Public Session whitelisting - updated comments for app.window.*

chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.h"
 
 #include <stddef.h>
 
 #include <cstddef>
 #include <string>
@@ skipping 372 matching lines @@
 
     // Allows access to web contents in response to user gesture. Note that this
     // doesn't trigger a permission warning on install though, so blocking is
     // somewhat at odds with the spirit of the API - however I presume the API
     // design assumes user-installed extensions, which we don't have here.
     // "activeTab",
 
     // Schedule code to run at future times.
     "alarms",
 
-    // Allow, but keep PS UX on top regardless.
-    // "app.window.alwaysOnTop",
+    // PS UX can always be seen, this one doesn't go over it so it's fine.
+    "app.window.alwaysOnTop",
 
-    // TODO(isandrk): The following permissions need to be adjusted
-    // (crbug/651071).
-    // Fullscreen is a no-op for Public Session.  Whitelisting nevertheless to
-    // broaden the range of supported apps.  (The recommended permission names
-    // are "app.window.*" but their unprefixed counterparts are still
-    // supported.)
+    // Fullscreen is crippled in Public Sessions, maximizes instead, so both
+    // fullscreen and overrideEsc are safe for use in PS. (The recommended
+    // permission names are "app.window.*" but their unprefixed counterparts are
+    // still supported.)
     "app.window.fullscreen",
     "app.window.fullscreen.overrideEsc",
     "fullscreen",
     "overrideEscFullscreen",
 
     "app.window.shape",
 
     // The embedded app is subject to the restrictions as well obviously.
     "appview",
 
@@ skipping 519 matching lines @@
   if (error) {
     *error = l10n_util::GetStringFUTF16(
           IDS_EXTENSION_CANT_INSTALL_IN_DEVICE_LOCAL_ACCOUNT,
           base::UTF8ToUTF16(extension->name()),
           base::UTF8ToUTF16(extension->id()));
   }
   return false;
 }
 
 }  // namespace chromeos