Do not try to enroll past OOBE/enrollment.

chrome/browser/chromeos/policy/device_cloud_policy_initializer_unittest.cc

Index: chrome/browser/chromeos/policy/device_cloud_policy_initializer_unittest.cc
diff --git a/chrome/browser/chromeos/policy/device_cloud_policy_initializer_unittest.cc b/chrome/browser/chromeos/policy/device_cloud_policy_initializer_unittest.cc
index d4f5206625a30c19acb8c288e5813da41d5b3159..434b6f45b439f928e65b96b60ad219e48851040a 100644
--- a/chrome/browser/chromeos/policy/device_cloud_policy_initializer_unittest.cc
+++ b/chrome/browser/chromeos/policy/device_cloud_policy_initializer_unittest.cc
@@ -24,9 +24,14 @@ namespace policy {
 struct ZeroTouchParam {
   const char* enable_zero_touch_flag;
   EnrollmentConfig::AuthMechanism auth_mechanism;
-
-  ZeroTouchParam(const char* flag, EnrollmentConfig::AuthMechanism auth)
-      : enable_zero_touch_flag(flag), auth_mechanism(auth) {}
+  EnrollmentConfig::AuthMechanism auth_mechanism_after_oobe;
+
+  ZeroTouchParam(const char* flag,
+                 EnrollmentConfig::AuthMechanism auth,
+                 EnrollmentConfig::AuthMechanism auth_after_oobe)
+      : enable_zero_touch_flag(flag),
+        auth_mechanism(auth),
+        auth_mechanism_after_oobe(auth_after_oobe) {}
 };
 
 class DeviceCloudPolicyInitializerTest
@@ -149,7 +154,7 @@ TEST_P(DeviceCloudPolicyInitializerTest,
       device_cloud_policy_initializer_.GetPrescribedEnrollmentConfig();
   EXPECT_EQ(EnrollmentConfig::MODE_NONE, config.mode);
   EXPECT_TRUE(config.management_domain.empty());
-  EXPECT_EQ(GetParam().auth_mechanism, config.auth_mechanism);
+  EXPECT_EQ(GetParam().auth_mechanism_after_oobe, config.auth_mechanism);
 
   // Advertised enrollment gets ignored.
   local_state_.SetBoolean(prefs::kDeviceEnrollmentAutoStart, true);
@@ -158,7 +163,7 @@ TEST_P(DeviceCloudPolicyInitializerTest,
   config = device_cloud_policy_initializer_.GetPrescribedEnrollmentConfig();
   EXPECT_EQ(EnrollmentConfig::MODE_NONE, config.mode);
   EXPECT_TRUE(config.management_domain.empty());
-  EXPECT_EQ(GetParam().auth_mechanism, config.auth_mechanism);
+  EXPECT_EQ(GetParam().auth_mechanism_after_oobe, config.auth_mechanism);
 
   // If the device is enterprise-managed, the management domain gets pulled from
   // install attributes.
@@ -167,14 +172,14 @@ TEST_P(DeviceCloudPolicyInitializerTest,
   config = device_cloud_policy_initializer_.GetPrescribedEnrollmentConfig();
   EXPECT_EQ(EnrollmentConfig::MODE_NONE, config.mode);
   EXPECT_EQ("example.com", config.management_domain);
-  EXPECT_EQ(GetParam().auth_mechanism, config.auth_mechanism);
+  EXPECT_EQ(GetParam().auth_mechanism_after_oobe, config.auth_mechanism);
 
   // If enrollment recovery is on, this is signaled in |config.mode|.
   local_state_.SetBoolean(prefs::kEnrollmentRecoveryRequired, true);
   config = device_cloud_policy_initializer_.GetPrescribedEnrollmentConfig();
   EXPECT_EQ(EnrollmentConfig::MODE_RECOVERY, config.mode);
   EXPECT_EQ("example.com", config.management_domain);
-  EXPECT_EQ(GetParam().auth_mechanism, config.auth_mechanism);
+  EXPECT_EQ(GetParam().auth_mechanism_after_oobe, config.auth_mechanism);
 }
 
 INSTANTIATE_TEST_CASE_P(
@@ -182,10 +187,13 @@ INSTANTIATE_TEST_CASE_P(
     DeviceCloudPolicyInitializerTest,
     ::testing::Values(
         ZeroTouchParam(nullptr,  // No flag set.
+                       EnrollmentConfig::AUTH_MECHANISM_INTERACTIVE,
                        EnrollmentConfig::AUTH_MECHANISM_INTERACTIVE),
         ZeroTouchParam("",  // Flag set without a set value.
-                       EnrollmentConfig::AUTH_MECHANISM_BEST_AVAILABLE),
+                       EnrollmentConfig::AUTH_MECHANISM_BEST_AVAILABLE,
+                       EnrollmentConfig::AUTH_MECHANISM_INTERACTIVE),
         ZeroTouchParam("forced",
+                       EnrollmentConfig::AUTH_MECHANISM_ATTESTATION,
                        EnrollmentConfig::AUTH_MECHANISM_ATTESTATION)));
 
 }  // namespace policy