Add timeout for SAML webcam logins

chrome/browser/resources/chromeos/login/screen_gaia_signin.js

Index: chrome/browser/resources/chromeos/login/screen_gaia_signin.js
diff --git a/chrome/browser/resources/chromeos/login/screen_gaia_signin.js b/chrome/browser/resources/chromeos/login/screen_gaia_signin.js
index bec4d6863f1f1f7485c19854a8cf8d7d4503a3ed..7107c4c6460ddb3123252bc4f6ec6c58b821d23c 100644
--- a/chrome/browser/resources/chromeos/login/screen_gaia_signin.js
+++ b/chrome/browser/resources/chromeos/login/screen_gaia_signin.js
@@ -27,6 +27,11 @@ login.createScreen('GaiaSigninScreen', 'gaia-signin', function() {
   // online.
   /** @const */ var IDLE_TIME_CHECK_FREQUENCY = 5 * 1000;
 
+  // Amount of time allowed for video based SAML logins, to prevent a site
+  // from keeping the camera on indefinitely.  This is a hard deadline and
+  // it will not be extended by user activity.
+  /** @const */ var MAX_VIDEO_LOGIN_TIME_SEC = 60;
+
   /**
    * The modes this screen can be in.
    * @enum {integer}
@@ -82,6 +87,13 @@ login.createScreen('GaiaSigninScreen', 'gaia-signin', function() {
     loadAnimationGuardTimer_: undefined,
 
     /**
+     * Timer id of the video login timer.
+     * @type {number}
+     * @private
+     */
+    videoTimer_: undefined,
+
+    /**
      * Whether we've processed 'showView' message - either from GAIA or from
      * guard timer.
      * @type {boolean}
@@ -635,6 +647,10 @@ login.createScreen('GaiaSigninScreen', 'gaia-signin', function() {
      */
     onVideoEnabledChange_: function() {
       this.updateSamlNotice_();
+      if (this.gaiaAuthHost_.videoEnabled && this.videoTimer_ === undefined) {
+        this.videoTimer_ = setTimeout(this.cancel.bind(this),

[Kevin Cernekee, 2016/05/13 20:53:54]

This timer needs to be canceled if the user clicks the "X" button or if login
succeeds.

I can't test the successful login flow right now.  Do you have any thoughts on
where in the code the "cancel timer" logic belongs?  Is onAuthFlowChange a good
candidate?

I've also noticed that manually canceling + restarting the flow does not reset
the videoEnabled flag, but maybe that should be reset elsewhere.

FWIW I am testing all of this by clicking "Add person" on a Chromebook that is
already owned by a test account.  Other flows that probably need to be handled
include:

 - Enterprise login with no default user
 - Enterprise login with "click here for video login" enabled
 - OOBE enrollment - do we care about this?

+            MAX_VIDEO_LOGIN_TIME_SEC * 1000);
+      }
     },
 
     /**