Make CapabilityFilter be part of Identity

mojo/shell/identity.h

Index: mojo/shell/identity.h
diff --git a/mojo/shell/identity.h b/mojo/shell/identity.h
index f60b2c5061f1beecea47819c6baa904809856b8b..4204ddabc275274f325a1a17a20ec3c1e68f85b4 100644
--- a/mojo/shell/identity.h
+++ b/mojo/shell/identity.h
@@ -5,6 +5,7 @@
 #ifndef MOJO_SHELL_IDENTITY_H_
 #define MOJO_SHELL_IDENTITY_H_
 
+#include "mojo/shell/capability_filter.h"
 #include "url/gurl.h"
 
 namespace mojo {
@@ -17,16 +18,33 @@ namespace shell {
 // grouping for a given application URL. For example, the core services are
 // grouped into "Core"/"Files"/"Network"/etc. using qualifier; content handler's
 // qualifier is derived from the origin of the content.
+// If a CapabilityFilter is not specified via the constructor, an instance of

[yzshen1, 2015/09/18 06:07:54]

I feel that it is less likely for the user to screw up if the default is a
reject-all filter. Since this is security-critical, I feel that it is nice to be
explicit if the user does want a permissive filter.

WDYT? Thanks!

+// Identity is constructed with a permissive filter (allowing connection to
+// all apps and services).
 struct Identity {
   Identity();
-  Identity(const GURL& in_url, const std::string& in_qualifier);
   explicit Identity(const GURL& in_url);
+  Identity(const GURL& in_url, const std::string& in_qualifier);
+  Identity(const GURL& in_url,
+           const std::string& in_qualifier,
+           CapabilityFilter filter);
+  ~Identity();
 
   bool operator<(const Identity& other) const;
   bool is_null() const { return url.is_empty(); }
 
   GURL url;

[yzshen1, 2015/09/18 06:07:54]

I think it is preferred to use either public members or getters/setters, but not
both together.

WDYT? Thanks!

   std::string qualifier;
+  const CapabilityFilter& filter() const { return filter_; }
+  void SetFilter(const CapabilityFilter& filter);
+
+ private:
+  // TODO(beng): CapabilityFilter is not currently included in equivalence
+  //             checks for Identity since we're not currently clear on the
+  //             policy for instance disambiguation. Need to figure this out.
+  //             This field is supplied because it is logically part of the
+  //             instance identity of an application.
+  CapabilityFilter filter_;
 };
 
 }  // namespace shell