Add policy provider that would filter extensions/apps allowed on the

chrome/browser/chromeos/extensions/signin_screen_policy_provider.h

Index: chrome/browser/chromeos/extensions/signin_screen_policy_provider.h
diff --git a/chrome/browser/chromeos/extensions/signin_screen_policy_provider.h b/chrome/browser/chromeos/extensions/signin_screen_policy_provider.h
new file mode 100644
index 0000000000000000000000000000000000000000..84c016034da7677695453bb6137a80dd2770030c
--- /dev/null
+++ b/chrome/browser/chromeos/extensions/signin_screen_policy_provider.h
@@ -0,0 +1,48 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_CHROMEOS_EXTENSIONS_SIGNIN_SCREEN_POLICY_PROVIDER_H_
+#define CHROME_BROWSER_CHROMEOS_EXTENSIONS_SIGNIN_SCREEN_POLICY_PROVIDER_H_
+
+#include <string>
+
+#include "base/macros.h"
+#include "base/strings/string16.h"
+#include "extensions/browser/management_policy.h"
+#include "extensions/common/extension.h"
+
+namespace chromeos {
+
+// A managed policy that guards which extensions can be loaded on
+// sign-in screen.
+class SigninScreenPolicyProvider
+    : public extensions::ManagementPolicy::Provider {
+ public:
+  SigninScreenPolicyProvider();
+  ~SigninScreenPolicyProvider() override;
+
+  // extensions::ManagementPolicy::Provider:
+  std::string GetDebugPolicyProviderName() const override;
+  bool UserMayLoad(const extensions::Extension* extension,
+                   base::string16* error) const override;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(SigninScreenPolicyProvider);
+};
+
+// Allows to bypass SigninScreenPolicyProvider checks. Use for tests.
+class ScopedSigninScreenPolicyProviderDisabler {

[emaxx, 2016/11/11 16:11:37]

Can this be suffixed with "ForTesting", to ensure that it won't be used for
anything outside tests? Or there's no such hook for the whole classes?

[Devlin, 2016/11/11 16:35:08]

Drive by - we could also just have a method that returns a base::AutoReset<bool>
here, i.e.
base::AutoReset<bool> GetScopedSigninScreenPolicyProviderDisabler() {
  return base::AutoReset<bool>(&g_bypass_checks_for_testing, true);
}

[Denis Kuznetsov (DE-MUC), 2016/11/11 21:26:33]

Done.

+ public:
+  ScopedSigninScreenPolicyProviderDisabler();
+  ~ScopedSigninScreenPolicyProviderDisabler();
+
+ private:
+  bool original_flag_;
+
+  DISALLOW_COPY_AND_ASSIGN(ScopedSigninScreenPolicyProviderDisabler);
+};
+
+}  // namespace chromeos
+
+#endif  // CHROME_BROWSER_CHROMEOS_EXTENSIONS_SIGNIN_SCREEN_POLICY_PROVIDER_H_