Add policy domain for signin screen apps

chrome/browser/extensions/api/storage/managed_value_store_cache.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/api/storage/managed_value_store_cache.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/bind_helpers.h"
 #include "base/callback.h"
 #include "base/files/file_util.h"
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
 #include "base/scoped_observer.h"
 #include "chrome/browser/extensions/api/storage/policy_value_store.h"
 #include "chrome/browser/policy/profile_policy_connector.h"
 #include "chrome/browser/policy/profile_policy_connector_factory.h"
 #include "chrome/browser/policy/schema_registry_service.h"
 #include "chrome/browser/policy/schema_registry_service_factory.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/common/extensions/api/storage/storage_schema_manifest_handler.h"
-#include "components/policy/core/common/policy_namespace.h"
 #include "components/policy/core/common/schema.h"
 #include "components/policy/core/common/schema_map.h"
 #include "components/policy/core/common/schema_registry.h"
 #include "content/public/browser/browser_thread.h"
 #include "extensions/browser/extension_prefs.h"
 #include "extensions/browser/extension_registry.h"
 #include "extensions/browser/extension_registry_observer.h"
 #include "extensions/browser/extension_system.h"
 #include "extensions/browser/value_store/value_store_change.h"
 #include "extensions/browser/value_store/value_store_factory.h"
@@ skipping 25 matching lines @@
 }  // namespace
 
 // This helper observes initialization of all the installed extensions and
 // subsequent loads and unloads, and keeps the SchemaRegistry of the Profile
 // in sync with the current list of extensions. This allows the PolicyService
 // to fetch cloud policy for those extensions, and allows its providers to
 // selectively load only extension policy that has users.
 class ManagedValueStoreCache::ExtensionTracker
     : public ExtensionRegistryObserver {
  public:
-  explicit ExtensionTracker(Profile* profile);
+  ExtensionTracker(Profile* profile, policy::PolicyDomain policy_domain);
   ~ExtensionTracker() override {}
 
  private:
   // ExtensionRegistryObserver implementation.
   void OnExtensionWillBeInstalled(content::BrowserContext* browser_context,
                                   const Extension* extension,
                                   bool is_update,
                                   const std::string& old_name) override;
   void OnExtensionUninstalled(content::BrowserContext* browser_context,
                               const Extension* extension,
                               extensions::UninstallReason reason) override;
 
   // Handler for the signal from ExtensionSystem::ready().
   void OnExtensionsReady();
 
   // Starts a schema load for all extensions that use managed storage.
   void LoadSchemas(std::unique_ptr<ExtensionSet> added);
 
   bool UsesManagedStorage(const Extension* extension) const;
 
   // Loads the schemas of the |extensions| and passes a ComponentMap to
   // Register().
   static void LoadSchemasOnBlockingPool(
       std::unique_ptr<ExtensionSet> extensions,
       base::WeakPtr<ExtensionTracker> self);
   void Register(const policy::ComponentMap* components);
 
   Profile* profile_;
+  policy::PolicyDomain policy_domain_;
   ScopedObserver<ExtensionRegistry, ExtensionRegistryObserver>
       extension_registry_observer_;
   policy::SchemaRegistry* schema_registry_;
   base::WeakPtrFactory<ExtensionTracker> weak_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(ExtensionTracker);
 };
 
-ManagedValueStoreCache::ExtensionTracker::ExtensionTracker(Profile* profile)
+ManagedValueStoreCache::ExtensionTracker::ExtensionTracker(
+    Profile* profile,
+    policy::PolicyDomain policy_domain)
     : profile_(profile),
+      policy_domain_(policy_domain),
       extension_registry_observer_(this),
-      schema_registry_(policy::SchemaRegistryServiceFactory::GetForContext(
-                           profile)->registry()),
+      schema_registry_(
+          policy::SchemaRegistryServiceFactory::GetForContext(profile)
+              ->registry()),
       weak_factory_(this) {
   extension_registry_observer_.Add(ExtensionRegistry::Get(profile_));
   // Load schemas when the extension system is ready. It might be ready now.
   ExtensionSystem::Get(profile_)->ready().Post(
       FROM_HERE,
       base::Bind(&ExtensionTracker::OnExtensionsReady,
                  weak_factory_.GetWeakPtr()));
 }
 
 void ManagedValueStoreCache::ExtensionTracker::OnExtensionWillBeInstalled(
@@ skipping 12 matching lines @@
   LoadSchemas(std::move(added));
 }
 
 void ManagedValueStoreCache::ExtensionTracker::OnExtensionUninstalled(
     content::BrowserContext* browser_context,
     const Extension* extension,
     extensions::UninstallReason reason) {
   if (!ExtensionSystem::Get(profile_)->ready().is_signaled())
     return;
   if (extension && UsesManagedStorage(extension)) {
-    schema_registry_->UnregisterComponent(policy::PolicyNamespace(
-        policy::POLICY_DOMAIN_EXTENSIONS, extension->id()));
+    schema_registry_->UnregisterComponent(
+        policy::PolicyNamespace(policy_domain_, extension->id()));
   }
 }
 
 void ManagedValueStoreCache::ExtensionTracker::OnExtensionsReady() {
   // Load schemas for all installed extensions.
   LoadSchemas(
       ExtensionRegistry::Get(profile_)->GenerateInstalledExtensionsSet());
 }
 
 void ManagedValueStoreCache::ExtensionTracker::LoadSchemas(
@@ skipping 51 matching lines @@
   }
 
   BrowserThread::PostTask(BrowserThread::UI, FROM_HERE,
                           base::Bind(&ExtensionTracker::Register, self,
                                      base::Owned(components.release())));
 }
 
 void ManagedValueStoreCache::ExtensionTracker::Register(
     const policy::ComponentMap* components) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  schema_registry_->RegisterComponents(policy::POLICY_DOMAIN_EXTENSIONS,
-                                       *components);
+  schema_registry_->RegisterComponents(policy_domain_, *components);
 
   // The first SetReady() call is performed after the ExtensionSystem is ready,
   // even if there are no managed extensions. It will trigger a loading of the
   // initial policy for any managed extensions, and eventually the PolicyService
-  // will become ready for POLICY_DOMAIN_EXTENSIONS, and
+  // will become ready for policy for extensions, and
   // OnPolicyServiceInitialized() will be invoked.
   // Subsequent calls to SetReady() are ignored.
+  //
+  // Note that instead of using the |policy_domain_| value here, both of the

[Devlin, 2016/10/27 00:50:34]

I'm confused by this, despite the helpful comment. :)

If there is some other cache corresponding to the other policy domain, why can't
we use that?
If there's not, should there be one?
If there shouldn't, can we default no cache to being ready? (100% of the 0
caches are ready. :))

[emaxx, 2016/10/27 13:34:22]

OK, so probably my comment is not clarifying the things well enough... Or maybe
that's because this CL is just a first step in the bigger change and therefore
lacks some context.


Answering your question - there will be only one cache for each profile. For
most of the cases, the cache instance will have
policy_domain_==POLICY_DOMAIN_EXTENSIONS (and therefore behave exactly as before
my changes); and for the signin profile the cache would have
policy_domain_==POLICY_DOMAIN_SIGNIN_EXTENSIONS.


Now the tricky thing that is happening here in lines 237-238 is that _both_ the
old POLICY_DOMAIN_EXTENSIONS and the new POLICY_DOMAIN_SIGNIN_EXTENSIONS domains
are marked as ready. And this is done regardless of the type of the profile.

The explanation for this, which I tried to fit into the new comment, is the
following: a lot of policy-related code depends on the value of
|SchemaRegistry::IsReady|, which returns true only after
|SchemaRegistry::SetReady| was called at least once for each domain. There's no
way to tell to |SchemaRegistry| or its clients "don't wait for readiness of
POLICY_DOMAIN_SIGNIN_EXTENSIONS for the normal user profile" or "don't wait for
readiness of POLICY_DOMAIN_EXTENSIONS for the signing profile". That's why the
only solution I found was calling |SchemaRegistry::SetReady| with both of the
domains here.

[Devlin, 2016/10/27 14:47:33]

Thanks for the explanation.  If this is the only place that will be calling this
with these values, and they must always be called together, could we make a
SetExtensionCachesReady() method or similar on the schema registry that toggles
both these?  That way the logic for the fact that there will only be one and
they should be toggled together is locked in related code, which seems a little
better to me.  WDYT?

[emaxx, 2016/10/27 16:15:48]

Sounds reasonable. I've updated the CL accordingly.

+  // extensions-related policy domains are marked as ready. That's due to
+  // some logic in the policy stack that is depending on the readiness state of
+  // schema registry, which is defined as a logical conjunction of the readiness
+  // state of all policy domains. As there is no other relevant piece in the
+  // code that could set the readiness state of the domain different from
+  // |policy_domain_|, it has to be done here.
   schema_registry_->SetReady(policy::POLICY_DOMAIN_EXTENSIONS);
+  schema_registry_->SetReady(policy::POLICY_DOMAIN_SIGNIN_EXTENSIONS);
 }
 
 ManagedValueStoreCache::ManagedValueStoreCache(
     BrowserContext* context,
     const scoped_refptr<ValueStoreFactory>& factory,
     const scoped_refptr<SettingsObserverList>& observers)
     : profile_(Profile::FromBrowserContext(context)),
+      policy_domain_(policy::POLICY_DOMAIN_EXTENSIONS),
       policy_service_(
           policy::ProfilePolicyConnectorFactory::GetForBrowserContext(context)
               ->policy_service()),
       storage_factory_(factory),
       observers_(observers) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
-  policy_service_->AddObserver(policy::POLICY_DOMAIN_EXTENSIONS, this);
+  policy_service_->AddObserver(policy_domain_, this);
 
-  extension_tracker_.reset(new ExtensionTracker(profile_));
+  extension_tracker_.reset(new ExtensionTracker(profile_, policy_domain_));
 
-  if (policy_service_->IsInitializationComplete(
-          policy::POLICY_DOMAIN_EXTENSIONS)) {
-    OnPolicyServiceInitialized(policy::POLICY_DOMAIN_EXTENSIONS);
-  }
+  if (policy_service_->IsInitializationComplete(policy_domain_))
+    OnPolicyServiceInitialized(policy_domain_);
 }
 
 ManagedValueStoreCache::~ManagedValueStoreCache() {
   DCHECK_CURRENTLY_ON(BrowserThread::FILE);
   // Delete the PolicyValueStores on FILE.
   store_map_.clear();
 }
 
 void ManagedValueStoreCache::ShutdownOnUI() {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
-  policy_service_->RemoveObserver(policy::POLICY_DOMAIN_EXTENSIONS, this);
+  policy_service_->RemoveObserver(policy_domain_, this);
   extension_tracker_.reset();
 }
 
 void ManagedValueStoreCache::RunWithValueStoreForExtension(
     const StorageCallback& callback,
     scoped_refptr<const Extension> extension) {
   DCHECK_CURRENTLY_ON(BrowserThread::FILE);
   callback.Run(GetStoreFor(extension->id()));
 }
 
 void ManagedValueStoreCache::DeleteStorageSoon(
     const std::string& extension_id) {
   DCHECK_CURRENTLY_ON(BrowserThread::FILE);
   // It's possible that the store exists, but hasn't been loaded yet
   // (because the extension is unloaded, for example). Open the database to
   // clear it if it exists.
   if (!HasStore(extension_id))
     return;
   GetStoreFor(extension_id)->DeleteStorage();
   store_map_.erase(extension_id);
 }
 
 void ManagedValueStoreCache::OnPolicyServiceInitialized(
     policy::PolicyDomain domain) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
-  if (domain != policy::POLICY_DOMAIN_EXTENSIONS)
+  if (domain != policy_domain_)
     return;
 
   // The PolicyService now has all the initial policies ready. Send policy
   // for all the managed extensions to their backing stores now.
   policy::SchemaRegistry* registry =
       policy::SchemaRegistryServiceFactory::GetForContext(profile_)->registry();
-  const policy::ComponentMap* map = registry->schema_map()->GetComponents(
-      policy::POLICY_DOMAIN_EXTENSIONS);
+  const policy::ComponentMap* map =
+      registry->schema_map()->GetComponents(policy_domain_);
   if (!map)
     return;
 
   const policy::PolicyMap empty_map;
   for (policy::ComponentMap::const_iterator it = map->begin();
        it != map->end(); ++it) {
-    const policy::PolicyNamespace ns(policy::POLICY_DOMAIN_EXTENSIONS,
-                                     it->first);
+    const policy::PolicyNamespace ns(policy_domain_, it->first);
     // If there is no policy for |ns| then this will clear the previous store,
     // if there is one.
     OnPolicyUpdated(ns, empty_map, policy_service_->GetPolicies(ns));
   }
 }
 
 void ManagedValueStoreCache::OnPolicyUpdated(const policy::PolicyNamespace& ns,
                                              const policy::PolicyMap& previous,
                                              const policy::PolicyMap& current) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
-  if (!policy_service_->IsInitializationComplete(
-           policy::POLICY_DOMAIN_EXTENSIONS)) {
+  if (!policy_service_->IsInitializationComplete(policy_domain_)) {
     // OnPolicyUpdated is called whenever a policy changes, but it doesn't
     // mean that all the policy providers are ready; wait until we get the
     // final policy values before passing them to the store.
     return;
   }
 
   BrowserThread::PostTask(
       BrowserThread::FILE, FROM_HERE,
       base::Bind(&ManagedValueStoreCache::UpdatePolicyOnFILE,
                  base::Unretained(this),
@@ skipping 35 matching lines @@
   return store;
 }
 
 bool ManagedValueStoreCache::HasStore(const std::string& extension_id) const {
   // Note: Currently only manage extensions (not apps).
   return storage_factory_->HasSettings(settings_namespace::MANAGED,
                                        kManagedModelType, extension_id);
 }
 
 }  // namespace extensions