Network traffic annotation added to supervised users.

chrome/browser/supervised_user/child_accounts/family_info_fetcher.cc

Index: chrome/browser/supervised_user/child_accounts/family_info_fetcher.cc
diff --git a/chrome/browser/supervised_user/child_accounts/family_info_fetcher.cc b/chrome/browser/supervised_user/child_accounts/family_info_fetcher.cc
index 28fbabb71b72bf3bb45ba1ac74d4d877eddb97f4..35f06fc9250087e7feb1005c299d1ff320e4f744 100644
--- a/chrome/browser/supervised_user/child_accounts/family_info_fetcher.cc
+++ b/chrome/browser/supervised_user/child_accounts/family_info_fetcher.cc
@@ -14,6 +14,7 @@
 #include "components/data_use_measurement/core/data_use_user_data.h"
 #include "net/base/load_flags.h"
 #include "net/http/http_status_code.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 #include "net/url_request/url_request_status.h"
 #include "url/gurl.h"
 
@@ -171,7 +172,35 @@ void FamilyInfoFetcher::OnGetTokenSuccess(
 
   GURL url = kids_management_api::GetURL(request_path_);
   const int id = 0;
-  url_fetcher_ = net::URLFetcher::Create(id, url, net::URLFetcher::GET, this);
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("family_info", R"(
+        semantics {
+          sender: "Supervised Users"
+          description:
+            "Fetches information about the user's family group from the Google "
+            "Family API."
+          trigger:
+            "Triggered in regular intervals to update profile information."
+          data:
+            "The request is authenticated with an OAuth2 access token "
+            "identifying the Google account. No other information is sent."
+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false
+          setting:
+            "This feature cannot be disabled in settings and is only enabled "
+            "for child accounts. If sign-in is restricted to accounts from a "
+            "managed domain, those accounts are not going to be child accounts."
+          chrome_policy {
+            RestrictSigninToPattern {
+              policy_options {mode: MANDATORY}
+              RestrictSigninToPattern: "*@manageddomain.com"

[Ramin Halavati, 2017/03/14 10:56:21]

I am a little unclear on this. Here we want the value that prevents this
request. Is it correct?

[Bernhard Bauer, 2017/03/14 11:16:12]

Yes, because managed domains and child accounts are mutually exclusive. The way
to disable features for child accounts is to disallow sign-in with the account
(on desktop directly in Chrome, or on Android via Google Play Services, because
that is where the credentials are managed).

[Ramin Halavati, 2017/03/14 11:40:37]

Thank you.

+            }
+          }
+        })");
+  url_fetcher_ = net::URLFetcher::Create(id, url, net::URLFetcher::GET, this,
+                                         traffic_annotation);
 
   data_use_measurement::DataUseUserData::AttachToFetcher(
       url_fetcher_.get(),