Adds an AccessPolicy that is queried to determine what a connection can do

mojo/services/view_manager/view_manager_service_impl.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "mojo/services/view_manager/view_manager_service_impl.h"
 
 #include "base/bind.h"
 #include "mojo/services/public/cpp/geometry/geometry_type_converters.h"
 #include "mojo/services/public/cpp/input_events/input_events_type_converters.h"
+#include "mojo/services/view_manager/default_access_policy.h"
 #include "mojo/services/view_manager/node.h"
 #include "mojo/services/view_manager/root_node_manager.h"
 #include "mojo/services/view_manager/view.h"
+#include "mojo/services/view_manager/window_manager_access_policy.h"
 #include "third_party/skia/include/core/SkBitmap.h"
 #include "ui/aura/window.h"
 #include "ui/gfx/codec/png_codec.h"
 
 namespace mojo {
 namespace service {
 
 ViewManagerServiceImpl::ViewManagerServiceImpl(
     RootNodeManager* root_node_manager,
     ConnectionSpecificId creator_id,
     const std::string& creator_url,
     const std::string& url,
     const NodeId& root_id)
     : root_node_manager_(root_node_manager),
       id_(root_node_manager_->GetAndAdvanceNextConnectionId()),
       url_(url),
       creator_id_(creator_id),
       creator_url_(creator_url),
       delete_on_connection_error_(false) {
+  // TODO: change this!

[Ben Goodger (Google), 2014/07/25 20:51:46]

You can now go ahead and cite http://crbug.com/397660

[sky, 2014/07/25 21:10:46]

Done.

   if (root_id != InvalidNodeId()) {
     CHECK(GetNode(root_id));
     roots_.insert(NodeIdToTransportId(root_id));
+    access_policy_.reset(new DefaultAccessPolicy(id_, this));
+  } else {
+    access_policy_.reset(new WindowManagerAccessPolicy(id_, this));
   }
 }
 
 ViewManagerServiceImpl::~ViewManagerServiceImpl() {
   // Delete any views we created.
   while (!view_map_.empty()) {
-    bool result = DeleteViewImpl(this, view_map_.begin()->second->id());
+    bool result = DeleteViewImpl(this, view_map_.begin()->second);
     DCHECK(result);
   }
 
   // Ditto the nodes.
   if (!node_map_.empty()) {
     RootNodeManager::ScopedChange change(this, root_node_manager_, true);
     while (!node_map_.empty())
       delete node_map_.begin()->second;
   }
 
@@ skipping 24 matching lines @@
     ConnectionSpecificId id) {
   if (creator_id_ == id)
     creator_id_ = kRootConnection;
 }
 
 void ViewManagerServiceImpl::ProcessNodeBoundsChanged(
     const Node* node,
     const gfx::Rect& old_bounds,
     const gfx::Rect& new_bounds,
     bool originated_change) {
-  if (originated_change)
+  if (originated_change || !IsNodeKnown(node))
     return;
-  Id node_id = NodeIdToTransportId(node->id());
-  if (known_nodes_.count(node_id) > 0) {
-    client()->OnNodeBoundsChanged(node_id,
-                                  Rect::From(old_bounds),
-                                  Rect::From(new_bounds));
-  }
+  client()->OnNodeBoundsChanged(NodeIdToTransportId(node->id()),
+                                Rect::From(old_bounds),
+                                Rect::From(new_bounds));
 }
 
 void ViewManagerServiceImpl::ProcessNodeHierarchyChanged(
     const Node* node,
     const Node* new_parent,
     const Node* old_parent,
     bool originated_change) {
-  if (known_nodes_.count(NodeIdToTransportId(node->id())) > 0) {
-    if (originated_change)
-      return;
-    if (node->id().connection_id != id_ && !IsNodeDescendantOfRoots(node)) {
-      // Node was a descendant of roots and is no longer, treat it as though the
-      // node was deleted.
-      RemoveFromKnown(node, NULL);
-      client()->OnNodeDeleted(NodeIdToTransportId(node->id()));
-      root_node_manager_->OnConnectionMessagedClient(id_);
-      return;
-    }
+  if (originated_change || root_node_manager_->is_processing_delete_node() ||
+      root_node_manager_->DidConnectionMessageClient(id_)) {
+    return;
   }
 
-  if (originated_change || root_node_manager_->is_processing_delete_node())
-    return;
-  std::vector<const Node*> to_send;
-  if (!ShouldNotifyOnHierarchyChange(node, &new_parent, &old_parent,
-                                     &to_send)) {
+  if (!access_policy_->ShouldNotifyOnHierarchyChange(
+          node, &new_parent, &old_parent)) {
     return;
   }
+  // Inform the client of any new nodes and update the set of nodes we know
+  // about.
+  std::vector<const Node*> to_send;
+  if (!IsNodeKnown(node))
+    GetUnknownNodesFrom(node, &to_send);
   const NodeId new_parent_id(new_parent ? new_parent->id() : NodeId());
   const NodeId old_parent_id(old_parent ? old_parent->id() : NodeId());
-  DCHECK((node->id().connection_id == id_) ||
-         (roots_.count(NodeIdToTransportId(node->id())) > 0) ||
-         (new_parent && IsNodeDescendantOfRoots(new_parent)) ||
-         (old_parent && IsNodeDescendantOfRoots(old_parent)));
   client()->OnNodeHierarchyChanged(NodeIdToTransportId(node->id()),
                                    NodeIdToTransportId(new_parent_id),
                                    NodeIdToTransportId(old_parent_id),
                                    NodesToNodeDatas(to_send));
+  root_node_manager_->OnConnectionMessagedClient(id_);
 }
 
 void ViewManagerServiceImpl::ProcessNodeReorder(const Node* node,
                                                 const Node* relative_node,
                                                 OrderDirection direction,
                                                 bool originated_change) {
-  if (originated_change ||
-      !known_nodes_.count(NodeIdToTransportId(node->id())) ||
-      !known_nodes_.count(NodeIdToTransportId(relative_node->id()))) {
+  if (originated_change || !IsNodeKnown(node) || !IsNodeKnown(relative_node))
     return;
-  }
 
   client()->OnNodeReordered(NodeIdToTransportId(node->id()),
                             NodeIdToTransportId(relative_node->id()),
                             direction);
 }
 
 void ViewManagerServiceImpl::ProcessNodeViewReplaced(
     const Node* node,
     const View* new_view,
     const View* old_view,
     bool originated_change) {
-  if (originated_change || !known_nodes_.count(NodeIdToTransportId(node->id())))
+  if (originated_change || !IsNodeKnown(node) ||
+      root_node_manager_->is_processing_delete_node()) {
     return;
+  }
   const Id new_view_id = new_view ?
-      ViewIdToTransportId(new_view->id()) : 0;
+      access_policy_->GetViewIdToSend(node, new_view) : 0;
   const Id old_view_id = old_view ?
-      ViewIdToTransportId(old_view->id()) : 0;
+      access_policy_->GetViewIdToSend(node, old_view) : 0;
   client()->OnNodeViewReplaced(NodeIdToTransportId(node->id()),
                                new_view_id, old_view_id);
 }
 
 void ViewManagerServiceImpl::ProcessNodeDeleted(const NodeId& node,
                                                 bool originated_change) {
   node_map_.erase(node.node_id);
 
   const bool in_known = known_nodes_.erase(NodeIdToTransportId(node)) > 0;
   const bool in_roots = roots_.erase(NodeIdToTransportId(node)) > 0;
 
+  // TODO(sky): cleanup!
   if (in_roots && roots_.empty())
     roots_.insert(NodeIdToTransportId(InvalidNodeId()));
 
   if (originated_change)
     return;
 
   if (in_known) {
     client()->OnNodeDeleted(NodeIdToTransportId(node));
     root_node_manager_->OnConnectionMessagedClient(id_);
-  } else if (root_node_manager_->IsProcessingChange() &&
-             !root_node_manager_->DidConnectionMessageClient(id_)) {
-    root_node_manager_->OnConnectionMessagedClient(id_);
   }
 }
 
 void ViewManagerServiceImpl::ProcessViewDeleted(const ViewId& view,
                                                 bool originated_change) {
-  if (originated_change)
-    return;
-  client()->OnViewDeleted(ViewIdToTransportId(view));
+  if (!originated_change && access_policy_->ShouldSendViewDeleted(view))
+    client()->OnViewDeleted(ViewIdToTransportId(view));
 }
 
 void ViewManagerServiceImpl::ProcessFocusChanged(const Node* focused_node,
                                                  const Node* blurred_node,
                                                  bool originated_change) {
   if (originated_change)
     return;
 
+  // TODO(sky): this should not notify all clients.
   Id focused_id = 0;
   Id blurred_id = 0;
-  if (focused_node) {
-    Id focused_node_id = NodeIdToTransportId(focused_node->id());
-    if (known_nodes_.count(focused_node_id) > 0)
-      focused_id = focused_node_id;
-  }
-  if (blurred_node) {
-    Id blurred_node_id = NodeIdToTransportId(blurred_node->id());
-    if (known_nodes_.count(blurred_node_id) > 0)
-      blurred_id = blurred_node_id;
-  }
+  if (focused_node && IsNodeKnown(focused_node))
+    focused_id = NodeIdToTransportId(focused_node->id());
+  if (blurred_node && IsNodeKnown(blurred_node))
+    blurred_id = NodeIdToTransportId(blurred_node->id());
 
   if (focused_id != 0 || blurred_id != 0)
     client()->OnFocusChanged(focused_id, blurred_id);
 }
 
 void ViewManagerServiceImpl::OnConnectionError() {
   if (delete_on_connection_error_)
     delete this;
 }
 
-bool ViewManagerServiceImpl::CanRemoveNodeFromParent(const Node* node) const {
-  if (!node)
-    return false;
-
-  const Node* parent = node->GetParent();
-  if (!parent)
-    return false;
-
-  if (roots_.empty())
-    return true;  // Root can do anything.
-
-  if (node->id().connection_id != id_)
-    return false;  // Can only unparent nodes we created.
-
-  if (roots_.count(NodeIdToTransportId(parent->id())) > 0)
-    return true;  // We can always remove from one of our roots.
-
-  // Don't allow removing from nodes from other connections that aren't in our
-  // root list.
-  if (parent->id().connection_id != id_)
-    return false;
-
-  // Allow the remove as long as we haven't embedded another node at |parent|.
-  ViewManagerServiceImpl* connection =
-      root_node_manager_->GetConnectionWithRoot(parent->id());
-  return !connection || connection == this;
-}
-
-bool ViewManagerServiceImpl::CanAddNode(const Node* parent,
-                                        const Node* child) const {
-  if (!parent || !child)
-    return false;  // Both nodes must be valid.
-
-  if (child->GetParent() == parent || child->Contains(parent))
-    return false;  // Would result in an invalid hierarchy.
-
-  if (roots_.empty())
-    return true;  // No restriction if there are no roots.
-
-  if (child->id().connection_id != id_)
-    return false;  // Can't move children from different connections.
-
-  if (!IsNodeDescendantOfRoots(parent) && parent->id().connection_id != id_)
-    return false;  // |parent| is not visible to this connection.
-
-  // Only allow the add if we haven't given one of the ancestors of |parent| to
-  // another node. That is, Embed() hasn't been invoked with one of our nodes.
-  return !IsNodeEmbeddedInAnotherConnection(parent);
+bool ViewManagerServiceImpl::IsNodeKnown(const Node* node) const {
+  return known_nodes_.count(NodeIdToTransportId(node->id())) > 0;
 }
 
 bool ViewManagerServiceImpl::CanReorderNode(const Node* node,
                                             const Node* relative_node,
                                             OrderDirection direction) const {
   if (!node || !relative_node)
     return false;
 
-  if (node->id().connection_id != id_)
-    return false;
-
   const Node* parent = node->GetParent();
   if (!parent || parent != relative_node->GetParent())
     return false;
 
-  if (known_nodes_.count(NodeIdToTransportId(parent->id())) == 0)
+  if (!access_policy_->CanReorderNode(node, relative_node, direction))
     return false;
 
   std::vector<const Node*> children = parent->GetChildren();
   const size_t child_i =
       std::find(children.begin(), children.end(), node) - children.begin();
   const size_t target_i =
       std::find(children.begin(), children.end(), relative_node) -
       children.begin();
   if ((direction == ORDER_DIRECTION_ABOVE && child_i == target_i + 1) ||
       (direction == ORDER_DIRECTION_BELOW && child_i + 1 == target_i)) {
     return false;
   }
 
   return true;
 }
 
-bool ViewManagerServiceImpl::CanDeleteNode(const NodeId& node_id) const {
-  return node_id.connection_id == id_;
-}
-
-bool ViewManagerServiceImpl::CanDeleteView(const ViewId& view_id) const {
-  return view_id.connection_id == id_;
-}
-
-bool ViewManagerServiceImpl::CanSetView(const Node* node,
-                                        const ViewId& view_id) const {
-  if (!node || !IsNodeDescendantOfRoots(node))
-    return false;
-
-  const View* view = GetView(view_id);
-  return (view && view_id.connection_id == id_) || view_id == ViewId();
-}
-
-bool ViewManagerServiceImpl::CanSetFocus(const Node* node) const {
-  // TODO(beng): security.
-  return true;
-}
-
-bool ViewManagerServiceImpl::CanGetNodeTree(const Node* node) const {
-  if (!node)
-    return false;
-
-  if (roots_.empty())
-    return true;
-
-  if (node->id().connection_id == id_)
-    return true;
-
-  return roots_.count(NodeIdToTransportId(node->id())) > 0;
-}
-
-bool ViewManagerServiceImpl::CanEmbed(Id transport_node_id) const {
-  const Node* node = GetNode(NodeIdFromTransportId(transport_node_id));
-  return node && node->id().connection_id == id_;
-}
-
-bool ViewManagerServiceImpl::CanSetNodeVisibility(const Node* node,
-                                                  bool visibile) const {
-  return node &&
-      (node->id().connection_id == id_ ||
-       roots_.find(NodeIdToTransportId(node->id())) != roots_.end()) &&
-      node->IsVisible() != visibile;
-}
-
-bool ViewManagerServiceImpl::CanDescendIntoNodeForNodeTree(
-    const Node* node) const {
-  if (roots_.empty())
-    return true;
-
-  ViewManagerServiceImpl* connection =
-      root_node_manager_->GetConnectionWithRoot(node->id());
-  return !connection || connection == this;
-}
-
 bool ViewManagerServiceImpl::DeleteNodeImpl(ViewManagerServiceImpl* source,
-                                            const NodeId& node_id) {
-  DCHECK_EQ(node_id.connection_id, id_);
-  Node* node = GetNode(node_id);
-  if (!node)
-    return false;
+                                            Node* node) {
+  DCHECK(node);
+  DCHECK_EQ(node->id().connection_id, id_);
   RootNodeManager::ScopedChange change(source, root_node_manager_, true);
   delete node;
   return true;
 }
 
 bool ViewManagerServiceImpl::DeleteViewImpl(ViewManagerServiceImpl* source,
-                                            const ViewId& view_id) {
-  DCHECK_EQ(view_id.connection_id, id_);
-  View* view = GetView(view_id);
-  if (!view)
-    return false;
+                                            View* view) {
+  DCHECK(view);
+  DCHECK_EQ(view->id().connection_id, id_);
   RootNodeManager::ScopedChange change(source, root_node_manager_, false);
   if (view->node())
     view->node()->SetView(NULL);
-  view_map_.erase(view_id.view_id);
-  // Make a copy of |view_id| as once we delete view |view_id| may no longer be
-  // valid.
-  const ViewId view_id_copy(view_id);
+  view_map_.erase(view->id().view_id);
+  const ViewId view_id(view->id());
   delete view;
-  root_node_manager_->ProcessViewDeleted(view_id_copy);
+  root_node_manager_->ProcessViewDeleted(view_id);
   return true;
 }
 
-bool ViewManagerServiceImpl::SetViewImpl(Node* node, const ViewId& view_id) {
+bool ViewManagerServiceImpl::SetViewImpl(Node* node, View* view) {
   DCHECK(node);  // CanSetView() should have verified node exists.
-  View* view = GetView(view_id);
   RootNodeManager::ScopedChange change(this, root_node_manager_, false);
   node->SetView(view);
   return true;
 }
 
 void ViewManagerServiceImpl::GetUnknownNodesFrom(
     const Node* node,
     std::vector<const Node*>* nodes) {
-  const Id transport_id = NodeIdToTransportId(node->id());
-  if (known_nodes_.count(transport_id) == 1)
+  if (IsNodeKnown(node))
     return;
   nodes->push_back(node);
-  known_nodes_.insert(transport_id);
+  known_nodes_.insert(NodeIdToTransportId(node->id()));
   std::vector<const Node*> children(node->GetChildren());
   for (size_t i = 0 ; i < children.size(); ++i)
     GetUnknownNodesFrom(children[i], nodes);
 }
 
 void ViewManagerServiceImpl::RemoveFromKnown(const Node* node,
                                              std::vector<Node*>* local_nodes) {
   if (node->id().connection_id == id_) {
     if (local_nodes)
       local_nodes->push_back(GetNode(node->id()));
     return;
   }
   known_nodes_.erase(NodeIdToTransportId(node->id()));
   std::vector<const Node*> children = node->GetChildren();
   for (size_t i = 0; i < children.size(); ++i)
     RemoveFromKnown(children[i], local_nodes);
 }
 
-bool ViewManagerServiceImpl::IsNodeEmbeddedInAnotherConnection(
-    const Node* node) const {
-  while (node) {
-    const ViewManagerServiceImpl* connection =
-        root_node_manager_->GetConnectionWithRoot(node->id());
-    if (connection)
-      return connection != this;
-    node = node->GetParent();
-  }
-  return false;
-}
-
 void ViewManagerServiceImpl::AddRoot(const NodeId& node_id) {
   const Id transport_node_id(NodeIdToTransportId(node_id));
   CHECK(roots_.count(transport_node_id) == 0);
 
   std::vector<const Node*> to_send;
   CHECK_EQ(creator_id_, node_id.connection_id);
   roots_.insert(transport_node_id);
   Node* node = GetNode(node_id);
   CHECK(node);
-  if (known_nodes_.count(transport_node_id) == 0) {
+  if (!IsNodeKnown(node)) {
     GetUnknownNodesFrom(node, &to_send);
   } else {
     // Even though the connection knows about the new root we need to tell it
     // |node| is now a root.
     to_send.push_back(node);
   }
 
   client()->OnRootAdded(NodesToNodeDatas(to_send));
   root_node_manager_->OnConnectionMessagedClient(id_);
 }
@@ skipping 28 matching lines @@
     return;
 
   Node* node = GetNode(node_id);
   CHECK(node);
   CHECK(node->id().connection_id == node_id.connection_id);
   std::vector<Node*> children = node->GetChildren();
   for (size_t i = 0; i < children.size(); ++i)
     node->Remove(children[i]);
 }
 
-bool ViewManagerServiceImpl::IsNodeDescendantOfRoots(const Node* node) const {
-  if (roots_.empty())
-    return true;
-  if (!node)
-    return false;
-  const Id invalid_node_id = NodeIdToTransportId(InvalidNodeId());
-  for (NodeIdSet::const_iterator i = roots_.begin(); i != roots_.end(); ++i) {
-    if (*i == invalid_node_id)
-      continue;
-    const Node* root = GetNode(NodeIdFromTransportId(*i));
-    DCHECK(root);
-    if (root->Contains(node))
-      return true;
-  }
-  return false;
-}
-
-bool ViewManagerServiceImpl::ShouldNotifyOnHierarchyChange(
-    const Node* node,
-    const Node** new_parent,
-    const Node** old_parent,
-    std::vector<const Node*>* to_send) {
-  // If the node is not in |roots_| or was never known to this connection then
-  // don't notify the client about it.
-  if (node->id().connection_id != id_ &&
-      known_nodes_.count(NodeIdToTransportId(node->id())) == 0 &&
-      !IsNodeDescendantOfRoots(node)) {
-    return false;
-  }
-  if (!IsNodeDescendantOfRoots(*new_parent))
-    *new_parent = NULL;
-  if (!IsNodeDescendantOfRoots(*old_parent))
-    *old_parent = NULL;
-
-  if (*new_parent) {
-    // On getting a new parent we may need to communicate new nodes to the
-    // client. We do that in the following cases:
-    // . New parent is a descendant of the roots. In this case the client
-    //   already knows all ancestors, so we only have to communicate descendants
-    //   of node the client doesn't know about.
-    // . If the client knew about the parent, we have to do the same.
-    // . If the client knows about the node and is added to a tree the client
-    //   doesn't know about we have to communicate from the root down (the
-    //   client is learning about a new root).
-    if (root_node_manager_->root()->Contains(*new_parent) ||
-        known_nodes_.count(NodeIdToTransportId((*new_parent)->id()))) {
-      GetUnknownNodesFrom(node, to_send);
-      return true;
-    }
-    // If parent wasn't known we have to communicate from the root down.
-    if (known_nodes_.count(NodeIdToTransportId(node->id()))) {
-      // No need to check against |roots_| as client should always know it's
-      // |roots_|.
-      GetUnknownNodesFrom((*new_parent)->GetRoot(), to_send);
-      return true;
-    }
-  }
-  // Otherwise only communicate the change if the node was known. We shouldn't
-  // need to communicate any nodes on a remove.
-  return known_nodes_.count(NodeIdToTransportId(node->id())) > 0;
-}
-
 Array<NodeDataPtr> ViewManagerServiceImpl::NodesToNodeDatas(
     const std::vector<const Node*>& nodes) {
   Array<NodeDataPtr> array(nodes.size());
   for (size_t i = 0; i < nodes.size(); ++i) {
     const Node* node = nodes[i];
-    DCHECK(known_nodes_.count(NodeIdToTransportId(node->id())) > 0);
+    DCHECK(IsNodeKnown(node));
     const Node* parent = node->GetParent();
     // If the parent isn't known, it means the parent is not visible to us (not
     // in roots), and should not be sent over.
-    if (parent && known_nodes_.count(NodeIdToTransportId(parent->id())) == 0)
+    if (parent && !IsNodeKnown(parent))
       parent = NULL;
     NodeDataPtr inode(NodeData::New());
     inode->parent_id = NodeIdToTransportId(parent ? parent->id() : NodeId());
     inode->node_id = NodeIdToTransportId(node->id());
+    // TODO(sky): should the id only be sent if known?
     inode->view_id =
         ViewIdToTransportId(node->view() ? node->view()->id() : ViewId());
     inode->bounds = Rect::From(node->bounds());
     array[i] = inode.Pass();
   }
   return array.Pass();
 }
 
 void ViewManagerServiceImpl::GetNodeTreeImpl(
     const Node* node,
     std::vector<const Node*>* nodes) const {
   DCHECK(node);
 
-  if (!CanGetNodeTree(node))
+  if (!access_policy_->CanGetNodeTree(node))
     return;
 
   nodes->push_back(node);
 
-  if (!CanDescendIntoNodeForNodeTree(node))
+  if (!access_policy_->CanDescendIntoNodeForNodeTree(node))
     return;
 
   std::vector<const Node*> children(node->GetChildren());
   for (size_t i = 0 ; i < children.size(); ++i)
     GetNodeTreeImpl(children[i], nodes);
 }
 
 void ViewManagerServiceImpl::CreateNode(
     Id transport_node_id,
     const Callback<void(ErrorCode)>& callback) {
   const NodeId node_id(NodeIdFromTransportId(transport_node_id));
   ErrorCode error_code = ERROR_CODE_NONE;
   if (node_id.connection_id != id_) {
     error_code = ERROR_CODE_ILLEGAL_ARGUMENT;
   } else if (node_map_.find(node_id.node_id) != node_map_.end()) {
     error_code = ERROR_CODE_VALUE_IN_USE;
   } else {
     node_map_[node_id.node_id] = new Node(root_node_manager_, node_id);
     known_nodes_.insert(transport_node_id);
   }
   callback.Run(error_code);
 }
 
 void ViewManagerServiceImpl::DeleteNode(
     Id transport_node_id,
     const Callback<void(bool)>& callback) {
-  const NodeId node_id(NodeIdFromTransportId(transport_node_id));
+  Node* node = GetNode(NodeIdFromTransportId(transport_node_id));
   bool success = false;
-  if (CanDeleteNode(node_id)) {
+  if (node && access_policy_->CanDeleteNode(node)) {
     ViewManagerServiceImpl* connection = root_node_manager_->GetConnection(
-        node_id.connection_id);
-    success = connection && connection->DeleteNodeImpl(this, node_id);
+        node->id().connection_id);
+    success = connection && connection->DeleteNodeImpl(this, node);
   }
   callback.Run(success);
 }
 
 void ViewManagerServiceImpl::AddNode(
     Id parent_id,
     Id child_id,
     const Callback<void(bool)>& callback) {
   bool success = false;
   Node* parent = GetNode(NodeIdFromTransportId(parent_id));
   Node* child = GetNode(NodeIdFromTransportId(child_id));
-  if (CanAddNode(parent, child)) {
+  if (parent && child && child->GetParent() != parent &&
+      !child->Contains(parent) && access_policy_->CanAddNode(parent, child)) {
     success = true;
     RootNodeManager::ScopedChange change(this, root_node_manager_, false);
     parent->Add(child);
   }
   callback.Run(success);
 }
 
 void ViewManagerServiceImpl::RemoveNodeFromParent(
     Id node_id,
     const Callback<void(bool)>& callback) {
   bool success = false;
   Node* node = GetNode(NodeIdFromTransportId(node_id));
-  if (CanRemoveNodeFromParent(node)) {
+  if (node && node->GetParent() &&
+      access_policy_->CanRemoveNodeFromParent(node)) {
     success = true;
     RootNodeManager::ScopedChange change(this, root_node_manager_, false);
     node->GetParent()->Remove(node);
   }
   callback.Run(success);
 }
 
 void ViewManagerServiceImpl::ReorderNode(Id node_id,
                                          Id relative_node_id,
                                          OrderDirection direction,
                                          const Callback<void(bool)>& callback) {
   bool success = false;
   Node* node = GetNode(NodeIdFromTransportId(node_id));
   Node* relative_node = GetNode(NodeIdFromTransportId(relative_node_id));
   if (CanReorderNode(node, relative_node, direction)) {
     success = true;
     RootNodeManager::ScopedChange change(this, root_node_manager_, false);
     node->GetParent()->Reorder(node, relative_node, direction);
     root_node_manager_->ProcessNodeReorder(node, relative_node, direction);
   }
   callback.Run(success);
 }
 
 void ViewManagerServiceImpl::GetNodeTree(
     Id node_id,
     const Callback<void(Array<NodeDataPtr>)>& callback) {
   Node* node = GetNode(NodeIdFromTransportId(node_id));
   std::vector<const Node*> nodes;
-  if (CanGetNodeTree(node)) {
+  if (node) {
     GetNodeTreeImpl(node, &nodes);
-#if !defined(NDEBUG)
-    for (size_t i = 0; i < nodes.size(); ++i)
-      DCHECK_GT(known_nodes_.count(NodeIdToTransportId(nodes[i]->id())), 0u);
-#endif
+    // TODO(sky): this should map in nodes that weren't none.
   }
   callback.Run(NodesToNodeDatas(nodes));
 }
 
 void ViewManagerServiceImpl::CreateView(
     Id transport_view_id,
     const Callback<void(bool)>& callback) {
   const ViewId view_id(ViewIdFromTransportId(transport_view_id));
   if (view_id.connection_id != id_ || view_map_.count(view_id.view_id)) {
     callback.Run(false);
     return;
   }
   view_map_[view_id.view_id] = new View(view_id);
   callback.Run(true);
 }
 
-void ViewManagerServiceImpl::DeleteView(
-    Id transport_view_id,
-    const Callback<void(bool)>& callback) {
-  const ViewId view_id(ViewIdFromTransportId(transport_view_id));
-  bool did_delete = CanDeleteView(view_id);
-  if (did_delete) {
+void ViewManagerServiceImpl::DeleteView(Id transport_view_id,
+                                        const Callback<void(bool)>& callback) {
+  View* view = GetView(ViewIdFromTransportId(transport_view_id));
+  bool did_delete = false;
+  if (view && access_policy_->CanDeleteView(view)) {
     ViewManagerServiceImpl* connection = root_node_manager_->GetConnection(
-        view_id.connection_id);
-    did_delete = (connection && connection->DeleteViewImpl(this, view_id));
+        view->id().connection_id);
+    did_delete = (connection && connection->DeleteViewImpl(this, view));
   }
   callback.Run(did_delete);
 }
 
 void ViewManagerServiceImpl::SetView(Id transport_node_id,
                                      Id transport_view_id,
                                      const Callback<void(bool)>& callback) {
   Node* node = GetNode(NodeIdFromTransportId(transport_node_id));
-  const ViewId view_id(ViewIdFromTransportId(transport_view_id));
-  callback.Run(CanSetView(node, view_id) && SetViewImpl(node, view_id));
+  View* view = GetView(ViewIdFromTransportId(transport_view_id));
+  const bool valid_view = view ||
+      ViewIdFromTransportId(transport_node_id) != ViewId();
+  callback.Run(valid_view && node && access_policy_->CanSetView(node, view) &&
+               SetViewImpl(node, view));
 }
 
 void ViewManagerServiceImpl::SetViewContents(
     Id view_id,
     ScopedSharedBufferHandle buffer,
     uint32_t buffer_size,
     const Callback<void(bool)>& callback) {
+  // TODO(sky): add coverage of not being able to set for random view.
   View* view = GetView(ViewIdFromTransportId(view_id));
-  if (!view) {
+  if (!view || !access_policy_->CanSetViewContents(view)) {
     callback.Run(false);
     return;
   }
   void* handle_data;
   if (MapBuffer(buffer.get(), 0, buffer_size, &handle_data,
                 MOJO_MAP_BUFFER_FLAG_NONE) != MOJO_RESULT_OK) {
     callback.Run(false);
     return;
   }
   SkBitmap bitmap;
   gfx::PNGCodec::Decode(static_cast<const unsigned char*>(handle_data),
                         buffer_size, &bitmap);
   view->SetBitmap(bitmap);
   UnmapBuffer(handle_data);
   callback.Run(true);
 }
 
 void ViewManagerServiceImpl::SetFocus(Id node_id,
                                       const Callback<void(bool)> & callback) {
   bool success = false;
   Node* node = GetNode(NodeIdFromTransportId(node_id));
-  if (CanSetFocus(node)) {
+  if (node && access_policy_->CanSetFocus(node)) {
     success = true;
     node->window()->Focus();
   }
   callback.Run(success);
 }
 
 void ViewManagerServiceImpl::SetNodeBounds(
     Id node_id,
     RectPtr bounds,
     const Callback<void(bool)>& callback) {
-  if (NodeIdFromTransportId(node_id).connection_id != id_) {
-    callback.Run(false);
-    return;
+  Node* node = GetNode(NodeIdFromTransportId(node_id));
+  const bool success = node && access_policy_->CanSetNodeBounds(node);
+  if (success) {
+    RootNodeManager::ScopedChange change(this, root_node_manager_, false);
+    gfx::Rect old_bounds = node->window()->bounds();
+    node->window()->SetBounds(bounds.To<gfx::Rect>());
   }
-
-  Node* node = GetNode(NodeIdFromTransportId(node_id));
-  if (!node) {
-    callback.Run(false);
-    return;
-  }
-
-  RootNodeManager::ScopedChange change(this, root_node_manager_, false);
-  gfx::Rect old_bounds = node->window()->bounds();
-  node->window()->SetBounds(bounds.To<gfx::Rect>());
-  callback.Run(true);
+  callback.Run(success);
 }
 
 void ViewManagerServiceImpl::SetNodeVisibility(
     Id transport_node_id,
     bool visible,
     const Callback<void(bool)>& callback) {
-  const NodeId node_id(NodeIdFromTransportId(transport_node_id));
-  Node* node = GetNode(node_id);
-  const bool success = CanSetNodeVisibility(node, visible);
+  Node* node = GetNode(NodeIdFromTransportId(transport_node_id));
+  const bool success = node && node->IsVisible() != visible &&
+      access_policy_->CanChangeNodeVisibility(node);
   if (success) {
     DCHECK(node);
     node->SetVisible(visible);
   }
   // TODO(sky): need to notify of visibility changes.
   callback.Run(success);
 }
 
 void ViewManagerServiceImpl::Embed(const String& url,
                                    Id transport_node_id,
                                    const Callback<void(bool)>& callback) {
   if (NodeIdFromTransportId(transport_node_id) == InvalidNodeId()) {
     root_node_manager_->EmbedRoot(url);
     callback.Run(true);
     return;
   }
-  bool success = CanEmbed(transport_node_id);
+  const Node* node = GetNode(NodeIdFromTransportId(transport_node_id));
+  bool success = node && access_policy_->CanEmbed(node);
   if (success) {
     // Only allow a node to be the root for one connection.
     const NodeId node_id(NodeIdFromTransportId(transport_node_id));
     ViewManagerServiceImpl* connection_by_url =
         root_node_manager_->GetConnectionByCreator(id_, url.To<std::string>());
     ViewManagerServiceImpl* connection_with_node_as_root =
         root_node_manager_->GetConnectionWithRoot(node_id);
     if ((connection_by_url != connection_with_node_as_root ||
          (!connection_by_url && !connection_with_node_as_root)) &&
         (!connection_by_url || !connection_by_url->HasRoot(node_id))) {
@@ skipping 42 matching lines @@
     for (NodeIdSet::const_iterator i = roots_.begin(); i != roots_.end(); ++i)
       GetUnknownNodesFrom(GetNode(NodeIdFromTransportId(*i)), &to_send);
   }
 
   client()->OnViewManagerConnectionEstablished(
       id_,
       creator_url_,
       NodesToNodeDatas(to_send));
 }
 
+const base::hash_set<Id>&
+ViewManagerServiceImpl::GetRootsForAccessPolicy() const {
+  return roots_;
+}
+
+bool
+ViewManagerServiceImpl::IsNodeKnownForAccessPolicy(const Node* node) const {
+  return IsNodeKnown(node);
+}
+
+bool ViewManagerServiceImpl::IsNodeEmbeddedInAnotherConnectionForAccessPolicy(
+    const Node* node) const {
+  ViewManagerServiceImpl* connection =
+      root_node_manager_->GetConnectionWithRoot(node->id());
+  return connection && connection != this;
+}
+
 }  // namespace service
 }  // namespace mojo