cros: No migration banner if user not allowed for ARC

chrome/browser/chromeos/login/screens/user_selection_screen.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/login/screens/user_selection_screen.h"
 
 #include <stddef.h>
 
 #include <utility>
 
@@ skipping 131 matching lines @@
   return quick_unlock_storage->IsFingerprintAuthenticationAvailable();
 }
 
 // Returns true if dircrypto migration check should be performed.
 bool ShouldCheckNeedDircryptoMigration() {
   return !base::CommandLine::ForCurrentProcess()->HasSwitch(
              switches::kDisableEncryptionMigration) &&
          arc::IsArcAvailable();
 }
 
+// Returns true if the user can run ARC based on the user type.
+bool IsUserAllowedForARC(const AccountId& account_id) {
+  if (!user_manager::UserManager::IsInitialized())
+    return false;
+
+  const user_manager::User* user =
+      user_manager::UserManager::Get()->FindUser(account_id);
+  if (!user)
+    return false;
+
+  return user->HasGaiaAccount() || (user->IsActiveDirectoryUser() &&

[kinaba, 2017/05/16 05:12:39]

Can this check filter out the
profile->IsLegacySupervised()
case in IsArcAllowedInAppListForProfile? (I believe it can because supervised
users don't seem to have Gaia account), but just to confirm.

[xiyuan, 2017/05/16 06:21:58]

Yes, legacy supervised user is managed locally (i.e. they do not have Gaia
accounts). So should be filtered out. I think it is the same as
profile->IsLegacySupervised().

[hidehiko, 2017/05/16 06:31:54]

What about Ephemeral case?

Also, can the logic across dirs be unified in some place (like
components/arc/arc_util, etc.?) in later CL (not necessary to be done in this
CL, but I think it is better for maintenance for consistency of the conditions)?

[kinaba, 2017/05/16 07:20:11]

I believe ephemeral users don't have homedir to migrate so
it should be ok to ignore for this current purpose.
(if there's no existing ecryptfs homedir the banner won't be shown.)


That said I agree we want to have a unified source of this kind of check.
Filing a crbug and landing this CL is fine for me though.

[xiyuan, 2017/05/16 16:02:55]

Correct. Ephemeral users would not have their cryptohome persisted and would not
even have user pods on the login screen. The banner check logic would not run
for them.

Filed http://crbug.com/722876 for the follow up work.

+                                    arc::IsArcAllowedForActiveDirectoryUsers());
+}
+
 }  // namespace
 
 // Helper class to call cryptohome to check whether a user needs dircrypto
 // migration. The check results are cached to limit calls to cryptohome.
 class UserSelectionScreen::DircryptoMigrationChecker {
  public:
   explicit DircryptoMigrationChecker(UserSelectionScreen* owner)
       : owner_(owner), weak_ptr_factory_(this) {}
   ~DircryptoMigrationChecker() = default;
 
   // Start to check whether the given user needs dircrypto migration.
   void Check(const AccountId& account_id) {
     focused_user_ = account_id;
 
     auto it = needs_dircrypto_migration_cache_.find(account_id);
     if (it != needs_dircrypto_migration_cache_.end()) {
       UpdateUI(account_id, it->second);
       return;
     }
 
+    // No banner if the user is not allowed for ARC.
+    if (!IsUserAllowedForARC(account_id)) {
+      UpdateUI(account_id, false);
+      return;
+    }
+
     DBusThreadManager::Get()
         ->GetCryptohomeClient()
         ->WaitForServiceToBeAvailable(
             base::Bind(&DircryptoMigrationChecker::RunCryptohomeCheck,
                        weak_ptr_factory_.GetWeakPtr(), account_id));
   }
 
  private:
   // WaitForServiceToBeAvailable callback to invoke NeedsDircryptoMigration when
   // cryptohome service is available.
@@ skipping 511 matching lines @@
   // The user profile should exist if and only if this is the lock screen.
   DCHECK_EQ(!!profile, GetScreenType() == LOCK_SCREEN);
 
   if (!profile)
     profile = profile_helper->GetSigninProfile();
 
   return EasyUnlockService::Get(profile);
 }
 
 }  // namespace chromeos