Enabling alwaysOnTop should fail to create app windows if the permission is lacking

chrome/browser/extensions/api/app_window/app_window_api.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/api/app_window/app_window_api.h"
 
 #include "apps/app_window.h"
 #include "apps/app_window_contents.h"
 #include "apps/app_window_registry.h"
 #include "apps/apps_client.h"
@@ skipping 30 matching lines @@
 namespace app_window_constants {
 const char kInvalidWindowId[] =
     "The window id can not be more than 256 characters long.";
 const char kInvalidColorSpecification[] =
     "The color specification could not be parsed.";
 const char kColorWithFrameNone[] = "Windows with no frame cannot have a color.";
 const char kInactiveColorWithoutColor[] =
     "frame.inactiveColor must be used with frame.color.";
 const char kConflictingBoundsOptions[] =
     "The $1 property cannot be specified for both inner and outer bounds.";
+const char kAlwaysOnTopPermission[] =
+    "The \"app.window.alwaysOnTop\" permission is required.";
 }  // namespace app_window_constants
 
 const char kNoneFrameOption[] = "none";
   // TODO(benwells): Remove HTML titlebar injection.
 const char kHtmlFrameOption[] = "experimental-html";
 
 namespace {
 
 // Opens an inspector window and delays the response to the
 // AppWindowCreateFunction until the DevToolsWindow has finished loading, and is
@@ skipping 166 matching lines @@
              switches::kEnableExperimentalExtensionApis))) {
       create_params.transparent_background = *options->transparent_background;
     }
 
     if (options->hidden.get())
       create_params.hidden = *options->hidden.get();
 
     if (options->resizable.get())
       create_params.resizable = *options->resizable.get();
 
-    if (options->always_on_top.get() &&
-        GetExtension()->HasAPIPermission(APIPermission::kAlwaysOnTopWindows))
+    if (options->always_on_top.get()) {
       create_params.always_on_top = *options->always_on_top.get();
 
+      if (create_params.always_on_top && !GetExtension()->HasAPIPermission(
+              APIPermission::kAlwaysOnTopWindows)) {
+        error_ = app_window_constants::kAlwaysOnTopPermission;
+        return false;
+      }
+    }
+
     if (options->focused.get())
       create_params.focused = *options->focused.get();
 
     if (options->type != extensions::api::app_window::WINDOW_TYPE_PANEL) {
       switch (options->state) {
         case extensions::api::app_window::STATE_NONE:
         case extensions::api::app_window::STATE_NORMAL:
           break;
         case extensions::api::app_window::STATE_FULLSCREEN:
           create_params.state = ui::SHOW_STATE_FULLSCREEN;
@@ skipping 217 matching lines @@
 
   if (options.frame->as_frame_options->inactive_color.get()) {
     error_ = app_window_constants::kInactiveColorWithoutColor;
     return false;
   }
 
   return true;
 }
 
 }  // namespace extensions