Fix cyclic dependency between ProfilePolicyConnector and PrefService.

chrome/browser/chromeos/policy/network_policy_service.cc

Index: chrome/browser/chromeos/policy/network_policy_service.cc
diff --git a/chrome/browser/chromeos/policy/network_policy_service.cc b/chrome/browser/chromeos/policy/network_policy_service.cc
new file mode 100644
index 0000000000000000000000000000000000000000..b31485738e6568db3a140d57bd35ccf3be6e845e
--- /dev/null
+++ b/chrome/browser/chromeos/policy/network_policy_service.cc
@@ -0,0 +1,89 @@
+// Copyright 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/chromeos/policy/network_policy_service.h"
+
+#include "base/bind.h"
+#include "base/prefs/pref_service.h"
+#include "chrome/browser/browser_process.h"
+#include "chrome/browser/chromeos/login/user.h"
+#include "chrome/browser/chromeos/login/user_manager.h"
+#include "chrome/browser/chromeos/policy/user_network_configuration_updater.h"
+#include "chrome/browser/chromeos/profiles/profile_helper.h"
+#include "chrome/browser/policy/browser_policy_connector.h"
+#include "chrome/common/pref_names.h"
+#include "chromeos/network/network_handler.h"
+#include "chromeos/network/onc/onc_certificate_importer_impl.h"
+
+namespace policy {
+
+NetworkPolicyService::~NetworkPolicyService() {}
+
+NetworkPolicyService::NetworkPolicyService(Profile* profile,
+                                           PolicyService* policy_service)
+    : user_prefs_(profile->GetPrefs()), weak_ptr_factory_(this) {
+  if (chromeos::ProfileHelper::IsSigninProfile(profile))
+    return;
+  chromeos::UserManager* user_manager = chromeos::UserManager::Get();
+  chromeos::User* user = user_manager->GetActiveUser();
+  CHECK(user);
+  std::string username = user->email();
+  bool is_primary_user =
+      chromeos::UserManager::Get()->GetLoggedInUsers().size() == 1;
+  if (!is_primary_user)
+    return;
+
+  BrowserPolicyConnector* connector =
+      g_browser_process->browser_policy_connector();
+  bool allow_trusted_certs_from_policy = false;
+  // Allow trusted certs from policy only for managed regular accounts.

[Mattias Nissler (ping if slow), 2013/09/20 12:35:23]

While at it, can you clarify the comment to say "only for accounts with managed
user affiliation, i.e users that are managed by the same domain as the device."

[pneubeck (no reviews), 2013/10/15 13:23:11]

Done.

+  const bool is_managed =
+      connector->GetUserAffiliation(username) == USER_AFFILIATION_MANAGED;
+  if (is_managed && user->GetType() == chromeos::User::USER_TYPE_REGULAR)
+    allow_trusted_certs_from_policy = true;
+
+  // A reference to |user| is stored by the NetworkConfigurationUpdater until
+  // the Updater is destructed during Shutdown.

[Mattias Nissler (ping if slow), 2013/09/20 12:35:23]

Why? This comment doesn't add any information, just points out the obvious.

[pneubeck (no reviews), 2013/10/15 13:23:11]

It's not obvious whether the returned Updater stores a pointer to |user| or
whether it uses it only during initialization.

I was asked to add this comment in a previous CL. However, I think it's
sufficient to have such documentation in CreateForUserPolicy's  function
comment.

+  network_configuration_updater_ =
+      UserNetworkConfigurationUpdater::CreateForUserPolicy(
+          allow_trusted_certs_from_policy,
+          *user,
+          scoped_ptr<chromeos::onc::CertificateImporter>(
+              new chromeos::onc::CertificateImporterImpl),
+          policy_service,
+          chromeos::NetworkHandler::Get()
+              ->managed_network_configuration_handler());
+}
+
+void NetworkPolicyService::SetPolicyCertVerifier(
+    PolicyCertVerifier* cert_verifier) {
+  if (network_configuration_updater_)
+    network_configuration_updater_->SetPolicyCertVerifier(cert_verifier);
+}
+
+base::Closure NetworkPolicyService::GetPolicyCertTrustedCallback() {
+  return base::Bind(&NetworkPolicyService::SetUsedPolicyCertificatesOnce,
+                    weak_ptr_factory_.GetWeakPtr());
+}
+
+void NetworkPolicyService::GetWebTrustedCertificates(
+    net::CertificateList* certs) const {
+  certs->clear();
+  if (network_configuration_updater_)
+    network_configuration_updater_->GetWebTrustedCertificates(certs);
+}
+
+bool NetworkPolicyService::UsedPolicyCertificates() {
+  return user_prefs_->GetBoolean(prefs::kUsedPolicyCertificatesOnce);
+}
+
+void NetworkPolicyService::SetUsedPolicyCertificatesOnce() {
+  user_prefs_->SetBoolean(prefs::kUsedPolicyCertificatesOnce, true);
+}
+
+void NetworkPolicyService::Shutdown() {
+  network_configuration_updater_.reset();
+}
+
+}  // namespace policy