Network traffic annotation added to OAuth2ApiCallFlow and its subclasses.

chrome/browser/extensions/api/identity/identity_get_auth_token_function.cc

 // Copyright 2017 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/api/identity/identity_get_auth_token_function.h"
 
 #include "base/strings/string_number_conversions.h"
 #include "chrome/browser/extensions/api/identity/identity_api.h"
 #include "chrome/browser/extensions/api/identity/identity_constants.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/signin/chrome_signin_client_factory.h"
 #include "chrome/browser/signin/profile_oauth2_token_service_factory.h"
 #include "chrome/browser/signin/signin_manager_factory.h"
 #include "chrome/common/extensions/api/identity.h"
 #include "components/signin/core/browser/profile_oauth2_token_service.h"
 #include "components/signin/core/browser/signin_manager.h"
 #include "components/signin/core/common/profile_management_switches.h"
 #include "extensions/common/extension_l10n_util.h"
 #include "google_apis/gaia/gaia_urls.h"
+#include "net/traffic_annotation/network_traffic_annotation.h"
 
 #if defined(OS_CHROMEOS)
 #include "chrome/browser/app_mode/app_mode_utils.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/chromeos/login/session/user_session_manager.h"
 #include "chrome/browser/chromeos/policy/browser_policy_connector_chromeos.h"
 #include "chrome/browser/chromeos/settings/device_oauth2_token_service.h"
 #include "chrome/browser/chromeos/settings/device_oauth2_token_service_factory.h"
 #include "components/user_manager/user_manager.h"
 #include "google_apis/gaia/gaia_constants.h"
@@ skipping 540 matching lines @@
   }
 #endif
   login_token_request_ = service->StartRequest(
       token_key_->account_id, OAuth2TokenService::ScopeSet(), this);
 }
 
 void IdentityGetAuthTokenFunction::StartGaiaRequest(
     const std::string& login_access_token) {
   DCHECK(!login_access_token.empty());
   mint_token_flow_.reset(CreateMintTokenFlow());
-  mint_token_flow_->Start(GetProfile()->GetRequestContext(),
-                          login_access_token);
+  net::NetworkTrafficAnnotationTag traffic_annotation =
+      net::DefineNetworkTrafficAnnotation("...", R"(
+        semantics {
+          sender: "..."

[Michael Courage, 2017/05/17 22:59:16]

Chrome Identity API maybe? Really the sender is a Chrome App or Extension

[Ramin Halavati, 2017/05/24 13:04:41]

|sender| should represent this module, which is creating the request. I think
"Chrome Identity API" is good. 

+          description: "..."

[Michael Courage, 2017/05/17 22:59:16]

requests a token from gaia allowing an app or extension to act as the user when
calling other google APIs

[Ramin Halavati, 2017/05/24 13:04:40]

Done.

+          trigger: "..."

[Michael Courage, 2017/05/17 22:59:16]

api call from the app/extension

[Ramin Halavati, 2017/05/24 13:04:40]

Done.

+          data: "..."

[Michael Courage, 2017/05/17 22:59:16]

The data sent is the user's login token, the identity of a chrome app/extension,
and a list of oauth scopes requested by the app/extension.

[Ramin Halavati, 2017/05/24 13:04:41]

Done.

+          destination: WEBSITE/GOOGLE_OWNED_SERVICE/OTHER/LOCAL

[Michael Courage, 2017/05/17 22:59:16]

talks to a google owned service (gaia)

[Ramin Halavati, 2017/05/24 13:04:41]

Done.

+        }
+        policy {

[Michael Courage, 2017/05/17 22:59:16]

I guess it's hard to split up these annotations given the way they are
implemented, but it doesn't make a lot of sense for this piece of code to be
declaring things like the cookie store used, since it doesn't control the cookie
store used. 

[Ramin Halavati, 2017/05/24 13:04:40]

Acknowledged.

+          cookies_allowed: false/true

[Michael Courage, 2017/05/17 22:59:16]

Looks like OAuth2ApiCallFlow disables cookies

[Ramin Halavati, 2017/05/24 13:04:41]

Done.

+          cookies_store: "..."
+          setting: "..."
+          chrome_policy {

[Michael Courage, 2017/05/17 22:59:16]

I don't know much about chrome policy. There's a SigninAllowed policy that says
it can disable chrome.identity APIs (which would include this one), but for some
reason it says it is deprecated.

[Ramin Halavati, 2017/05/24 13:04:41]

Acknowledged.

+            [POLICY_NAME] {
+              policy_options {mode: MANDATORY/RECOMMENDED/UNSET}
+              [POLICY_NAME]: ... //(value to disable it)
+            }
+          }
+          policy_exception_justification: "..."
+        })");
+  mint_token_flow_->Start(GetProfile()->GetRequestContext(), login_access_token,
+                          traffic_annotation);
 }
 
 void IdentityGetAuthTokenFunction::ShowLoginPopup() {
   signin_flow_.reset(new IdentitySigninFlow(this, GetProfile()));
   signin_flow_->Start();
 }
 
 void IdentityGetAuthTokenFunction::ShowOAuthApprovalDialog(
     const IssueAdviceInfo& issue_advice) {
   const std::string locale = extension_l10n_util::CurrentLocaleOrDefault();
@@ skipping 46 matching lines @@
   // Component apps using auto_approve may use Chrome's client ID by
   // omitting the field.
   if (client_id.empty() && extension()->location() == Manifest::COMPONENT &&
       oauth2_info.auto_approve) {
     client_id = GaiaUrls::GetInstance()->oauth2_chrome_client_id();
   }
   return client_id;
 }
 
 }  // namespace extensions