Make extensions developer mode adhere to policy

chrome/browser/extensions/api/developer_private/developer_private_api.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/api/developer_private/developer_private_api.h"
 
 #include <stddef.h>
 #include <utility>
 
 #include "base/bind.h"
@@ skipping 85 matching lines @@
 const char kFileSelectionCanceled[] =
     "File selection was canceled.";
 const char kNoSuchRendererError[] = "No such renderer.";
 const char kInvalidPathError[] = "Invalid path.";
 const char kManifestKeyIsRequiredError[] =
     "The 'manifestKey' argument is required for manifest files.";
 const char kCouldNotFindWebContentsError[] =
     "Could not find a valid web contents.";
 const char kCannotUpdateSupervisedProfileSettingsError[] =
     "Cannot change settings for a supervised profile.";
+const char kCannotUpdatePolicyControlledProfileSettingsError[] =
+    "Cannot change policy-controlled settings.";
 const char kNoOptionsPageForExtensionError[] =
     "Extension does not have an options page.";
 
 const char kUnpackedAppsFolder[] = "apps_target";
 const char kManifestFile[] = "manifest.json";
 
 ExtensionService* GetExtensionService(content::BrowserContext* context) {
   return ExtensionSystem::Get(context)->extension_service();
 }
 
@@ skipping 44 matching lines @@
     InstallVerifier::Get(context)->VerifyAllExtensions();
 }
 
 std::unique_ptr<developer::ProfileInfo> CreateProfileInfo(Profile* profile) {
   std::unique_ptr<developer::ProfileInfo> info(new developer::ProfileInfo());
   info->is_supervised = profile->IsSupervised();
   PrefService* prefs = profile->GetPrefs();
   info->is_incognito_available =
       IncognitoModePrefs::GetAvailability(prefs) !=
           IncognitoModePrefs::DISABLED;
+  info->is_developer_mode_disabled_by_policy =
+      prefs->GetBoolean(prefs::kDevToolsDisabled);
   info->in_developer_mode =
       !info->is_supervised &&
+      !info->is_developer_mode_disabled_by_policy &&
       prefs->GetBoolean(prefs::kExtensionsUIDeveloperMode);
   info->app_info_dialog_enabled = CanShowAppInfoDialog();
   info->can_load_unpacked =
       !ExtensionManagementFactory::GetForBrowserContext(profile)
           ->BlacklistedByDefault();
   return info;
 }
 
 }  // namespace
 
@@ skipping 45 matching lines @@
   extension_management_observer_.Add(
       ExtensionManagementFactory::GetForBrowserContext(profile));
   command_service_observer_.Add(CommandService::Get(profile));
   pref_change_registrar_.Init(profile->GetPrefs());
   // The unretained is safe, since the PrefChangeRegistrar unregisters the
   // callback on destruction.
   pref_change_registrar_.Add(
       prefs::kExtensionsUIDeveloperMode,
       base::Bind(&DeveloperPrivateEventRouter::OnProfilePrefChanged,
                  base::Unretained(this)));
+  pref_change_registrar_.Add(
+      prefs::kDevToolsDisabled,
+      base::Bind(&DeveloperPrivateEventRouter::OnDevToolsDisabledChanged,
+                 base::Unretained(this)));
 }
 
 DeveloperPrivateEventRouter::~DeveloperPrivateEventRouter() {
 }
 
 void DeveloperPrivateEventRouter::AddExtensionId(
     const std::string& extension_id) {
   extension_ids_.insert(extension_id);
 }
 
@@ skipping 118 matching lines @@
 
 void DeveloperPrivateEventRouter::OnProfilePrefChanged() {
   std::unique_ptr<base::ListValue> args(new base::ListValue());
   args->Append(CreateProfileInfo(profile_)->ToValue());
   std::unique_ptr<Event> event(
       new Event(events::DEVELOPER_PRIVATE_ON_PROFILE_STATE_CHANGED,
                 developer::OnProfileStateChanged::kEventName, std::move(args)));
   event_router_->BroadcastEvent(std::move(event));
 }
 
+void DeveloperPrivateEventRouter::OnDevToolsDisabledChanged() {
+  PrefService* prefs = profile_->GetPrefs();
+
+  // Ensure that the developer mode is off if it is disabled by policy
+  if (prefs->GetBoolean(prefs::kDevToolsDisabled))
+    prefs->SetBoolean(prefs::kExtensionsUIDeveloperMode, false);

[Bernhard Bauer, 2016/11/25 15:43:35]

Could you set this value via the ConfigurationPolicyPrefStore? Usually we try to
avoid modifying user preferences for things that aren't actually a user choice.

[pmarko, 2016/11/28 14:19:30]

Thank you for pointing this out -- done. Your suggestion is much more elegant
and actually has the correct behavior when the policy is removed again.

+
+  // Be sure to generate a notification to the UI to show/hide the
+  // 'controlled by policy' indicator
+  OnProfilePrefChanged();
+}
+
 void DeveloperPrivateEventRouter::BroadcastItemStateChanged(
     developer::EventType event_type,
     const std::string& extension_id) {
   std::unique_ptr<ExtensionInfoGenerator> info_generator(
       new ExtensionInfoGenerator(profile_));
   ExtensionInfoGenerator* info_generator_weak = info_generator.get();
   info_generator_weak->CreateExtensionInfo(
       extension_id,
       base::Bind(&DeveloperPrivateEventRouter::BroadcastItemStateChangedHelper,
                  weak_factory_.GetWeakPtr(), event_type, extension_id,
@@ skipping 208 matching lines @@
 DeveloperPrivateUpdateProfileConfigurationFunction::Run() {
   std::unique_ptr<developer::UpdateProfileConfiguration::Params> params(
       developer::UpdateProfileConfiguration::Params::Create(*args_));
   EXTENSION_FUNCTION_VALIDATE(params);
 
   const developer::ProfileConfigurationUpdate& update = params->update;
   PrefService* prefs = GetProfile()->GetPrefs();
   if (update.in_developer_mode) {
     if (GetProfile()->IsSupervised())
       return RespondNow(Error(kCannotUpdateSupervisedProfileSettingsError));
+    if (prefs->GetBoolean(prefs::kDevToolsDisabled))
+      return RespondNow(Error(

[Bernhard Bauer, 2016/11/25 15:43:35]

This is a multi-line statement, so the block needs braces.

[pmarko, 2016/11/28 14:19:30]

Done.

+          kCannotUpdatePolicyControlledProfileSettingsError));
     prefs->SetBoolean(prefs::kExtensionsUIDeveloperMode,
                       *update.in_developer_mode);
   }
 
   return RespondNow(NoArguments());
 }
 
 DeveloperPrivateUpdateExtensionConfigurationFunction::
 ~DeveloperPrivateUpdateExtensionConfigurationFunction() {}
 
@@ skipping 840 matching lines @@
         update.extension_id, update.command_name, *update.keybinding);
   }
 
   return RespondNow(NoArguments());
 }
 
 
 }  // namespace api
 
 }  // namespace extensions