Track whether a given user session has completed initialization, and use

chrome/browser/chromeos/policy/user_policy_manager_factory_chromeos.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/policy/user_policy_manager_factory_chromeos.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/command_line.h"
@@ skipping 181 matching lines @@
       }
       is_active_directory = true;
       break;
   }
 
   const bool is_browser_restart =
       command_line->HasSwitch(chromeos::switches::kLoginUser);
   const user_manager::UserManager* const user_manager =
       user_manager::UserManager::Get();
 
   // We want to block for policy in a few situations: if the user is new, or if

[emaxx, 2017/02/23 21:45:25]

nit: The comment should be updated to correspond to the code.

[Andrew T Wilson (Slow), 2017/02/24 16:15:15]

Done.

   // we are forcing an online signin. An online signin will be forced if there
   // has been a credential error, or if the initial session creation was not
   // completed (the oauth_token_status is not set to valid by OAuth2LoginManager
   // until profile creation/session restore is complete).
   const bool block_forever_for_policy =
       !user_manager->IsLoggedInAsStub() &&
       (user_manager->IsCurrentUserNew() ||

[emaxx, 2017/02/23 21:45:25]

IIUC, IsCurrentUserNew() returns true for ephemeral users even during
restart-after-crash. So, even if there IS actually cached policy, we would start
waiting for policy fetch (which, if the policy fetch fails, would terminate the
user session).

Or you planned to implement the fine-grained checks in the policy stack in a
separate CL?

[Andrew T Wilson (Slow), 2017/02/24 16:15:15]

Good point, I'll remove the check for new user as it doesn't buy us anything
(per our discussion). I still plan to put more checks in policy code in a
followup CL, but want to fix this logic now since it fixes a bug.

-       user_manager->GetActiveUser()->force_online_signin() ||
-       user_manager->GetActiveUser()->oauth_token_status() !=
-           user_manager::User::OAUTH2_TOKEN_STATUS_VALID);
+       !user_manager->GetActiveUser()->session_initialized());
 
   const bool wait_for_policy_fetch =
       block_forever_for_policy || !is_browser_restart;
 
   base::TimeDelta initial_policy_fetch_timeout;
   if (block_forever_for_policy) {
     initial_policy_fetch_timeout = base::TimeDelta::Max();
   } else if (wait_for_policy_fetch) {
     initial_policy_fetch_timeout =
         base::TimeDelta::FromSeconds(kInitialPolicyFetchTimeoutSeconds);
@@ skipping 102 matching lines @@
 
 bool UserPolicyManagerFactoryChromeOS::HasTestingFactory(
     content::BrowserContext* context) {
   return false;
 }
 
 void UserPolicyManagerFactoryChromeOS::CreateServiceNow(
     content::BrowserContext* context) {}
 
 }  // namespace policy