case to ensure that
non-whitelisted apps have no access to the device token.

+  bool IsOriginWhitelistedInPublicSession();
 #endif
 
   // Methods for invoking UI. Overridable for testing.
   virtual void ShowLoginPopup();
   virtual void ShowOAuthApprovalDialog(const IssueAdviceInfo& issue_advice);
 
   // Checks if there is a master login token to mint tokens for the extension.
   bool HasLoginToken() const;
 
   // Maps OAuth2 protocol errors to an error message returned to the
@@ skipping 70 matching lines @@
   // Helper to initialize final URL prefix.
   void InitFinalRedirectURLPrefix(const std::string& extension_id);
 
   scoped_ptr<WebAuthFlow> auth_flow_;
   GURL final_url_prefix_;
 };
 
 }  // namespace extensions
 
 #endif  // CHROME_BROWSER_EXTENSIONS_API_IDENTITY_IDENTITY_API_H_