Add DeviceADPolicyManager to provide AD policy.

chrome/browser/chromeos/settings/device_settings_service.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/settings/device_settings_service.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/location.h"
@@ skipping 63 matching lines @@
 
 // static
 DeviceSettingsService* DeviceSettingsService::Get() {
   CHECK(g_device_settings_service);
   return g_device_settings_service;
 }
 
 DeviceSettingsService::DeviceSettingsService()
     : session_manager_client_(NULL),
       store_status_(STORE_SUCCESS),
+      device_mode_(policy::DEVICE_MODE_PENDING),

[emaxx, 2016/11/11 15:25:09]

nit: Move initializers to the class definition?

[Thiemo Nagel, 2016/11/16 19:11:01]

Done.

       load_retries_left_(kMaxLoadRetries),
-      weak_factory_(this) {
-}
+      weak_factory_(this) {}
 
 DeviceSettingsService::~DeviceSettingsService() {
   DCHECK(pending_operations_.empty());
   for (auto& observer : observers_)
     observer.OnDeviceSettingsServiceShutdown();
 }
 
 void DeviceSettingsService::SetSessionManager(
     SessionManagerClient* session_manager_client,
     scoped_refptr<OwnerKeyUtil> owner_key_util) {
@@ skipping 12 matching lines @@
 
 void DeviceSettingsService::UnsetSessionManager() {
   pending_operations_.clear();
 
   if (session_manager_client_)
     session_manager_client_->RemoveObserver(this);
   session_manager_client_ = NULL;
   owner_key_util_ = NULL;
 }
 
+void DeviceSettingsService::SetDeviceMode(policy::DeviceMode device_mode) {
+  device_mode_ = device_mode;

[emaxx, 2016/11/11 15:25:09]

Can we add some DCHECK/CHECK regarding allowed device mode transitions?
For instance, that the device mode can only change when it was
DEVICE_MODE_PENDING.

[Thiemo Nagel, 2016/11/16 19:11:01]

Sounds like a good idea.  Done.

+  RunPendingOwnershipStatusCallbacks();
+}
+
 scoped_refptr<PublicKey> DeviceSettingsService::GetPublicKey() {
   return public_key_;
 }
 
 void DeviceSettingsService::Load() {
   EnqueueLoad(false);
 }
 
 void DeviceSettingsService::Store(
     std::unique_ptr<em::PolicyFetchResponse> policy,
     const base::Closure& callback) {
   Enqueue(linked_ptr<SessionManagerOperation>(new StoreSettingsOperation(
       base::Bind(&DeviceSettingsService::HandleCompletedOperation,
                  weak_factory_.GetWeakPtr(), callback),
       std::move(policy))));
 }
 
 DeviceSettingsService::OwnershipStatus
     DeviceSettingsService::GetOwnershipStatus() {
   if (public_key_.get())
     return public_key_->is_loaded() ? OWNERSHIP_TAKEN : OWNERSHIP_NONE;
+  if (device_mode_ == policy::DEVICE_MODE_ENTERPRISE_AD)
+    return OWNERSHIP_TAKEN;
   return OWNERSHIP_UNKNOWN;
 }
 
 void DeviceSettingsService::GetOwnershipStatusAsync(
     const OwnershipStatusCallback& callback) {
-  if (public_key_.get()) {
-    // If there is a key, report status immediately.
+  if (GetOwnershipStatus() != OWNERSHIP_UNKNOWN) {
+    // Report status immediately.
     base::ThreadTaskRunnerHandle::Get()->PostTask(
         FROM_HERE, base::Bind(callback, GetOwnershipStatus()));
   } else {
     // If the key hasn't been loaded yet, enqueue the callback to be fired when
     // the next SessionManagerOperation completes. If no operation is pending,
     // start a load operation to fetch the key and report the result.
     pending_ownership_status_callbacks_.push_back(callback);
     if (pending_operations_.empty())
       EnqueueLoad(false);
   }
@@ skipping 54 matching lines @@
 }
 
 void DeviceSettingsService::Enqueue(
     const linked_ptr<SessionManagerOperation>& operation) {
   pending_operations_.push_back(operation);
   if (pending_operations_.front().get() == operation.get())
     StartNextOperation();
 }
 
 void DeviceSettingsService::EnqueueLoad(bool force_key_load) {
+  bool verify_signature = true;
+  if (device_mode_ == policy::DEVICE_MODE_ENTERPRISE_AD) {
+    force_key_load = false;

[emaxx, 2016/11/11 15:25:08]

That's a bit unexpected that the "force" value is actually not respected in some
cases.
I'd suggest either to move this condition to the calling place, or to rename the
method argument.

[Thiemo Nagel, 2016/11/16 19:11:01]

I've renamed to "request_key_load" since there are multiple call sites and I
wouldn't want to have the condition at all of them.

+    verify_signature = false;
+  }
   linked_ptr<SessionManagerOperation> operation(new LoadSettingsOperation(
+      force_key_load, verify_signature,
       base::Bind(&DeviceSettingsService::HandleCompletedOperation,
-                 weak_factory_.GetWeakPtr(),
-                 base::Closure())));
-  operation->set_force_key_load(force_key_load);
+                 weak_factory_.GetWeakPtr(), base::Closure())));
   Enqueue(operation);
 }
 
 void DeviceSettingsService::EnsureReload(bool force_key_load) {
   if (!pending_operations_.empty())
     pending_operations_.front()->RestartLoad(force_key_load);
   else
     EnqueueLoad(force_key_load);
 }
 
 void DeviceSettingsService::StartNextOperation() {
   if (!pending_operations_.empty() && session_manager_client_ &&
       owner_key_util_.get()) {
     pending_operations_.front()->Start(
         session_manager_client_, owner_key_util_, public_key_);
   }
 }
 
 void DeviceSettingsService::HandleCompletedOperation(
     const base::Closure& callback,
     SessionManagerOperation* operation,
     Status status) {
   DCHECK_EQ(operation, pending_operations_.front().get());
   store_status_ = status;
 
-  OwnershipStatus ownership_status = OWNERSHIP_UNKNOWN;
   scoped_refptr<PublicKey> new_key(operation->public_key());
-  if (new_key.get()) {

[emaxx, 2016/11/11 15:25:08]

Are these checks for new_key.get() and new_key->is_loaded() not applicable
anymore?

[Thiemo Nagel, 2016/11/16 19:11:01]

RunPendingOwnershipStatusCallbacks() below calls GetOwnershipStatus() which does
the same check on public_key_ which has the same value as new_key.

But I've re-added the NOTREACHED(), it's now a DCHECK().

-    ownership_status = new_key->is_loaded() ? OWNERSHIP_TAKEN : OWNERSHIP_NONE;
-  } else {
-    NOTREACHED() << "Failed to determine key status.";
-  }
-
   bool new_owner_key = false;
   if (public_key_.get() != new_key.get()) {
     public_key_ = new_key;
     new_owner_key = true;
   }
 
   if (status == STORE_SUCCESS) {
     policy_data_ = std::move(operation->policy_data());
     device_settings_ = std::move(operation->device_settings());
     load_retries_left_ = kMaxLoadRetries;
@@ skipping 23 matching lines @@
       observer.OwnershipStatusChanged();
     content::NotificationService::current()->Notify(
         chrome::NOTIFICATION_OWNERSHIP_STATUS_CHANGED,
         content::Source<DeviceSettingsService>(this),
         content::NotificationService::NoDetails());
   }
 
   for (auto& observer : observers_)
     observer.DeviceSettingsUpdated();
 
-  std::vector<OwnershipStatusCallback> callbacks;
-  callbacks.swap(pending_ownership_status_callbacks_);
-  for (std::vector<OwnershipStatusCallback>::iterator iter(callbacks.begin());
-       iter != callbacks.end(); ++iter) {
-    iter->Run(ownership_status);
-  }
+  RunPendingOwnershipStatusCallbacks();
 
   // The completion callback happens after the notification so clients can
   // filter self-triggered updates.
   if (!callback.is_null())
     callback.Run();
 
   // Only remove the pending operation here, so new operations triggered by any
   // of the callbacks above are queued up properly.
   pending_operations_.pop_front();
 
   StartNextOperation();
 }
 
 void DeviceSettingsService::HandleError(Status status,
                                         const base::Closure& callback) {
   store_status_ = status;
 
   LOG(ERROR) << "Session manager operation failed: " << status;
 
   for (auto& observer : observers_)
     observer.DeviceSettingsUpdated();
 
   // The completion callback happens after the notification so clients can
   // filter self-triggered updates.
   if (!callback.is_null())
     callback.Run();
 }
 
+void DeviceSettingsService::RunPendingOwnershipStatusCallbacks() {
+  std::vector<OwnershipStatusCallback> callbacks;
+  callbacks.swap(pending_ownership_status_callbacks_);
+  for (auto& callback : callbacks) {

[emaxx, 2016/11/11 15:25:09]

const auto& should be probably enough.

[Thiemo Nagel, 2016/11/16 19:11:01]

Done.

+    callback.Run(GetOwnershipStatus());
+  }
+}
+
 ScopedTestDeviceSettingsService::ScopedTestDeviceSettingsService() {
   DeviceSettingsService::Initialize();
 }
 
 ScopedTestDeviceSettingsService::~ScopedTestDeviceSettingsService() {
   // Clean pending operations.
   DeviceSettingsService::Get()->UnsetSessionManager();
   DeviceSettingsService::Shutdown();
 }
 
 }  // namespace chromeos