Plumbing for login apps device policy to extensions.

chrome/browser/extensions/chrome_process_manager_delegate.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/chrome_process_manager_delegate.h"
 
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "build/build_config.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/chrome_notification_types.h"
+#include "chrome/browser/extensions/extension_management.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/profiles/profile_manager.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_finder.h"
 #include "chrome/common/chrome_switches.h"
 #include "components/user_manager/user_manager.h"
 #include "content/public/browser/notification_service.h"
 #include "extensions/browser/extension_system.h"
 #include "extensions/browser/process_manager.h"
 #include "extensions/browser/process_manager_factory.h"
 #include "extensions/common/one_shot_event.h"
 
+#if defined(OS_CHROMEOS)
+#include "chrome/browser/chromeos/profiles/profile_helper.h"
+#endif
+
 namespace extensions {
 
 ChromeProcessManagerDelegate::ChromeProcessManagerDelegate() {
   registrar_.Add(this,
                  chrome::NOTIFICATION_BROWSER_WINDOW_READY,
                  content::NotificationService::AllSources());
   registrar_.Add(this,
                  chrome::NOTIFICATION_PROFILE_CREATED,
                  content::NotificationService::AllSources());
   registrar_.Add(this,
                  chrome::NOTIFICATION_PROFILE_DESTROYED,
                  content::NotificationService::AllSources());
 }
 
 ChromeProcessManagerDelegate::~ChromeProcessManagerDelegate() {
 }
 
 bool ChromeProcessManagerDelegate::IsBackgroundPageAllowed(
     content::BrowserContext* context) const {
   Profile* profile = static_cast<Profile*>(context);
 
   bool is_normal_session = !profile->IsGuestSession() &&
                            !profile->IsSystemProfile();
+  bool allow_for_signin_profile = false;
+
 #if defined(OS_CHROMEOS)
-  is_normal_session = is_normal_session &&
-                      user_manager::UserManager::Get()->IsUserLoggedIn();
+  if (is_normal_session) {
+    const bool user_logged_in =
+        user_manager::UserManager::Get()->IsUserLoggedIn();
+    is_normal_session = user_logged_in;
+
+    const bool is_signin_profile =
+        chromeos::ProfileHelper::IsSigninProfile(profile);
+    const bool signin_apps_enabled =
+        base::CommandLine::ForCurrentProcess()->HasSwitch(
+            switches::kEnableSigninApps);
+    const bool signin_apps_installed =
+        !ExtensionManagementFactory::GetForBrowserContext(context)
+             ->GetForceInstallList()
+             ->empty();
+
+    allow_for_signin_profile =
+        is_signin_profile && signin_apps_enabled && signin_apps_installed;
+  }
 #endif
 
   // Disallow if the current session is a Guest mode session or login screen but
   // the current browser context is *not* off-the-record. Such context is
   // artificial and background page shouldn't be created in it.
   // http://crbug.com/329498
-  return is_normal_session || profile->IsOffTheRecord();
+  return is_normal_session || profile->IsOffTheRecord() ||
+         allow_for_signin_profile;

[emaxx, 2016/11/10 15:03:44]

I think there's still something wrong with this expression.

Suppose this is called for sign-in profile after the user has logged in, i.e.:
1. profile->IsGuestSession()==false;
2. profile->IsSystemProfile()==false;
3. UserManager->IsUserLoggedIn()==true;
4. IsSigninProfile(profile)==true.
Then we have is_normal_session evaluated to true in line #52, re-assigned to
true in line #58, and therefore the whole IsBackgroundPageAllowed method will
return true regardless of the value of allow_for_signin_profile.


I understand you intention to write the integration tests after all critical
pieces land, but I think that this CL would benefit a lot from having tests at
least for critical pieces like this.

 }
 
 bool ChromeProcessManagerDelegate::DeferCreatingStartupBackgroundHosts(
     content::BrowserContext* context) const {
   Profile* profile = static_cast<Profile*>(context);
 
   // The profile may not be valid yet if it is still being initialized.
   // In that case, defer loading, since it depends on an initialized profile.
   // Background hosts will be loaded later via NOTIFICATION_PROFILE_CREATED.
   // http://crbug.com/222473
@@ skipping 97 matching lines @@
     ProcessManager* incognito_manager =
         ProcessManagerFactory::GetForBrowserContextIfExists(
             profile->GetOffTheRecordProfile());
     if (incognito_manager) {
       incognito_manager->CloseBackgroundHosts();
     }
   }
 }
 
 }  // namespace extensions