Network traffic annotation added to OAuth2ApiCallFlow and its subclasses.

components/cryptauth/cryptauth_client_impl.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/cryptauth/cryptauth_client_impl.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/command_line.h"
@@ skipping 42 matching lines @@
     std::unique_ptr<CryptAuthAccessTokenFetcher> access_token_fetcher,
     scoped_refptr<net::URLRequestContextGetter> url_request_context,
     const DeviceClassifier& device_classifier)
     : api_call_flow_(std::move(api_call_flow)),
       access_token_fetcher_(std::move(access_token_fetcher)),
       url_request_context_(url_request_context),
       device_classifier_(device_classifier),
       has_call_started_(false),
       weak_ptr_factory_(this) {}
 
 CryptAuthClientImpl::~CryptAuthClientImpl() {

[sacomoto, 2017/06/15 06:13:23]

For all requests:

destination: GOOGLE_OWNED_SERVICE

[Ramin Halavati, 2017/06/16 09:48:18]

Done.

 }
 
 void CryptAuthClientImpl::GetMyDevices(

[sacomoto, 2017/06/15 06:13:19]

Currently, this request (and the SendDeviceSyncTickle) can be triggered both by
EasyUnlock and Magic Tether. In the future, we expect other services to trigger
this service. So, I don't exactly what to put in the "trigger",  "setting" and
"chrome_policy".

To give a bit more context. This request list the user's devices registered on
CryptAuth. CryptAuth contains, among other informations, the public key
associated to each device. Those features (EasyUnlock and Magic Tether) use
theses keys to authenticate other devices when performing some local
communication (e.g. Bluetooth Low Energy).

In the future, we expect other features to use the similar methods (and keys)
when performing these local communications. So, this request might be have
several different triggers. 

[Ramin Halavati, 2017/06/16 09:48:17]

I moved the annotation to the caller function so that it can be given as an
argument and have precise values.

     const GetMyDevicesRequest& request,
     const GetMyDevicesCallback& callback,
     const ErrorCallback& error_callback) {
-  MakeApiCall(kGetMyDevicesPath, request, callback, error_callback);
+  net::PartialNetworkTrafficAnnotationTag partial_traffic_annotation =
+      net::DefinePartialNetworkTrafficAnnotation("...", "oauth2_api_call_flow",

[sacomoto, 2017/06/15 06:13:23]

cryptauth_get_my_devices

[Ramin Halavati, 2017/06/16 09:48:18]

Acknowledged.

+                                                 R"(
+      semantics {
+        sender: "..."
+        description: "..."
+        trigger: "..."
+        data: "..."
+        destination: WEBSITE/GOOGLE_OWNED_SERVICE/OTHER/LOCAL
+      }
+      policy {
+        setting: "..."
+        chrome_policy {
+          [POLICY_NAME] {
+            policy_options {mode: MANDATORY/RECOMMENDED/UNSET}
+            [POLICY_NAME]: ... //(value to disable it)
+          }
+        }
+        policy_exception_justification: "..."
+      })");
+  MakeApiCall(kGetMyDevicesPath, request, callback, error_callback,
+              partial_traffic_annotation);
 }
 
 void CryptAuthClientImpl::FindEligibleUnlockDevices(
     const FindEligibleUnlockDevicesRequest& request,
     const FindEligibleUnlockDevicesCallback& callback,
     const ErrorCallback& error_callback) {
-  MakeApiCall(kFindEligibleUnlockDevicesPath, request, callback,
-              error_callback);
+  net::PartialNetworkTrafficAnnotationTag partial_traffic_annotation =
+      net::DefinePartialNetworkTrafficAnnotation("...", "oauth2_api_call_flow",

[sacomoto, 2017/06/15 06:13:15]

cryptauth_find_eligible_unlock_devices

[Ramin Halavati, 2017/06/16 09:48:17]

Done.

+                                                 R"(
+      semantics {
+        sender: "..."

[sacomoto, 2017/06/15 06:13:11]

CryptAuth Device Manager.

[Ramin Halavati, 2017/06/16 09:48:16]

Done.

+        description: "..."

[sacomoto, 2017/06/15 06:13:12]

Gets the list of mobile devices that can be used by Smart Lock to unlock the
current device.

[Ramin Halavati, 2017/06/16 09:48:16]

Done.

+        trigger: "..."

[sacomoto, 2017/06/15 06:13:11]

This request is sent when the user starts the Smart Lock setup flow.

[Ramin Halavati, 2017/06/16 09:48:17]

Done.

+        data: "..."

[sacomoto, 2017/06/15 06:13:11]

The device's public key.

[Ramin Halavati, 2017/06/16 09:48:18]

Done.

+        destination: WEBSITE/GOOGLE_OWNED_SERVICE/OTHER/LOCAL
+      }
+      policy {
+        setting: "..."

[sacomoto, 2017/06/15 06:13:10]

This request will only be send if the user explicitly tries to enable Smart Lock
(EasyUnlock), i.e. starts the setup flow.

[Ramin Halavati, 2017/06/16 09:48:16]

Done.

+        chrome_policy {
+          [POLICY_NAME] {

[sacomoto, 2017/06/15 06:13:23]

EasyUnlockAllowed

[Ramin Halavati, 2017/06/16 09:48:17]

Done.

+            policy_options {mode: MANDATORY/RECOMMENDED/UNSET}

[sacomoto, 2017/06/15 06:13:11]

MANDATORY.

[Ramin Halavati, 2017/06/16 09:48:17]

We are removing this field as it's always MANDATORY.

+            [POLICY_NAME]: ... //(value to disable it)

[sacomoto, 2017/06/15 06:13:17]

EasyUnlockAllowed: false

[Ramin Halavati, 2017/06/16 09:48:17]

Done.

+          }
+        }
+        policy_exception_justification: "..."
+      })");
+  MakeApiCall(kFindEligibleUnlockDevicesPath, request, callback, error_callback,
+              partial_traffic_annotation);
 }
 
 void CryptAuthClientImpl::SendDeviceSyncTickle(
     const SendDeviceSyncTickleRequest& request,
     const SendDeviceSyncTickleCallback& callback,
     const ErrorCallback& error_callback) {
-  MakeApiCall(kSendDeviceSyncTicklePath, request, callback, error_callback);
+  net::PartialNetworkTrafficAnnotationTag partial_traffic_annotation =
+      net::DefinePartialNetworkTrafficAnnotation("...", "oauth2_api_call_flow",

[sacomoto, 2017/06/15 06:13:11]

cryptauth_device_sync_tickle

[Ramin Halavati, 2017/06/16 09:48:17]

Acknowledged.

+                                                 R"(
+      semantics {
+        sender: "..."
+        description: "..."
+        trigger: "..."
+        data: "..."
+        destination: WEBSITE/GOOGLE_OWNED_SERVICE/OTHER/LOCAL
+      }
+      policy {
+        setting: "..."
+        chrome_policy {
+          [POLICY_NAME] {
+            policy_options {mode: MANDATORY/RECOMMENDED/UNSET}
+            [POLICY_NAME]: ... //(value to disable it)
+          }
+        }
+        policy_exception_justification: "..."
+      })");
+  MakeApiCall(kSendDeviceSyncTicklePath, request, callback, error_callback,
+              partial_traffic_annotation);
 }
 
 void CryptAuthClientImpl::ToggleEasyUnlock(
     const ToggleEasyUnlockRequest& request,
     const ToggleEasyUnlockCallback& callback,
     const ErrorCallback& error_callback) {
-  MakeApiCall(kToggleEasyUnlockPath, request, callback, error_callback);
+  net::PartialNetworkTrafficAnnotationTag partial_traffic_annotation =
+      net::DefinePartialNetworkTrafficAnnotation("...", "oauth2_api_call_flow",

[sacomoto, 2017/06/15 06:13:14]

cryptauth_toggle_easyunlock

[Ramin Halavati, 2017/06/16 09:48:17]

Done.

+                                                 R"(
+      semantics {
+        sender: "..."

[sacomoto, 2017/06/15 06:13:11]

CryptAuth Device Manager

[Ramin Halavati, 2017/06/16 09:48:17]

Done.

+        description: "..."

[sacomoto, 2017/06/15 06:13:11]

Enables Smart Lock (EasyUnlock) for the current device.

[Ramin Halavati, 2017/06/16 09:48:16]

Done.

+        trigger: "..."

[sacomoto, 2017/06/15 06:13:16]

This request is send after the user goes through the EasyUnlock setup flow.

[Ramin Halavati, 2017/06/16 09:48:17]

Done.

+        data: "..."

[sacomoto, 2017/06/15 06:13:11]

The device public key.

[Ramin Halavati, 2017/06/16 09:48:16]

Done.

+        destination: WEBSITE/GOOGLE_OWNED_SERVICE/OTHER/LOCAL
+      }
+      policy {
+        setting: "..."

[sacomoto, 2017/06/15 06:13:15]

This will only be send if the user explicitly enables Smart Lock (EasyUnlock),
i.e. successfully complete the setup flow.

[Ramin Halavati, 2017/06/16 09:48:18]

Done.

+        chrome_policy {
+          [POLICY_NAME] {

[sacomoto, 2017/06/15 06:13:10]

EasyUnlockAllowed

[Ramin Halavati, 2017/06/16 09:48:17]

Done.

+            policy_options {mode: MANDATORY/RECOMMENDED/UNSET}

[sacomoto, 2017/06/15 06:13:21]

MANDATORY

[Ramin Halavati, 2017/06/16 09:48:16]

Acknowledged.

+            [POLICY_NAME]: ... //(value to disable it)

[sacomoto, 2017/06/15 06:13:10]

EasyUnlockAllowed: false

[Ramin Halavati, 2017/06/16 09:48:16]

Done.

+          }
+        }
+        policy_exception_justification: "..."
+      })");
+  MakeApiCall(kToggleEasyUnlockPath, request, callback, error_callback,
+              partial_traffic_annotation);
 }
 
 void CryptAuthClientImpl::SetupEnrollment(
     const SetupEnrollmentRequest& request,
     const SetupEnrollmentCallback& callback,
     const ErrorCallback& error_callback) {
-  MakeApiCall(kSetupEnrollmentPath, request, callback, error_callback);
+  net::PartialNetworkTrafficAnnotationTag partial_traffic_annotation =
+      net::DefinePartialNetworkTrafficAnnotation("...", "oauth2_api_call_flow",

[sacomoto, 2017/06/15 06:13:11]

cryptauth_enrollment_flow_setup

[Ramin Halavati, 2017/06/16 09:48:17]

Done.

+                                                 R"(
+      semantics {
+        sender: "..."

[sacomoto, 2017/06/15 06:13:23]

CryptAuth Enrollment Manager

[Ramin Halavati, 2017/06/16 09:48:16]

Done.

+        description: "..."

[sacomoto, 2017/06/15 06:13:20]

Starts the CryptAuth registration flow.

[Ramin Halavati, 2017/06/16 09:48:18]

Done.

+        trigger: "..."

[sacomoto, 2017/06/15 06:13:10]

Occurs periodically, at least once a month.

[Ramin Halavati, 2017/06/16 09:48:16]

Done.

+        data: "..."

[sacomoto, 2017/06/15 06:13:23]

Various device information (public key, bluetooth MAC address, model, OS
version, screen size, manufacturer, has screen lock enabled).

[Ramin Halavati, 2017/06/16 09:48:17]

Done.

+        destination: WEBSITE/GOOGLE_OWNED_SERVICE/OTHER/LOCAL
+      }
+      policy {
+        setting: "..."

[sacomoto, 2017/06/15 06:13:18]

This feature cannot be disabled by settings. However, this request is made only
for signed-in users.

[Ramin Halavati, 2017/06/16 09:48:18]

Done.

+        chrome_policy {

[sacomoto, 2017/06/15 06:13:10]

There is no policy covering this request.

[Ramin Halavati, 2017/06/16 09:48:17]

How about 'SigninAllowed'?

[sacomoto, 2017/06/19 18:25:38]

Yes, you are right. This policy would disable all API calls in this class.

[Ramin Halavati, 2017/06/20 05:35:33]

Acknowledged.

+          [POLICY_NAME] {
+            policy_options {mode: MANDATORY/RECOMMENDED/UNSET}
+            [POLICY_NAME]: ... //(value to disable it)
+          }
+        }
+        policy_exception_justification: "..."
+      })");
+  MakeApiCall(kSetupEnrollmentPath, request, callback, error_callback,
+              partial_traffic_annotation);
 }
 
 void CryptAuthClientImpl::FinishEnrollment(
     const FinishEnrollmentRequest& request,
     const FinishEnrollmentCallback& callback,
     const ErrorCallback& error_callback) {
-  MakeApiCall(kFinishEnrollmentPath, request, callback, error_callback);
+  net::PartialNetworkTrafficAnnotationTag partial_traffic_annotation =
+      net::DefinePartialNetworkTrafficAnnotation("...", "oauth2_api_call_flow",

[sacomoto, 2017/06/15 06:13:23]

cryptauth_enrollment_flow_finish

[Ramin Halavati, 2017/06/16 09:48:16]

Done.

+                                                 R"(
+      semantics {
+        sender: "..."

[sacomoto, 2017/06/15 06:13:11]

CryptAuth Enrollment Manager

[Ramin Halavati, 2017/06/16 09:48:17]

Done.

+        description: "..."

[sacomoto, 2017/06/15 06:13:23]

Finishes the CryptAuth registration flow.

[Ramin Halavati, 2017/06/16 09:48:18]

Done.

+        trigger: "..."

[sacomoto, 2017/06/15 06:13:22]

Occurs periodically, at least once a month.

[Ramin Halavati, 2017/06/16 09:48:17]

Done.

+        data: "..."

[Ramin Halavati, 2017/06/16 09:48:17]

None?

+        destination: WEBSITE/GOOGLE_OWNED_SERVICE/OTHER/LOCAL
+      }
+      policy {
+        setting: "..."

[sacomoto, 2017/06/15 06:13:10]

This feature cannot be disabled by settings. However, this request is made only
for signed-in users.

[Ramin Halavati, 2017/06/16 09:48:17]

Done.

+        chrome_policy {

[sacomoto, 2017/06/15 06:13:23]

There is no policy covering this request.

[Ramin Halavati, 2017/06/16 09:48:16]

Acknowledged.

+          [POLICY_NAME] {
+            policy_options {mode: MANDATORY/RECOMMENDED/UNSET}
+            [POLICY_NAME]: ... //(value to disable it)
+          }
+        }
+        policy_exception_justification: "..."
+      })");
+  MakeApiCall(kFinishEnrollmentPath, request, callback, error_callback,
+              partial_traffic_annotation);
 }
 
 std::string CryptAuthClientImpl::GetAccessTokenUsed() {
   return access_token_used_;
 }
 
 template <class RequestProto, class ResponseProto>
 void CryptAuthClientImpl::MakeApiCall(
     const std::string& request_path,
     const RequestProto& request_proto,
     const base::Callback<void(const ResponseProto&)>& response_callback,
-    const ErrorCallback& error_callback) {
+    const ErrorCallback& error_callback,
+    const net::PartialNetworkTrafficAnnotationTag& partial_traffic_annotation) {
   if (has_call_started_) {
     error_callback.Run(
         "Client has been used for another request. Do not reuse.");
     return;
   }
   has_call_started_ = true;
 
+  api_call_flow_->SetPartialNetworkTrafficAnnotation(
+      partial_traffic_annotation);
+
   // The |device_classifier| field must be present for all CryptAuth requests.
   RequestProto request_copy(request_proto);
   request_copy.mutable_device_classifier()->CopyFrom(device_classifier_);
 
   std::string serialized_request;
   if (!request_copy.SerializeToString(&serialized_request)) {
     error_callback.Run(std::string("Failed to serialize ") +
                        request_proto.GetTypeName() + " proto.");
     return;
   }
@@ skipping 58 matching lines @@
 
 std::unique_ptr<CryptAuthClient> CryptAuthClientFactoryImpl::CreateInstance() {
   return base::MakeUnique<CryptAuthClientImpl>(
       base::WrapUnique(new CryptAuthApiCallFlow()),
       base::WrapUnique(
           new CryptAuthAccessTokenFetcherImpl(token_service_, account_id_)),
       url_request_context_, device_classifier_);
 }
 
 }  // namespace cryptauth