Network traffic annotation added to supervised users.

chrome/browser/supervised_user/legacy/supervised_user_refresh_token_fetcher.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/supervised_user/legacy/supervised_user_refresh_token_fetcher.h"
 
 #include "base/callback.h"
 #include "base/json/json_reader.h"
 #include "base/logging.h"
 #include "base/strings/stringprintf.h"
 #include "base/values.h"
 #include "components/data_use_measurement/core/data_use_user_data.h"
 #include "google_apis/gaia/gaia_constants.h"
 #include "google_apis/gaia/gaia_oauth_client.h"
 #include "google_apis/gaia/gaia_urls.h"
 #include "google_apis/gaia/google_service_auth_error.h"
 #include "google_apis/gaia/oauth2_api_call_flow.h"
 #include "google_apis/gaia/oauth2_token_service.h"
 #include "net/base/escape.h"
 #include "net/base/load_flags.h"
 #include "net/base/net_errors.h"
 #include "net/http/http_status_code.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "net/url_request/url_fetcher.h"
 #include "net/url_request/url_request_status.h"
 
 using GaiaConstants::kChromeSyncSupervisedOAuth2Scope;
 using base::Time;
 using gaia::GaiaOAuthClient;
 using net::URLFetcher;
 using net::URLFetcherDelegate;
 using net::URLRequestContextGetter;
 
@@ skipping 121 matching lines @@
     const std::string& access_token,
     const Time& expiration_time) {
   DCHECK_EQ(access_token_request_.get(), request);
   access_token_ = access_token;
 
   GURL url(GaiaUrls::GetInstance()->oauth2_issue_token_url());
   // GaiaOAuthClient uses id 0, so we use 1 to distinguish the requests in
   // unit tests.
   const int id = 1;
 
-  url_fetcher_ = URLFetcher::Create(id, url, URLFetcher::POST, this);
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation(
+          "supervised_user_refresh_token_fetcher", R"(
+          semantics {
+            sender: "Supervised Users"
+            description:
+              "Fetches an OAuth2 refresh token scoped down to the supervised "

[Marc Treib, 2017/03/14 11:52:46]

nit: Capitalize "Supervised User" (for consistency)

[Ramin Halavati, 2017/03/14 11:58:36]

Done.

+              "user Sync scope and tied to the given Supervised User ID, "
+              "identifying the Supervised User Profile to be created."
+            trigger:
+              "Called when creating a new Supervised User profile in Chrome to "
+              "fetch OAuth credentials for using Sync with new profile."

[Marc Treib, 2017/03/14 11:52:46]

s/with new/with the new/

[Ramin Halavati, 2017/03/14 11:58:36]

Done.

+            data:
+              "The request is authenticated with an OAuth2 access token "
+              "identifying the Google account and contains the following "
+              "information:\n* The Supervised User ID, a randomly generated "
+              "64-bit identifier for the profile.\n* The device name, to "
+              "identify the refresh token in account management."
+            destination: GOOGLE_OWNED_SERVICE
+          }
+          policy {
+            cookies_allowed: false
+            setting:
+              "Users can disable this feature by toggling 'Let anyone add a "
+              "person to Chrome' in Chromium settings, under People."
+            chrome_policy {
+              SupervisedUserCreationEnabled {
+                policy_options {mode: MANDATORY}
+                RestrictSigninToPattern: false

[Marc Treib, 2017/03/14 11:52:46]

I think this should be
SupervisedUserCreationEnabled: false

[Ramin Halavati, 2017/03/14 11:58:36]

Done.

+              }
+            }
+          })");
+  url_fetcher_ =
+      URLFetcher::Create(id, url, URLFetcher::POST, this, traffic_annotation);
 
   data_use_measurement::DataUseUserData::AttachToFetcher(
       url_fetcher_.get(),
       data_use_measurement::DataUseUserData::SUPERVISED_USER);
   url_fetcher_->SetRequestContext(context_);
   url_fetcher_->SetLoadFlags(net::LOAD_DO_NOT_SEND_COOKIES |
                              net::LOAD_DO_NOT_SAVE_COOKIES);
   url_fetcher_->SetAutomaticallyRetryOnNetworkChanges(kNumRetries);
   url_fetcher_->AddExtraRequestHeader(
       base::StringPrintf(kAuthorizationHeaderFormat, access_token.c_str()));
@@ skipping 124 matching lines @@
     const std::string& account_id,
     const std::string& device_id,
     URLRequestContextGetter* context) {
   std::unique_ptr<SupervisedUserRefreshTokenFetcher> fetcher(
       new SupervisedUserRefreshTokenFetcherImpl(
           oauth2_token_service, account_id, device_id, context));
   return fetcher;
 }
 
 SupervisedUserRefreshTokenFetcher::~SupervisedUserRefreshTokenFetcher() {}