Expose signing key from cloud policy stores

chrome/browser/chromeos/policy/device_local_account_policy_store.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/policy/device_local_account_policy_store.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/callback.h"
@@ skipping 15 matching lines @@
 
 DeviceLocalAccountPolicyStore::DeviceLocalAccountPolicyStore(
     const std::string& account_id,
     chromeos::SessionManagerClient* session_manager_client,
     chromeos::DeviceSettingsService* device_settings_service,
     scoped_refptr<base::SequencedTaskRunner> background_task_runner)
     : UserCloudPolicyStoreBase(background_task_runner),
       account_id_(account_id),
       session_manager_client_(session_manager_client),
       device_settings_service_(device_settings_service),
-      weak_factory_(this) {}
+      weak_factory_(this) {
+  owning_domain_ = g_browser_process->platform_part()
+                       ->browser_policy_connector_chromeos()
+                       ->GetEnterpriseDomain();
+  device_settings_service_->AddObserver(this);
+  UpdateFromDeviceSettingsService();
+}
 
-DeviceLocalAccountPolicyStore::~DeviceLocalAccountPolicyStore() {}
+DeviceLocalAccountPolicyStore::~DeviceLocalAccountPolicyStore() {
+  device_settings_service_->RemoveObserver(this);
+}
 
 void DeviceLocalAccountPolicyStore::Load() {
   weak_factory_.InvalidateWeakPtrs();
   session_manager_client_->RetrieveDeviceLocalAccountPolicy(
       account_id_,
       base::Bind(&DeviceLocalAccountPolicyStore::ValidateLoadedPolicyBlob,
                  weak_factory_.GetWeakPtr()));
 }
 
 void DeviceLocalAccountPolicyStore::Store(
     const em::PolicyFetchResponse& policy) {
   weak_factory_.InvalidateWeakPtrs();
   CheckKeyAndValidate(
       true, base::MakeUnique<em::PolicyFetchResponse>(policy),
       base::Bind(&DeviceLocalAccountPolicyStore::StoreValidatedPolicy,
                  weak_factory_.GetWeakPtr()));
 }
 
+void DeviceLocalAccountPolicyStore::DeviceSettingsUpdated() {
+  UpdateFromDeviceSettingsService();
+}
+
+void DeviceLocalAccountPolicyStore::UpdateFromDeviceSettingsService() {
+  scoped_refptr<ownership::PublicKey> key =
+      device_settings_service_->GetPublicKey();
+  public_key_ = key ? key->as_string() : std::string();
+}
+
 void DeviceLocalAccountPolicyStore::ValidateLoadedPolicyBlob(
     const std::string& policy_blob) {
   if (policy_blob.empty()) {
     status_ = CloudPolicyStore::STATUS_LOAD_ERROR;
     NotifyStoreError();
   } else {
     std::unique_ptr<em::PolicyFetchResponse> policy(
         new em::PolicyFetchResponse());
     if (policy->ParseFromString(policy_blob)) {
       CheckKeyAndValidate(
@@ skipping 68 matching lines @@
 
 void DeviceLocalAccountPolicyStore::Validate(
     bool valid_timestamp_required,
     std::unique_ptr<em::PolicyFetchResponse> policy_response,
     const UserCloudPolicyValidator::CompletionCallback& callback,
     chromeos::DeviceSettingsService::OwnershipStatus ownership_status) {
   DCHECK_NE(chromeos::DeviceSettingsService::OWNERSHIP_UNKNOWN,
             ownership_status);
   const em::PolicyData* device_policy_data =
       device_settings_service_->policy_data();
-  scoped_refptr<ownership::PublicKey> key =
-      device_settings_service_->GetPublicKey();
-  if (!key.get() || !key->is_loaded() || !device_policy_data) {
+  if (!device_policy_data || public_key_.empty()) {
     status_ = CloudPolicyStore::STATUS_BAD_STATE;
     NotifyStoreLoaded();
     return;
   }
 
   std::unique_ptr<UserCloudPolicyValidator> validator(
       UserCloudPolicyValidator::Create(std::move(policy_response),
                                        background_task_runner()));
   validator->ValidateUsername(account_id_, false);
   validator->ValidatePolicyType(dm_protocol::kChromePublicAccountPolicyType);
@@ skipping 12 matching lines @@
   validator->ValidateDMToken(device_policy_data->request_token(),
                              CloudPolicyValidatorBase::DM_TOKEN_REQUIRED);
 
   // Validate the device id to match what device policy has.
   validator->ValidateDeviceId(device_policy_data->device_id(),
                               CloudPolicyValidatorBase::DEVICE_ID_REQUIRED);
 
   validator->ValidatePayload();
   policy::BrowserPolicyConnectorChromeOS* connector =
       g_browser_process->platform_part()->browser_policy_connector_chromeos();
-  validator->ValidateSignature(key->as_string(),
-                               GetPolicyVerificationKey(),
-                               connector->GetEnterpriseDomain(),
-                               false);
+  validator->ValidateSignature(public_key_, GetPolicyVerificationKey(),
+                               connector->GetEnterpriseDomain(), false);
   validator.release()->StartValidation(callback);
 }
 
 }  // namespace policy