Expose signing key from cloud policy stores

chrome/browser/chromeos/policy/device_local_account_policy_store.h

Index: chrome/browser/chromeos/policy/device_local_account_policy_store.h
diff --git a/chrome/browser/chromeos/policy/device_local_account_policy_store.h b/chrome/browser/chromeos/policy/device_local_account_policy_store.h
index 63c81ecc959735dbf40778884ecd42d901573cc7..abce20492e9953a553b4fbfa1e2a26995f1b30d3 100644
--- a/chrome/browser/chromeos/policy/device_local_account_policy_store.h
+++ b/chrome/browser/chromeos/policy/device_local_account_policy_store.h
@@ -8,6 +8,7 @@
 #include <memory>
 #include <string>
 
+#include "base/callback.h"
 #include "base/compiler_specific.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
@@ -21,7 +22,6 @@ class SequencedTaskRunner;
 }
 
 namespace chromeos {
-class DeviceSettingsService;
 class SessionManagerClient;
 }
 
@@ -35,8 +35,7 @@ class DeviceLocalAccountPolicyBroker;
 
 // CloudPolicyStore implementation for device-local account policy. Stores/loads
 // policy to/from session_manager.
-class DeviceLocalAccountPolicyStore
-    : public UserCloudPolicyStoreBase {
+class DeviceLocalAccountPolicyStore : public UserCloudPolicyStoreBase {
  public:
   DeviceLocalAccountPolicyStore(
       const std::string& account_id,
@@ -52,15 +51,22 @@ class DeviceLocalAccountPolicyStore
   void Load() override;
 
  private:
+  // The callback invoked once policy validation is complete. Passed are the
+  // used public key and the validator.
+  using ValidateCompletionCallback =
+      base::Callback<void(const std::string&, UserCloudPolicyValidator*)>;
+
   // Called back by |session_manager_client_| after policy retrieval. Checks for
   // success and triggers policy validation.
   void ValidateLoadedPolicyBlob(const std::string& policy_blob);
 
   // Updates state after validation and notifies observers.
-  void UpdatePolicy(UserCloudPolicyValidator* validator);
+  void UpdatePolicy(const std::string& used_public_key,

[Thiemo Nagel, 2016/11/21 17:45:33]

Nit: "used" doesn't seem to convey meaningful information (after all if it was
unused, it probably wouldn't be a parameter in the first place).  How about
"policy_key"?

[emaxx, 2016/11/21 20:04:58]

Good point.
Replaced this now with "signature_validation_public_key" - do you think it's
clear enough?

+                    UserCloudPolicyValidator* validator);
 
   // Sends the policy blob to session_manager for storing after validation.
-  void StoreValidatedPolicy(UserCloudPolicyValidator* validator);
+  void StoreValidatedPolicy(const std::string& used_public_key,
+                            UserCloudPolicyValidator* validator);
 
   // Called back when a store operation completes, updates state and reloads the
   // policy if applicable.
@@ -70,13 +76,13 @@ class DeviceLocalAccountPolicyStore
   void CheckKeyAndValidate(
       bool valid_timestamp_required,
       std::unique_ptr<enterprise_management::PolicyFetchResponse> policy,
-      const UserCloudPolicyValidator::CompletionCallback& callback);
+      const ValidateCompletionCallback& callback);
 
   // Triggers policy validation.
   void Validate(
       bool valid_timestamp_required,
       std::unique_ptr<enterprise_management::PolicyFetchResponse> policy,
-      const UserCloudPolicyValidator::CompletionCallback& callback,
+      const ValidateCompletionCallback& callback,
       chromeos::DeviceSettingsService::OwnershipStatus ownership_status);
 
   const std::string account_id_;