| OLD | NEW |
| 1 // Copyright 2016 The Chromium Authors. All rights reserved. | 1 // Copyright 2016 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef CHROME_BROWSER_CHROMEOS_ARC_ARC_AUTH_SERVICE_H_ | 5 #ifndef CHROME_BROWSER_CHROMEOS_ARC_ARC_AUTH_SERVICE_H_ |
| 6 #define CHROME_BROWSER_CHROMEOS_ARC_ARC_AUTH_SERVICE_H_ | 6 #define CHROME_BROWSER_CHROMEOS_ARC_ARC_AUTH_SERVICE_H_ |
| 7 | 7 |
| 8 #include <memory> | 8 #include <memory> |
| 9 #include <ostream> | |
| 10 #include <string> | 9 #include <string> |
| 11 | 10 |
| 12 #include "base/macros.h" | 11 #include "base/macros.h" |
| 13 #include "base/memory/weak_ptr.h" | 12 #include "base/memory/weak_ptr.h" |
| 14 #include "base/observer_list.h" | |
| 15 #include "base/timer/timer.h" | |
| 16 #include "chrome/browser/chromeos/arc/arc_support_host.h" | 13 #include "chrome/browser/chromeos/arc/arc_support_host.h" |
| 17 #include "chrome/browser/chromeos/arc/optin/arc_optin_preference_handler_observe
r.h" | |
| 18 #include "chrome/browser/chromeos/policy/android_management_client.h" | |
| 19 #include "components/arc/arc_bridge_service.h" | |
| 20 #include "components/arc/arc_service.h" | 14 #include "components/arc/arc_service.h" |
| 21 #include "components/arc/common/auth.mojom.h" | 15 #include "components/arc/common/auth.mojom.h" |
| 22 #include "components/arc/instance_holder.h" | 16 #include "components/arc/instance_holder.h" |
| 23 #include "components/prefs/pref_change_registrar.h" | |
| 24 #include "components/sync_preferences/pref_service_syncable_observer.h" | |
| 25 #include "components/sync_preferences/synced_pref_observer.h" | |
| 26 #include "mojo/public/cpp/bindings/binding.h" | 17 #include "mojo/public/cpp/bindings/binding.h" |
| 27 | 18 |
| 28 class ArcAppLauncher; | 19 namespace net { |
| 29 class Profile; | 20 class URLRequestContextGetter; |
| 30 | |
| 31 namespace ash { | |
| 32 class ShelfDelegate; | |
| 33 } | |
| 34 | |
| 35 namespace user_prefs { | |
| 36 class PrefRegistrySyncable; | |
| 37 } | 21 } |
| 38 | 22 |
| 39 namespace arc { | 23 namespace arc { |
| 40 | 24 |
| 41 class ArcAndroidManagementChecker; | |
| 42 class ArcAuthCodeFetcher; | 25 class ArcAuthCodeFetcher; |
| 43 class ArcAuthContext; | 26 class ArcAuthContext; |
| 44 class ArcOptInPreferenceHandler; | |
| 45 class ArcRobotAuth; | 27 class ArcRobotAuth; |
| 46 enum class ProvisioningResult : int; | |
| 47 | 28 |
| 48 // This class proxies the request from the client to fetch an auth code from | 29 // Implementation of ARC authorization. |
| 49 // LSO. It lives on the UI thread. | 30 // TODO(hidehiko): Move to c/b/c/arc/auth with adding tests. |
| 50 class ArcAuthService : public ArcService, | 31 class ArcAuthService : public ArcService, |
| 51 public mojom::AuthHost, | 32 public mojom::AuthHost, |
| 52 public ArcBridgeService::Observer, | |
| 53 public InstanceHolder<mojom::AuthInstance>::Observer, | 33 public InstanceHolder<mojom::AuthInstance>::Observer, |
| 54 public ArcSupportHost::Observer, | 34 public ArcSupportHost::Observer { |
| 55 public ArcOptInPreferenceHandlerObserver, | |
| 56 public sync_preferences::PrefServiceSyncableObserver, | |
| 57 public sync_preferences::SyncedPrefObserver { | |
| 58 public: | 35 public: |
| 59 // Represents each State of ARC session. | |
| 60 // NOT_INITIALIZED: represents the state that the Profile is not yet ready | |
| 61 // so that this service is not yet initialized, or Chrome is being shut | |
| 62 // down so that this is destroyed. | |
| 63 // STOPPED: ARC session is not running, or being terminated. | |
| 64 // SHOWING_TERMS_OF_SERVICE: "Terms Of Service" page is shown on ARC support | |
| 65 // Chrome app. | |
| 66 // CHECKING_ANDROID_MANAGEMENT: Checking Android management status. Note that | |
| 67 // the status is checked for each ARC session starting, but this is the | |
| 68 // state only for the first boot case (= opt-in case). The second time and | |
| 69 // later the management check is running in parallel with ARC session | |
| 70 // starting, and in such a case, State is ACTIVE, instead. | |
| 71 // FETCHING_CODE: Fetching an auth token. Similar to | |
| 72 // CHECKING_ANDROID_MANAGEMENT case, this is only for the first boot case. | |
| 73 // In re-auth flow (fetching an auth token while ARC is running), the | |
| 74 // State should be ACTIVE. | |
| 75 // TODO(hidehiko): Migrate into re-auth flow, then remove this state. | |
| 76 // ACTIVE: ARC is running. | |
| 77 // | |
| 78 // State transition should be as follows: | |
| 79 // | |
| 80 // NOT_INITIALIZED -> STOPPED: when the primary Profile gets ready. | |
| 81 // ...(any)... -> NOT_INITIALIZED: when the Chrome is being shutdown. | |
| 82 // ...(any)... -> STOPPED: on error. | |
| 83 // | |
| 84 // In the first boot case (no OOBE case): | |
| 85 // STOPPED -> SHOWING_TERMS_OF_SERVICE: when arc.enabled preference is set. | |
| 86 // SHOWING_TERMS_OF_SERVICE -> CHECKING_ANDROID_MANAGEMENT: when a user | |
| 87 // agree with "Terms Of Service" | |
| 88 // CHECKING_ANDROID_MANAGEMENT -> FETCHING_CODE: when Android management | |
| 89 // check passes. | |
| 90 // FETCHING_CODE -> ACTIVE: when the auth token is successfully fetched. | |
| 91 // | |
| 92 // In the first boot case (OOBE case): | |
| 93 // STOPPED -> FETCHING_CODE: When arc.enabled preference is set. | |
| 94 // FETCHING_CODE -> ACTIVE: when the auth token is successfully fetched. | |
| 95 // | |
| 96 // In the second (or later) boot case: | |
| 97 // STOPPED -> ACTIVE: when arc.enabled preference is checked that it is | |
| 98 // true. Practically, this is when the primary Profile gets ready. | |
| 99 enum class State { | |
| 100 NOT_INITIALIZED, | |
| 101 STOPPED, | |
| 102 SHOWING_TERMS_OF_SERVICE, | |
| 103 CHECKING_ANDROID_MANAGEMENT, | |
| 104 ACTIVE, | |
| 105 }; | |
| 106 | |
| 107 class Observer { | |
| 108 public: | |
| 109 virtual ~Observer() = default; | |
| 110 | |
| 111 // Called to notify that ARC bridge is shut down. | |
| 112 virtual void OnShutdownBridge() {} | |
| 113 | |
| 114 // Called to notify that ARC enabled state has been updated. | |
| 115 virtual void OnOptInEnabled(bool enabled) {} | |
| 116 | |
| 117 // Called to notify that ARC has been initialized successfully. | |
| 118 virtual void OnInitialStart() {} | |
| 119 }; | |
| 120 | |
| 121 explicit ArcAuthService(ArcBridgeService* bridge_service); | 36 explicit ArcAuthService(ArcBridgeService* bridge_service); |
| 122 ~ArcAuthService() override; | 37 ~ArcAuthService() override; |
| 123 | 38 |
| 124 static ArcAuthService* Get(); | 39 // This is introduced to work with existing tests. |
| 125 | 40 // TODO(crbug.com/664095): Clean up the test and remove this method. |
| 126 // It is called from chrome/browser/prefs/browser_prefs.cc. | 41 static ArcAuthService* GetForTest(); |
| 127 static void RegisterProfilePrefs(user_prefs::PrefRegistrySyncable* registry); | |
| 128 | |
| 129 static void DisableUIForTesting(); | |
| 130 static void SetShelfDelegateForTesting(ash::ShelfDelegate* shelf_delegate); | |
| 131 | |
| 132 // Checks if OptIn verification was disabled by switch in command line. | |
| 133 static bool IsOptInVerificationDisabled(); | |
| 134 | |
| 135 static void EnableCheckAndroidManagementForTesting(); | |
| 136 | |
| 137 // Returns true if Arc is allowed to run for the given profile. | |
| 138 static bool IsAllowedForProfile(const Profile* profile); | |
| 139 | |
| 140 // Returns true if Arc is allowed to run for the current session. | |
| 141 bool IsAllowed() const; | |
| 142 | |
| 143 void OnPrimaryUserProfilePrepared(Profile* profile); | |
| 144 void Shutdown(); | |
| 145 | |
| 146 Profile* profile() { return profile_; } | |
| 147 const Profile* profile() const { return profile_; } | |
| 148 | |
| 149 State state() const { return state_; } | |
| 150 | |
| 151 // Adds or removes observers. | |
| 152 void AddObserver(Observer* observer); | |
| 153 void RemoveObserver(Observer* observer); | |
| 154 | |
| 155 // ArcBridgeService::Observer: | |
| 156 void OnBridgeStopped(ArcBridgeService::StopReason reason) override; | |
| 157 | 42 |
| 158 // InstanceHolder<mojom::AuthInstance>::Observer: | 43 // InstanceHolder<mojom::AuthInstance>::Observer: |
| 159 void OnInstanceReady() override; | 44 void OnInstanceReady() override; |
| 45 void OnInstanceClosed() override; |
| 160 | 46 |
| 161 // AuthHost: | 47 // mojom::AuthHost: |
| 162 void OnSignInComplete() override; | 48 void OnSignInComplete() override; |
| 163 void OnSignInFailed(mojom::ArcSignInFailureReason reason) override; | 49 void OnSignInFailed(mojom::ArcSignInFailureReason reason) override; |
| 164 void RequestAccountInfo() override; | 50 void RequestAccountInfo() override; |
| 165 | 51 |
| 166 // Deprecated methods: | 52 // Deprecated methods: |
| 167 // For security reason this code can be used only once and exists for specific | 53 // For security reason this code can be used only once and exists for specific |
| 168 // period of time. | 54 // period of time. |
| 169 void GetAuthCodeDeprecated0( | 55 void GetAuthCodeDeprecated0( |
| 170 const GetAuthCodeDeprecated0Callback& callback) override; | 56 const GetAuthCodeDeprecated0Callback& callback) override; |
| 171 void GetAuthCodeDeprecated( | 57 void GetAuthCodeDeprecated( |
| 172 const GetAuthCodeDeprecatedCallback& callback) override; | 58 const GetAuthCodeDeprecatedCallback& callback) override; |
| 173 void GetAuthCodeAndAccountTypeDeprecated( | 59 void GetAuthCodeAndAccountTypeDeprecated( |
| 174 const GetAuthCodeAndAccountTypeDeprecatedCallback& callback) override; | 60 const GetAuthCodeAndAccountTypeDeprecatedCallback& callback) override; |
| 175 // Callback is called with a bool that indicates the management status of the | |
| 176 // user. | |
| 177 void GetIsAccountManagedDeprecated( | 61 void GetIsAccountManagedDeprecated( |
| 178 const GetIsAccountManagedDeprecatedCallback& callback) override; | 62 const GetIsAccountManagedDeprecatedCallback& callback) override; |
| 179 | 63 |
| 180 // Called from Arc support platform app when user cancels signing. | |
| 181 void CancelAuthCode(); | |
| 182 | |
| 183 bool IsArcManaged() const; | |
| 184 bool IsArcEnabled() const; | |
| 185 | |
| 186 // This requires Arc to be allowed (|IsAllowed|)for current profile. | |
| 187 void EnableArc(); | |
| 188 void DisableArc(); | |
| 189 | |
| 190 // Called from the Chrome OS metrics provider to record Arc.State | |
| 191 // periodically. | |
| 192 void RecordArcState(); | |
| 193 | |
| 194 // sync_preferences::PrefServiceSyncableObserver | |
| 195 void OnIsSyncingChanged() override; | |
| 196 | |
| 197 // sync_preferences::SyncedPrefObserver | |
| 198 void OnSyncedPrefChanged(const std::string& path, bool from_sync) override; | |
| 199 | |
| 200 // ArcSupportHost::Observer: | 64 // ArcSupportHost::Observer: |
| 201 void OnWindowClosed() override; | |
| 202 void OnTermsAgreed(bool is_metrics_enabled, | |
| 203 bool is_backup_and_restore_enabled, | |
| 204 bool is_location_service_enabled) override; | |
| 205 void OnAuthSucceeded(const std::string& auth_code) override; | 65 void OnAuthSucceeded(const std::string& auth_code) override; |
| 206 void OnRetryClicked() override; | 66 void OnRetryClicked() override; |
| 207 void OnSendFeedbackClicked() override; | |
| 208 | |
| 209 // arc::ArcOptInPreferenceHandlerObserver: | |
| 210 void OnMetricsModeChanged(bool enabled, bool managed) override; | |
| 211 void OnBackupAndRestoreModeChanged(bool enabled, bool managed) override; | |
| 212 void OnLocationServicesModeChanged(bool enabled, bool managed) override; | |
| 213 | |
| 214 // Stops ARC without changing ArcEnabled preference. | |
| 215 void StopArc(); | |
| 216 | |
| 217 // StopArc(), then EnableArc(). Between them data clear may happens. | |
| 218 // This is a special method to support enterprise device lost case. | |
| 219 // This can be called only when ARC is running. | |
| 220 void StopAndEnableArc(); | |
| 221 | |
| 222 // Removes the data if ARC is stopped. Otherwise, queue to remove the data | |
| 223 // on ARC is stopped. | |
| 224 void RemoveArcData(); | |
| 225 | |
| 226 ArcSupportHost* support_host() { return support_host_.get(); } | |
| 227 | |
| 228 void StartArc(); | |
| 229 | |
| 230 void OnProvisioningFinished(ProvisioningResult result); | |
| 231 | 67 |
| 232 private: | 68 private: |
| 233 using AccountInfoCallback = base::Callback<void(mojom::AccountInfoPtr)>; | 69 using AccountInfoCallback = base::Callback<void(mojom::AccountInfoPtr)>; |
| 234 class AccountInfoNotifier; | 70 class AccountInfoNotifier; |
| 235 | 71 |
| 236 // TODO(hidehiko): move UI methods/fields to ArcSupportHost. | 72 // Starts to request account info. |
| 237 void SetState(State state); | |
| 238 void ShutdownBridge(); | |
| 239 void OnOptInPreferenceChanged(); | |
| 240 void StartUI(); | |
| 241 void OnAndroidManagementPassed(); | |
| 242 void OnArcDataRemoved(bool success); | |
| 243 void OnArcSignInTimeout(); | |
| 244 void FetchAuthCode(); | |
| 245 void PrepareContextForAuthCodeRequest(); | |
| 246 void RequestAccountInfoInternal( | 73 void RequestAccountInfoInternal( |
| 247 std::unique_ptr<AccountInfoNotifier> account_info_notifier); | 74 std::unique_ptr<AccountInfoNotifier> account_info_notifier); |
| 75 |
| 76 // Called when HTTP context is prepared. |
| 77 void OnContextPrepared(net::URLRequestContextGetter* request_context_getter); |
| 78 |
| 248 void OnAccountInfoReady(mojom::AccountInfoPtr account_info); | 79 void OnAccountInfoReady(mojom::AccountInfoPtr account_info); |
| 249 | 80 |
| 250 // Callback for Robot auth in Kiosk mode. | 81 // Callback for Robot auth in Kiosk mode. |
| 251 void OnRobotAuthCodeFetched(const std::string& auth_code); | 82 void OnRobotAuthCodeFetched(const std::string& auth_code); |
| 252 | 83 |
| 253 // Callback for automatic auth code fetching when --arc-user-auth-endpoint | 84 // Callback for automatic auth code fetching when --arc-user-auth-endpoint |
| 254 // flag is set. | 85 // flag is set. |
| 255 void OnAuthCodeFetched(const std::string& auth_code); | 86 void OnAuthCodeFetched(const std::string& auth_code); |
| 256 | 87 |
| 257 // Common procedure across LSO auth code fetching, automatic auth code | 88 // Common procedure across LSO auth code fetching, automatic auth code |
| 258 // fetching, and Robot auth. | 89 // fetching, and Robot auth. |
| 259 void OnAuthCodeObtained(const std::string& auth_code); | 90 void OnAuthCodeObtained(const std::string& auth_code); |
| 260 | 91 |
| 261 void StartArcAndroidManagementCheck(); | 92 mojo::Binding<mojom::AuthHost> binding_; |
| 262 | |
| 263 // Called when the Android management check is done in opt-in flow or | |
| 264 // re-auth flow. | |
| 265 void OnAndroidManagementChecked( | |
| 266 policy::AndroidManagementClient::Result result); | |
| 267 | |
| 268 // Called when the background Android management check is done. It is | |
| 269 // triggered when the second or later ARC boot timing. | |
| 270 void OnBackgroundAndroidManagementChecked( | |
| 271 policy::AndroidManagementClient::Result result); | |
| 272 | |
| 273 // Called when HTTP context is prepared. | |
| 274 void OnContextPrepared(net::URLRequestContextGetter* request_context_getter); | |
| 275 | |
| 276 // Unowned pointer. Keeps current profile. | |
| 277 Profile* profile_ = nullptr; | |
| 278 | |
| 279 // Registrar used to monitor ARC enabled state. | |
| 280 PrefChangeRegistrar pref_change_registrar_; | |
| 281 | |
| 282 mojo::Binding<AuthHost> binding_; | |
| 283 State state_ = State::NOT_INITIALIZED; | |
| 284 base::ObserverList<Observer> observer_list_; | |
| 285 std::unique_ptr<ArcAppLauncher> playstore_launcher_; | |
| 286 bool clear_required_ = false; | |
| 287 bool reenable_arc_ = false; | |
| 288 base::OneShotTimer arc_sign_in_timer_; | |
| 289 | |
| 290 // Notifies the correct callback whenever the auth_code is ready. | |
| 291 std::unique_ptr<AccountInfoNotifier> account_info_notifier_; | |
| 292 | |
| 293 // Temporarily keeps the ArcSupportHost instance. | |
| 294 // This should be moved to ArcSessionManager when the refactoring is | |
| 295 // done. | |
| 296 std::unique_ptr<ArcSupportHost> support_host_; | |
| 297 // Handles preferences and metrics mode. | |
| 298 std::unique_ptr<arc::ArcOptInPreferenceHandler> preference_handler_; | |
| 299 | 93 |
| 300 std::unique_ptr<ArcAuthContext> context_; | 94 std::unique_ptr<ArcAuthContext> context_; |
| 301 std::unique_ptr<ArcAuthCodeFetcher> auth_code_fetcher_; | 95 std::unique_ptr<ArcAuthCodeFetcher> auth_code_fetcher_; |
| 302 std::unique_ptr<ArcAndroidManagementChecker> android_management_checker_; | |
| 303 std::unique_ptr<ArcRobotAuth> arc_robot_auth_; | 96 std::unique_ptr<ArcRobotAuth> arc_robot_auth_; |
| 304 | 97 |
| 305 base::Time sign_in_time_; | 98 std::unique_ptr<AccountInfoNotifier> notifier_; |
| 306 | 99 |
| 307 base::WeakPtrFactory<ArcAuthService> weak_ptr_factory_; | 100 base::WeakPtrFactory<ArcAuthService> weak_ptr_factory_; |
| 308 | 101 |
| 309 DISALLOW_COPY_AND_ASSIGN(ArcAuthService); | 102 DISALLOW_COPY_AND_ASSIGN(ArcAuthService); |
| 310 }; | 103 }; |
| 311 | 104 |
| 312 // Outputs the stringified |state| to |os|. This is only for logging purposes. | |
| 313 std::ostream& operator<<(std::ostream& os, const ArcAuthService::State& state); | |
| 314 | |
| 315 } // namespace arc | 105 } // namespace arc |
| 316 | 106 |
| 317 #endif // CHROME_BROWSER_CHROMEOS_ARC_ARC_AUTH_SERVICE_H_ | 107 #endif // CHROME_BROWSER_CHROMEOS_ARC_ARC_AUTH_SERVICE_H_ |
| OLD | NEW |