Add login screen locale and input method device policies

chrome/browser/ui/webui/chromeos/login/signin_screen_handler.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/webui/chromeos/login/signin_screen_handler.h"
 
 #include <stddef.h>
 
 #include <algorithm>
 #include <vector>
@@ skipping 213 matching lines @@
       DLOG(ERROR) << "SigninScreenHandler::SetUserInputMethod('" << username
                   << "'): user input method '" << user_input_method
                   << "' is not enabled and enabling failed (ignored!).";
     }
   }
   ime_state->ChangeInputMethod(user_input_method, false /* show_message */);
 
   return true;
 }
 
+void EnforcePolicyInputMethods(std::string user_input_method) {
+  chromeos::CrosSettings* cros_settings = chromeos::CrosSettings::Get();
+  const base::ListValue* login_screen_input_methods = nullptr;
+  if (!cros_settings->GetList(chromeos::kDeviceLoginScreenInputMethods,
+                              &login_screen_input_methods))
+    return;

[Shu Chen, 2017/02/07 02:47:09]

nit: wrap this by brackets {}.

[pmarko, 2017/02/07 10:44:09]

Done.

+
+  std::vector<std::string> allowed_input_methods;
+
+  // Add user's input method first so it is pre-selected.
+  if (!user_input_method.empty()) {
+    allowed_input_methods.push_back(user_input_method);
+  }
+
+  std::string input_method;
+  for (const auto& input_method_entry : *login_screen_input_methods) {
+    if (input_method_entry->GetAsString(&input_method)) {
+      allowed_input_methods.push_back(input_method);
+    }

[Shu Chen, 2017/02/07 02:47:09]

nit: no need these brackets.

[pmarko, 2017/02/07 10:44:09]

Done.

+  }
+  chromeos::input_method::InputMethodManager* imm =
+      chromeos::input_method::InputMethodManager::Get();
+  imm->GetActiveIMEState()->SetAllowedInputMethods(allowed_input_methods);
+}
+
+void StopEnforcingPolicyInputMethods() {
+  // Empty means all input methods are allowed
+  std::vector<std::string> allowed_input_methods;
+  chromeos::input_method::InputMethodManager* imm =
+      chromeos::input_method::InputMethodManager::Get();
+  imm->GetActiveIMEState()->SetAllowedInputMethods(allowed_input_methods);
+}
+
 }  // namespace
 
 // LoginScreenContext implementation ------------------------------------------
 
 LoginScreenContext::LoginScreenContext() {
   Init();
 }
 
 LoginScreenContext::LoginScreenContext(const base::ListValue* args) {
   Init();
@@ skipping 43 matching lines @@
                  chrome::NOTIFICATION_AUTH_CANCELLED,
                  content::NotificationService::AllSources());
 
   chromeos::DBusThreadManager::Get()->GetPowerManagerClient()->AddObserver(
       this);
 
   chromeos::input_method::ImeKeyboard* keyboard =
       chromeos::input_method::InputMethodManager::Get()->GetImeKeyboard();
   if (keyboard)
     keyboard->AddObserver(this);
+  OnAllowedInputMethodsChanged();
+  allowed_input_methods_subscription_ =
+      chromeos::CrosSettings::Get()->AddSettingsObserver(
+          chromeos::kDeviceLoginScreenInputMethods,
+          base::Bind(&SigninScreenHandler::OnAllowedInputMethodsChanged,
+                     base::Unretained(this)));
 
   content::ServiceManagerConnection::GetForProcess()
       ->GetConnector()
       ->BindInterface(ash_util::GetAshServiceName(), &touch_view_manager_ptr_);
   touch_view_manager_ptr_->AddObserver(
       touch_view_binding_.CreateInterfacePtrAndBind());
 }
 
 SigninScreenHandler::~SigninScreenHandler() {
   OobeUI* oobe_ui = GetOobeUI();
   if (oobe_ui && oobe_ui_observer_added_)
     oobe_ui->RemoveObserver(this);
   chromeos::DBusThreadManager::Get()->GetPowerManagerClient()->RemoveObserver(
       this);
   chromeos::input_method::ImeKeyboard* keyboard =
       chromeos::input_method::InputMethodManager::Get()->GetImeKeyboard();
   if (keyboard)
     keyboard->RemoveObserver(this);
+  StopEnforcingPolicyInputMethods();

[Shu Chen, 2017/02/07 02:47:09]

I'd like to understand about what will happen after this?
By the implementation of InputMethodMangerImpl, SetAllowedInputMethods(<empty>)
won't make any impact to the input method list.
If that is intentional, why we need to StopEnforcingPolicyInputMethods?

[pmarko, 2017/02/07 10:44:09]

After SetAllowedInputMethods(non_empty_vec), additional input methods can not be
enabled. Calling SetAllowedInputMethods(empty_vec) will not change the input
method list, but it will be possible to add additional input methods again
(using EnableInputMethod).

This is meant for consistency: If the InputMethodManager's State outlives
SigninScreenHandler, I think SigninScreenHandler should not leave input method
restrictions in place. That's why these are removed in the destructor.

   weak_factory_.InvalidateWeakPtrs();
   if (delegate_)
     delegate_->SetWebUIHandler(nullptr);
   network_state_informer_->RemoveObserver(this);
   proximity_auth::ScreenlockBridge::Get()->SetLockHandler(nullptr);
   proximity_auth::ScreenlockBridge::Get()->SetFocusedUser(EmptyAccountId());
 }
 
 // static
 std::string SigninScreenHandler::GetUserLRUInputMethod(
@@ skipping 22 matching lines @@
 
 // static
 // Update keyboard layout to least recently used by the user.
 void SigninScreenHandler::SetUserInputMethod(
     const std::string& username,
     input_method::InputMethodManager::State* ime_state) {
   bool succeed = false;
 
   const std::string input_method = GetUserLRUInputMethod(username);
 
+  EnforcePolicyInputMethods(input_method);
+
   if (!input_method.empty())
     succeed = SetUserInputMethodImpl(username, input_method, ime_state);
 
   // This is also a case when LRU layout is set only for a few local users,
   // thus others need to be switched to default locale.
   // Otherwise they will end up using another user's locale to log in.
   if (!succeed) {
     DVLOG(0) << "SetUserInputMethod('" << username
              << "'): failed to set user layout. Switching to default.";
 
@@ skipping 194 matching lines @@
   AddCallback("cancelUserAdding", &SigninScreenHandler::HandleCancelUserAdding);
   AddCallback("migrateUserData", &SigninScreenHandler::HandleMigrateUserData);
   AddCallback("resyncUserData", &SigninScreenHandler::HandleResyncUserData);
   AddCallback("loginUIStateChanged",
               &SigninScreenHandler::HandleLoginUIStateChanged);
   AddCallback("unlockOnLoginSuccess",
               &SigninScreenHandler::HandleUnlockOnLoginSuccess);
   AddCallback("showLoadingTimeoutError",
               &SigninScreenHandler::HandleShowLoadingTimeoutError);
   AddCallback("focusPod", &SigninScreenHandler::HandleFocusPod);
+  AddCallback("noPodFocused", &SigninScreenHandler::HandleNoPodFocused);
   AddCallback("getPublicSessionKeyboardLayouts",
               &SigninScreenHandler::HandleGetPublicSessionKeyboardLayouts);
   AddCallback("getTouchViewState",
               &SigninScreenHandler::HandleGetTouchViewState);
   AddCallback("logRemoveUserWarningShown",
               &SigninScreenHandler::HandleLogRemoveUserWarningShown);
   AddCallback("firstIncorrectPasswordAttempt",
               &SigninScreenHandler::HandleFirstIncorrectPasswordAttempt);
   AddCallback("maxIncorrectPasswordAttempts",
               &SigninScreenHandler::HandleMaxIncorrectPasswordAttempts);
@@ skipping 799 matching lines @@
   UpdateState(NetworkError::ERROR_REASON_LOADING_TIMEOUT);
 }
 
 void SigninScreenHandler::HandleFocusPod(const AccountId& account_id) {
   proximity_auth::ScreenlockBridge::Get()->SetFocusedUser(account_id);
   if (delegate_)
     delegate_->CheckUserStatus(account_id);
   if (!test_focus_pod_callback_.is_null())
     test_focus_pod_callback_.Run();
 
+  focused_pod_account_id_ = base::MakeUnique<AccountId>(account_id);
+
   const user_manager::User* user =
       user_manager::UserManager::Get()->FindUser(account_id);
   // |user| may be nullptr in kiosk mode or unit tests.
   if (user && user->is_logged_in() && !user->is_active()) {
     ash::WmShell::Get()->GetSessionStateDelegate()->SwitchActiveUser(
         account_id);
   } else {
     SetUserInputMethod(account_id.GetUserEmail(), ime_state_.get());
     WallpaperManager::Get()->SetUserWallpaperDelayed(account_id);
 
     bool use_24hour_clock = false;
     if (user_manager::known_user::GetBooleanPref(
             account_id, prefs::kUse24HourClock, &use_24hour_clock)) {
       g_browser_process->platform_part()
           ->GetSystemClock()
           ->SetLastFocusedPodHourClockType(
               use_24hour_clock ? base::k24HourClock : base::k12HourClock);
     }
   }
 }
 
+void SigninScreenHandler::HandleNoPodFocused() {
+  focused_pod_account_id_.reset();
+  EnforcePolicyInputMethods(std::string());
+}
+
 void SigninScreenHandler::HandleGetPublicSessionKeyboardLayouts(
     const AccountId& account_id,
     const std::string& locale) {
   GetKeyboardLayoutsForLocale(
       base::Bind(&SigninScreenHandler::SendPublicSessionKeyboardLayouts,
                  weak_factory_.GetWeakPtr(), account_id, locale),
       locale);
 }
 
 void SigninScreenHandler::SendPublicSessionKeyboardLayouts(
@@ skipping 127 matching lines @@
     CallJS("login.AccountPickerScreen.setCapsLockState", caps_lock_enabled_);
 }
 
 void SigninScreenHandler::OnFeedbackFinished() {
   CallJS("login.UnrecoverableCryptohomeErrorScreen.resumeAfterFeedbackUI");
 
   // Recreate user's cryptohome after the feedback is attempted.
   HandleResyncUserData();
 }
 
+void SigninScreenHandler::OnAllowedInputMethodsChanged() {
+  if (focused_pod_account_id_) {
+    std::string user_input_method =
+        GetUserLRUInputMethod(focused_pod_account_id_->GetUserEmail());
+    EnforcePolicyInputMethods(user_input_method);
+  } else {
+    EnforcePolicyInputMethods(std::string());
+  }
+}
+
 }  // namespace chromeos