cros: Added policies for screen unlock.

chrome/browser/chromeos/login/quick_unlock/quick_unlock_utils.cc

Index: chrome/browser/chromeos/login/quick_unlock/quick_unlock_utils.cc
diff --git a/chrome/browser/chromeos/login/quick_unlock/quick_unlock_utils.cc b/chrome/browser/chromeos/login/quick_unlock/quick_unlock_utils.cc
index afd4e68382a125618bf15689f464cbf84223e2c3..3beae8927a1fa80f5b903877df4f881b2266fdd4 100644
--- a/chrome/browser/chromeos/login/quick_unlock/quick_unlock_utils.cc
+++ b/chrome/browser/chromeos/login/quick_unlock/quick_unlock_utils.cc
@@ -8,23 +8,43 @@
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/chromeos/policy/browser_policy_connector_chromeos.h"
 #include "chrome/common/chrome_features.h"
+#include "chrome/common/pref_names.h"
+#include "components/prefs/pref_registry_simple.h"
+#include "components/prefs/pref_service.h"
 #include "components/user_manager/user_manager.h"
 
 namespace chromeos {
 
 namespace {
 bool enable_for_testing_ = false;
+// Options for the quick unlock whitelist.
+const char kQuickUnlockWhitelistOptionAll[] = "all";
+const char kQuickUnlockWhitelistOptionPin[] = "PIN";
 }  // namespace
 
-bool IsQuickUnlockEnabled() {
+void RegisterQuickUnlockProfilePrefs(PrefRegistrySimple* registry) {
+  base::ListValue quick_unlock_whitelist_default;
+  quick_unlock_whitelist_default.AppendString(kQuickUnlockWhitelistOptionPin);
+  registry->RegisterListPref(prefs::kQuickUnlockModeWhitelist,
+                             quick_unlock_whitelist_default.DeepCopy());
+  registry->RegisterIntegerPref(
+      prefs::kQuickUnlockTimeout,
+      static_cast<int>(QuickUnlockPasswordConfirmationFrequency::DAY));

[battre, 2016/11/04 10:59:35]

I did not research the context. Please be sure that you are not enabling PIN
unlock by default while the PIN is set to a default value of 0000 on a factory
reset device.

[jdufault, 2016/11/04 21:18:35]

Where are you getting the 0000 default value from?

+}
+
+bool IsPinUnlockEnabled(PrefService* pref_service) {
   if (enable_for_testing_)
     return true;
 
-  // TODO(jdufault): Implement a proper policy check. For now, just disable if
-  // the device is enterprise enrolled. See crbug.com/612271.
-  if (g_browser_process->platform_part()
-          ->browser_policy_connector_chromeos()
-          ->IsEnterpriseManaged()) {
+  // Check if policy allows PIN.
+  const base::ListValue* quick_unlock_whitelist =
+      pref_service->GetList(prefs::kQuickUnlockModeWhitelist);
+  base::StringValue all_value(kQuickUnlockWhitelistOptionAll);
+  base::StringValue pin_value(kQuickUnlockWhitelistOptionPin);
+  if (quick_unlock_whitelist->Find(all_value) ==
+          quick_unlock_whitelist->end() &&
+      quick_unlock_whitelist->Find(pin_value) ==
+          quick_unlock_whitelist->end()) {
     return false;
   }