Abandon user sign in when policy is retrieved before session started

chrome/browser/chromeos/settings/session_manager_operation.cc

Index: chrome/browser/chromeos/settings/session_manager_operation.cc
diff --git a/chrome/browser/chromeos/settings/session_manager_operation.cc b/chrome/browser/chromeos/settings/session_manager_operation.cc
index ed847589209fa0736305c5404076c0db125bdf0a..819b03829c0d153066ff63132bd9cd644b716803 100644
--- a/chrome/browser/chromeos/settings/session_manager_operation.cc
+++ b/chrome/browser/chromeos/settings/session_manager_operation.cc
@@ -139,20 +139,23 @@ void SessionManagerOperation::RetrieveDeviceSettings() {
 
 void SessionManagerOperation::BlockingRetrieveDeviceSettings() {
   ValidateDeviceSettings(
-      session_manager_client()->BlockingRetrieveDevicePolicy());
+      session_manager_client()->BlockingRetrieveDevicePolicy(),
+      SessionManagerClient::SUCCESS);

[emaxx, 2017/04/18 15:03:17]

Same comment as was above for DeviceLocalAccountPolicyStore: it's better to
obtain the actual response type instead of injecting the possibly untrue
"SUCCESS" flag.

[igorcov, 2017/04/20 14:52:29]

Done.

 }
 
 void SessionManagerOperation::ValidateDeviceSettings(
-    const std::string& policy_blob) {
+    const std::string& policy_blob,
+    const chromeos::SessionManagerClient::RetrievePolicyResponseType&
+        response_type) {
   std::unique_ptr<em::PolicyFetchResponse> policy(
       new em::PolicyFetchResponse());
-  if (policy_blob.empty()) {
+  if (policy_blob.empty() && response_type == SessionManagerClient::SUCCESS) {
     ReportResult(DeviceSettingsService::STORE_NO_POLICY);
     return;
   }
 
-  if (!policy->ParseFromString(policy_blob) ||
-      !policy->IsInitialized()) {
+  if (!policy->ParseFromString(policy_blob) || !policy->IsInitialized() ||
+      response_type != SessionManagerClient::SUCCESS) {

[emaxx, 2017/04/18 15:03:17]

nit: Maybe move the response_type comparison into the beginning of the
condition, so that the parsing is skipped completely in case of errors?

[igorcov, 2017/04/20 14:52:29]

Didn't notice that, thanks.

     ReportResult(DeviceSettingsService::STORE_INVALID_POLICY);
     return;
   }