Add policy provider that would filter extensions/apps allowed on the

chrome/browser/chromeos/extensions/signin_screen_policy_provider_unittest.cc

+// Copyright 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/memory/ref_counted.h"
+#include "base/strings/utf_string_conversions.h"
+#include "chrome/browser/chromeos/extensions/signin_screen_policy_provider.h"
+#include "components/version_info/version_info.h"
+#include "extensions/common/extension_builder.h"
+#include "extensions/common/features/feature_channel.h"
+#include "extensions/common/features/feature_session_type.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+using extensions::Extension;
+
+namespace {
+
+scoped_refptr<extensions::Extension> CreateTestApp(
+    const std::string& extension_id,
+    extensions::Manifest::Location location) {
+  return extensions::ExtensionBuilder()
+      .SetManifest(
+          extensions::DictionaryBuilder()
+              .Set("name", "test app")
+              .Set("version", "1")
+              .Set("manifest_version", 2)
+              .Set("app",
+                   extensions::DictionaryBuilder()
+                       .Set("background",
+                            extensions::DictionaryBuilder()
+                                .Set("persistent", "false")
+                                .Set("scripts", extensions::ListBuilder()
+                                                    .Append("background.js")
+                                                    .Build())
+                                .Build())
+                       .Build())
+              .Set("storage",
+                   extensions::DictionaryBuilder()
+                       .Set("managed_schema", "managed_storage_schema.json")
+                       .Build())
+              .Set("permissions", extensions::ListBuilder()
+                                      .Append("usb")
+                                      .Append("alwaysOnTopWindows")
+                                      .Build())
+              .Build())
+      .SetID(extension_id)
+      .SetLocation(location)
+      .Build();
+}
+
+}  // namespace
+
+class SigninScreenPolicyProviderTest : public testing::Test {
+ protected:
+  chromeos::SigninScreenPolicyProvider provider_;
+};
+
+TEST_F(SigninScreenPolicyProviderTest, AllowPolicyExtensionOnDev) {

[achuithb, 2016/11/11 00:36:28]

Let's add some descriptive comments to each of these tests

[Denis Kuznetsov (DE-MUC), 2016/11/11 15:50:17]

Done.

+  extensions::ScopedCurrentChannel channel(version_info::Channel::DEV);
+  scoped_refptr<extensions::Extension> extension =
+      CreateTestApp("abacabadabacabaeabacabadabacabaf",
+                    extensions::Manifest::Location::EXTERNAL_POLICY);
+  base::string16 error;
+  EXPECT_TRUE(provider_.UserMayLoad(extension.get(), &error));
+  EXPECT_TRUE(error.empty());
+}
+
+TEST_F(SigninScreenPolicyProviderTest, DenyRandomPolicyExtensionOnStable) {
+  extensions::ScopedCurrentChannel channel(version_info::Channel::STABLE);
+  scoped_refptr<extensions::Extension> extension =
+      CreateTestApp("abacabadabacabaeabacabadabacabaf",
+                    extensions::Manifest::Location::EXTERNAL_POLICY);
+  base::string16 error;
+  EXPECT_FALSE(provider_.UserMayLoad(extension.get(), &error));
+  EXPECT_FALSE(error.empty());
+}
+
+TEST_F(SigninScreenPolicyProviderTest, AllowEssentialExtensionOnStable) {
+  extensions::ScopedCurrentChannel channel(version_info::Channel::STABLE);
+  scoped_refptr<extensions::Extension> extension =
+      CreateTestApp("beknehfpfkghjoafdifaflglpjkojoco" /* gnubby */,

[achuithb, 2016/11/11 00:36:28]

maybe pull these constants out and name them?

[Denis Kuznetsov (DE-MUC), 2016/11/11 15:50:16]

Done.

+                    extensions::Manifest::Location::EXTERNAL_COMPONENT);
+  base::string16 error;
+  EXPECT_TRUE(provider_.UserMayLoad(extension.get(), &error));
+  EXPECT_TRUE(error.empty());
+}
+
+TEST_F(SigninScreenPolicyProviderTest,
+       AllowWhitelistedExtensionViaPolicyOnStable) {
+  extensions::ScopedCurrentChannel channel(version_info::Channel::STABLE);
+  scoped_refptr<extensions::Extension> extension = CreateTestApp(
+      "khpfeaanjngmcnplbdlpegiifgpfgdco" /* smart card connector */,

[achuithb, 2016/11/11 00:36:28]

ditto

[Denis Kuznetsov (DE-MUC), 2016/11/11 15:50:17]

Done.

+      extensions::Manifest::Location::EXTERNAL_POLICY);
+  base::string16 error;
+  EXPECT_TRUE(provider_.UserMayLoad(extension.get(), &error));
+  EXPECT_TRUE(error.empty());
+}
+
+TEST_F(SigninScreenPolicyProviderTest,
+       DenyNonPolicyWhitelistedExtensionOnStable) {
+  extensions::ScopedCurrentChannel channel(version_info::Channel::STABLE);
+  scoped_refptr<extensions::Extension> extension = CreateTestApp(
+      "khpfeaanjngmcnplbdlpegiifgpfgdco" /* smart card connector */,
+      extensions::Manifest::Location::EXTERNAL_COMPONENT);
+  base::string16 error;
+  EXPECT_FALSE(provider_.UserMayLoad(extension.get(), &error));
+  EXPECT_FALSE(error.empty());
+}
+
+TEST_F(SigninScreenPolicyProviderTest, DenyRandomNonPolicyExtensionOnDev) {
+  extensions::ScopedCurrentChannel channel(version_info::Channel::DEV);
+  scoped_refptr<extensions::Extension> extension =
+      CreateTestApp("abacabadabacabaeabacabadabacabaf",
+                    extensions::Manifest::Location::EXTERNAL_COMPONENT);
+  base::string16 error;
+  EXPECT_FALSE(provider_.UserMayLoad(extension.get(), &error));
+  EXPECT_FALSE(error.empty());
+}