Wire up component cloud policy to device local accounts.

chrome/browser/chromeos/policy/device_local_account_policy_service.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/policy/device_local_account_policy_service.h"
 
 #include <vector>
 
 #include "base/bind.h"
 #include "base/file_util.h"
 #include "base/files/file_enumerator.h"
-#include "base/files/file_path.h"
 #include "base/logging.h"
 #include "base/message_loop/message_loop.h"
 #include "base/message_loop/message_loop_proxy.h"
 #include "base/path_service.h"
 #include "base/sequenced_task_runner.h"
+#include "base/stl_util.h"
 #include "base/strings/string_number_conversions.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/chromeos/policy/device_local_account.h"
 #include "chrome/browser/chromeos/policy/device_local_account_external_data_service.h"
 #include "chrome/browser/chromeos/policy/device_local_account_policy_store.h"
 #include "chrome/browser/chromeos/settings/device_settings_service.h"
 #include "chrome/common/chrome_content_client.h"
 #include "chromeos/chromeos_paths.h"
 #include "chromeos/dbus/session_manager_client.h"
 #include "chromeos/settings/cros_settings_names.h"
 #include "chromeos/settings/cros_settings_provider.h"
 #include "components/policy/core/common/cloud/cloud_policy_client.h"
 #include "components/policy/core/common/cloud/cloud_policy_constants.h"
 #include "components/policy/core/common/cloud/cloud_policy_refresh_scheduler.h"
 #include "components/policy/core/common/cloud/device_management_service.h"
 #include "components/policy/core/common/cloud/system_policy_request_context.h"
+#include "content/public/browser/browser_thread.h"
 #include "net/url_request/url_request_context_getter.h"
 #include "policy/policy_constants.h"
 #include "policy/proto/device_management_backend.pb.h"
 #include "url/gurl.h"
 
 namespace em = enterprise_management;
 
 namespace policy {
 
 namespace {
@@ skipping 21 matching lines @@
       new CloudPolicyClient(std::string(), std::string(),
                             kPolicyVerificationKeyHash,
                             USER_AFFILIATION_MANAGED,
                             NULL, device_management_service, request_context));
   client->SetupRegistration(policy_data->request_token(),
                             policy_data->device_id());
   return client.Pass();
 }
 
 // Get the subdirectory of the cache directory in which force-installed
-// extensions are cached for |account_id|.
-std::string GetCacheSubdirectoryForAccountID(const std::string& account_id) {
+// extensions are cached for |account_id|. This is also used for the
+// component policy cache.
+std::string EncodeAccountId(const std::string& account_id) {
   return base::HexEncode(account_id.c_str(), account_id.size());
 }
 
 // Cleans up the cache directory by removing subdirectories that are not found
 // in |subdirectories_to_keep|. Only caches whose cache directory is found in
 // |subdirectories_to_keep| may be running while the clean-up is in progress.
-void DeleteOrphanedExtensionCaches(
+void DeleteOrphanedCaches(
+    const base::FilePath& cache_root_dir,
     const std::set<std::string>& subdirectories_to_keep) {
-  base::FilePath cache_root_dir;
-  CHECK(PathService::Get(chromeos::DIR_DEVICE_LOCAL_ACCOUNT_EXTENSIONS,
-                         &cache_root_dir));
   base::FileEnumerator enumerator(cache_root_dir,
                                   false,
                                   base::FileEnumerator::DIRECTORIES);
   for (base::FilePath path = enumerator.Next(); !path.empty();
        path = enumerator.Next()) {
     const std::string subdirectory(path.BaseName().MaybeAsASCII());
-    if (subdirectories_to_keep.find(subdirectory) ==
-        subdirectories_to_keep.end()) {
+    if (!ContainsKey(subdirectories_to_keep, subdirectory))
       base::DeleteFile(path, true);
-    }
   }
 }
 
 // Removes the subdirectory belonging to |account_id_to_delete| from the cache
 // directory. No cache belonging to |account_id_to_delete| may be running while
 // the removal is in progress.
 void DeleteObsoleteExtensionCache(const std::string& account_id_to_delete) {
   base::FilePath cache_root_dir;
   CHECK(PathService::Get(chromeos::DIR_DEVICE_LOCAL_ACCOUNT_EXTENSIONS,
                          &cache_root_dir));
-  const base::FilePath path = cache_root_dir
-      .Append(GetCacheSubdirectoryForAccountID(account_id_to_delete));
+  const base::FilePath path =
+      cache_root_dir.Append(EncodeAccountId(account_id_to_delete));
   if (base::DirectoryExists(path))
     base::DeleteFile(path, true);
 }
 
 }  // namespace
 
 DeviceLocalAccountPolicyBroker::DeviceLocalAccountPolicyBroker(
     const DeviceLocalAccount& account,
+    const base::FilePath& component_policy_cache_path,
     scoped_ptr<DeviceLocalAccountPolicyStore> store,
     scoped_refptr<DeviceLocalAccountExternalDataManager> external_data_manager,
     const scoped_refptr<base::SequencedTaskRunner>& task_runner)
     : account_id_(account.account_id),
       user_id_(account.user_id),
+      component_policy_cache_path_(component_policy_cache_path),
       store_(store.Pass()),
       external_data_manager_(external_data_manager),
       core_(PolicyNamespaceKey(dm_protocol::kChromePublicAccountPolicyType,
                                store_->account_id()),
             store_.get(),
             task_runner) {
   base::FilePath cache_root_dir;
   CHECK(PathService::Get(chromeos::DIR_DEVICE_LOCAL_ACCOUNT_EXTENSIONS,
                          &cache_root_dir));
   extension_loader_ = new chromeos::DeviceLocalAccountExternalPolicyLoader(
-      store_.get(),
-      cache_root_dir.Append(
-          GetCacheSubdirectoryForAccountID(account.account_id)));
+      store_.get(), cache_root_dir.Append(EncodeAccountId(account.account_id)));
 }
 
 DeviceLocalAccountPolicyBroker::~DeviceLocalAccountPolicyBroker() {
   external_data_manager_->SetPolicyStore(NULL);
   external_data_manager_->Disconnect();
 }
 
 void DeviceLocalAccountPolicyBroker::Initialize() {
   store_->Load();
 }
@@ skipping 29 matching lines @@
 
 std::string DeviceLocalAccountPolicyBroker::GetDisplayName() const {
   std::string display_name;
   const base::Value* display_name_value =
       store_->policy_map().GetValue(policy::key::kUserDisplayName);
   if (display_name_value)
     display_name_value->GetAsString(&display_name);
   return display_name;
 }
 
+base::FilePath DeviceLocalAccountPolicyBroker::GetComponentPolicyCachePath()
+    const {
+  return component_policy_cache_path_;
+}
+
 DeviceLocalAccountPolicyService::DeviceLocalAccountPolicyService(
     chromeos::SessionManagerClient* session_manager_client,
     chromeos::DeviceSettingsService* device_settings_service,
     chromeos::CrosSettings* cros_settings,
     scoped_refptr<base::SequencedTaskRunner> store_background_task_runner,
     scoped_refptr<base::SequencedTaskRunner> extension_cache_task_runner,
     scoped_refptr<base::SequencedTaskRunner>
         external_data_service_backend_task_runner,
     scoped_refptr<base::SequencedTaskRunner> io_task_runner,
     scoped_refptr<net::URLRequestContextGetter> request_context)
     : session_manager_client_(session_manager_client),
       device_settings_service_(device_settings_service),
       cros_settings_(cros_settings),
       device_management_service_(NULL),
       waiting_for_cros_settings_(false),
       orphan_cache_deletion_state_(NOT_STARTED),
       store_background_task_runner_(store_background_task_runner),
       extension_cache_task_runner_(extension_cache_task_runner),
       request_context_(request_context),
       local_accounts_subscription_(cros_settings_->AddSettingsObserver(
           chromeos::kAccountsPrefDeviceLocalAccounts,
           base::Bind(&DeviceLocalAccountPolicyService::
                          UpdateAccountListIfNonePending,
                      base::Unretained(this)))),
       weak_factory_(this) {
+  CHECK(PathService::Get(chromeos::DIR_DEVICE_LOCAL_ACCOUNT_COMPONENT_POLICY,
+                         &component_policy_cache_root_));
   external_data_service_.reset(new DeviceLocalAccountExternalDataService(
       this,
       external_data_service_backend_task_runner,
       io_task_runner));
   UpdateAccountList();
 }
 
 DeviceLocalAccountPolicyService::~DeviceLocalAccountPolicyService() {
   DCHECK(!request_context_);
   DCHECK(policy_brokers_.empty());
@@ skipping 187 matching lines @@
                                             session_manager_client_,
                                             device_settings_service_,
                                             store_background_task_runner_));
       store->AddObserver(this);
       scoped_refptr<DeviceLocalAccountExternalDataManager>
           external_data_manager =
               external_data_service_->GetExternalDataManager(it->account_id,
                                                              store.get());
       broker.reset(new DeviceLocalAccountPolicyBroker(
           *it,
+          component_policy_cache_root_.Append(EncodeAccountId(it->account_id)),
           store.Pass(),
           external_data_manager,
           base::MessageLoopProxy::current()));
     }
 
     // Fire up the cloud connection for fetching policy for the account from
     // the cloud if this is an enterprise-managed device.
     broker->ConnectIfPossible(device_settings_service_,
                               device_management_service_,
                               request_context_);
 
     policy_brokers_[it->user_id] = broker.release();
     if (!broker_initialized) {
       // The broker must be initialized after it has been added to
       // |policy_brokers_|.
       policy_brokers_[it->user_id]->Initialize();
     }
 
-    if (orphan_cache_deletion_state_ == NOT_STARTED) {
-      subdirectories_to_keep.insert(
-          GetCacheSubdirectoryForAccountID(it->account_id));
-    }
-  }
-
-  std::set<std::string> obsolete_account_ids;
-  for (PolicyBrokerMap::const_iterator it = old_policy_brokers.begin();
-       it != old_policy_brokers.end(); ++it) {
-    obsolete_account_ids.insert(it->second->account_id());
+    subdirectories_to_keep.insert(EncodeAccountId(it->account_id));
   }
 
   if (orphan_cache_deletion_state_ == NOT_STARTED) {
     DCHECK(old_policy_brokers.empty());
     DCHECK(busy_extension_cache_directories_.empty());
 
     // If this method is running for the first time, no extension caches have
     // been started yet. Take this opportunity to do a clean-up by removing
     // orphaned cache directories not found in |subdirectories_to_keep| from the
     // cache directory.
     orphan_cache_deletion_state_ = IN_PROGRESS;
+
+    base::FilePath cache_root_dir;
+    CHECK(PathService::Get(chromeos::DIR_DEVICE_LOCAL_ACCOUNT_EXTENSIONS,

[Bernhard Bauer, 2014/06/19 16:59:27]

Why a CHECK instead of a DCHECK?

[Joao da Silva, 2014/06/19 17:04:56]

Because this can't possibly fail, but if it does then we can't proceed. Also, a
DCHECK will skip the Get() call in release builds.

[Bernhard Bauer, 2014/06/19 17:22:44]

Eh, "Can't possibly fail" is pretty much the definition of DCHECK :) (see
http://dev.chromium.org/developers/coding-style#TOC-CHECK-DCHECK-and-NOTREACHED-)

The usual way to make sure the code is compiled in in Release builds as well is
to extract the result to a variable and then DCHECK that.

+                           &cache_root_dir));
     extension_cache_task_runner_->PostTaskAndReply(
         FROM_HERE,
-        base::Bind(&DeleteOrphanedExtensionCaches, subdirectories_to_keep),
-        base::Bind(&DeviceLocalAccountPolicyService::
-                       OnOrphanedExtensionCachesDeleted,
-                   weak_factory_.GetWeakPtr()));
+        base::Bind(
+            &DeleteOrphanedCaches, cache_root_dir, subdirectories_to_keep),
+        base::Bind(
+            &DeviceLocalAccountPolicyService::OnOrphanedExtensionCachesDeleted,
+            weak_factory_.GetWeakPtr()));
 
     // Start the extension caches for all brokers. These belong to accounts in
     // |account_ids| and are not affected by the clean-up.
     StartExtensionCachesIfPossible();
   } else {
     // If this method has run before, obsolete brokers may exist. Shut down
     // their extension caches and delete the brokers.
     DeleteBrokers(&old_policy_brokers);
 
     if (orphan_cache_deletion_state_ == DONE) {
       // If the initial clean-up of orphaned cache directories has been
       // complete, start any extension caches that are not running yet but can
       // be started now because their cache directories are not busy.
       StartExtensionCachesIfPossible();
     }
   }
 
+  // Purge the component policy caches of any accounts that have been removed.
+  // Do this only after any obsolete brokers have been destroyed.
+  // TODO(joaodasilva): for now this must be posted to the FILE thread,
+  // to avoid racing with the ComponentCloudPolicyStore. Use a task runner
+  // once that class supports another background thread too.
+  content::BrowserThread::PostTask(content::BrowserThread::FILE, FROM_HERE,
+                                   base::Bind(&DeleteOrphanedCaches,
+                                              component_policy_cache_root_,
+                                              subdirectories_to_keep));
+
   FOR_EACH_OBSERVER(Observer, observers_, OnDeviceLocalAccountsChanged());
 }
 
 void DeviceLocalAccountPolicyService::DeleteBrokers(PolicyBrokerMap* map) {
   for (PolicyBrokerMap::iterator it = map->begin(); it != map->end(); ++it) {
     it->second->core()->store()->RemoveObserver(this);
     scoped_refptr<chromeos::DeviceLocalAccountExternalPolicyLoader>
         extension_loader = it->second->extension_loader();
     if (extension_loader->IsCacheRunning()) {
       DCHECK(!IsExtensionCacheDirectoryBusy(it->second->account_id()));
       busy_extension_cache_directories_.insert(it->second->account_id());
       extension_loader->StopCache(base::Bind(
           &DeviceLocalAccountPolicyService::OnObsoleteExtensionCacheShutdown,
           weak_factory_.GetWeakPtr(),
           it->second->account_id()));
     }
+    FOR_EACH_OBSERVER(Observer, observers_, OnBrokerShutdown(it->second));
     delete it->second;
   }
   map->clear();
 }
 
 DeviceLocalAccountPolicyBroker*
     DeviceLocalAccountPolicyService::GetBrokerForStore(
         CloudPolicyStore* store) {
   for (PolicyBrokerMap::iterator it(policy_brokers_.begin());
        it != policy_brokers_.end(); ++it) {
     if (it->second->core()->store() == store)
       return it->second;
   }
   return NULL;
 }
 
 }  // namespace policy