Wire up the identity API for enterprise Kiosk Apps.

chrome/browser/extensions/api/identity/experimental_identity_api.cc

Index: chrome/browser/extensions/api/identity/experimental_identity_api.cc
diff --git a/chrome/browser/extensions/api/identity/experimental_identity_api.cc b/chrome/browser/extensions/api/identity/experimental_identity_api.cc
index 1845aedd029dfa07f956a0ceb84ad6f099d08c24..197d980bc4ee0e474ef1ba24c54eed51b320898e 100644
--- a/chrome/browser/extensions/api/identity/experimental_identity_api.cc
+++ b/chrome/browser/extensions/api/identity/experimental_identity_api.cc
@@ -11,8 +11,10 @@
 #include "base/strings/stringprintf.h"
 #include "base/values.h"
 #include "chrome/browser/app_mode/app_mode_utils.h"
+#include "chrome/browser/browser_process.h"
 #include "chrome/browser/extensions/api/identity/identity_api.h"
 #include "chrome/browser/extensions/extension_install_prompt.h"
+#include "chrome/browser/policy/browser_policy_connector.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/signin/signin_manager.h"
 #include "chrome/browser/signin/signin_manager_factory.h"
@@ -33,6 +35,8 @@
 
 #if defined(OS_CHROMEOS)
 #include "chrome/browser/chromeos/login/user_manager.h"
+#include "chrome/browser/chromeos/settings/device_oauth2_token_service.h"
+#include "chrome/browser/chromeos/settings/device_oauth2_token_service_factory.h"
 #endif
 
 namespace extensions {
@@ -85,6 +89,18 @@ bool ExperimentalIdentityGetAuthTokenFunction::RunImpl() {
   // Balanced in CompleteFunctionWithResult|CompleteFunctionWithError
   AddRef();
 
+#if defined(OS_CHROMEOS)
+  if (chromeos::UserManager::Get()->IsLoggedInAsKioskApp() &&
+      g_browser_process->browser_policy_connector()->IsEnterpriseManaged()) {

[zel, 2013/06/19 03:09:35]

do you want to test if DeviceOAuth2TokenServiceFactory has refresh token?

[Mattias Nissler (ping if slow), 2013/06/19 03:44:40]

Since we don't have the intention to send the user through the auth flow, the
only thing we'd do if there's no token would be to bail out early. But then
again, there's no harm in having DeviceOAuth2TokenService handle that situation
(i.e. reporting an error immediately).

[zel, 2013/06/19 21:46:25]

Actually, we can still let app show sign-in UI on this identity API call. That
way you will still permit enrolled kiosk app that don't have robot accounts
associated with them.  

+    OAuth2TokenService::ScopeSet scope_set(oauth2_info.scopes.begin(),
+                                           oauth2_info.scopes.end());
+    device_token_request_ =
+        chromeos::DeviceOAuth2TokenServiceFactory::Get()->StartRequest(
+            scope_set, this);
+    return true;
+  }
+#endif
+
   if (!HasLoginToken()) {
     if (!should_prompt_for_signin_) {
       error_ = identity_constants::kUserNotSignedIn;
@@ -209,6 +225,31 @@ void ExperimentalIdentityGetAuthTokenFunction::InstallUIAbort(
   CompleteFunctionWithError(identity_constants::kUserRejected);
 }
 
+void ExperimentalIdentityGetAuthTokenFunction::OnGetTokenSuccess(
+    const OAuth2TokenService::Request* request,
+    const std::string& access_token,
+    const base::Time& expiration_time) {
+  DCHECK_EQ(device_token_request_.get(), request);
+  device_token_request_.reset();
+
+  const OAuth2Info& oauth2_info = OAuth2Info::GetOAuth2Info(GetExtension());
+  IdentityTokenCacheValue token(access_token,
+                                expiration_time - base::Time::Now());
+  IdentityAPI::GetFactoryInstance()->GetForProfile(profile())->SetCachedToken(
+      GetExtension()->id(), oauth2_info.scopes, token);
+
+  CompleteFunctionWithResult(access_token);
+}
+
+void ExperimentalIdentityGetAuthTokenFunction::OnGetTokenFailure(
+    const OAuth2TokenService::Request* request,
+    const GoogleServiceAuthError& error) {
+  DCHECK_EQ(device_token_request_.get(), request);
+  device_token_request_.reset();
+
+  CompleteFunctionWithError(error.ToString());
+}
+
 void ExperimentalIdentityGetAuthTokenFunction::StartGaiaRequest(
     OAuth2MintTokenFlow::Mode mode) {
   mint_token_flow_.reset(CreateMintTokenFlow(mode));