Network traffic annotation added to gaia_auth_fetcher.

google_apis/gaia/gaia_auth_fetcher.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "google_apis/gaia/gaia_auth_fetcher.h"
 
 #include <string>
 #include <utility>
 #include <vector>
 
@@ skipping 201 matching lines @@
 
 void GaiaAuthFetcher::SetLogoutHeaders(const std::string& headers) {
   logout_headers_ = headers;
 }
 
 void GaiaAuthFetcher::CancelRequest() {
   fetcher_.reset();
   fetch_pending_ = false;
 }
 
-void GaiaAuthFetcher::CreateAndStartGaiaFetcher(const std::string& body,
-                                                const std::string& headers,
-                                                const GURL& gaia_gurl,
-                                                int load_flags) {
+void GaiaAuthFetcher::CreateAndStartGaiaFetcher(
+    const std::string& body,
+    const std::string& headers,
+    const GURL& gaia_gurl,
+    int load_flags,
+    const net::NetworkTrafficAnnotationTag& traffic_annotation) {
   DCHECK(!fetch_pending_) << "Tried to fetch two things at once!";
   fetcher_ = net::URLFetcher::Create(
       0, gaia_gurl, body.empty() ? net::URLFetcher::GET : net::URLFetcher::POST,
-      this);
+      this, traffic_annotation);
   fetcher_->SetRequestContext(getter_);
   fetcher_->SetUploadData("application/x-www-form-urlencoded", body);
   gaia::MarkURLFetcherAsGaia(fetcher_.get());
 
   VLOG(2) << "Gaia fetcher URL: " << gaia_gurl.spec();
   VLOG(2) << "Gaia fetcher headers: " << headers;
   VLOG(2) << "Gaia fetcher body: " << body;
 
   // The Gaia token exchange requests do not require any cookie-based
   // identification as part of requests.  We suppress sending any cookies to
@@ skipping 264 matching lines @@
 
     if (sessionDictionary->GetString("login_hint", login_hint))
       break;
   }
 
   if (login_hint->empty())
     return false;
   return true;
 }
 
 void GaiaAuthFetcher::StartIssueAuthToken(const std::string& sid,

[msarda, 2017/05/15 12:23:49]

I think this method is no longer used. I think it is fine for us to remove it
instead of annotating it.

[Ramin Halavati, 2017/05/15 13:27:50]

Done.

                                           const std::string& lsid,
                                           const char* const service) {
   DCHECK(!fetch_pending_) << "Tried to fetch two things at once!";
 
   VLOG(1) << "Starting IssueAuthToken for: " << service;
   requested_service_ = service;
   request_body_ = MakeIssueAuthTokenBody(sid, lsid, service);
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("gaia_auth_", R"(
+        semantics {
+          sender: "Gaia Auth API"

[msarda, 2017/05/15 12:23:49]

Here and everywhere else: Chrome - Google authentication API.

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          description: "..."
+          trigger: "..."
+          data: "..."
+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false/true
+          cookies_store: "..."
+          setting:
+            "This feature cannot be disabled in settings, but if user signs "
+            "out of Chrome, this request would not be made."
+          chrome_policy {
+            SigninAllowed {
+              policy_options {mode: MANDATORY}
+              SigninAllowed: false
+            }
+          }
+        })");
   CreateAndStartGaiaFetcher(request_body_, std::string(),
-                            issue_auth_token_gurl_, kLoadFlagsIgnoreCookies);
+                            issue_auth_token_gurl_, kLoadFlagsIgnoreCookies,
+                            traffic_annotation);
 }
 
 void GaiaAuthFetcher::StartRevokeOAuth2Token(const std::string& auth_token) {
   DCHECK(!fetch_pending_) << "Tried to fetch two things at once!";
 
   VLOG(1) << "Starting OAuth2 token revocation";
   request_body_ = MakeRevokeTokenBody(auth_token);
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("gaia_auth_", R"(
+        semantics {
+          sender: "Gaia Auth API"
+          description: "..."

[msarda, 2017/05/15 12:23:50]

This request revokes an OAuth2 refresh token.

[Ramin Halavati, 2017/05/15 13:27:48]

Done.

+          trigger: "..."

[msarda, 2017/05/15 12:23:48]

Here and everywhere else: Same as the comment below at
StartGetCheckConnectionInfo

[Ramin Halavati, 2017/05/15 13:27:48]

Done.

+          data: "..."

[msarda, 2017/05/15 12:23:48]

The OAuth2 refresh token that should be revoked.

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false/true

[msarda, 2017/05/15 12:23:50]

false

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          cookies_store: "..."

[msarda, 2017/05/15 12:23:48]

Remove.

[Ramin Halavati, 2017/05/15 13:27:48]

Done.

+          setting:
+            "This feature cannot be disabled in settings, but if user signs "
+            "out of Chrome, this request would not be made."
+          chrome_policy {
+            SigninAllowed {
+              policy_options {mode: MANDATORY}
+              SigninAllowed: false
+            }
+          }
+        })");
   CreateAndStartGaiaFetcher(request_body_, std::string(), oauth2_revoke_gurl_,
-                            kLoadFlagsIgnoreCookies);
+                            kLoadFlagsIgnoreCookies, traffic_annotation);
 }
 
 void GaiaAuthFetcher::StartCookieForOAuthLoginTokenExchange(
     const std::string& session_index) {
   StartCookieForOAuthLoginTokenExchangeWithDeviceId(session_index,
                                                     std::string());
 }
 
 void GaiaAuthFetcher::StartCookieForOAuthLoginTokenExchangeWithDeviceId(
     const std::string& session_index,
@@ skipping 25 matching lines @@
   if (!session_index.empty())
     query_string += "&authuser=" + session_index;
 
   std::string device_id_header;
   if (!device_id.empty()) {
     device_id_header =
         base::StringPrintf(kDeviceIdHeaderFormat, device_id.c_str());
   }
 
   fetch_token_from_auth_code_ = fetch_token_from_auth_code;
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("gaia_auth_", R"(

[msarda, 2017/05/15 12:23:49]

What is "gaia_auth_" used for?

[Ramin Halavati, 2017/05/15 13:27:48]

It's the unique_id of this request, it can be used to collect stats on different
requests, debug network errors, etc.

+        semantics {
+          sender: "Gaia Auth API"
+          description: "..."

[msarda, 2017/05/15 12:23:50]

This request exchanges exchange the cookies of a Google signed-in user session
for an OAuth2 refresh token.

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          trigger: "..."
+          data: "..."

[msarda, 2017/05/15 12:23:50]

This request includes the following data: the Google console client ID of the
Chrome application, the ID of the device, the index of the session in the Google
authentication cookies.

[Ramin Halavati, 2017/05/15 13:27:50]

Done.

+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false/true

[msarda, 2017/05/15 12:23:49]

true

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          cookies_store: "..."
+          setting:
+            "This feature cannot be disabled in settings, but if user signs "
+            "out of Chrome, this request would not be made."
+          chrome_policy {
+            SigninAllowed {
+              policy_options {mode: MANDATORY}
+              SigninAllowed: false
+            }
+          }
+        })");
   CreateAndStartGaiaFetcher(std::string(), device_id_header,
                             client_login_to_oauth2_gurl_.Resolve(query_string),
-                            net::LOAD_NORMAL);
+                            net::LOAD_NORMAL, traffic_annotation);
 }
 
 void GaiaAuthFetcher::StartAuthCodeForOAuth2TokenExchange(
     const std::string& auth_code) {
   StartAuthCodeForOAuth2TokenExchangeWithDeviceId(auth_code, std::string());
 }
 
 void GaiaAuthFetcher::StartAuthCodeForOAuth2TokenExchangeWithDeviceId(
     const std::string& auth_code,
     const std::string& device_id) {
   DCHECK(!fetch_pending_) << "Tried to fetch two things at once!";
 
   VLOG(1) << "Starting OAuth token pair fetch";
   request_body_ = MakeGetTokenPairBody(auth_code, device_id);
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("gaia_auth_", R"(
+        semantics {
+          sender: "Gaia Auth API"
+          description: "..."

[msarda, 2017/05/15 12:23:49]

This request exchanges an authorization code for an Oauth 2.0 refresh token.

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          trigger: "..."
+          data: "..."

[msarda, 2017/05/15 12:23:50]

This request includes the following data:
* the Google console client ID and client secret of the Chrome application
* the OAuth 2.0 authorization code
* the ID of the device

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false/true

[msarda, 2017/05/15 12:23:49]

false

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          cookies_store: "..."
+          setting:
+            "This feature cannot be disabled in settings, but if user signs "
+            "out of Chrome, this request would not be made."
+          chrome_policy {
+            SigninAllowed {
+              policy_options {mode: MANDATORY}
+              SigninAllowed: false
+            }
+          }
+        })");
   CreateAndStartGaiaFetcher(request_body_, std::string(), oauth2_token_gurl_,
-                            kLoadFlagsIgnoreCookies);
+                            kLoadFlagsIgnoreCookies, traffic_annotation);
 }
 
 void GaiaAuthFetcher::StartGetUserInfo(const std::string& lsid) {
   DCHECK(!fetch_pending_) << "Tried to fetch two things at once!";
 
   VLOG(1) << "Starting GetUserInfo for lsid=" << lsid;
   request_body_ = MakeGetUserInfoBody(lsid);
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("gaia_auth_", R"(
+        semantics {
+          sender: "Gaia Auth API"
+          description: "..."

[msarda, 2017/05/15 12:23:50]

This request fetches user information of a Google account.

[Ramin Halavati, 2017/05/15 13:27:48]

Done.

+          trigger: "..."

[msarda, 2017/05/15 12:23:50]

This fetcher is only used after signing in with a child account.

[Ramin Halavati, 2017/05/15 13:27:48]

Done.

+          data: "..."

[msarda, 2017/05/15 12:23:48]

The value of the Google authentication LSID cookie.

[Ramin Halavati, 2017/05/15 13:27:50]

Done.

+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false/true

[msarda, 2017/05/15 12:23:49]

false

[Ramin Halavati, 2017/05/15 13:27:50]

Done.

+          cookies_store: "..."

[msarda, 2017/05/15 12:23:50]

?

[Ramin Halavati, 2017/05/15 13:27:50]

Done.

+          setting:
+            "This feature cannot be disabled in settings, but if user signs "
+            "out of Chrome, this request would not be made."
+          chrome_policy {
+            SigninAllowed {
+              policy_options {mode: MANDATORY}
+              SigninAllowed: false
+            }
+          }
+        })");
   CreateAndStartGaiaFetcher(request_body_, std::string(), get_user_info_gurl_,
-                            kLoadFlagsIgnoreCookies);
+                            kLoadFlagsIgnoreCookies, traffic_annotation);
 }
 
 void GaiaAuthFetcher::StartMergeSession(const std::string& uber_token,
                                         const std::string& external_cc_result) {
   DCHECK(!fetch_pending_) << "Tried to fetch two things at once!";
 
   VLOG(1) << "Starting MergeSession with uber_token=" << uber_token;
 
   // The continue URL is a required parameter of the MergeSession API, but in
   // this case we don't actually need or want to navigate to it.  Setting it to
   // an arbitrary Google URL.
   //
   // In order for the new session to be merged correctly, the server needs to
   // know what sessions already exist in the browser.  The fetcher needs to be
   // created such that it sends the cookies with the request, which is
   // different from all other requests the fetcher can make.
   std::string continue_url("http://www.google.com");
   std::string query = MakeMergeSessionQuery(uber_token, external_cc_result,
                                             continue_url, source_);
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("gaia_auth_", R"(
+        semantics {
+          sender: "Gaia Auth API"
+          description: "..."

[msarda, 2017/05/15 12:23:49]

This request adds an account to the Google authentication cookies.

[Ramin Halavati, 2017/05/15 13:27:50]

Done.

+          trigger: "..."
+          data: "..."

[msarda, 2017/05/15 12:23:50]

This request includes the following data:
* the user-auth token
* a string containing the result of connection checks for various Google web
properties (optional)

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false/true

[msarda, 2017/05/15 12:23:48]

true

[Ramin Halavati, 2017/05/15 13:27:50]

Done.

+          cookies_store: "..."

[msarda, 2017/05/15 12:23:48]

?

[Ramin Halavati, 2017/05/15 13:27:50]

Done.

+          setting:
+            "This feature cannot be disabled in settings, but if user signs "
+            "out of Chrome, this request would not be made."
+          chrome_policy {
+            SigninAllowed {
+              policy_options {mode: MANDATORY}
+              SigninAllowed: false
+            }
+          }
+        })");
   CreateAndStartGaiaFetcher(std::string(), std::string(),
                             merge_session_gurl_.Resolve(query),
-                            net::LOAD_NORMAL);
+                            net::LOAD_NORMAL, traffic_annotation);
 }
 
 void GaiaAuthFetcher::StartTokenFetchForUberAuthExchange(
     const std::string& access_token,
     bool is_bound_to_channel_id) {
   DCHECK(!fetch_pending_) << "Tried to fetch two things at once!";
 
   VLOG(1) << "Starting StartTokenFetchForUberAuthExchange with access_token="
            << access_token;
   std::string authentication_header =
       base::StringPrintf(kOAuthHeaderFormat, access_token.c_str());
   int load_flags =
       is_bound_to_channel_id ? net::LOAD_NORMAL : kLoadFlagsIgnoreCookies;
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("gaia_auth_", R"(
+        semantics {
+          sender: "Gaia Auth API"

[msarda, 2017/05/15 12:23:48]

Here and everywhere else: Chrome - Google authentication API.

[Ramin Halavati, 2017/05/15 13:27:50]

Done.

+          description: "..."

[msarda, 2017/05/15 12:23:49]

This request exchanges an Oauth2 access token for an uber-auth token that. This
token may be used to add an account to the Google authentication cookies.

[Ramin Halavati, 2017/05/15 13:27:48]

Please elaborate more for a non-technical reader.

+          trigger: "..."

[msarda, 2017/05/15 12:23:49]

Same as the comment below at StartGetCheckConnectionInfo

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          data: "..."

[msarda, 2017/05/15 12:23:49]

This request contains an OAuth2 access token. 

[Ramin Halavati, 2017/05/15 13:27:48]

Done.

+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false/true

[msarda, 2017/05/15 12:23:49]

true or false

[Ramin Halavati, 2017/05/15 13:27:49]

Done, let's write 'True' is it's the privacy concerning case.

+          cookies_store: "..."

[msarda, 2017/05/15 12:23:49]

What should this be?

[Ramin Halavati, 2017/05/15 13:27:50]

Done.

+          setting:
+            "This feature cannot be disabled in settings, but if user signs "
+            "out of Chrome, this request would not be made."
+          chrome_policy {
+            SigninAllowed {
+              policy_options {mode: MANDATORY}
+              SigninAllowed: false
+            }
+          }
+        })");
   CreateAndStartGaiaFetcher(std::string(), authentication_header,
-                            uberauth_token_gurl_, load_flags);
+                            uberauth_token_gurl_, load_flags,
+                            traffic_annotation);
 }
 
 void GaiaAuthFetcher::StartOAuthLogin(const std::string& access_token,
                                       const std::string& service) {
   DCHECK(!fetch_pending_) << "Tried to fetch two things at once!";
 
   request_body_ = MakeOAuthLoginBody(service, source_);
   std::string authentication_header =
       base::StringPrintf(kOAuth2BearerHeaderFormat, access_token.c_str());
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("gaia_auth_", R"(
+        semantics {
+          sender: "Gaia Auth API"

[msarda, 2017/05/15 12:23:48]

Chrome - Google authentication API.

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          description: "..."

[msarda, 2017/05/15 12:23:50]

This request exchanges an OAuthLogin-scoped oauth2 access token for a
ClientLogin-style service tokens. The response to this request is the same as
the response to a ClientLogin request, except that captcha challenges are never
issued.

[Ramin Halavati, 2017/05/15 13:27:50]

Please elaborate for a less technical reader.

+          trigger: "..."

[msarda, 2017/05/15 12:23:50]

Same as the comment below at StartGetCheckConnectionInfo

[Ramin Halavati, 2017/05/15 13:27:48]

Done.

+          data: "..."

[msarda, 2017/05/15 12:23:48]

This request contains an OAuth2 access token and the service for which a
ClientLogin-style should be delivered. 

[Ramin Halavati, 2017/05/15 13:27:50]

Done.

+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false/true
+          cookies_store: "..."

[msarda, 2017/05/15 12:23:50]

Here and everywhere else: What should this be?

[Ramin Halavati, 2017/05/15 13:27:48]

Done.

+          setting:
+            "This feature cannot be disabled in settings, but if user signs "
+            "out of Chrome, this request would not be made."
+          chrome_policy {
+            SigninAllowed {
+              policy_options {mode: MANDATORY}
+              SigninAllowed: false
+            }
+          }
+        })");
   CreateAndStartGaiaFetcher(request_body_, authentication_header,
-                            oauth_login_gurl_, net::LOAD_NORMAL);
+                            oauth_login_gurl_, net::LOAD_NORMAL,
+                            traffic_annotation);
 }
 
 void GaiaAuthFetcher::StartListAccounts() {
   DCHECK(!fetch_pending_) << "Tried to fetch two things at once!";
 
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("gaia_auth_", R"(
+        semantics {
+          sender: "Gaia Auth API"

[msarda, 2017/05/15 12:23:48]

Chrome - Google authentication API.

[Ramin Halavati, 2017/05/15 13:27:48]

Done.

+          description: "..."

[msarda, 2017/05/15 12:23:48]

This request is used to list the accounts in the Google authentication cookies.

[Ramin Halavati, 2017/05/15 13:27:50]

Done.

+          trigger: "..."

[msarda, 2017/05/15 12:23:49]

Same as the comment below at StartGetCheckConnectionInfo

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          data: "..."

[msarda, 2017/05/15 12:23:50]

None.

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false/true

[msarda, 2017/05/15 12:23:49]

true

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          cookies_store: "..."

[msarda, 2017/05/15 12:23:50]

What should this be?

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          setting:
+            "This feature cannot be disabled in settings, but if user signs "
+            "out of Chrome, this request would not be made."
+          chrome_policy {
+            SigninAllowed {
+              policy_options {mode: MANDATORY}
+              SigninAllowed: false
+            }
+          }
+        })");
   CreateAndStartGaiaFetcher(" ",  // To force an HTTP POST.
                             "Origin: https://www.google.com",
-                            list_accounts_gurl_, net::LOAD_NORMAL);
+                            list_accounts_gurl_, net::LOAD_NORMAL,
+                            traffic_annotation);
 }
 
 void GaiaAuthFetcher::StartLogOut() {
   DCHECK(!fetch_pending_) << "Tried to fetch two things at once!";
 
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("gaia_auth_", R"(
+        semantics {
+          sender: "Gaia Auth API"

[msarda, 2017/05/15 12:23:50]

Chrome - Google authentication API.

[Ramin Halavati, 2017/05/15 13:27:50]

Done.

+          description: "..."

[msarda, 2017/05/15 12:23:49]

This request is part of the Chrome - Google authentication API and allows its
callers to sign out all Google accounts from the content area.

[Ramin Halavati, 2017/05/15 13:27:50]

Done.

+          trigger: "..."

[msarda, 2017/05/15 12:23:48]

Same as the comment below at StartGetCheckConnectionInfo

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          data: "..."

[msarda, 2017/05/15 12:23:50]

None.

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false/true

[msarda, 2017/05/15 12:23:49]

true

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          cookies_store: "..."

[msarda, 2017/05/15 12:23:50]

What should this be?

[Ramin Halavati, 2017/05/15 13:27:50]

If you don't modify it, the default is 'user'.

+          setting:
+            "This feature cannot be disabled in settings, but if user signs "
+            "out of Chrome, this request would not be made."
+          chrome_policy {
+            SigninAllowed {
+              policy_options {mode: MANDATORY}
+              SigninAllowed: false
+            }
+          }
+        })");
   CreateAndStartGaiaFetcher(std::string(), logout_headers_, logout_gurl_,
-                            net::LOAD_NORMAL);
+                            net::LOAD_NORMAL, traffic_annotation);
 }
 
 void GaiaAuthFetcher::StartGetCheckConnectionInfo() {
   DCHECK(!fetch_pending_) << "Tried to fetch two things at once!";
 
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("gaia_auth_", R"(
+        semantics {
+          sender: "Gaia Auth API"

[msarda, 2017/05/15 12:23:48]

Chrome - Google authentication API.

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

+          description: "..."

[msarda, 2017/05/15 12:23:49]

This request is used to fetch from the Google authentication server the the list
of URLs to check its connection info.

[Ramin Halavati, 2017/05/15 13:27:49]

Could you please elaborate on the description?

+          trigger: "..."

[msarda, 2017/05/15 12:23:48]

It is not clear to me what to say here:
1. This is part of an API, so it may be called by any user, so we may leave this
as "Undefined - this is part of an API, so any caller may decide to call this
method."
2. Today, this method is called from
https://cs.chromium.org/chromium/src/components/signin/core/browser/gaia_cook...

So it is not clear to me if we want this to be specific about this call.

[Ramin Halavati, 2017/05/15 13:27:48]

I didn't get the description clearly, let's continue with trigger when that's
done.

+          data: "..."

[msarda, 2017/05/15 12:23:50]

None

[Ramin Halavati, 2017/05/15 13:27:48]

Done.

+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false/true

[msarda, 2017/05/15 12:23:49]

false

[Ramin Halavati, 2017/05/15 13:27:48]

Done.

+          cookies_store: "..."

[msarda, 2017/05/15 12:23:50]

Remove line

[Ramin Halavati, 2017/05/15 13:27:50]

Done.

+          setting:
+            "This feature cannot be disabled in settings, but if user signs "
+            "out of Chrome, this request would not be made."
+          chrome_policy {
+            SigninAllowed {
+              policy_options {mode: MANDATORY}
+              SigninAllowed: false
+            }
+          }
+        })");
   CreateAndStartGaiaFetcher(std::string(), std::string(),
                             get_check_connection_info_url_,
-                            kLoadFlagsIgnoreCookies);
+                            kLoadFlagsIgnoreCookies, traffic_annotation);
 }
 
 void GaiaAuthFetcher::StartListIDPSessions(const std::string& scopes,

[msarda, 2017/05/15 12:23:49]

It looks like this method is never used - I would say we should probably remove
it instead of annotating it:
https://cs.chromium.org/chromium/src/google_apis/gaia/gaia_auth_fetcher.h?typ...

[Ramin Halavati, 2017/05/15 13:27:48]

Done.

                                            const std::string& domain) {
   DCHECK(!fetch_pending_) << "Tried to fetch two things at once!";
 
   request_body_ = MakeListIDPSessionsBody(scopes, domain);
   requested_service_ = kListIdpServiceRequested;
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("gaia_auth_", R"(
+        semantics {
+          sender: "Gaia Auth API"
+          description: "..."
+          trigger: "..."
+          data: "..."
+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false/true
+          cookies_store: "..."
+          setting:
+            "This feature cannot be disabled in settings, but if user signs "
+            "out of Chrome, this request would not be made."
+          chrome_policy {
+            SigninAllowed {
+              policy_options {mode: MANDATORY}
+              SigninAllowed: false
+            }
+          }
+        })");
   CreateAndStartGaiaFetcher(request_body_, std::string(), oauth2_iframe_url_,
-                            net::LOAD_NORMAL);
+                            net::LOAD_NORMAL, traffic_annotation);
 }
 
 void GaiaAuthFetcher::StartGetTokenResponse(const std::string& scopes,

[msarda, 2017/05/15 12:23:50]

It looks like this method is never used - I would say we should probably remove
it instead of annotating it:
https://cs.chromium.org/chromium/src/google_apis/gaia/gaia_auth_fetcher.h?typ...

[Ramin Halavati, 2017/05/15 13:27:49]

Done.

                                             const std::string& domain,
                                             const std::string& login_hint) {
   DCHECK(!fetch_pending_) << "Tried to fetch two things at once!";
 
   request_body_ = MakeGetTokenResponseBody(scopes, domain, login_hint);
   requested_service_ = kGetTokenResponseRequested;
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("gaia_auth_", R"(
+        semantics {
+          sender: "Gaia Auth API"
+          description: "..."
+          trigger: "..."
+          data: "..."
+          destination: GOOGLE_OWNED_SERVICE
+        }
+        policy {
+          cookies_allowed: false/true
+          cookies_store: "..."
+          setting:
+            "This feature cannot be disabled in settings, but if user signs "
+            "out of Chrome, this request would not be made."
+          chrome_policy {
+            SigninAllowed {
+              policy_options {mode: MANDATORY}
+              SigninAllowed: false
+            }
+          }
+        })");
   CreateAndStartGaiaFetcher(request_body_, std::string(), oauth2_iframe_url_,
-                            net::LOAD_NORMAL);
+                            net::LOAD_NORMAL, traffic_annotation);
 }
 
 // static
 GoogleServiceAuthError GaiaAuthFetcher::GenerateAuthError(
     const std::string& data,
     const net::URLRequestStatus& status) {
   if (!status.is_success()) {
     if (status.status() == net::URLRequestStatus::CANCELED) {
       return GoogleServiceAuthError(GoogleServiceAuthError::REQUEST_CANCELED);
     }
@@ skipping 310 matching lines @@
   return alleged_error.find(kSecondFactor) !=
       std::string::npos;
 }
 
 // static
 bool GaiaAuthFetcher::IsWebLoginRequiredSuccess(
     const std::string& alleged_error) {
   return alleged_error.find(kWebLoginRequired) !=
       std::string::npos;
 }