Allow explicitly whitelisted apps/extensions in public sessions

chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.cc

Index: chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.cc
diff --git a/chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.cc b/chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.cc
new file mode 100644
index 0000000000000000000000000000000000000000..5f0f4fae817d4547a66452d6e9510201b75c27fe
--- /dev/null
+++ b/chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.cc
@@ -0,0 +1,70 @@
+// Copyright 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/chromeos/extensions/device_local_account_management_policy_provider.h"
+
+#include <string>
+
+#include "base/logging.h"
+#include "base/strings/utf_string_conversions.h"
+#include "chrome/common/extensions/extension.h"
+#include "extensions/common/manifest.h"
+#include "grit/generated_resources.h"
+#include "ui/base/l10n/l10n_util.h"
+
+namespace chromeos {
+
+namespace {
+
+// Apps/extensions explicitly whitelisted for use in device-local accounts.
+const char* kDeviceLocalAccountWhitelist[] = {
+  "bpmcpldpdmajfigpchkicefoigmkfalc",  // QuickOffice
+};
+
+}  // namespace
+
+DeviceLocalAccountManagementPolicyProvider::
+    DeviceLocalAccountManagementPolicyProvider() {
+}
+
+DeviceLocalAccountManagementPolicyProvider::
+    ~DeviceLocalAccountManagementPolicyProvider() {
+}
+
+std::string DeviceLocalAccountManagementPolicyProvider::
+    GetDebugPolicyProviderName() const {
+#if defined(NDEBUG)
+  NOTREACHED();
+  return std::string();
+#else
+  return "whitelist for device-local accounts";
+#endif
+}
+
+bool DeviceLocalAccountManagementPolicyProvider::UserMayLoad(
+    const extensions::Extension* extension,
+    string16* error) const {
+  // Allow extension if its type is whitelisted for use in device-local
+  // accounts.
+  if (extension->GetType() == extensions::Manifest::TYPE_HOSTED_APP)
+    return true;
+
+  // Allow extension if its specific ID is whitelisted for use in device-local
+  // accounts.
+  for (size_t i = 0; i < arraysize(kDeviceLocalAccountWhitelist); ++i) {
+    if (extension->id() == kDeviceLocalAccountWhitelist[i])
+      return true;
+  }
+
+  // Disallow all other extensions.
+  if (error) {
+    *error = l10n_util::GetStringFUTF16(
+          IDS_EXTENSION_CANT_INSTALL_IN_PUBLIC_SESSION,
+          UTF8ToUTF16(extension->name()),
+          UTF8ToUTF16(extension->id()));
+  }
+  return false;
+}
+
+}  // namespace chromeos