Public Sessions - prompt the user for audioCapture/videoCapture requests

chrome/browser/media/public_session_media_access_handler.cc

Index: chrome/browser/media/public_session_media_access_handler.cc
diff --git a/chrome/browser/media/public_session_media_access_handler.cc b/chrome/browser/media/public_session_media_access_handler.cc
new file mode 100644
index 0000000000000000000000000000000000000000..c053ce277e04ff7f0ef04ceab090d5cfc41f01c5
--- /dev/null
+++ b/chrome/browser/media/public_session_media_access_handler.cc
@@ -0,0 +1,172 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/media/public_session_media_access_handler.h"
+
+#include <utility>
+
+#include "base/bind.h"
+#include "base/bind_helpers.h"
+#include "base/memory/ptr_util.h"
+#include "chromeos/login/login_state.h"
+#include "content/public/browser/web_contents.h"
+#include "extensions/common/extension.h"
+#include "extensions/common/permissions/manifest_permission_set.h"
+#include "extensions/common/url_pattern_set.h"
+#include "extensions/common/permissions/permission_set.h"
+
+namespace {
+
+// Returns true if we're in a Public Session.
+bool IsPublicSession() {
+#if defined(OS_CHROMEOS)
+  if (chromeos::LoginState::IsInitialized()) {
+    return chromeos::LoginState::Get()->IsPublicSessionUser();
+  }
+#endif
+  return false;
+}
+
+}  // namespace
+
+PublicSessionMediaAccessHandler::PublicSessionMediaAccessHandler(
+    ExtensionMediaAccessHandler& extension_media_access_handler)
+  : extension_media_access_handler_(extension_media_access_handler) {
+}

[Sergey Ulanov, 2016/12/01 01:21:28]

'git cl format' please.

[Ivan Šandrk, 2016/12/01 17:32:04]

Done.

+
+PublicSessionMediaAccessHandler::~PublicSessionMediaAccessHandler() {
+}
+
+bool PublicSessionMediaAccessHandler::SupportsStreamType(
+    const content::MediaStreamType type,
+    const extensions::Extension* extension) {
+  if (IsPublicSession() && extension && extension->is_platform_app())
+    return extension_media_access_handler_.SupportsStreamType(type, extension);
+  return false;
+}
+
+bool PublicSessionMediaAccessHandler::CheckMediaAccessPermission(
+    content::WebContents* web_contents,
+    const GURL& security_origin,
+    content::MediaStreamType type,
+    const extensions::Extension* extension) {
+  return extension_media_access_handler_.CheckMediaAccessPermission(
+      web_contents, security_origin, type, extension);
+}
+
+void PublicSessionMediaAccessHandler::HandleRequest(
+    content::WebContents* web_contents,
+    const content::MediaStreamRequest& request,
+    const content::MediaResponseCallback& callback,
+    const extensions::Extension* extension) {
+  DCHECK(IsPublicSession() && extension && extension->is_platform_app());
+
+  bool needs_prompt = false;
+  extensions::APIPermissionSet new_apis;
+  const UserChoice& user_choice = user_choice_cache_[extension->id()];
+
+  if (user_choice.NeedsPrompting(request.audio_type)) {
+    new_apis.insert(extensions::APIPermission::kAudioCapture);
+    needs_prompt = true;
+  }
+  if (user_choice.NeedsPrompting(request.video_type)) {
+    new_apis.insert(extensions::APIPermission::kVideoCapture);
+    needs_prompt = true;
+  }
+
+  if (needs_prompt) {
+    auto permission_set = base::MakeUnique<extensions::PermissionSet>(
+        new_apis, extensions::ManifestPermissionSet(),
+        extensions::URLPatternSet(), extensions::URLPatternSet());
+
+    auto prompt = base::MakeUnique<ExtensionInstallPrompt>(web_contents);
+    prompt->ShowDialog(
+        base::Bind(&PublicSessionMediaAccessHandler::ResolvePermissionPrompt,
+            base::Unretained(this), web_contents, request, callback,

[Devlin, 2016/11/30 19:02:48]

Why is this unretained safe?

[Sergey Ulanov, 2016/12/01 01:21:28]

+1

[Ivan Šandrk, 2016/12/01 17:32:04]

The lifetime of PublicSessionMediaAccessHandler is the same as lifetime of
MediaCaptureDevicesDispatcher (since it gets created in its constructor). MCDD
is managed by a base::Singleton and is created during first access and is
destroyed at normal process exit[1]. It's created sometime before login, and I'm
guessing it gets destroyed after logout during shutdown sequence. 

[1]:
https://cs.chromium.org/chromium/src/base/memory/singleton.h?cl=GROK&gsn=get&...

Here I'm making the assumption that the newly created dialog cannot possibly
outlive the logged-in session (ie. if it's displayed during logout it gets
destroyed). I've added some logging code and this is the output when the dialog
is open and then we logout:

[extension_install_prompt.cc(658)]            ShowDialog
[public_session_media_access_handler.cc(134)] ResolvePermissionPrompt
[extension_install_prompt.cc(629)]            Destructor
[media_capture_devices_dispatcher.cc(103)]    Destructor
[public_session_media_access_handler.cc(36)]  Destructor

ReSolvePermissionPrompt is called before the destructor of PSMAH so it's safe,
and the prompt is then also immediately destroyed.

+            extension, base::Passed(&prompt)),

[Devlin, 2016/11/30 19:02:48]

this strikes me as a bit dangerous - we're moving the object that we're actively
calling into... I wouldn't be entirely surprised if some compilers made this
dangerous.

[Ivan Šandrk, 2016/12/01 17:32:04]

Changed it a bit, good now?

+        extension,
+        nullptr, // Uses the extension icon.
+        base::MakeUnique<ExtensionInstallPrompt::Prompt>(
+            ExtensionInstallPrompt::PERMISSIONS_PROMPT),
+        std::move(permission_set),
+        ExtensionInstallPrompt::GetDefaultShowDialogCallback());
+    return;
+  }
+
+  ChainHandleRequest(web_contents, request, callback, extension);
+}
+
+void PublicSessionMediaAccessHandler::ChainHandleRequest(
+    content::WebContents* web_contents,
+    const content::MediaStreamRequest& request,
+    const content::MediaResponseCallback& callback,
+    const extensions::Extension* extension) {
+  const UserChoice& user_choice = user_choice_cache_[extension->id()];
+  content::MediaStreamRequest request_copy(request);
+
+  if (!user_choice.IsAllowed(content::MEDIA_DEVICE_AUDIO_CAPTURE))
+    request_copy.audio_type = content::MEDIA_NO_SERVICE;
+  if (!user_choice.IsAllowed(content::MEDIA_DEVICE_VIDEO_CAPTURE))
+    request_copy.video_type = content::MEDIA_NO_SERVICE;
+
+  extension_media_access_handler_.HandleRequest(
+      web_contents, request_copy, callback, extension);
+}
+
+
+void PublicSessionMediaAccessHandler::ResolvePermissionPrompt(
+    content::WebContents* web_contents,
+    const content::MediaStreamRequest& request,
+    const content::MediaResponseCallback& callback,
+    const extensions::Extension* extension,
+    std::unique_ptr<ExtensionInstallPrompt> prompt,
+    ExtensionInstallPrompt::Result prompt_result) {
+  bool allowed = (prompt_result == ExtensionInstallPrompt::Result::ACCEPTED);
+  UserChoice& user_choice = user_choice_cache_[extension->id()];
+
+  if (user_choice.NeedsPrompting(request.audio_type))
+    user_choice.Set(content::MEDIA_DEVICE_AUDIO_CAPTURE, allowed);
+  if (user_choice.NeedsPrompting(request.video_type))
+    user_choice.Set(content::MEDIA_DEVICE_VIDEO_CAPTURE, allowed);
+
+  ChainHandleRequest(web_contents, request, callback, extension);
+}
+
+bool PublicSessionMediaAccessHandler::UserChoice::IsAllowed(
+    content::MediaStreamType type) const {
+  if (IsPublicSession()) {
+    if (type == content::MEDIA_DEVICE_AUDIO_CAPTURE) {

[Devlin, 2016/11/30 19:02:48]

optional: These methods would be more succinct if we did something like:
struct PermissionState {
  bool prompted = false;
  bool allowed = false;
}
std::map<Type, PermissionState> states

and then here, just
if (IsPublicSession()) {
  const PermissionState state = states[type];
  return !state.prompted || state.allowed;
}

NeedsPrompting() {
  return states[type].prompted;
}

Set() {
  PermissionState& state = states[type];
  DCHECK(!state.prompted);
  state.prompted = true;
  state.allowed = allowed;
}

But, up to you.

[Ivan Šandrk, 2016/12/01 17:32:04]

Agreed, but it would also complicate the logic in some places afaict.

+      return !audio_prompted_ || audio_allowed_;
+    } else {
+      DCHECK(type == content::MEDIA_DEVICE_VIDEO_CAPTURE);
+      return !video_prompted_ || video_allowed_;
+    }
+  }
+  return false;
+}
+
+bool PublicSessionMediaAccessHandler::UserChoice::NeedsPrompting(
+    content::MediaStreamType type) const {
+  if (type == content::MEDIA_DEVICE_AUDIO_CAPTURE) {
+    return !audio_prompted_;
+  }
+  if (type == content::MEDIA_DEVICE_VIDEO_CAPTURE) {
+    return !video_prompted_;
+  }
+  return false;
+}
+
+void PublicSessionMediaAccessHandler::UserChoice::Set(
+    content::MediaStreamType type, bool allowed) {
+  if (type == content::MEDIA_DEVICE_AUDIO_CAPTURE) {
+    DCHECK(!audio_prompted_);
+    audio_prompted_ = true;
+    audio_allowed_ = allowed;
+  } else {
+    DCHECK(type == content::MEDIA_DEVICE_VIDEO_CAPTURE);
+    DCHECK(!video_prompted_);
+    video_prompted_ = true;
+    video_allowed_ = allowed;
+  }
+}