MD Settings: Certificate manager, respect export/edit/delete restrictions.

chrome/browser/resources/settings/certificate_manager_page/certificate_subentry.js

Index: chrome/browser/resources/settings/certificate_manager_page/certificate_subentry.js
diff --git a/chrome/browser/resources/settings/certificate_manager_page/certificate_subentry.js b/chrome/browser/resources/settings/certificate_manager_page/certificate_subentry.js
index 934a2242edb4eed963f4841afa5624d80bfd40fe..9405f103a9477c1aa5cbc8e391a508ef950950c4 100644
--- a/chrome/browser/resources/settings/certificate_manager_page/certificate_subentry.js
+++ b/chrome/browser/resources/settings/certificate_manager_page/certificate_subentry.js
@@ -141,12 +141,35 @@ Polymer({
   },
 
   /**
-   * @param {string} certificateType The type of this certificate.
+   * @param {!settings.CertificateType} certificateType
+   * @param {!CertificateSubnode} model
    * @return {boolean} Whether the certificate can be edited.
    * @private
    */
-  canEdit_: function(certificateType) {
-    return this.certificateType == settings.CertificateType.CA;
+  canEdit_: function(certificateType, model) {
+    return certificateType == settings.CertificateType.CA && !model.policy;
+  },
+
+  /**
+   * @param {!settings.CertificateType} certificateType
+   * @param {!CertificateSubnode} model
+   * @return {boolean} Whether the certificate can be exported.
+   * @private
+   */
+  canExport_: function(certificateType, model) {
+    if (certificateType == settings.CertificateType.PERSONAL) {
+      return model.extractable;
+    }
+    return true;
+  },
+
+  /**
+   * @param {!CertificateSubnode} model
+   * @return {boolean} Whether the certificate can be deleted.
+   * @private
+   */
+  canDelete_: function(model) {
+    return !model.readonly && !model.policy;
   },
 
   /** @private */