Add timeout for SAML webcam logins

chrome/browser/resources/chromeos/login/screen_gaia_signin.js

Index: chrome/browser/resources/chromeos/login/screen_gaia_signin.js
diff --git a/chrome/browser/resources/chromeos/login/screen_gaia_signin.js b/chrome/browser/resources/chromeos/login/screen_gaia_signin.js
index 4c60e44b4aca827fd883bf3c6446e6444c260618..c607412ba7c5df50a005b4537413bcdc47dbe042 100644
--- a/chrome/browser/resources/chromeos/login/screen_gaia_signin.js
+++ b/chrome/browser/resources/chromeos/login/screen_gaia_signin.js
@@ -27,6 +27,11 @@ login.createScreen('GaiaSigninScreen', 'gaia-signin', function() {
   // online.
   /** @const */ var IDLE_TIME_CHECK_FREQUENCY = 5 * 1000;
 
+  // Amount of time allowed for video based SAML logins, to prevent a site
+  // from keeping the camera on indefinitely.  This is a hard deadline and
+  // it will not be extended by user activity.
+  /** @const */ var VIDEO_LOGIN_TIMEOUT = 60 * 1000;

[emaxx, 2016/05/18 01:14:53]

According to http://crbug.com/606979#c8, the timeout should be 180 seconds.

[Kevin Cernekee, 2016/05/18 20:38:09]

Done.

+
   /**
    * The modes this screen can be in.
    * @enum {integer}
@@ -82,6 +87,13 @@ login.createScreen('GaiaSigninScreen', 'gaia-signin', function() {
     loadAnimationGuardTimer_: undefined,
 
     /**
+     * Timer id of the video login timer.
+     * @type {number}
+     * @private
+     */
+    videoTimer_: undefined,
+
+    /**
      * Whether we've processed 'showView' message - either from GAIA or from
      * guard timer.
      * @type {boolean}
@@ -635,6 +647,10 @@ login.createScreen('GaiaSigninScreen', 'gaia-signin', function() {
      */
     onVideoEnabledChange_: function() {
       this.updateSamlNotice_();
+      if (this.gaiaAuthHost_.videoEnabled && this.videoTimer_ === undefined) {
+        this.videoTimer_ = setTimeout(this.cancel.bind(this),
+            VIDEO_LOGIN_TIMEOUT);
+      }

[emaxx, 2016/05/18 01:14:53]

I guess that, as an effect of the Authenticator.resetStates_ method, the
videoEnabled flag may change back from true to false here. The cancel method
below may cover all such possible cases, but it's quite difficult to track down
all possible execution flows.
So I would suggest, being on the safe side, to add here a branch with clearing
the timeout when the video is not enabled (and +1 to separating the timer
stopping operation into another method).

[Kevin Cernekee, 2016/05/18 20:38:09]

Done.

     },
 
     /**
@@ -855,6 +871,11 @@ login.createScreen('GaiaSigninScreen', 'gaia-signin', function() {
       // Clear any error messages that were shown before login.
       Oobe.clearErrors();
 
+      if (this.videoTimer_ !== undefined) {

[achuithb, 2016/05/17 23:38:38]

Maybe add a method like clearVideoTimer()?

[Kevin Cernekee, 2016/05/18 20:38:09]

Done.

+        clearTimeout(this.videoTimer_);
+        this.videoTimer_ = undefined;
+      }
+
       this.authCompleted_ = true;
       this.updateControlsState();
     },
@@ -951,6 +972,11 @@ login.createScreen('GaiaSigninScreen', 'gaia-signin', function() {
       if (!this.navigation_.refreshVisible && !this.navigation_.closeVisible)
         return;
 
+      if (this.videoTimer_ !== undefined) {

[emaxx, 2016/05/18 01:30:17]

Shouldn't this be moved to the top of the function?
Because currently it may happen that the video timer fires, but its id stored in
the videoTimer_ member is not cleared here because of the above code; this would
result in ignoring all new attempts to set up a video timer.

[Kevin Cernekee, 2016/05/18 20:38:09]

Done.

+        clearTimeout(this.videoTimer_);
+        this.videoTimer_ = undefined;
+      }
+
       if (this.closable)
         Oobe.showUserPods();
       else