Add a new app API to enable watchdog behavior restarts in kiosk apps

extensions/browser/api/runtime/runtime_api.cc

Index: extensions/browser/api/runtime/runtime_api.cc
diff --git a/extensions/browser/api/runtime/runtime_api.cc b/extensions/browser/api/runtime/runtime_api.cc
index e62805e674289632f33a1786b7a89eac8b06d478..2e1232de39df6bd996c0a527529f5ec90d7f7cbb 100644
--- a/extensions/browser/api/runtime/runtime_api.cc
+++ b/extensions/browser/api/runtime/runtime_api.cc
@@ -10,6 +10,7 @@
 #include "base/lazy_instance.h"
 #include "base/logging.h"
 #include "base/metrics/histogram.h"
+#include "base/strings/string_number_conversions.h"
 #include "base/values.h"
 #include "base/version.h"
 #include "content/public/browser/browser_context.h"
@@ -28,6 +29,7 @@
 #include "extensions/browser/lazy_background_task_queue.h"
 #include "extensions/browser/notification_types.h"
 #include "extensions/browser/process_manager_factory.h"
+#include "extensions/browser/state_store.h"
 #include "extensions/common/api/runtime.h"
 #include "extensions/common/error_utils.h"
 #include "extensions/common/extension.h"
@@ -76,6 +78,11 @@ const char kPrefPreviousVersion[] = "previous_version";
 // with the equivalent Pepper API.
 const char kPackageDirectoryPath[] = "crxfs";
 
+// Preference key for storing the last successful restart on watchdog requests.
+const char kPrefRestartOnWatchdogTime[] = "last_restart_on_watchdog_time";
+
+const int kMinDurationBetweenSuccessiveRestartsHours = 3;
+
 void DispatchOnStartupEventImpl(BrowserContext* browser_context,
                                 const std::string& extension_id,
                                 bool first_call,
@@ -156,7 +163,10 @@ RuntimeAPI::RuntimeAPI(content::BrowserContext* context)
     : browser_context_(context),
       dispatch_chrome_updated_event_(false),
       extension_registry_observer_(this),
-      process_manager_observer_(this) {
+      process_manager_observer_(this),
+      minimum_duration_between_restarts_(base::TimeDelta::FromHours(
+          kMinDurationBetweenSuccessiveRestartsHours)),
+      weak_ptr_factory_(this) {
   // RuntimeAPI is redirected in incognito, so |browser_context_| is never
   // incognito.
   DCHECK(!browser_context_->IsOffTheRecord());
@@ -321,10 +331,116 @@ bool RuntimeAPI::RestartDevice(std::string* error_message) {
   return delegate_->RestartDevice(error_message);
 }
 
+void RuntimeAPI::RestartDeviceOnWatchdogTimeout(
+    const std::string& extension_id,
+    int seconds_from_now,
+    const OnWatchdogTimeoutCallback& callback) {
+  // To achieve as much accuracy as possible, record the time of the call as
+  // |now| here.
+  base::Time now = base::Time::NowFromSystemTime();

[xiyuan, 2016/05/16 18:25:17]

nit: const base::Time

[afakhry, 2016/05/17 18:38:31]

Done.

+
+  if (schedule_restart_first_extension_id_.empty()) {
+    schedule_restart_first_extension_id_ = extension_id;
+  } else if (extension_id != schedule_restart_first_extension_id_) {
+    // We only allow the first extension to call this API to call it repeatedly.
+    // Any other extension will fail.
+    callback.Run(false, "Error: Not the first extension to call this API.");
+    return;
+  }
+
+  if (seconds_from_now == -1) {
+    MaybeCancelRunningWatchdogTimer();
+    callback.Run(true, "No more restarts are scheduled.");
+    return;
+  }
+
+  // Try to read any previously recorded restart request time.
+  StateStore* storage = ExtensionSystem::Get(browser_context_)->state_store();
+  if (storage) {
+    storage->GetExtensionValue(
+        extension_id, kPrefRestartOnWatchdogTime,
+        base::Bind(&RuntimeAPI::ScheduleDelayedRestart,
+                   weak_ptr_factory_.GetWeakPtr(), extension_id, now,
+                   seconds_from_now, callback));
+    return;
+  }
+
+  std::unique_ptr<base::Value> stored_last_restart(
+      new base::FundamentalValue(0.0));
+  ScheduleDelayedRestart(extension_id, now, seconds_from_now, callback,
+                         std::move(stored_last_restart));
+}
+
 bool RuntimeAPI::OpenOptionsPage(const Extension* extension) {
   return delegate_->OpenOptionsPage(extension);
 }
 
+void RuntimeAPI::MaybeCancelRunningWatchdogTimer() {
+  if (!watchdog_timer_.IsRunning())
+    return;
+
+  if (!current_watchdog_request_callback_.is_null()) {
+    current_watchdog_request_callback_.Run(false,
+                                           "Restart request was cancelled.");
+    current_watchdog_request_callback_.Reset();
+  }
+}
+
+void RuntimeAPI::ScheduleDelayedRestart(
+    const std::string& extension_id,
+    const base::Time& now,
+    int seconds_from_now,

[xiyuan, 2016/05/16 18:25:17]

nit: slightly prefer to combine |now| and |seconds_from_now| into one
base::Time, say restart_time.

[afakhry, 2016/05/17 18:38:31]

I think this might add a bit of redundancy, since passing |restart_time| to
ScheduleDelayedRestart() will make me need to do the following in the caller:

base::Time restart_time = 
    base::Time::NowFromSystemTime() +
    base::TimeDelta::FromSeconds(seconds_from_now);

Then do the opposite operation in ScheduleDelayedRestart():

base::Time now = base::Time::NowFromSystemTime();
base::TimeDelta delay_till_restart = restart_time - now;

also the above |now| is slightly later than the actual now when the API was
invoked.

I prefer to leave it the way it is, unless of course you see otherwise.

+    const OnWatchdogTimeoutCallback& callback,
+    std::unique_ptr<base::Value> stored_last_restart) {
+  base::TimeDelta delay_till_restart =
+      base::TimeDelta::FromSeconds(seconds_from_now);
+
+  // Read the last restart  time, and throttle restart requests that are
+  // received too soon successively.
+  double last_restart_time_double = 0.0;
+  if (stored_last_restart &&
+      stored_last_restart->GetAsDouble(&last_restart_time_double)) {
+    base::Time last_restart_time =
+        base::Time::FromDoubleT(last_restart_time_double);
+
+    base::Time future_restart_time = now + delay_till_restart;
+    base::TimeDelta future_time_since_last_restart =
+        future_restart_time - last_restart_time;

[xiyuan, 2016/05/16 18:25:17]

nit: future_restart_time > last_restart_time ? 
  future_restart_time - last_restart_time : base::TimeDelta();

Just in case the wall clock on the device has changed between reboots and makes
|last_restart_time| in the future.

[afakhry, 2016/05/17 18:38:31]

Done.

+    if (future_time_since_last_restart < minimum_duration_between_restarts_) {
+      // Schedule the restart after |minimum_duration_between_restarts_| has
+      // passed.
+      delay_till_restart =
+          minimum_duration_between_restarts_ - (now - last_restart_time);
+    }
+  }
+
+  MaybeCancelRunningWatchdogTimer();
+  current_watchdog_request_callback_ = callback;
+  watchdog_timer_.Start(FROM_HERE, delay_till_restart,
+                        base::Bind(&RuntimeAPI::OnRestartWatchdogTimeout,
+                                   base::Unretained(this), extension_id));

[xiyuan, 2016/05/16 18:25:17]

nit: replace base::Unretained with weak_ptr_factory_.GetWeakPtr() since we have
it now.

[afakhry, 2016/05/17 18:38:31]

Done.

+}
+
+void RuntimeAPI::OnRestartWatchdogTimeout(const std::string& extension_id) {
+  std::string error_message;
+  const bool success = delegate_->RestartDevice(&error_message);
+
+  current_watchdog_request_callback_.Run(success, error_message);
+  current_watchdog_request_callback_.Reset();
+
+  if (success) {
+    // Store |now| as the last successful restart request time.
+    StateStore* storage = ExtensionSystem::Get(browser_context_)->state_store();
+    if (storage) {
+      base::Time now = base::Time::NowFromSystemTime();
+      std::unique_ptr<base::Value> restart_time(
+          new base::FundamentalValue(now.ToDoubleT()));
+      storage->SetExtensionValue(extension_id, kPrefRestartOnWatchdogTime,

[xiyuan, 2016/05/16 18:25:17]

We might want to make this happen before attempting to reboot. Chrome only has 3
seconds or so time and the worry is that it is not enough to persist the data to
disk.

[afakhry, 2016/05/17 18:38:31]

Done. 
My concern was, I didn't want to store "now" unless I make sure that request is
successful. Now that we prevent non-kiosk apps from calling this API from the
beginning (and this is the only way the request can fail),then it's ok to assume
that the request will always be successful.

I added a NOTREACHED() if our assumption is broken.

+                                 std::move(restart_time));
+    }
+  }
+}
+
 ///////////////////////////////////////////////////////////////////////////////
 
 // static
@@ -551,6 +667,40 @@ ExtensionFunction::ResponseAction RuntimeRestartFunction::Run() {
   return RespondNow(NoArguments());
 }
 
+ExtensionFunction::ResponseAction RuntimeRestartOnWatchdogFunction::Run() {
+  std::unique_ptr<api::runtime::RestartOnWatchdog::Params> params(
+      api::runtime::RestartOnWatchdog::Params::Create(*args_));
+  EXTENSION_FUNCTION_VALIDATE(params.get());
+
+  // TODO(afakhry): Handle non-kiost apps.
+
+  int seconds = params->seconds;
+
+  if (seconds < -1) {
+    return RespondNow(
+        Error("Invalid argument: *.", base::IntToString(seconds)));
+  }
+
+  RuntimeAPI::GetFactoryInstance()
+      ->Get(browser_context())
+      ->RestartDeviceOnWatchdogTimeout(
+          extension()->id(), seconds,
+          base::Bind(&RuntimeRestartOnWatchdogFunction::OnWatchdogTimeout,
+                     this));
+
+  return RespondLater();

[xiyuan, 2016/05/16 18:25:17]

RestartDeviceOnWatchdogTimeout() might call Response() synchronously (e.g. on
error). And we should not call this for such cases.

[afakhry, 2016/05/17 18:38:31]

Done!
Thanks for catching that. I made RestartDeviceOnWatchdogTimeout() return a
status enum |RestartOnWatchdogStatus|, based on which we either RespondNow() or
RespondLater().

+}
+
+void RuntimeRestartOnWatchdogFunction::OnWatchdogTimeout(
+    bool success,
+    const std::string& message) {
+  if (!success)
+    WriteToConsole(content::CONSOLE_MESSAGE_LEVEL_ERROR, message);
+
+  Respond(ArgumentList(
+      api::runtime::RestartOnWatchdog::Results::Create(success, message)));
+}
+
 ExtensionFunction::ResponseAction RuntimeGetPlatformInfoFunction::Run() {
   runtime::PlatformInfo info;
   if (!RuntimeAPI::GetFactoryInstance()