Network traffic annotation added to OAuth2ApiCallFlow and its subclasses.

components/cryptauth/cryptauth_client_impl.cc

Index: components/cryptauth/cryptauth_client_impl.cc
diff --git a/components/cryptauth/cryptauth_client_impl.cc b/components/cryptauth/cryptauth_client_impl.cc
index 259838598ef08a9ce1856025ef9d3a0dba08081f..97033684324c188361c68f10c6403407e038bb9b 100644
--- a/components/cryptauth/cryptauth_client_impl.cc
+++ b/components/cryptauth/cryptauth_client_impl.cc
@@ -67,43 +67,168 @@ void CryptAuthClientImpl::GetMyDevices(
     const GetMyDevicesRequest& request,
     const GetMyDevicesCallback& callback,
     const ErrorCallback& error_callback) {
-  MakeApiCall(kGetMyDevicesPath, request, callback, error_callback);
+  net::PartialNetworkTrafficAnnotationTag partial_traffic_annotation =
+      net::DefinePartialNetworkTrafficAnnotation("...", "oauth2_api_call_flow",

[sacomoto, 2017/06/15 06:13:23]

cryptauth_get_my_devices

[Ramin Halavati, 2017/06/16 09:48:18]

Acknowledged.

+                                                 R"(
+      semantics {
+        sender: "..."
+        description: "..."
+        trigger: "..."
+        data: "..."
+        destination: WEBSITE/GOOGLE_OWNED_SERVICE/OTHER/LOCAL
+      }
+      policy {
+        setting: "..."
+        chrome_policy {
+          [POLICY_NAME] {
+            policy_options {mode: MANDATORY/RECOMMENDED/UNSET}
+            [POLICY_NAME]: ... //(value to disable it)
+          }
+        }
+        policy_exception_justification: "..."
+      })");
+  MakeApiCall(kGetMyDevicesPath, request, callback, error_callback,
+              partial_traffic_annotation);
 }
 
 void CryptAuthClientImpl::FindEligibleUnlockDevices(
     const FindEligibleUnlockDevicesRequest& request,
     const FindEligibleUnlockDevicesCallback& callback,
     const ErrorCallback& error_callback) {
-  MakeApiCall(kFindEligibleUnlockDevicesPath, request, callback,
-              error_callback);
+  net::PartialNetworkTrafficAnnotationTag partial_traffic_annotation =
+      net::DefinePartialNetworkTrafficAnnotation("...", "oauth2_api_call_flow",

[sacomoto, 2017/06/15 06:13:15]

cryptauth_find_eligible_unlock_devices

[Ramin Halavati, 2017/06/16 09:48:17]

Done.

+                                                 R"(
+      semantics {
+        sender: "..."

[sacomoto, 2017/06/15 06:13:11]

CryptAuth Device Manager.

[Ramin Halavati, 2017/06/16 09:48:16]

Done.

+        description: "..."

[sacomoto, 2017/06/15 06:13:12]

Gets the list of mobile devices that can be used by Smart Lock to unlock the
current device.

[Ramin Halavati, 2017/06/16 09:48:16]

Done.

+        trigger: "..."

[sacomoto, 2017/06/15 06:13:11]

This request is sent when the user starts the Smart Lock setup flow.

[Ramin Halavati, 2017/06/16 09:48:17]

Done.

+        data: "..."

[sacomoto, 2017/06/15 06:13:11]

The device's public key.

[Ramin Halavati, 2017/06/16 09:48:18]

Done.

+        destination: WEBSITE/GOOGLE_OWNED_SERVICE/OTHER/LOCAL
+      }
+      policy {
+        setting: "..."

[sacomoto, 2017/06/15 06:13:10]

This request will only be send if the user explicitly tries to enable Smart Lock
(EasyUnlock), i.e. starts the setup flow.

[Ramin Halavati, 2017/06/16 09:48:16]

Done.

+        chrome_policy {
+          [POLICY_NAME] {

[sacomoto, 2017/06/15 06:13:23]

EasyUnlockAllowed

[Ramin Halavati, 2017/06/16 09:48:17]

Done.

+            policy_options {mode: MANDATORY/RECOMMENDED/UNSET}

[sacomoto, 2017/06/15 06:13:11]

MANDATORY.

[Ramin Halavati, 2017/06/16 09:48:17]

We are removing this field as it's always MANDATORY.

+            [POLICY_NAME]: ... //(value to disable it)

[sacomoto, 2017/06/15 06:13:17]

EasyUnlockAllowed: false

[Ramin Halavati, 2017/06/16 09:48:17]

Done.

+          }
+        }
+        policy_exception_justification: "..."
+      })");
+  MakeApiCall(kFindEligibleUnlockDevicesPath, request, callback, error_callback,
+              partial_traffic_annotation);
 }
 
 void CryptAuthClientImpl::SendDeviceSyncTickle(
     const SendDeviceSyncTickleRequest& request,
     const SendDeviceSyncTickleCallback& callback,
     const ErrorCallback& error_callback) {
-  MakeApiCall(kSendDeviceSyncTicklePath, request, callback, error_callback);
+  net::PartialNetworkTrafficAnnotationTag partial_traffic_annotation =
+      net::DefinePartialNetworkTrafficAnnotation("...", "oauth2_api_call_flow",

[sacomoto, 2017/06/15 06:13:11]

cryptauth_device_sync_tickle

[Ramin Halavati, 2017/06/16 09:48:17]

Acknowledged.

+                                                 R"(
+      semantics {
+        sender: "..."
+        description: "..."
+        trigger: "..."
+        data: "..."
+        destination: WEBSITE/GOOGLE_OWNED_SERVICE/OTHER/LOCAL
+      }
+      policy {
+        setting: "..."
+        chrome_policy {
+          [POLICY_NAME] {
+            policy_options {mode: MANDATORY/RECOMMENDED/UNSET}
+            [POLICY_NAME]: ... //(value to disable it)
+          }
+        }
+        policy_exception_justification: "..."
+      })");
+  MakeApiCall(kSendDeviceSyncTicklePath, request, callback, error_callback,
+              partial_traffic_annotation);
 }
 
 void CryptAuthClientImpl::ToggleEasyUnlock(
     const ToggleEasyUnlockRequest& request,
     const ToggleEasyUnlockCallback& callback,
     const ErrorCallback& error_callback) {
-  MakeApiCall(kToggleEasyUnlockPath, request, callback, error_callback);
+  net::PartialNetworkTrafficAnnotationTag partial_traffic_annotation =
+      net::DefinePartialNetworkTrafficAnnotation("...", "oauth2_api_call_flow",

[sacomoto, 2017/06/15 06:13:14]

cryptauth_toggle_easyunlock

[Ramin Halavati, 2017/06/16 09:48:17]

Done.

+                                                 R"(
+      semantics {
+        sender: "..."

[sacomoto, 2017/06/15 06:13:11]

CryptAuth Device Manager

[Ramin Halavati, 2017/06/16 09:48:17]

Done.

+        description: "..."

[sacomoto, 2017/06/15 06:13:11]

Enables Smart Lock (EasyUnlock) for the current device.

[Ramin Halavati, 2017/06/16 09:48:16]

Done.

+        trigger: "..."

[sacomoto, 2017/06/15 06:13:16]

This request is send after the user goes through the EasyUnlock setup flow.

[Ramin Halavati, 2017/06/16 09:48:17]

Done.

+        data: "..."

[sacomoto, 2017/06/15 06:13:11]

The device public key.

[Ramin Halavati, 2017/06/16 09:48:16]

Done.

+        destination: WEBSITE/GOOGLE_OWNED_SERVICE/OTHER/LOCAL
+      }
+      policy {
+        setting: "..."

[sacomoto, 2017/06/15 06:13:15]

This will only be send if the user explicitly enables Smart Lock (EasyUnlock),
i.e. successfully complete the setup flow.

[Ramin Halavati, 2017/06/16 09:48:18]

Done.

+        chrome_policy {
+          [POLICY_NAME] {

[sacomoto, 2017/06/15 06:13:10]

EasyUnlockAllowed

[Ramin Halavati, 2017/06/16 09:48:17]

Done.

+            policy_options {mode: MANDATORY/RECOMMENDED/UNSET}

[sacomoto, 2017/06/15 06:13:21]

MANDATORY

[Ramin Halavati, 2017/06/16 09:48:16]

Acknowledged.

+            [POLICY_NAME]: ... //(value to disable it)

[sacomoto, 2017/06/15 06:13:10]

EasyUnlockAllowed: false

[Ramin Halavati, 2017/06/16 09:48:16]

Done.

+          }
+        }
+        policy_exception_justification: "..."
+      })");
+  MakeApiCall(kToggleEasyUnlockPath, request, callback, error_callback,
+              partial_traffic_annotation);
 }
 
 void CryptAuthClientImpl::SetupEnrollment(
     const SetupEnrollmentRequest& request,
     const SetupEnrollmentCallback& callback,
     const ErrorCallback& error_callback) {
-  MakeApiCall(kSetupEnrollmentPath, request, callback, error_callback);
+  net::PartialNetworkTrafficAnnotationTag partial_traffic_annotation =
+      net::DefinePartialNetworkTrafficAnnotation("...", "oauth2_api_call_flow",

[sacomoto, 2017/06/15 06:13:11]

cryptauth_enrollment_flow_setup

[Ramin Halavati, 2017/06/16 09:48:17]

Done.

+                                                 R"(
+      semantics {
+        sender: "..."

[sacomoto, 2017/06/15 06:13:23]

CryptAuth Enrollment Manager

[Ramin Halavati, 2017/06/16 09:48:16]

Done.

+        description: "..."

[sacomoto, 2017/06/15 06:13:20]

Starts the CryptAuth registration flow.

[Ramin Halavati, 2017/06/16 09:48:18]

Done.

+        trigger: "..."

[sacomoto, 2017/06/15 06:13:10]

Occurs periodically, at least once a month.

[Ramin Halavati, 2017/06/16 09:48:16]

Done.

+        data: "..."

[sacomoto, 2017/06/15 06:13:23]

Various device information (public key, bluetooth MAC address, model, OS
version, screen size, manufacturer, has screen lock enabled).

[Ramin Halavati, 2017/06/16 09:48:17]

Done.

+        destination: WEBSITE/GOOGLE_OWNED_SERVICE/OTHER/LOCAL
+      }
+      policy {
+        setting: "..."

[sacomoto, 2017/06/15 06:13:18]

This feature cannot be disabled by settings. However, this request is made only
for signed-in users.

[Ramin Halavati, 2017/06/16 09:48:18]

Done.

+        chrome_policy {

[sacomoto, 2017/06/15 06:13:10]

There is no policy covering this request.

[Ramin Halavati, 2017/06/16 09:48:17]

How about 'SigninAllowed'?

[sacomoto, 2017/06/19 18:25:38]

Yes, you are right. This policy would disable all API calls in this class.

[Ramin Halavati, 2017/06/20 05:35:33]

Acknowledged.

+          [POLICY_NAME] {
+            policy_options {mode: MANDATORY/RECOMMENDED/UNSET}
+            [POLICY_NAME]: ... //(value to disable it)
+          }
+        }
+        policy_exception_justification: "..."
+      })");
+  MakeApiCall(kSetupEnrollmentPath, request, callback, error_callback,
+              partial_traffic_annotation);
 }
 
 void CryptAuthClientImpl::FinishEnrollment(
     const FinishEnrollmentRequest& request,
     const FinishEnrollmentCallback& callback,
     const ErrorCallback& error_callback) {
-  MakeApiCall(kFinishEnrollmentPath, request, callback, error_callback);
+  net::PartialNetworkTrafficAnnotationTag partial_traffic_annotation =
+      net::DefinePartialNetworkTrafficAnnotation("...", "oauth2_api_call_flow",

[sacomoto, 2017/06/15 06:13:23]

cryptauth_enrollment_flow_finish

[Ramin Halavati, 2017/06/16 09:48:16]

Done.

+                                                 R"(
+      semantics {
+        sender: "..."

[sacomoto, 2017/06/15 06:13:11]

CryptAuth Enrollment Manager

[Ramin Halavati, 2017/06/16 09:48:17]

Done.

+        description: "..."

[sacomoto, 2017/06/15 06:13:23]

Finishes the CryptAuth registration flow.

[Ramin Halavati, 2017/06/16 09:48:18]

Done.

+        trigger: "..."

[sacomoto, 2017/06/15 06:13:22]

Occurs periodically, at least once a month.

[Ramin Halavati, 2017/06/16 09:48:17]

Done.

+        data: "..."

[Ramin Halavati, 2017/06/16 09:48:17]

None?

+        destination: WEBSITE/GOOGLE_OWNED_SERVICE/OTHER/LOCAL
+      }
+      policy {
+        setting: "..."

[sacomoto, 2017/06/15 06:13:10]

This feature cannot be disabled by settings. However, this request is made only
for signed-in users.

[Ramin Halavati, 2017/06/16 09:48:17]

Done.

+        chrome_policy {

[sacomoto, 2017/06/15 06:13:23]

There is no policy covering this request.

[Ramin Halavati, 2017/06/16 09:48:16]

Acknowledged.

+          [POLICY_NAME] {
+            policy_options {mode: MANDATORY/RECOMMENDED/UNSET}
+            [POLICY_NAME]: ... //(value to disable it)
+          }
+        }
+        policy_exception_justification: "..."
+      })");
+  MakeApiCall(kFinishEnrollmentPath, request, callback, error_callback,
+              partial_traffic_annotation);
 }
 
 std::string CryptAuthClientImpl::GetAccessTokenUsed() {
@@ -115,7 +240,8 @@ void CryptAuthClientImpl::MakeApiCall(
     const std::string& request_path,
     const RequestProto& request_proto,
     const base::Callback<void(const ResponseProto&)>& response_callback,
-    const ErrorCallback& error_callback) {
+    const ErrorCallback& error_callback,
+    const net::PartialNetworkTrafficAnnotationTag& partial_traffic_annotation) {
   if (has_call_started_) {
     error_callback.Run(
         "Client has been used for another request. Do not reuse.");
@@ -123,6 +249,9 @@ void CryptAuthClientImpl::MakeApiCall(
   }
   has_call_started_ = true;
 
+  api_call_flow_->SetPartialNetworkTrafficAnnotation(
+      partial_traffic_annotation);
+
   // The |device_classifier| field must be present for all CryptAuth requests.
   RequestProto request_copy(request_proto);
   request_copy.mutable_device_classifier()->CopyFrom(device_classifier_);