Identity API: web-based scope approval dialogs for getAuthToken

chrome/browser/extensions/api/identity/identity_apitest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/string_util.h"
 #include "base/stringprintf.h"
 #include "base/values.h"
 #include "chrome/browser/extensions/api/identity/identity_api.h"
 #include "chrome/browser/extensions/extension_apitest.h"
 #include "chrome/browser/extensions/extension_browsertest.h"
@@ skipping 175 matching lines @@
 
 ProfileKeyedService* IdentityAPITestFactory(content::BrowserContext* profile) {
   return new IdentityAPI(static_cast<Profile*>(profile));
 }
 
 }  // namespace
 
 class MockGetAuthTokenFunction : public IdentityGetAuthTokenFunction {
  public:
   MockGetAuthTokenFunction() : login_ui_result_(true),
-                               install_ui_result_(false),
+                               scope_ui_result_(true),
                                login_ui_shown_(false),
-                               install_ui_shown_(false) {
+                               scope_ui_shown_(false) {
   }
 
   void set_login_ui_result(bool result) {
     login_ui_result_ = result;
   }
 
-  void set_install_ui_result(bool result) {
-    install_ui_result_ = result;
+  void set_scope_ui_failure(GaiaWebAuthFlow::Failure failure) {
+    scope_ui_result_ = false;
+    scope_ui_failure_ = failure;
+  }
+
+  void set_scope_ui_oauth_error(const std::string& oauth_error) {
+    scope_ui_oauth_error_ = oauth_error;
   }
 
   bool login_ui_shown() const {
     return login_ui_shown_;
   }
 
-  bool install_ui_shown() const {
-    return install_ui_shown_;
+  bool scope_ui_shown() const {
+    return scope_ui_shown_;
   }
 
   virtual void ShowLoginPopup() OVERRIDE {
     EXPECT_FALSE(login_ui_shown_);
     login_ui_shown_ = true;
     if (login_ui_result_)
       SigninSuccess("fake_refresh_token");
     else
       SigninFailed();
   }
 
   virtual void ShowOAuthApprovalDialog(
       const IssueAdviceInfo& issue_advice) OVERRIDE {
-    install_ui_shown_ = true;
-    // Call InstallUIProceed or InstallUIAbort based on the flag.
-    if (install_ui_result_)
-      InstallUIProceed();
-    else
-      InstallUIAbort(true);
+    scope_ui_shown_ = true;
+
+    if (scope_ui_result_) {
+      if (scope_ui_oauth_error_.empty())
+        OnGaiaFlowCompleted(kAccessToken, "3600", "");
+      else
+        OnGaiaFlowCompleted("", "", scope_ui_oauth_error_);
+    } else if (scope_ui_failure_ == GaiaWebAuthFlow::SERVICE_AUTH_ERROR) {
+      GoogleServiceAuthError error(GoogleServiceAuthError::CONNECTION_FAILED);
+      OnGaiaFlowFailure(scope_ui_failure_, error);
+    } else {
+      GoogleServiceAuthError error(GoogleServiceAuthError::NONE);
+      OnGaiaFlowFailure(scope_ui_failure_, error);
+    }
   }
 
   MOCK_CONST_METHOD0(HasLoginToken, bool());
   MOCK_METHOD1(CreateMintTokenFlow,
                OAuth2MintTokenFlow* (OAuth2MintTokenFlow::Mode mode));
 
  private:
   ~MockGetAuthTokenFunction() {}
   bool login_ui_result_;
-  bool install_ui_result_;
+  bool scope_ui_result_;
+  GaiaWebAuthFlow::Failure scope_ui_failure_;
+  std::string scope_ui_oauth_error_;
   bool login_ui_shown_;
-  bool install_ui_shown_;
+  bool scope_ui_shown_;
 };
 
 class MockQueuedMintRequest : public IdentityMintRequestQueue::Request {
  public:
   MOCK_METHOD1(StartMintToken, void(IdentityMintRequestQueue::MintType));
 };
 
 class GetAuthTokenFunctionTest : public AsyncExtensionBrowserTest {
  protected:
   enum OAuth2Fields {
@@ skipping 27 matching lines @@
 };
 
 IN_PROC_BROWSER_TEST_F(GetAuthTokenFunctionTest,
                        NoClientId) {
   scoped_refptr<MockGetAuthTokenFunction> func(new MockGetAuthTokenFunction());
   func->set_extension(CreateExtension(SCOPES));
   std::string error = utils::RunFunctionAndReturnError(
       func.get(), "[{}]", browser());
   EXPECT_EQ(std::string(errors::kInvalidClientId), error);
   EXPECT_FALSE(func->login_ui_shown());
-  EXPECT_FALSE(func->install_ui_shown());
+  EXPECT_FALSE(func->scope_ui_shown());
 }
 
 IN_PROC_BROWSER_TEST_F(GetAuthTokenFunctionTest,
                        NoScopes) {
   scoped_refptr<MockGetAuthTokenFunction> func(new MockGetAuthTokenFunction());
   func->set_extension(CreateExtension(CLIENT_ID));
   std::string error = utils::RunFunctionAndReturnError(
       func.get(), "[{}]", browser());
   EXPECT_EQ(std::string(errors::kInvalidScopes), error);
   EXPECT_FALSE(func->login_ui_shown());
-  EXPECT_FALSE(func->install_ui_shown());
+  EXPECT_FALSE(func->scope_ui_shown());
 }
 
 IN_PROC_BROWSER_TEST_F(GetAuthTokenFunctionTest,
                        NonInteractiveNotSignedIn) {
   scoped_refptr<MockGetAuthTokenFunction> func(new MockGetAuthTokenFunction());
   func->set_extension(CreateExtension(CLIENT_ID | SCOPES));
   EXPECT_CALL(*func.get(), HasLoginToken()).WillOnce(Return(false));
   std::string error = utils::RunFunctionAndReturnError(
       func.get(), "[{}]", browser());
   EXPECT_EQ(std::string(errors::kUserNotSignedIn), error);
   EXPECT_FALSE(func->login_ui_shown());
-  EXPECT_FALSE(func->install_ui_shown());
+  EXPECT_FALSE(func->scope_ui_shown());
 }
 
 IN_PROC_BROWSER_TEST_F(GetAuthTokenFunctionTest,
                        NonInteractiveMintFailure) {
   scoped_refptr<MockGetAuthTokenFunction> func(new MockGetAuthTokenFunction());
   func->set_extension(CreateExtension(CLIENT_ID | SCOPES));
   EXPECT_CALL(*func.get(), HasLoginToken())
       .WillOnce(Return(true));
   TestOAuth2MintTokenFlow* flow = new TestOAuth2MintTokenFlow(
       TestOAuth2MintTokenFlow::MINT_TOKEN_FAILURE, func.get());
   EXPECT_CALL(*func.get(), CreateMintTokenFlow(_)).WillOnce(Return(flow));
   std::string error = utils::RunFunctionAndReturnError(
       func.get(), "[{}]", browser());
   EXPECT_TRUE(StartsWithASCII(error, errors::kAuthFailure, false));
   EXPECT_FALSE(func->login_ui_shown());
-  EXPECT_FALSE(func->install_ui_shown());
+  EXPECT_FALSE(func->scope_ui_shown());
 }
 
 IN_PROC_BROWSER_TEST_F(GetAuthTokenFunctionTest,
                        NonInteractiveMintAdviceSuccess) {
   scoped_refptr<const Extension> extension(CreateExtension(CLIENT_ID | SCOPES));
   scoped_refptr<MockGetAuthTokenFunction> func(new MockGetAuthTokenFunction());
   func->set_extension(extension);
   EXPECT_CALL(*func.get(), HasLoginToken())
       .WillOnce(Return(true));
   TestOAuth2MintTokenFlow* flow = new TestOAuth2MintTokenFlow(
       TestOAuth2MintTokenFlow::ISSUE_ADVICE_SUCCESS, func.get());
   EXPECT_CALL(*func.get(), CreateMintTokenFlow(_)).WillOnce(Return(flow));
   std::string error = utils::RunFunctionAndReturnError(
       func.get(), "[{}]", browser());
   EXPECT_EQ(std::string(errors::kNoGrant), error);
   EXPECT_FALSE(func->login_ui_shown());
-  EXPECT_FALSE(func->install_ui_shown());
+  EXPECT_FALSE(func->scope_ui_shown());
 
   const OAuth2Info& oauth2_info = OAuth2Info::GetOAuth2Info(extension);
   EXPECT_EQ(IdentityTokenCacheValue::CACHE_STATUS_ADVICE,
             id_api()->GetCachedToken(extension->id(),
                                      oauth2_info.scopes).status());
 }
 
 IN_PROC_BROWSER_TEST_F(GetAuthTokenFunctionTest,
                        NonInteractiveMintBadCredentials) {
   scoped_refptr<MockGetAuthTokenFunction> func(new MockGetAuthTokenFunction());
   func->set_extension(CreateExtension(CLIENT_ID | SCOPES));
   EXPECT_CALL(*func.get(), HasLoginToken())
       .WillOnce(Return(true));
   TestOAuth2MintTokenFlow* flow = new TestOAuth2MintTokenFlow(
       TestOAuth2MintTokenFlow::MINT_TOKEN_BAD_CREDENTIALS, func.get());
   EXPECT_CALL(*func.get(), CreateMintTokenFlow(_)).WillOnce(Return(flow));
   std::string error = utils::RunFunctionAndReturnError(
       func.get(), "[{}]", browser());
   EXPECT_TRUE(StartsWithASCII(error, errors::kAuthFailure, false));
   EXPECT_FALSE(func->login_ui_shown());
-  EXPECT_FALSE(func->install_ui_shown());
+  EXPECT_FALSE(func->scope_ui_shown());
 }
 
 IN_PROC_BROWSER_TEST_F(GetAuthTokenFunctionTest,
                        NonInteractiveSuccess) {
   scoped_refptr<MockGetAuthTokenFunction> func(new MockGetAuthTokenFunction());
   scoped_refptr<const Extension> extension(CreateExtension(CLIENT_ID | SCOPES));
   func->set_extension(extension);
   const OAuth2Info& oauth2_info = OAuth2Info::GetOAuth2Info(extension);
   EXPECT_CALL(*func.get(), HasLoginToken())
       .WillOnce(Return(true));
   TestOAuth2MintTokenFlow* flow = new TestOAuth2MintTokenFlow(
       TestOAuth2MintTokenFlow::MINT_TOKEN_SUCCESS, func.get());
   EXPECT_CALL(*func.get(), CreateMintTokenFlow(_)).WillOnce(Return(flow));
   scoped_ptr<base::Value> value(utils::RunFunctionAndReturnSingleResult(
       func.get(), "[{}]", browser()));
   std::string access_token;
   EXPECT_TRUE(value->GetAsString(&access_token));
   EXPECT_EQ(std::string(kAccessToken), access_token);
   EXPECT_FALSE(func->login_ui_shown());
-  EXPECT_FALSE(func->install_ui_shown());
+  EXPECT_FALSE(func->scope_ui_shown());
   EXPECT_EQ(IdentityTokenCacheValue::CACHE_STATUS_TOKEN,
             id_api()->GetCachedToken(extension->id(),
                                      oauth2_info.scopes).status());
 }
 
 IN_PROC_BROWSER_TEST_F(GetAuthTokenFunctionTest,
                        InteractiveLoginCanceled) {
   scoped_refptr<MockGetAuthTokenFunction> func(new MockGetAuthTokenFunction());
   func->set_extension(CreateExtension(CLIENT_ID | SCOPES));
   EXPECT_CALL(*func.get(), HasLoginToken()).WillOnce(Return(false));
   func->set_login_ui_result(false);
   std::string error = utils::RunFunctionAndReturnError(
       func.get(), "[{\"interactive\": true}]", browser());
   EXPECT_EQ(std::string(errors::kUserNotSignedIn), error);
   EXPECT_TRUE(func->login_ui_shown());
-  EXPECT_FALSE(func->install_ui_shown());
+  EXPECT_FALSE(func->scope_ui_shown());
 }
 
 IN_PROC_BROWSER_TEST_F(GetAuthTokenFunctionTest,
                        InteractiveMintBadCredentialsLoginCanceled) {
   scoped_refptr<MockGetAuthTokenFunction> func(new MockGetAuthTokenFunction());
   func->set_extension(CreateExtension(CLIENT_ID | SCOPES));
   EXPECT_CALL(*func.get(), HasLoginToken())
       .WillOnce(Return(true));
   TestOAuth2MintTokenFlow* flow = new TestOAuth2MintTokenFlow(
       TestOAuth2MintTokenFlow::MINT_TOKEN_BAD_CREDENTIALS, func.get());
   EXPECT_CALL(*func.get(), CreateMintTokenFlow(_)).WillOnce(Return(flow));
   func->set_login_ui_result(false);
   std::string error = utils::RunFunctionAndReturnError(
       func.get(), "[{\"interactive\": true}]", browser());
   EXPECT_EQ(std::string(errors::kUserNotSignedIn), error);
   EXPECT_TRUE(func->login_ui_shown());
-  EXPECT_FALSE(func->install_ui_shown());
+  EXPECT_FALSE(func->scope_ui_shown());
 }
 
 IN_PROC_BROWSER_TEST_F(GetAuthTokenFunctionTest,
                        InteractiveLoginSuccessNoToken) {
   scoped_refptr<MockGetAuthTokenFunction> func(new MockGetAuthTokenFunction());
   func->set_extension(CreateExtension(CLIENT_ID | SCOPES));
   EXPECT_CALL(*func.get(), HasLoginToken()).WillOnce(Return(false));
   func->set_login_ui_result(false);
   std::string error = utils::RunFunctionAndReturnError(
       func.get(), "[{\"interactive\": true}]", browser());
   EXPECT_EQ(std::string(errors::kUserNotSignedIn), error);
   EXPECT_TRUE(func->login_ui_shown());
-  EXPECT_FALSE(func->install_ui_shown());
+  EXPECT_FALSE(func->scope_ui_shown());
 }
 
 IN_PROC_BROWSER_TEST_F(GetAuthTokenFunctionTest,
                        InteractiveLoginSuccessMintFailure) {
   scoped_refptr<MockGetAuthTokenFunction> func(new MockGetAuthTokenFunction());
   func->set_extension(CreateExtension(CLIENT_ID | SCOPES));
   EXPECT_CALL(*func.get(), HasLoginToken())
       .WillOnce(Return(false));
   func->set_login_ui_result(true);
   TestOAuth2MintTokenFlow* flow = new TestOAuth2MintTokenFlow(
       TestOAuth2MintTokenFlow::MINT_TOKEN_FAILURE, func.get());
   EXPECT_CALL(*func.get(), CreateMintTokenFlow(_)).WillOnce(Return(flow));
   std::string error = utils::RunFunctionAndReturnError(
       func.get(), "[{\"interactive\": true}]", browser());
   EXPECT_TRUE(StartsWithASCII(error, errors::kAuthFailure, false));
   EXPECT_TRUE(func->login_ui_shown());
-  EXPECT_FALSE(func->install_ui_shown());
+  EXPECT_FALSE(func->scope_ui_shown());
 }
 
 IN_PROC_BROWSER_TEST_F(GetAuthTokenFunctionTest,
                        InteractiveLoginSuccessMintSuccess) {
   scoped_refptr<MockGetAuthTokenFunction> func(new MockGetAuthTokenFunction());
   func->set_extension(CreateExtension(CLIENT_ID | SCOPES));
   EXPECT_CALL(*func.get(), HasLoginToken())
       .WillOnce(Return(false));
   func->set_login_ui_result(true);
   TestOAuth2MintTokenFlow* flow = new TestOAuth2MintTokenFlow(
       TestOAuth2MintTokenFlow::MINT_TOKEN_SUCCESS, func.get());
   EXPECT_CALL(*func.get(), CreateMintTokenFlow(_)).WillOnce(Return(flow));
   scoped_ptr<base::Value> value(utils::RunFunctionAndReturnSingleResult(
       func.get(), "[{\"interactive\": true}]", browser()));
   std::string access_token;
   EXPECT_TRUE(value->GetAsString(&access_token));
   EXPECT_EQ(std::string(kAccessToken), access_token);
   EXPECT_TRUE(func->login_ui_shown());
-  EXPECT_FALSE(func->install_ui_shown());
+  EXPECT_FALSE(func->scope_ui_shown());
 }
 
 IN_PROC_BROWSER_TEST_F(GetAuthTokenFunctionTest,
                        InteractiveLoginSuccessApprovalAborted) {
   scoped_refptr<MockGetAuthTokenFunction> func(new MockGetAuthTokenFunction());
   func->set_extension(CreateExtension(CLIENT_ID | SCOPES));
   EXPECT_CALL(*func.get(), HasLoginToken())
       .WillOnce(Return(false));
   func->set_login_ui_result(true);
   TestOAuth2MintTokenFlow* flow = new TestOAuth2MintTokenFlow(
       TestOAuth2MintTokenFlow::ISSUE_ADVICE_SUCCESS, func.get());
   EXPECT_CALL(*func.get(), CreateMintTokenFlow(_)).WillOnce(Return(flow));
-  func->set_install_ui_result(false);
+  func->set_scope_ui_failure(GaiaWebAuthFlow::WINDOW_CLOSED);
   std::string error = utils::RunFunctionAndReturnError(
       func.get(), "[{\"interactive\": true}]", browser());
   EXPECT_EQ(std::string(errors::kUserRejected), error);
   EXPECT_TRUE(func->login_ui_shown());
-  EXPECT_TRUE(func->install_ui_shown());
+  EXPECT_TRUE(func->scope_ui_shown());
 }
 
 IN_PROC_BROWSER_TEST_F(GetAuthTokenFunctionTest,
-                       InteractiveLoginSuccessApprovalDoneMintFailure) {
+                       InteractiveLoginSuccessApprovalSuccess) {
+  scoped_refptr<const Extension> extension(CreateExtension(CLIENT_ID | SCOPES));
   scoped_refptr<MockGetAuthTokenFunction> func(new MockGetAuthTokenFunction());
-  func->set_extension(CreateExtension(CLIENT_ID | SCOPES));
+  func->set_extension(extension);
   EXPECT_CALL(*func.get(), HasLoginToken())
       .WillOnce(Return(false));
   func->set_login_ui_result(true);
-  TestOAuth2MintTokenFlow* flow1 = new TestOAuth2MintTokenFlow(
+  TestOAuth2MintTokenFlow* flow = new TestOAuth2MintTokenFlow(
       TestOAuth2MintTokenFlow::ISSUE_ADVICE_SUCCESS, func.get());
-  TestOAuth2MintTokenFlow* flow2 = new TestOAuth2MintTokenFlow(
-      TestOAuth2MintTokenFlow::MINT_TOKEN_FAILURE, func.get());
   EXPECT_CALL(*func.get(), CreateMintTokenFlow(_))
-      .WillOnce(Return(flow1))
-      .WillOnce(Return(flow2));
+      .WillOnce(Return(flow));
 
-  func->set_install_ui_result(true);
-  std::string error = utils::RunFunctionAndReturnError(
-      func.get(), "[{\"interactive\": true}]", browser());
-  EXPECT_TRUE(StartsWithASCII(error, errors::kAuthFailure, false));
-  EXPECT_TRUE(func->login_ui_shown());
-  EXPECT_TRUE(func->install_ui_shown());
-}
-
-IN_PROC_BROWSER_TEST_F(GetAuthTokenFunctionTest,
-                       InteractiveLoginSuccessApprovalDoneMintSuccess) {
-  scoped_refptr<MockGetAuthTokenFunction> func(new MockGetAuthTokenFunction());
-  scoped_refptr<const Extension> extension(CreateExtension(CLIENT_ID | SCOPES));
-  func->set_extension(extension);
-  const OAuth2Info& oauth2_info = OAuth2Info::GetOAuth2Info(extension);
-  EXPECT_CALL(*func.get(), HasLoginToken())
-      .WillOnce(Return(false));
-  func->set_login_ui_result(true);
-  TestOAuth2MintTokenFlow* flow1 = new TestOAuth2MintTokenFlow(
-      TestOAuth2MintTokenFlow::ISSUE_ADVICE_SUCCESS, func.get());
-  TestOAuth2MintTokenFlow* flow2 = new TestOAuth2MintTokenFlow(
-      TestOAuth2MintTokenFlow::MINT_TOKEN_SUCCESS, func.get());
-  EXPECT_CALL(*func.get(), CreateMintTokenFlow(_))
-      .WillOnce(Return(flow1))
-      .WillOnce(Return(flow2));
-
-  func->set_install_ui_result(true);
   scoped_ptr<base::Value> value(utils::RunFunctionAndReturnSingleResult(
       func.get(), "[{\"interactive\": true}]", browser()));
   std::string access_token;
   EXPECT_TRUE(value->GetAsString(&access_token));
   EXPECT_EQ(std::string(kAccessToken), access_token);
   EXPECT_TRUE(func->login_ui_shown());
-  EXPECT_TRUE(func->install_ui_shown());
-  EXPECT_EQ(IdentityTokenCacheValue::CACHE_STATUS_TOKEN,
-            id_api()->GetCachedToken(extension->id(),
-                                     oauth2_info.scopes).status());
+  EXPECT_TRUE(func->scope_ui_shown());
 }
 
 IN_PROC_BROWSER_TEST_F(GetAuthTokenFunctionTest,
                        InteractiveApprovalAborted) {
   scoped_refptr<MockGetAuthTokenFunction> func(new MockGetAuthTokenFunction());
   func->set_extension(CreateExtension(CLIENT_ID | SCOPES));
   EXPECT_CALL(*func.get(), HasLoginToken())
       .WillOnce(Return(true));
   TestOAuth2MintTokenFlow* flow = new TestOAuth2MintTokenFlow(
       TestOAuth2MintTokenFlow::ISSUE_ADVICE_SUCCESS, func.get());
   EXPECT_CALL(*func.get(), CreateMintTokenFlow(_)).WillOnce(Return(flow));
-  func->set_install_ui_result(false);
+  func->set_scope_ui_failure(GaiaWebAuthFlow::WINDOW_CLOSED);
   std::string error = utils::RunFunctionAndReturnError(
       func.get(), "[{\"interactive\": true}]", browser());
   EXPECT_EQ(std::string(errors::kUserRejected), error);
   EXPECT_FALSE(func->login_ui_shown());
-  EXPECT_TRUE(func->install_ui_shown());
+  EXPECT_TRUE(func->scope_ui_shown());
 }
 
 IN_PROC_BROWSER_TEST_F(GetAuthTokenFunctionTest,
-                       InteractiveApprovalDoneMintSuccess) {
+                       InteractiveApprovalInvalidRedirect) {
   scoped_refptr<MockGetAuthTokenFunction> func(new MockGetAuthTokenFunction());
   func->set_extension(CreateExtension(CLIENT_ID | SCOPES));
   EXPECT_CALL(*func.get(), HasLoginToken())
       .WillOnce(Return(true));
-  TestOAuth2MintTokenFlow* flow1 = new TestOAuth2MintTokenFlow(
+  TestOAuth2MintTokenFlow* flow = new TestOAuth2MintTokenFlow(
       TestOAuth2MintTokenFlow::ISSUE_ADVICE_SUCCESS, func.get());
-  TestOAuth2MintTokenFlow* flow2 = new TestOAuth2MintTokenFlow(
-      TestOAuth2MintTokenFlow::MINT_TOKEN_SUCCESS, func.get());
+  EXPECT_CALL(*func.get(), CreateMintTokenFlow(_)).WillOnce(Return(flow));
+  func->set_scope_ui_failure(GaiaWebAuthFlow::INVALID_REDIRECT);
+  std::string error = utils::RunFunctionAndReturnError(
+      func.get(), "[{\"interactive\": true}]", browser());
+  EXPECT_EQ(std::string(errors::kInvalidRedirect), error);
+  EXPECT_FALSE(func->login_ui_shown());
+  EXPECT_TRUE(func->scope_ui_shown());
+}
+
+IN_PROC_BROWSER_TEST_F(GetAuthTokenFunctionTest,
+                       InteractiveApprovalConnectionFailure) {
+  scoped_refptr<MockGetAuthTokenFunction> func(new MockGetAuthTokenFunction());
+  func->set_extension(CreateExtension(CLIENT_ID | SCOPES));
+  EXPECT_CALL(*func.get(), HasLoginToken())
+      .WillOnce(Return(true));
+  TestOAuth2MintTokenFlow* flow = new TestOAuth2MintTokenFlow(
+      TestOAuth2MintTokenFlow::ISSUE_ADVICE_SUCCESS, func.get());
+  EXPECT_CALL(*func.get(), CreateMintTokenFlow(_)).WillOnce(Return(flow));
+  func->set_scope_ui_failure(GaiaWebAuthFlow::SERVICE_AUTH_ERROR);
+  std::string error = utils::RunFunctionAndReturnError(
+      func.get(), "[{\"interactive\": true}]", browser());
+  EXPECT_TRUE(StartsWithASCII(error, errors::kAuthFailure, false));
+  EXPECT_FALSE(func->login_ui_shown());
+  EXPECT_TRUE(func->scope_ui_shown());
+}
+
+IN_PROC_BROWSER_TEST_F(GetAuthTokenFunctionTest,
+                       InteractiveApprovalOAuthErrors) {
+  scoped_refptr<const Extension> extension(CreateExtension(CLIENT_ID | SCOPES));
+
+  std::map<std::string, std::string> error_map;
+  error_map.insert(std::make_pair("access_denied", errors::kUserRejected));
+  error_map.insert(std::make_pair("invalid_scope", errors::kInvalidScopes));
+  error_map.insert(std::make_pair(
+      "unmapped_error", std::string(errors::kAuthFailure) + "unmapped_error"));
+
+  for (std::map<std::string, std::string>::const_iterator
+           it = error_map.begin();
+       it != error_map.end();
+       ++it) {
+    scoped_refptr<MockGetAuthTokenFunction> func(
+        new MockGetAuthTokenFunction());
+    func->set_extension(extension);
+    EXPECT_CALL(*func.get(), HasLoginToken()).WillOnce(Return(true));
+    TestOAuth2MintTokenFlow* flow = new TestOAuth2MintTokenFlow(
+        TestOAuth2MintTokenFlow::ISSUE_ADVICE_SUCCESS, func.get());
+    ON_CALL(*func.get(), CreateMintTokenFlow(_)).WillByDefault(Return(flow));
+    func->set_scope_ui_oauth_error(it->first);
+    std::string error = utils::RunFunctionAndReturnError(
+        func.get(), "[{\"interactive\": true}]", browser());
+    EXPECT_EQ(it->second, error);
+    EXPECT_FALSE(func->login_ui_shown());
+    EXPECT_TRUE(func->scope_ui_shown());
+  }
+}
+
+IN_PROC_BROWSER_TEST_F(GetAuthTokenFunctionTest,
+                       InteractiveApprovalSuccess) {
+  scoped_refptr<const Extension> extension(CreateExtension(CLIENT_ID | SCOPES));
+  const OAuth2Info& oauth2_info = OAuth2Info::GetOAuth2Info(extension);
+  scoped_refptr<MockGetAuthTokenFunction> func(new MockGetAuthTokenFunction());
+  func->set_extension(extension);
+  EXPECT_CALL(*func.get(), HasLoginToken())
+      .WillOnce(Return(true));
+  TestOAuth2MintTokenFlow* flow = new TestOAuth2MintTokenFlow(
+      TestOAuth2MintTokenFlow::ISSUE_ADVICE_SUCCESS, func.get());
   EXPECT_CALL(*func.get(), CreateMintTokenFlow(_))
-      .WillOnce(Return(flow1))
-      .WillOnce(Return(flow2));
+      .WillOnce(Return(flow));
 
-  func->set_install_ui_result(true);
   scoped_ptr<base::Value> value(utils::RunFunctionAndReturnSingleResult(
       func.get(), "[{\"interactive\": true}]", browser()));
   std::string access_token;
   EXPECT_TRUE(value->GetAsString(&access_token));
   EXPECT_EQ(std::string(kAccessToken), access_token);
   EXPECT_FALSE(func->login_ui_shown());
-  EXPECT_TRUE(func->install_ui_shown());
-}
+  EXPECT_TRUE(func->scope_ui_shown());
 
-IN_PROC_BROWSER_TEST_F(GetAuthTokenFunctionTest,
-                       InteractiveApprovalDoneMintBadCredentials) {
-  scoped_refptr<MockGetAuthTokenFunction> func(new MockGetAuthTokenFunction());
-  func->set_extension(CreateExtension(CLIENT_ID | SCOPES));
-  EXPECT_CALL(*func.get(), HasLoginToken())
-      .WillOnce(Return(true));
-  TestOAuth2MintTokenFlow* flow1 = new TestOAuth2MintTokenFlow(
-      TestOAuth2MintTokenFlow::ISSUE_ADVICE_SUCCESS, func.get());
-  TestOAuth2MintTokenFlow* flow2 = new TestOAuth2MintTokenFlow(
-      TestOAuth2MintTokenFlow::MINT_TOKEN_BAD_CREDENTIALS, func.get());
-  EXPECT_CALL(*func.get(), CreateMintTokenFlow(_))
-      .WillOnce(Return(flow1))
-      .WillOnce(Return(flow2));
-
-  func->set_install_ui_result(true);
-  std::string error = utils::RunFunctionAndReturnError(
-      func.get(), "[{\"interactive\": true}]", browser());
-  EXPECT_TRUE(StartsWithASCII(error, errors::kAuthFailure, false));
-  EXPECT_FALSE(func->login_ui_shown());
-  EXPECT_TRUE(func->install_ui_shown());
+  EXPECT_EQ(IdentityTokenCacheValue::CACHE_STATUS_TOKEN,
+            id_api()->GetCachedToken(extension->id(),
+                                     oauth2_info.scopes).status());
 }
 
 IN_PROC_BROWSER_TEST_F(GetAuthTokenFunctionTest, NoninteractiveQueue) {
   scoped_refptr<const Extension> extension(CreateExtension(CLIENT_ID | SCOPES));
   scoped_refptr<MockGetAuthTokenFunction> func(new MockGetAuthTokenFunction());
   func->set_extension(extension);
 
   // Create a fake request to block the queue.
   const OAuth2Info& oauth2_info = OAuth2Info::GetOAuth2Info(extension);
   std::set<std::string> scopes(oauth2_info.scopes.begin(),
@@ skipping 21 matching lines @@
       TestOAuth2MintTokenFlow::MINT_TOKEN_SUCCESS, func.get());
   EXPECT_CALL(*func.get(), CreateMintTokenFlow(_)).WillOnce(Return(flow));
 
   queue->RequestComplete(type, extension->id(), scopes, &queued_request);
 
   scoped_ptr<base::Value> value(WaitForSingleResult(func));
   std::string access_token;
   EXPECT_TRUE(value->GetAsString(&access_token));
   EXPECT_EQ(std::string(kAccessToken), access_token);
   EXPECT_FALSE(func->login_ui_shown());
-  EXPECT_FALSE(func->install_ui_shown());
+  EXPECT_FALSE(func->scope_ui_shown());
 }
 
 IN_PROC_BROWSER_TEST_F(GetAuthTokenFunctionTest, InteractiveQueue) {
   scoped_refptr<const Extension> extension(CreateExtension(CLIENT_ID | SCOPES));
   scoped_refptr<MockGetAuthTokenFunction> func(new MockGetAuthTokenFunction());
   func->set_extension(extension);
 
   // Create a fake request to block the queue.
   const OAuth2Info& oauth2_info = OAuth2Info::GetOAuth2Info(extension);
   std::set<std::string> scopes(oauth2_info.scopes.begin(),
@@ skipping 11 matching lines @@
 
   // The real request will start processing, but wait in the queue behind
   // the blocker.
   EXPECT_CALL(*func.get(), HasLoginToken()).WillOnce(Return(true));
   TestOAuth2MintTokenFlow* flow1 = new TestOAuth2MintTokenFlow(
       TestOAuth2MintTokenFlow::ISSUE_ADVICE_SUCCESS, func.get());
   EXPECT_CALL(*func.get(), CreateMintTokenFlow(_)).WillOnce(Return(flow1));
   RunFunctionAsync(func, "[{\"interactive\": true}]");
   // Verify that we have fetched the login token and run the first flow.
   testing::Mock::VerifyAndClearExpectations(func);
-  EXPECT_FALSE(func->install_ui_shown());
+  EXPECT_FALSE(func->scope_ui_shown());
 
-  // The UI will be displayed and the second flow will be created
-  // after the first queued request clears.
-  func->set_install_ui_result(true);
-  TestOAuth2MintTokenFlow* flow2 = new TestOAuth2MintTokenFlow(
-      TestOAuth2MintTokenFlow::MINT_TOKEN_SUCCESS, func.get());
-  EXPECT_CALL(*func.get(), CreateMintTokenFlow(_)).WillOnce(Return(flow2));
-
+  // The UI will be displayed and a token retrieved after the first
+  // queued request clears.
   queue->RequestComplete(type, extension->id(), scopes, &queued_request);
 
   scoped_ptr<base::Value> value(WaitForSingleResult(func));
   std::string access_token;
   EXPECT_TRUE(value->GetAsString(&access_token));
   EXPECT_EQ(std::string(kAccessToken), access_token);
   EXPECT_FALSE(func->login_ui_shown());
-  EXPECT_TRUE(func->install_ui_shown());
+  EXPECT_TRUE(func->scope_ui_shown());
 }
 
 IN_PROC_BROWSER_TEST_F(GetAuthTokenFunctionTest,
                        InteractiveQueuedNoninteractiveFails) {
   scoped_refptr<const Extension> extension(CreateExtension(CLIENT_ID | SCOPES));
   scoped_refptr<MockGetAuthTokenFunction> func(new MockGetAuthTokenFunction());
   func->set_extension(extension);
 
   // Create a fake request to block the interactive queue.
   const OAuth2Info& oauth2_info = OAuth2Info::GetOAuth2Info(extension);
@@ skipping 10 matching lines @@
   EXPECT_CALL(queued_request, StartMintToken(type)).Times(1);
   queue->RequestStart(type, extension->id(), scopes, &queued_request);
 
   // Non-interactive requests fail without hitting GAIA, because a
   // consent UI is known to be up.
   EXPECT_CALL(*func.get(), HasLoginToken()).WillOnce(Return(true));
   std::string error = utils::RunFunctionAndReturnError(
       func.get(), "[{}]", browser());
   EXPECT_EQ(std::string(errors::kNoGrant), error);
   EXPECT_FALSE(func->login_ui_shown());
-  EXPECT_FALSE(func->install_ui_shown());
+  EXPECT_FALSE(func->scope_ui_shown());
 
   queue->RequestComplete(type, extension->id(), scopes, &queued_request);
 }
 
 IN_PROC_BROWSER_TEST_F(GetAuthTokenFunctionTest,
                        NonInteractiveCacheHit) {
   scoped_refptr<const Extension> extension(CreateExtension(CLIENT_ID | SCOPES));
   scoped_refptr<MockGetAuthTokenFunction> func(new MockGetAuthTokenFunction());
   func->set_extension(extension);
 
   // pre-populate the cache with a token
   const OAuth2Info& oauth2_info = OAuth2Info::GetOAuth2Info(extension);
   IdentityTokenCacheValue token(kAccessToken,
                                 base::TimeDelta::FromSeconds(3600));
   id_api()->SetCachedToken(extension->id(), oauth2_info.scopes, token);
 
   // Get a token. Should not require a GAIA request.
   EXPECT_CALL(*func.get(), HasLoginToken())
       .WillOnce(Return(true));
   scoped_ptr<base::Value> value(utils::RunFunctionAndReturnSingleResult(
       func.get(), "[{}]", browser()));
   std::string access_token;
   EXPECT_TRUE(value->GetAsString(&access_token));
   EXPECT_EQ(std::string(kAccessToken), access_token);
   EXPECT_FALSE(func->login_ui_shown());
-  EXPECT_FALSE(func->install_ui_shown());
+  EXPECT_FALSE(func->scope_ui_shown());
 }
 
 IN_PROC_BROWSER_TEST_F(GetAuthTokenFunctionTest,
                        NonInteractiveIssueAdviceCacheHit) {
   scoped_refptr<const Extension> extension(CreateExtension(CLIENT_ID | SCOPES));
   scoped_refptr<MockGetAuthTokenFunction> func(new MockGetAuthTokenFunction());
   func->set_extension(extension);
 
   // pre-populate the cache with advice
   const OAuth2Info& oauth2_info = OAuth2Info::GetOAuth2Info(extension);
   IssueAdviceInfo info;
   IdentityTokenCacheValue token(info);
   id_api()->SetCachedToken(extension->id(), oauth2_info.scopes, token);
 
   // Should return an error without a GAIA request.
   EXPECT_CALL(*func.get(), HasLoginToken())
       .WillOnce(Return(true));
   std::string error = utils::RunFunctionAndReturnError(
       func.get(), "[{}]", browser());
   EXPECT_EQ(std::string(errors::kNoGrant), error);
   EXPECT_FALSE(func->login_ui_shown());
-  EXPECT_FALSE(func->install_ui_shown());
+  EXPECT_FALSE(func->scope_ui_shown());
 }
 
 IN_PROC_BROWSER_TEST_F(GetAuthTokenFunctionTest,
                        InteractiveCacheHit) {
   scoped_refptr<const Extension> extension(CreateExtension(CLIENT_ID | SCOPES));
   scoped_refptr<MockGetAuthTokenFunction> func(new MockGetAuthTokenFunction());
   func->set_extension(extension);
 
   // Create a fake request to block the queue.
   const OAuth2Info& oauth2_info = OAuth2Info::GetOAuth2Info(extension);
@@ skipping 23 matching lines @@
   // When we wake up the request, it returns the cached token without
   // displaying a UI, or hitting GAIA.
 
   queue->RequestComplete(type, extension->id(), scopes, &queued_request);
 
   scoped_ptr<base::Value> value(WaitForSingleResult(func));
   std::string access_token;
   EXPECT_TRUE(value->GetAsString(&access_token));
   EXPECT_EQ(std::string(kAccessToken), access_token);
   EXPECT_FALSE(func->login_ui_shown());
-  EXPECT_FALSE(func->install_ui_shown());
+  EXPECT_FALSE(func->scope_ui_shown());
 }
 
 IN_PROC_BROWSER_TEST_F(GetAuthTokenFunctionTest,
                        LoginInvalidatesTokenCache) {
   scoped_refptr<MockGetAuthTokenFunction> func(new MockGetAuthTokenFunction());
   scoped_refptr<const Extension> extension(CreateExtension(CLIENT_ID | SCOPES));
   func->set_extension(extension);
 
   // pre-populate the cache with a token
   const OAuth2Info& oauth2_info = OAuth2Info::GetOAuth2Info(extension);
   IdentityTokenCacheValue token(kAccessToken,
                                 base::TimeDelta::FromSeconds(3600));
   id_api()->SetCachedToken(extension->id(), oauth2_info.scopes, token);
 
   // Because the user is not signed in, the token will be removed,
   // and we'll hit GAIA for new tokens.
   EXPECT_CALL(*func.get(), HasLoginToken())
       .WillOnce(Return(false));
   func->set_login_ui_result(true);
-  TestOAuth2MintTokenFlow* flow1 = new TestOAuth2MintTokenFlow(
+  TestOAuth2MintTokenFlow* flow = new TestOAuth2MintTokenFlow(
       TestOAuth2MintTokenFlow::ISSUE_ADVICE_SUCCESS, func.get());
-  TestOAuth2MintTokenFlow* flow2 = new TestOAuth2MintTokenFlow(
-      TestOAuth2MintTokenFlow::MINT_TOKEN_SUCCESS, func.get());
   EXPECT_CALL(*func.get(), CreateMintTokenFlow(_))
-      .WillOnce(Return(flow1))
-      .WillOnce(Return(flow2));
+      .WillOnce(Return(flow));
 
-  func->set_install_ui_result(true);
   scoped_ptr<base::Value> value(utils::RunFunctionAndReturnSingleResult(
       func.get(), "[{\"interactive\": true}]", browser()));
   std::string access_token;
   EXPECT_TRUE(value->GetAsString(&access_token));
   EXPECT_EQ(std::string(kAccessToken), access_token);
   EXPECT_TRUE(func->login_ui_shown());
-  EXPECT_TRUE(func->install_ui_shown());
+  EXPECT_TRUE(func->scope_ui_shown());
   EXPECT_EQ(IdentityTokenCacheValue::CACHE_STATUS_TOKEN,
             id_api()->GetCachedToken(extension->id(),
                                      oauth2_info.scopes).status());
 }
 
 class RemoveCachedAuthTokenFunctionTest : public ExtensionBrowserTest {
  protected:
   bool InvalidateDefaultToken() {
     scoped_refptr<IdentityRemoveCachedAuthTokenFunction> func(
         new IdentityRemoveCachedAuthTokenFunction);
@@ skipping 177 matching lines @@
   scoped_ptr<base::Value> value(utils::RunFunctionAndReturnSingleResult(
       function, args, browser()));
 
   std::string url;
   EXPECT_TRUE(value->GetAsString(&url));
   EXPECT_EQ(std::string("https://abcdefghij.chromiumapp.org/callback#test"),
             url);
 }
 
 }  // namespace extensions