Abandon user sign in when policy is retrieved before session started

chrome/browser/chromeos/policy/device_local_account_policy_store.cc

Index: chrome/browser/chromeos/policy/device_local_account_policy_store.cc
diff --git a/chrome/browser/chromeos/policy/device_local_account_policy_store.cc b/chrome/browser/chromeos/policy/device_local_account_policy_store.cc
index 31f42df64268d730dab40792c82127a1b18fd5f1..ae00ed28c5202f84f903adb750c006abc31ed0e0 100644
--- a/chrome/browser/chromeos/policy/device_local_account_policy_store.cc
+++ b/chrome/browser/chromeos/policy/device_local_account_policy_store.cc
@@ -59,7 +59,8 @@ void DeviceLocalAccountPolicyStore::LoadImmediately() {
   const std::string policy_blob =
       session_manager_client_->BlockingRetrieveDeviceLocalAccountPolicy(
           account_id_);
-  ValidateLoadedPolicyBlob(false /*validate_in_background*/, policy_blob);
+  ValidateLoadedPolicyBlob(false /*validate_in_background*/, policy_blob,
+                           chromeos::SessionManagerClient::SUCCESS);

[emaxx, 2017/04/18 15:03:16]

It's a bit weird that the asynchronous method
(RetrieveDeviceLocalAccountPolicy()) was changed to support passing the error,
while the synchronous method (BlockingRetrieveDeviceLocalAccountPolicy())
wasn't.
They should really behave in the same way. And also we shouldn't pass SUCCESS
here without actually knowing whether the operation was successful.

So I guess when choosing a solution (either pass the error in both cases or
don't pass it at all), the right question is: should we protect the device-local
accounts from reading policy before session start? If yes (which I guess is the
case), then the error should be passed and actually handled in
ValidateLoadedPolicyBlob() below.

[igorcov, 2017/04/20 14:52:29]

Changed to have the same pattern for all.

 }
 
 void DeviceLocalAccountPolicyStore::Store(
@@ -74,7 +75,9 @@ void DeviceLocalAccountPolicyStore::Store(
 
 void DeviceLocalAccountPolicyStore::ValidateLoadedPolicyBlob(
     bool validate_in_background,
-    const std::string& policy_blob) {
+    const std::string& policy_blob,
+    const chromeos::SessionManagerClient::RetrievePolicyResponseType&
+        response_type) {
   if (policy_blob.empty()) {
     status_ = CloudPolicyStore::STATUS_LOAD_ERROR;
     NotifyStoreError();