Policy implementation for encryptfs to ext4 migration strategy

chrome/browser/chromeos/arc/arc_session_manager.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/arc/arc_session_manager.h"
 
 #include <utility>
 
 #include "base/bind.h"
 #include "base/callback_helpers.h"
@@ skipping 611 matching lines @@
   // Reset any pending request to re-enable ARC.
   reenable_arc_ = false;
   StopArc();
   VLOG(1) << "ARC opt-out. Removing user data.";
   RequestArcDataRemoval();
 }
 
 void ArcSessionManager::RequestArcDataRemoval() {
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
   DCHECK(profile_);
+
+  // The check if migration is allowed is done to make sure the data is not
+  // removed if the device had ARC enabled and became disabled as result of
+  // migration to ext4 policy.
+  // TODO(igorcov): Remove this check after migration. crbug.com/725493
+  if (!arc::IsArcMigrationAllowed()) {
+    return;

[bartfab (slow), 2017/06/12 12:49:03]

Can we add a unit test for this? It would be very valuable to have a test that
ensures we do not accidentally cause data loss.

[igorcov, 2017/06/12 16:50:09]

As far as I understand the code, this should be a DCHECK because in current
implementation the |profile_| can be set only if IsArcAllowedForProfile()
returns true. I've left it as an if for safety reason, but don't see a way to
make a test for it (meaning hitting this case).

+  }
+
   // TODO(hidehiko): DCHECK the previous state. This is called for four cases;
   // 1) Supporting managed user initial disabled case (Please see also
   //    ArcPlayStoreEnabledPreferenceHandler::Start() for details).
   // 2) Supporting enterprise triggered data removal.
   // 3) One called in OnProvisioningFinished().
   // 4) On request disabling.
   // After the state machine is fixed, 2) should be replaced by
   // RequestDisable() immediately followed by RequestEnable().
   // 3) and 4) are internal state transition. So, as for public interface, 1)
   // should be the only use case, and the |state_| should be limited to
@@ skipping 397 matching lines @@
 
 #undef MAP_STATE
 
   // Some compilers report an error even if all values of an enum-class are
   // covered exhaustively in a switch statement.
   NOTREACHED() << "Invalid value " << static_cast<int>(state);
   return os;
 }
 
 }  // namespace arc