Make extensions developer mode adhere to policy

chrome/browser/extensions/api/developer_private/developer_private_api.cc

Index: chrome/browser/extensions/api/developer_private/developer_private_api.cc
diff --git a/chrome/browser/extensions/api/developer_private/developer_private_api.cc b/chrome/browser/extensions/api/developer_private/developer_private_api.cc
index 02cf2f17dff8d66e7f20873346a50f0a69ebda8d..a3943e877511aaf22b354d521fbc0ea964bf8f52 100644
--- a/chrome/browser/extensions/api/developer_private/developer_private_api.cc
+++ b/chrome/browser/extensions/api/developer_private/developer_private_api.cc
@@ -103,6 +103,8 @@ const char kCouldNotFindWebContentsError[] =
     "Could not find a valid web contents.";
 const char kCannotUpdateSupervisedProfileSettingsError[] =
     "Cannot change settings for a supervised profile.";
+const char kCannotUpdatePolicyControlledProfileSettingsError[] =
+    "Cannot change policy-controlled settings.";
 const char kNoOptionsPageForExtensionError[] =
     "Extension does not have an options page.";
 
@@ -167,8 +169,11 @@ std::unique_ptr<developer::ProfileInfo> CreateProfileInfo(Profile* profile) {
   info->is_incognito_available =
       IncognitoModePrefs::GetAvailability(prefs) !=
           IncognitoModePrefs::DISABLED;
+  info->is_developer_mode_disabled_by_policy =
+      prefs->GetBoolean(prefs::kDevToolsDisabled);
   info->in_developer_mode =
       !info->is_supervised &&
+      !info->is_developer_mode_disabled_by_policy &&
       prefs->GetBoolean(prefs::kExtensionsUIDeveloperMode);
   info->app_info_dialog_enabled = CanShowAppInfoDialog();
   info->can_load_unpacked =
@@ -234,6 +239,10 @@ DeveloperPrivateEventRouter::DeveloperPrivateEventRouter(Profile* profile)
       prefs::kExtensionsUIDeveloperMode,
       base::Bind(&DeveloperPrivateEventRouter::OnProfilePrefChanged,
                  base::Unretained(this)));
+  pref_change_registrar_.Add(
+      prefs::kDevToolsDisabled,
+      base::Bind(&DeveloperPrivateEventRouter::OnDevToolsDisabledChanged,
+                 base::Unretained(this)));
 }
 
 DeveloperPrivateEventRouter::~DeveloperPrivateEventRouter() {
@@ -372,6 +381,18 @@ void DeveloperPrivateEventRouter::OnProfilePrefChanged() {
   event_router_->BroadcastEvent(std::move(event));
 }
 
+void DeveloperPrivateEventRouter::OnDevToolsDisabledChanged() {
+  PrefService* prefs = profile_->GetPrefs();
+
+  // Ensure that the developer mode is off if it is disabled by policy
+  if (prefs->GetBoolean(prefs::kDevToolsDisabled))
+    prefs->SetBoolean(prefs::kExtensionsUIDeveloperMode, false);

[Bernhard Bauer, 2016/11/25 15:43:35]

Could you set this value via the ConfigurationPolicyPrefStore? Usually we try to
avoid modifying user preferences for things that aren't actually a user choice.

[pmarko, 2016/11/28 14:19:30]

Thank you for pointing this out -- done. Your suggestion is much more elegant
and actually has the correct behavior when the policy is removed again.

+
+  // Be sure to generate a notification to the UI to show/hide the
+  // 'controlled by policy' indicator
+  OnProfilePrefChanged();
+}
+
 void DeveloperPrivateEventRouter::BroadcastItemStateChanged(
     developer::EventType event_type,
     const std::string& extension_id) {
@@ -600,6 +621,9 @@ DeveloperPrivateUpdateProfileConfigurationFunction::Run() {
   if (update.in_developer_mode) {
     if (GetProfile()->IsSupervised())
       return RespondNow(Error(kCannotUpdateSupervisedProfileSettingsError));
+    if (prefs->GetBoolean(prefs::kDevToolsDisabled))
+      return RespondNow(Error(

[Bernhard Bauer, 2016/11/25 15:43:35]

This is a multi-line statement, so the block needs braces.

[pmarko, 2016/11/28 14:19:30]

Done.

+          kCannotUpdatePolicyControlledProfileSettingsError));
     prefs->SetBoolean(prefs::kExtensionsUIDeveloperMode,
                       *update.in_developer_mode);
   }