Make CapabilityFilter be part of Identity

mojo/shell/identity.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef MOJO_SHELL_IDENTITY_H_
 #define MOJO_SHELL_IDENTITY_H_
 
+#include "mojo/shell/capability_filter.h"
 #include "url/gurl.h"
 
 namespace mojo {
 namespace shell {
 
 // Represents the identity of an application.
 // |url| is the URL of the application.
 // |qualifier| is a string that allows to tie a specific instance of an
 // application to another. A typical use case of qualifier is to control process
 // grouping for a given application URL. For example, the core services are
 // grouped into "Core"/"Files"/"Network"/etc. using qualifier; content handler's
 // qualifier is derived from the origin of the content.
+// If a CapabilityFilter is not specified via the constructor, an instance of

[yzshen1, 2015/09/18 06:07:54]

I feel that it is less likely for the user to screw up if the default is a
reject-all filter. Since this is security-critical, I feel that it is nice to be
explicit if the user does want a permissive filter.

WDYT? Thanks!

+// Identity is constructed with a permissive filter (allowing connection to
+// all apps and services).
 struct Identity {
   Identity();
+  explicit Identity(const GURL& in_url);
   Identity(const GURL& in_url, const std::string& in_qualifier);
-  explicit Identity(const GURL& in_url);
+  Identity(const GURL& in_url,
+           const std::string& in_qualifier,
+           CapabilityFilter filter);
+  ~Identity();
 
   bool operator<(const Identity& other) const;
   bool is_null() const { return url.is_empty(); }
 
   GURL url;

[yzshen1, 2015/09/18 06:07:54]

I think it is preferred to use either public members or getters/setters, but not
both together.

WDYT? Thanks!

   std::string qualifier;
+  const CapabilityFilter& filter() const { return filter_; }
+  void SetFilter(const CapabilityFilter& filter);
+
+ private:
+  // TODO(beng): CapabilityFilter is not currently included in equivalence
+  //             checks for Identity since we're not currently clear on the
+  //             policy for instance disambiguation. Need to figure this out.
+  //             This field is supplied because it is logically part of the
+  //             instance identity of an application.
+  CapabilityFilter filter_;
 };
 
 }  // namespace shell
 }  // namespace mojo
 
 #endif  // MOJO_SHELL_IDENTITY_H_