Make Web Push use InstanceID tokens instead of GCM registrations

chrome/browser/push_messaging/push_messaging_service_impl.cc

Index: chrome/browser/push_messaging/push_messaging_service_impl.cc
diff --git a/chrome/browser/push_messaging/push_messaging_service_impl.cc b/chrome/browser/push_messaging/push_messaging_service_impl.cc
index 0117f1dc36c52fa66742a45788dfb37c3fb01a65..e72983532a4d0d7fab68c5f232c64dd90792c79e 100644
--- a/chrome/browser/push_messaging/push_messaging_service_impl.cc
+++ b/chrome/browser/push_messaging/push_messaging_service_impl.cc
@@ -25,6 +25,8 @@
 #include "chrome/browser/push_messaging/push_messaging_service_factory.h"
 #include "chrome/browser/push_messaging/push_messaging_service_observer.h"
 #include "chrome/browser/services/gcm/gcm_profile_service_factory.h"
+#include "chrome/browser/services/gcm/instance_id/instance_id_profile_service.h"
+#include "chrome/browser/services/gcm/instance_id/instance_id_profile_service_factory.h"
 #include "chrome/browser/ui/chrome_pages.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/features.h"
@@ -33,6 +35,8 @@
 #include "components/content_settings/core/browser/host_content_settings_map.h"
 #include "components/gcm_driver/gcm_driver.h"
 #include "components/gcm_driver/gcm_profile_service.h"
+#include "components/gcm_driver/instance_id/instance_id.h"
+#include "components/gcm_driver/instance_id/instance_id_driver.h"
 #include "components/pref_registry/pref_registry_syncable.h"
 #include "components/prefs/pref_service.h"
 #include "components/rappor/rappor_utils.h"
@@ -52,7 +56,11 @@
 #include "chrome/browser/background/background_mode_manager.h"
 #endif
 
+using instance_id::InstanceID;
+
 namespace {
+const char kGCMScope[] = "GCM";

[Peter Beverloo, 2016/04/21 13:26:19]

micro nit: blank line after namespace definition.

Please document this constant as well.

[johnme, 2016/05/25 14:11:51]

Done.

+
 const int kMaxRegistrations = 1000000;
 
 // Chrome does not yet support silent push messages, and requires websites to
@@ -180,7 +188,7 @@ void PushMessagingServiceImpl::DecreasePushSubscriptionCount(int subtract,
 }
 
 bool PushMessagingServiceImpl::CanHandle(const std::string& app_id) const {
-  return !PushMessagingAppIdentifier::FindByAppId(profile_, app_id).is_null();
+  return app_id.rfind(kPushMessagingAppIdentifierPrefix, 0) == 0;
 }
 
 void PushMessagingServiceImpl::ShutdownHandler() {
@@ -286,9 +294,8 @@ void PushMessagingServiceImpl::DeliverMessageCallback(
     case content::PUSH_DELIVERY_STATUS_UNKNOWN_APP_ID:
     case content::PUSH_DELIVERY_STATUS_PERMISSION_DENIED:
     case content::PUSH_DELIVERY_STATUS_NO_SERVICE_WORKER:
-      Unsubscribe(app_id, message.sender_id,
-                  base::Bind(&UnregisterCallbackToClosure,
-                             completion_closure_runner.Release()));
+      Unsubscribe(app_id, base::Bind(&UnregisterCallbackToClosure,
+                                     completion_closure_runner.Release()));
       break;
   }
 
@@ -380,10 +387,9 @@ void PushMessagingServiceImpl::SubscribeFromDocument(
   // Push does not allow permission requests from iframes.
   profile_->GetPermissionManager()->RequestPermission(
       content::PermissionType::PUSH_MESSAGING, web_contents->GetMainFrame(),
-      requesting_origin,
-      base::Bind(&PushMessagingServiceImpl::DidRequestPermission,
-                 weak_factory_.GetWeakPtr(), app_identifier, options,
-                 callback));
+      requesting_origin, base::Bind(&PushMessagingServiceImpl::DoSubscribe,
+                                    weak_factory_.GetWeakPtr(), app_identifier,
+                                    options, callback));
 }
 
 void PushMessagingServiceImpl::SubscribeFromWorker(
@@ -412,14 +418,8 @@ void PushMessagingServiceImpl::SubscribeFromWorker(
     return;
   }
 
-  IncreasePushSubscriptionCount(1, true /* is_pending */);
-  std::vector<std::string> sender_ids(1,
-                                      NormalizeSenderInfo(options.sender_info));
-
-  GetGCMDriver()->Register(app_identifier.app_id(), sender_ids,
-                           base::Bind(&PushMessagingServiceImpl::DidSubscribe,
-                                      weak_factory_.GetWeakPtr(),
-                                      app_identifier, register_callback));
+  DoSubscribe(app_identifier, options, register_callback,
+              blink::mojom::PermissionStatus::GRANTED);
 }
 
 blink::WebPushPermissionStatus PushMessagingServiceImpl::GetPermissionStatus(
@@ -439,6 +439,29 @@ bool PushMessagingServiceImpl::SupportNonVisibleMessages() {
   return false;
 }
 
+void PushMessagingServiceImpl::DoSubscribe(
+    const PushMessagingAppIdentifier& app_identifier,
+    const content::PushSubscriptionOptions& options,
+    const content::PushMessagingService::RegisterCallback& register_callback,
+    blink::mojom::PermissionStatus permission_status) {
+  if (permission_status != blink::mojom::PermissionStatus::GRANTED) {
+    SubscribeEndWithError(register_callback,
+                          content::PUSH_REGISTRATION_STATUS_PERMISSION_DENIED);
+    return;
+  }
+
+  IncreasePushSubscriptionCount(1, true /* is_pending */);
+
+  GetInstanceIDDriver()
+      ->GetInstanceID(app_identifier.app_id())
+      ->GetToken(
+          NormalizeSenderInfo(options.sender_info) /* authorized_entity */,
+          kGCMScope, std::map<std::string, std::string>() /* options */,
+          base::Bind(&PushMessagingServiceImpl::DidSubscribe,
+                     weak_factory_.GetWeakPtr(), app_identifier,
+                     register_callback));
+}
+
 void PushMessagingServiceImpl::SubscribeEnd(
     const content::PushMessagingService::RegisterCallback& callback,
     const std::string& subscription_id,
@@ -460,14 +483,14 @@ void PushMessagingServiceImpl::DidSubscribe(
     const PushMessagingAppIdentifier& app_identifier,
     const content::PushMessagingService::RegisterCallback& callback,
     const std::string& subscription_id,
-    gcm::GCMClient::Result result) {
+    InstanceID::Result result) {
   DecreasePushSubscriptionCount(1, true /* was_pending */);
 
   content::PushRegistrationStatus status =
       content::PUSH_REGISTRATION_STATUS_SERVICE_ERROR;
 
   switch (result) {
-    case gcm::GCMClient::SUCCESS:
+    case InstanceID::SUCCESS:
       // Make sure that this subscription has associated encryption keys prior
       // to returning it to the developer - they'll need this information in
       // order to send payloads to the user.
@@ -478,15 +501,14 @@ void PushMessagingServiceImpl::DidSubscribe(
                      subscription_id));
 
       return;
-    case gcm::GCMClient::INVALID_PARAMETER:
-    case gcm::GCMClient::GCM_DISABLED:
-    case gcm::GCMClient::ASYNC_OPERATION_PENDING:
-    case gcm::GCMClient::SERVER_ERROR:
-    case gcm::GCMClient::UNKNOWN_ERROR:
+    case InstanceID::INVALID_PARAMETER:
+    case InstanceID::DISABLED:
+    case InstanceID::ASYNC_OPERATION_PENDING:
+    case InstanceID::SERVER_ERROR:
+    case InstanceID::UNKNOWN_ERROR:
       status = content::PUSH_REGISTRATION_STATUS_SERVICE_ERROR;

[Peter Beverloo, 2016/04/21 13:26:18]

I'm beginning to think we should consider having DLOG(ERROR) calls in aggregated
switch cases like this, which would tremendously help debugging of any sort of
issue. WDYT?

[johnme, 2016/05/25 14:11:51]

Done (hopefully it won't trigger too often; in theory it's possible for sloppy
sites to trigger this in a loop).

       break;
-    case gcm::GCMClient::NETWORK_ERROR:
-    case gcm::GCMClient::TTL_EXCEEDED:
+    case InstanceID::NETWORK_ERROR:
       status = content::PUSH_REGISTRATION_STATUS_NETWORK_ERROR;
       break;
   }
@@ -516,27 +538,6 @@ void PushMessagingServiceImpl::DidSubscribeWithEncryptionInfo(
                content::PUSH_REGISTRATION_STATUS_SUCCESS_FROM_PUSH_SERVICE);
 }
 
-void PushMessagingServiceImpl::DidRequestPermission(
-    const PushMessagingAppIdentifier& app_identifier,
-    const content::PushSubscriptionOptions& options,
-    const content::PushMessagingService::RegisterCallback& register_callback,
-    blink::mojom::PermissionStatus permission_status) {
-  if (permission_status != blink::mojom::PermissionStatus::GRANTED) {
-    SubscribeEndWithError(register_callback,
-                          content::PUSH_REGISTRATION_STATUS_PERMISSION_DENIED);
-    return;
-  }
-
-  IncreasePushSubscriptionCount(1, true /* is_pending */);
-  std::vector<std::string> sender_ids(1,
-                                      NormalizeSenderInfo(options.sender_info));
-
-  GetGCMDriver()->Register(app_identifier.app_id(), sender_ids,
-                           base::Bind(&PushMessagingServiceImpl::DidSubscribe,
-                                      weak_factory_.GetWeakPtr(),
-                                      app_identifier, register_callback));
-}
-
 // GetEncryptionInfo methods ---------------------------------------------------
 
 void PushMessagingServiceImpl::GetEncryptionInfo(
@@ -571,7 +572,6 @@ void PushMessagingServiceImpl::DidGetEncryptionInfo(
 void PushMessagingServiceImpl::Unsubscribe(
     const GURL& requesting_origin,
     int64_t service_worker_registration_id,
-    const std::string& sender_id,
     const content::PushMessagingService::UnregisterCallback& callback) {
   PushMessagingAppIdentifier app_identifier =
       PushMessagingAppIdentifier::FindByServiceWorker(
@@ -584,12 +584,11 @@ void PushMessagingServiceImpl::Unsubscribe(
     return;
   }
 
-  Unsubscribe(app_identifier.app_id(), sender_id, callback);
+  Unsubscribe(app_identifier.app_id(), callback);
 }
 
 void PushMessagingServiceImpl::Unsubscribe(
     const std::string& app_id,
-    const std::string& sender_id,
     const content::PushMessagingService::UnregisterCallback& callback) {
   // Delete the mapping for this app_id, to guarantee that no messages get
   // delivered in future (even if unregistration fails).
@@ -601,27 +600,18 @@ void PushMessagingServiceImpl::Unsubscribe(
   if (was_registered)
     app_identifier.DeleteFromPrefs(profile_);
 
-  const auto& unregister_callback =
+  GetInstanceIDDriver()->GetInstanceID(app_id)->DeleteID(

[Peter Beverloo, 2016/04/21 13:26:18]

Now that we don't call GCMDriver::Unregister(WithSenderId), what gets rid of the
stored encryption keys in the GCM key store?

[johnme, 2016/05/25 14:11:51]

848 lines later... Done (https://codereview.chromium.org/1923953002)

       base::Bind(&PushMessagingServiceImpl::DidUnsubscribe,
-                 weak_factory_.GetWeakPtr(), was_registered, callback);
-#if defined(OS_ANDROID)
-  // On Android the backend is different, and requires the original sender_id.
-  // UnsubscribeBecausePermissionRevoked sometimes calls us with an empty one.
-  if (sender_id.empty()) {
-    unregister_callback.Run(gcm::GCMClient::INVALID_PARAMETER);
-  } else {
-    GetGCMDriver()->UnregisterWithSenderId(
-        app_id, NormalizeSenderInfo(sender_id), unregister_callback);
-  }
-#else
-  GetGCMDriver()->Unregister(app_id, unregister_callback);
-#endif
+                 weak_factory_.GetWeakPtr(), app_id, was_registered, callback));
 }
 
 void PushMessagingServiceImpl::DidUnsubscribe(
+    const std::string& app_id,
     bool was_subscribed,
     const content::PushMessagingService::UnregisterCallback& callback,
-    gcm::GCMClient::Result result) {
+    InstanceID::Result result) {
+  GetInstanceIDDriver()->RemoveInstanceID(app_id);
+
   if (was_subscribed)
     DecreasePushSubscriptionCount(1, false /* was_pending */);
 
@@ -635,18 +625,17 @@ void PushMessagingServiceImpl::DidUnsubscribe(
     return;
   }
   switch (result) {
-    case gcm::GCMClient::SUCCESS:
+    case InstanceID::SUCCESS:
       callback.Run(content::PUSH_UNREGISTRATION_STATUS_SUCCESS_UNREGISTERED);
       break;
-    case gcm::GCMClient::INVALID_PARAMETER:
-    case gcm::GCMClient::GCM_DISABLED:
-    case gcm::GCMClient::SERVER_ERROR:
-    case gcm::GCMClient::UNKNOWN_ERROR:
+    case InstanceID::INVALID_PARAMETER:
+    case InstanceID::DISABLED:
+    case InstanceID::SERVER_ERROR:
+    case InstanceID::UNKNOWN_ERROR:
       callback.Run(content::PUSH_UNREGISTRATION_STATUS_PENDING_SERVICE_ERROR);
       break;
-    case gcm::GCMClient::ASYNC_OPERATION_PENDING:
-    case gcm::GCMClient::NETWORK_ERROR:
-    case gcm::GCMClient::TTL_EXCEEDED:
+    case InstanceID::ASYNC_OPERATION_PENDING:
+    case InstanceID::NETWORK_ERROR:
       callback.Run(content::PUSH_UNREGISTRATION_STATUS_PENDING_NETWORK_ERROR);
       break;
   }
@@ -690,31 +679,16 @@ void PushMessagingServiceImpl::OnContentSettingChanged(
       continue;
     }
 
-    GetSenderId(
-        profile_, app_identifier.origin(),
-        app_identifier.service_worker_registration_id(),
-        base::Bind(
-            &PushMessagingServiceImpl::UnsubscribeBecausePermissionRevoked,
-            weak_factory_.GetWeakPtr(), app_identifier, barrier_closure));
+    UnsubscribeBecausePermissionRevoked(app_identifier, barrier_closure);

[Peter Beverloo, 2016/04/21 13:26:19]

Can we coalesce UnsubscribeBecausePermissionRevoked() into this method? It's
only three additional statements.

[johnme, 2016/05/25 14:11:51]

Not any more - I had to re-add the async GetSenderId call.

   }
 }
 
 void PushMessagingServiceImpl::UnsubscribeBecausePermissionRevoked(
     const PushMessagingAppIdentifier& app_identifier,
-    const base::Closure& closure,
-    const std::string& sender_id,
-    bool success,
-    bool not_found) {
+    const base::Closure& closure) {
   base::Closure barrier_closure = base::BarrierClosure(2, closure);
 
-  // Unsubscribe the PushMessagingAppIdentifier with the push service.
-  // It's possible for GetSenderId to have failed and sender_id to be empty, if
-  // cookies (and the SW database) for an origin got cleared before permissions
-  // are cleared for the origin. In that case Unsubscribe will just delete the
-  // app identifier to block future messages.
-  // TODO(johnme): Auto-unregister before SW DB is cleared
-  // (https://crbug.com/402458).

[Peter Beverloo, 2016/04/21 13:26:19]

Now that we no longer rely on the sender_id I think this will actually enable us
to do something sensible in response to
ServiceWorkerContextObserver::OnRegistrationDeleted() and
ServiceWorkerContextObserver::OnStorageWiped() \o/

[johnme, 2016/05/25 14:11:51]

Yup - the future is bright! Though unfortunately, we still need the sender_id to
unsubscribe legacy GCM registrations on Android, so this isn't quite as simple.

-  Unsubscribe(app_identifier.app_id(), sender_id,
+  Unsubscribe(app_identifier.app_id(),
               base::Bind(&UnregisterCallbackToClosure, barrier_closure));
 
   // Clear the associated service worker push registration id.
@@ -781,3 +755,12 @@ gcm::GCMDriver* PushMessagingServiceImpl::GetGCMDriver() const {
   CHECK(gcm_profile_service->driver());
   return gcm_profile_service->driver();
 }
+
+instance_id::InstanceIDDriver* PushMessagingServiceImpl::GetInstanceIDDriver()
+    const {
+  instance_id::InstanceIDProfileService* instance_id_profile_service =
+      instance_id::InstanceIDProfileServiceFactory::GetForProfile(profile_);
+  CHECK(instance_id_profile_service);
+  CHECK(instance_id_profile_service->driver());
+  return instance_id_profile_service->driver();
+}