OAuth2 support for Webstore downloads.

chrome/browser/extensions/updater/extension_updater_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <list>
 #include <map>
 #include <set>
 #include <vector>
 
 #include "base/bind.h"
@@ skipping 35 matching lines @@
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/notification_source.h"
 #include "content/public/test/test_browser_thread_bundle.h"
 #include "content/public/test/test_utils.h"
 #include "extensions/browser/extension_prefs.h"
 #include "extensions/browser/extension_registry.h"
 #include "extensions/browser/extension_system.h"
 #include "extensions/common/extension.h"
 #include "extensions/common/id_util.h"
 #include "extensions/common/manifest_constants.h"
+#include "google_apis/gaia/fake_identity_provider.h"
+#include "google_apis/gaia/fake_oauth2_token_service.h"
 #include "libxml/globals.h"
 #include "net/base/backoff_entry.h"
 #include "net/base/escape.h"
 #include "net/base/load_flags.h"
+#include "net/http/http_request_headers.h"
 #include "net/url_request/test_url_fetcher_factory.h"
 #include "net/url_request/url_request_status.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/third_party/mozilla/url_parse.h"
 
 #if defined(OS_CHROMEOS)
 #include "chrome/browser/chromeos/login/users/user_manager.h"
 #include "chrome/browser/chromeos/settings/cros_settings.h"
 #include "chrome/browser/chromeos/settings/device_settings_service.h"
@@ skipping 45 matching lines @@
 
 const char kEmptyUpdateUrlData[] = "";
 
 const char kAuthUserQueryKey[] = "authuser";
 
 int kExpectedLoadFlags =
     net::LOAD_DO_NOT_SEND_COOKIES |
     net::LOAD_DO_NOT_SAVE_COOKIES |
     net::LOAD_DISABLE_CACHE;
 
-int kExpectedLoadFlagsForProtectedDownload = net::LOAD_DISABLE_CACHE;
+int kExpectedLoadFlagsForDownloadWithCookies = net::LOAD_DISABLE_CACHE;
 
 const ManifestFetchData::PingData kNeverPingedData(
     ManifestFetchData::kNeverPinged, ManifestFetchData::kNeverPinged, true);
 
 class MockExtensionDownloaderDelegate : public ExtensionDownloaderDelegate {
  public:
   MOCK_METHOD4(OnExtensionDownloadFailed, void(const std::string&,
                                                Error,
                                                const PingResult&,
                                                const std::set<int>&));
@@ skipping 460 matching lines @@
       SetupPendingExtensionManagerForTest(1, GURL(update_url),
                                           pending_extension_manager);
     } else {
       service.CreateTestExtensions(1, 1, &extensions, &update_url,
                                    Manifest::INTERNAL);
       service.set_extensions(extensions, ExtensionList());
     }
 
     // Set up and start the updater.
     net::TestURLFetcherFactory factory;
-    ExtensionUpdater updater(
-        &service, service.extension_prefs(), service.pref_service(),
-        service.profile(), 60*60*24, NULL);
+    ExtensionUpdater updater(&service,
+                             service.extension_prefs(),
+                             service.pref_service(),
+                             service.profile(),
+                             60 * 60 * 24,
+                             NULL,
+                             make_scoped_ptr<IdentityProvider>(NULL));
     updater.Start();
 
     // Tell the update that it's time to do update checks.
     EXPECT_EQ(0u, observer.StartedCount());
     SimulateTimerFired(&updater);
     EXPECT_EQ(1u, observer.StartedCount());
 
     // Get the url our mock fetcher was asked to fetch.
     net::TestURLFetcher* fetcher =
         factory.GetFetcherByID(ExtensionDownloader::kManifestFetcherId);
@@ skipping 66 matching lines @@
     EXPECT_EQ(id, params["id"]);
     EXPECT_EQ(version, params["v"]);
     EXPECT_EQ("a%3D1%26b%3D2%26c", params["ap"]);
   }
 
   void TestUpdateUrlDataFromGallery(const std::string& gallery_url) {
     net::TestURLFetcherFactory factory;
 
     MockService service(prefs_.get());
     MockExtensionDownloaderDelegate delegate;
-    ExtensionDownloader downloader(&delegate, service.request_context());
+    ExtensionDownloader downloader(&delegate, service.request_context(), NULL);
     ExtensionList extensions;
     std::string url(gallery_url);
 
     service.CreateTestExtensions(1, 1, &extensions, &url, Manifest::INTERNAL);
 
     const std::string& id = extensions[0]->id();
     EXPECT_CALL(delegate, GetPingDataForExtension(id, _));
 
     downloader.AddExtension(*extensions[0].get(), 0);
     downloader.StartAllPending(NULL);
@@ skipping 21 matching lines @@
     std::map<std::string, std::string> params;
     VerifyQueryAndExtractParameters(fetch_data.full_url().query(), &params);
     EXPECT_EQ(id, params["id"]);
     EXPECT_EQ(version, params["v"]);
     EXPECT_EQ(install_source, params["installsource"]);
   }
 
   void TestDetermineUpdates() {
     TestingProfile profile;
     MockExtensionDownloaderDelegate delegate;
-    ExtensionDownloader downloader(&delegate, profile.GetRequestContext());
+    ExtensionDownloader downloader(
+        &delegate, profile.GetRequestContext(), NULL);
 
     // Check passing an empty list of parse results to DetermineUpdates
     ManifestFetchData fetch_data(GURL("http://localhost/foo"), 0);
     UpdateManifest::Results updates;
     std::vector<int> updateable;
     downloader.DetermineUpdates(fetch_data, updates, &updateable);
     EXPECT_TRUE(updateable.empty());
 
     // Create two updates - expect that DetermineUpdates will return the first
     // one (v1.0 installed, v1.1 available) but not the second one (both
@@ skipping 22 matching lines @@
 
   void TestDetermineUpdatesPending() {
     // Create a set of test extensions
     ServiceForManifestTests service(prefs_.get());
     PendingExtensionManager* pending_extension_manager =
         service.pending_extension_manager();
     SetupPendingExtensionManagerForTest(3, GURL(), pending_extension_manager);
 
     TestingProfile profile;
     MockExtensionDownloaderDelegate delegate;
-    ExtensionDownloader downloader(&delegate, profile.GetRequestContext());
+    ExtensionDownloader downloader(
+        &delegate, profile.GetRequestContext(), NULL);
 
     ManifestFetchData fetch_data(GURL("http://localhost/foo"), 0);
     UpdateManifest::Results updates;
 
     std::list<std::string> ids_for_update_check;
     pending_extension_manager->GetPendingIdsForUpdateCheck(
         &ids_for_update_check);
 
     std::list<std::string>::const_iterator it;
     for (it = ids_for_update_check.begin();
@@ skipping 18 matching lines @@
       EXPECT_EQ(static_cast<int>(i), updateable[i]);
     }
   }
 
   void TestMultipleManifestDownloading() {
     net::TestURLFetcherFactory factory;
     factory.set_remove_fetcher_on_delete(true);
     net::TestURLFetcher* fetcher = NULL;
     MockService service(prefs_.get());
     MockExtensionDownloaderDelegate delegate;
-    ExtensionDownloader downloader(&delegate, service.request_context());
+    ExtensionDownloader downloader(&delegate, service.request_context(), NULL);
     downloader.manifests_queue_.set_backoff_policy(&kNoBackoffPolicy);
 
     GURL kUpdateUrl("http://localhost/manifest1");
 
     scoped_ptr<ManifestFetchData> fetch1(new ManifestFetchData(kUpdateUrl, 0));
     scoped_ptr<ManifestFetchData> fetch2(new ManifestFetchData(kUpdateUrl, 0));
     scoped_ptr<ManifestFetchData> fetch3(new ManifestFetchData(kUpdateUrl, 0));
     scoped_ptr<ManifestFetchData> fetch4(new ManifestFetchData(kUpdateUrl, 0));
     ManifestFetchData::PingData zeroDays(0, 0, true);
     fetch1->AddExtension(
@@ skipping 119 matching lines @@
     if (fetcher)
       ADD_FAILURE() << "Unexpected fetch: " << fetcher->GetOriginalURL();
   }
 
   void TestManifestRetryDownloading() {
     net::TestURLFetcherFactory factory;
     net::TestURLFetcher* fetcher = NULL;
     NotificationsObserver observer;
     MockService service(prefs_.get());
     MockExtensionDownloaderDelegate delegate;
-    ExtensionDownloader downloader(&delegate, service.request_context());
+    ExtensionDownloader downloader(&delegate, service.request_context(), NULL);
     downloader.manifests_queue_.set_backoff_policy(&kNoBackoffPolicy);
 
     GURL kUpdateUrl("http://localhost/manifest1");
 
     scoped_ptr<ManifestFetchData> fetch(new ManifestFetchData(kUpdateUrl, 0));
     ManifestFetchData::PingData zeroDays(0, 0, true);
     fetch->AddExtension(
         "1111", "1.0", &zeroDays, kEmptyUpdateUrlData, std::string());
 
     // This will start the first fetcher.
@@ skipping 52 matching lines @@
     RunUntilIdle();
 
     Mock::VerifyAndClearExpectations(&delegate);
   }
 
   void TestSingleExtensionDownloading(bool pending, bool retry, bool fail) {
     net::TestURLFetcherFactory factory;
     net::TestURLFetcher* fetcher = NULL;
     scoped_ptr<ServiceForDownloadTests> service(
         new ServiceForDownloadTests(prefs_.get()));
-    ExtensionUpdater updater(service.get(), service->extension_prefs(),
+    ExtensionUpdater updater(service.get(),
+                             service->extension_prefs(),
                              service->pref_service(),
                              service->profile(),
                              kUpdateFrequencySecs,
-                             NULL);
+                             NULL,
+                             make_scoped_ptr<IdentityProvider>(NULL));
     updater.Start();
     MockExtensionDownloaderDelegate delegate;
     delegate.DelegateTo(&updater);
     ResetDownloader(
         &updater,
-        new ExtensionDownloader(&delegate, service->request_context()));
+        new ExtensionDownloader(&delegate, service->request_context(), NULL));
     updater.downloader_->extensions_queue_.set_backoff_policy(
         &kNoBackoffPolicy);
 
     GURL test_url("http://localhost/extension.crx");
 
     std::string id = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
     std::string hash;
     Version version("0.0.1");
     std::set<int> requests;
     requests.insert(0);
@@ skipping 65 matching lines @@
       // Expect that ExtensionUpdater asked the mock extensions service to
       // install a file with the test data for the right id.
       EXPECT_EQ(id, service->extension_id());
       base::FilePath tmpfile_path = service->install_path();
       EXPECT_FALSE(tmpfile_path.empty());
       EXPECT_EQ(extension_file_path, tmpfile_path);
     }
   }
 
   // Update a single extension in an environment where the download request
-  // initially responds with a 403 status. Expect the fetcher to automatically
-  // retry with cookies enabled.
-  void TestSingleProtectedExtensionDownloading(bool use_https,
-                                               bool fail,
-                                               int max_authuser,
-                                               int valid_authuser) {
+  // initially responds with a 403 status. If |identity_provider| is not NULL,
+  // this will first expect a request which includes an Authorization header
+  // with an OAuth2 bearer token; otherwise, or if OAuth2 failure is simulated,
+  // this expects the downloader to fall back onto cookie-based credentials.
+  void TestProtectedDownload(
+      const std::string& url_prefix,
+      bool enable_oauth2,
+      bool succeed_with_oauth2,
+      int valid_authuser,
+      int max_authuser) {
+    const char kFakeAccountId[] = "bobloblaw@lawblog.example.com";
+    const char kFakeOAuth2Token[] = "ce n'est pas un jeton";
+
     net::TestURLFetcherFactory factory;
     net::TestURLFetcher* fetcher = NULL;
     scoped_ptr<ServiceForDownloadTests> service(
         new ServiceForDownloadTests(prefs_.get()));
-    ExtensionUpdater updater(service.get(), service->extension_prefs(),
+    ExtensionUpdater updater(service.get(),
+                             service->extension_prefs(),
                              service->pref_service(),
                              service->profile(),
                              kUpdateFrequencySecs,
-                             NULL);
+                             NULL,
+                             make_scoped_ptr<IdentityProvider>(NULL));
     updater.Start();
+
+    scoped_ptr<FakeOAuth2TokenService> fake_token_service;
+    scoped_ptr<FakeIdentityProvider> fake_identity_provider;
+    if (enable_oauth2) {
+      fake_token_service.reset(new FakeOAuth2TokenService());
+      fake_identity_provider.reset(new FakeIdentityProvider(
+          fake_token_service.get()));
+      fake_identity_provider->LogIn(kFakeAccountId);
+      fake_token_service->AddAccount(kFakeAccountId);
+    }
+
     ResetDownloader(
         &updater,
-        new ExtensionDownloader(&updater, service->request_context()));
+        new ExtensionDownloader(&updater,
+                                service->request_context(),
+                                fake_identity_provider.get()));
     updater.downloader_->extensions_queue_.set_backoff_policy(
         &kNoBackoffPolicy);
 
-    GURL test_url(use_https ? "https://localhost/extension.crx" :
-                              "http://localhost/extension.crx");
-
+    GURL test_url(base::StringPrintf("%s/extension.crx", url_prefix.c_str()));
     std::string id = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
     std::string hash;
     Version version("0.0.1");
     std::set<int> requests;
     requests.insert(0);
     scoped_ptr<ExtensionDownloader::ExtensionFetch> fetch(
         new ExtensionDownloader::ExtensionFetch(
             id, test_url, hash, version.GetString(), requests));
     updater.downloader_->FetchUpdatedExtension(fetch.Pass());
 
     fetcher = factory.GetFetcherByID(ExtensionDownloader::kExtensionFetcherId);
     EXPECT_TRUE(fetcher != NULL && fetcher->delegate() != NULL);
-    EXPECT_TRUE(fetcher->GetLoadFlags() == kExpectedLoadFlags);
+    EXPECT_EQ(kExpectedLoadFlags, fetcher->GetLoadFlags());
 
     // Fake a 403 response.
     fetcher->set_url(test_url);
     fetcher->set_status(net::URLRequestStatus());
     fetcher->set_response_code(403);
     fetcher->delegate()->OnURLFetchComplete(fetcher);
+    if (fake_token_service) {
+      fake_token_service->IssueAllTokensForAccount(
+          kFakeAccountId, kFakeOAuth2Token, base::Time::Now());
+    }
     RunUntilIdle();
 
-    // Verify that the fetcher has been switched to protected download mode
-    // so that cookies would be sent with the next request (https only).
+    bool using_oauth2 = false;
+    int expected_load_flags = kExpectedLoadFlags;
+    // Verify that the fetch has had its credentials properly incremented.
     fetcher = factory.GetFetcherByID(ExtensionDownloader::kExtensionFetcherId);
     EXPECT_TRUE(fetcher != NULL && fetcher->delegate() != NULL);
-    if (use_https) {
-      EXPECT_TRUE(
-          fetcher->GetLoadFlags() == kExpectedLoadFlagsForProtectedDownload);
+    net::HttpRequestHeaders fetch_headers;
+    fetcher->GetExtraRequestHeaders(&fetch_headers);
+    // If the download URL is not https, no credentials should be provided.
+    if (!test_url.SchemeIsSecure()) {
+      // No cookies.
+      EXPECT_EQ(kExpectedLoadFlags, fetcher->GetLoadFlags());
+      // No Authorization header.
+      EXPECT_FALSE(fetch_headers.HasHeader(
+          net::HttpRequestHeaders::kAuthorization));
+      expected_load_flags = kExpectedLoadFlags;
     } else {
-      EXPECT_TRUE(fetcher->GetLoadFlags() == kExpectedLoadFlags);
+      // HTTPS is in use, so credentials are allowed.
+      if (enable_oauth2 && test_url.DomainIs("google.com")) {
+        // If an IdentityProvider is present and the URL is a google.com
+        // URL, the fetcher should be in OAuth2 mode after the intitial
+        // challenge.
+        EXPECT_TRUE(fetch_headers.HasHeader(
+            net::HttpRequestHeaders::kAuthorization));
+        std::string expected_header_value = base::StringPrintf("Bearer %s",
+            kFakeOAuth2Token);
+        std::string actual_header_value;
+        fetch_headers.GetHeader(net::HttpRequestHeaders::kAuthorization,
+                                &actual_header_value);
+        EXPECT_EQ(expected_header_value, actual_header_value);
+        using_oauth2 = true;
+      } else {
+        // No IdentityProvider (or no google.com), so expect cookies instead of
+        // an Authorization header.
+        EXPECT_FALSE(fetch_headers.HasHeader(
+            net::HttpRequestHeaders::kAuthorization));
+        EXPECT_EQ(kExpectedLoadFlagsForDownloadWithCookies,
+            fetcher->GetLoadFlags());
+        expected_load_flags = kExpectedLoadFlagsForDownloadWithCookies;
+      }
     }
 
-    // Attempt to fetch again after the auth failure.
-    bool succeed = !fail;
-    if (fail) {
-      // Do not simulate incremental authuser retries.
-      if (max_authuser == 0) {
-        // Fail and verify that the fetch queue is cleared.
+    bool success = false;
+    if (using_oauth2) {
+      if (succeed_with_oauth2) {
+        success = true;
+      } else {
+        // Simulate OAuth2 failure and ensure that we fall back on cookies.
         fetcher->set_url(test_url);
         fetcher->set_status(net::URLRequestStatus());
-        fetcher->set_response_code(401);
+        fetcher->set_response_code(403);
         fetcher->delegate()->OnURLFetchComplete(fetcher);
         RunUntilIdle();
 
-        EXPECT_EQ(0U, updater.downloader_->extensions_queue_.active_request());
-        return;
+        const ExtensionDownloader::ExtensionFetch& fetch =
+            *updater.downloader_->extensions_queue_.active_request();
+        EXPECT_EQ(0, GetAuthUserQueryValue(fetch.url));
+        EXPECT_EQ(ExtensionDownloader::ExtensionFetch::CREDENTIALS_COOKIES,
+                  fetch.credentials);
+
+        fetcher = factory.GetFetcherByID(
+            ExtensionDownloader::kExtensionFetcherId);
+        EXPECT_TRUE(fetcher != NULL && fetcher->delegate() != NULL);
+        fetcher->GetExtraRequestHeaders(&fetch_headers);
+        EXPECT_FALSE(fetch_headers.HasHeader(
+            net::HttpRequestHeaders::kAuthorization));
+        EXPECT_EQ(kExpectedLoadFlagsForDownloadWithCookies,
+            fetcher->GetLoadFlags());
+        expected_load_flags = kExpectedLoadFlagsForDownloadWithCookies;
       }
+    }
 
-      // Simulate incremental authuser retries.
-      for (int user_index = 0; user_index <= max_authuser; ++user_index) {
+    if (!success) {
+      // Not yet ready to simulate a successful fetch. At this point we begin
+      // simulating cookie-based authentication with increasing values of
+      // authuser (starting from 0.)
+      int user_index = 0;
+      for (; user_index <= max_authuser; ++user_index) {
         const ExtensionDownloader::ExtensionFetch& fetch =
             *updater.downloader_->extensions_queue_.active_request();
         EXPECT_EQ(user_index, GetAuthUserQueryValue(fetch.url));
         if (user_index == valid_authuser) {
-          succeed = true;
+          success = true;
           break;
         }
+        // Simulate an authorization failure which should elicit an increment
+        // of the authuser value.
         fetcher =
             factory.GetFetcherByID(ExtensionDownloader::kExtensionFetcherId);
         EXPECT_TRUE(fetcher != NULL && fetcher->delegate() != NULL);
+        EXPECT_EQ(expected_load_flags, fetcher->GetLoadFlags());
         fetcher->set_url(fetch.url);
         fetcher->set_status(net::URLRequestStatus());
         fetcher->set_response_code(403);
         fetcher->delegate()->OnURLFetchComplete(fetcher);
         RunUntilIdle();
       }
+
+      // Simulate exhaustion of all available authusers.
+      if (!success && user_index > max_authuser) {
+        const ExtensionDownloader::ExtensionFetch& fetch =
+            *updater.downloader_->extensions_queue_.active_request();
+        fetcher =
+            factory.GetFetcherByID(ExtensionDownloader::kExtensionFetcherId);
+        EXPECT_TRUE(fetcher != NULL && fetcher->delegate() != NULL);
+        fetcher->set_url(fetch.url);
+        fetcher->set_status(net::URLRequestStatus());
+        fetcher->set_response_code(401);
+        fetcher->delegate()->OnURLFetchComplete(fetcher);
+        RunUntilIdle();
+      }
     }
 
-    // Succeed
-    if (succeed) {
+    // Simulate successful authorization with a 200 response.
+    if (success) {
       fetcher =
           factory.GetFetcherByID(ExtensionDownloader::kExtensionFetcherId);
       EXPECT_TRUE(fetcher != NULL && fetcher->delegate() != NULL);
       base::FilePath extension_file_path(FILE_PATH_LITERAL("/whatever"));
       fetcher->set_url(test_url);
       fetcher->set_status(net::URLRequestStatus());
       fetcher->set_response_code(200);
       fetcher->SetResponseFilePath(extension_file_path);
       fetcher->delegate()->OnURLFetchComplete(fetcher);
       RunUntilIdle();
 
       // Verify installation would proceed as normal.
       EXPECT_EQ(id, service->extension_id());
       base::FilePath tmpfile_path = service->install_path();
       EXPECT_FALSE(tmpfile_path.empty());
       EXPECT_EQ(extension_file_path, tmpfile_path);
     }
   }
 
   // Two extensions are updated.  If |updates_start_running| is true, the
   // mock extensions service has UpdateExtension(...) return true, and
   // the test is responsible for creating fake CrxInstallers.  Otherwise,
   // UpdateExtension() returns false, signaling install failures.
   void TestMultipleExtensionDownloading(bool updates_start_running) {
     net::TestURLFetcherFactory factory;
     net::TestURLFetcher* fetcher = NULL;
     ServiceForDownloadTests service(prefs_.get());
-    ExtensionUpdater updater(
-        &service, service.extension_prefs(), service.pref_service(),
-        service.profile(), kUpdateFrequencySecs, NULL);
+    ExtensionUpdater updater(&service,
+                             service.extension_prefs(),
+                             service.pref_service(),
+                             service.profile(),
+                             kUpdateFrequencySecs,
+                             NULL,
+                             make_scoped_ptr<IdentityProvider>(NULL));
     updater.Start();
     ResetDownloader(
         &updater,
-        new ExtensionDownloader(&updater, service.request_context()));
+        new ExtensionDownloader(&updater, service.request_context(), NULL));
     updater.downloader_->extensions_queue_.set_backoff_policy(
         &kNoBackoffPolicy);
 
     EXPECT_FALSE(updater.crx_install_is_running_);
 
     GURL url1("http://localhost/extension1.crx");
     GURL url2("http://localhost/extension2.crx");
 
     std::string id1 = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
     std::string id2 = "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb";
@@ skipping 184 matching lines @@
       prefs->SetLastActivePingDay(id, now - TimeDelta::FromSeconds(15));
     } else if (active_ping_days > 0) {
       Time last_active_ping_day = now -
                                   TimeDelta::FromDays(active_ping_days) -
                                   TimeDelta::FromSeconds(15);
       prefs->SetLastActivePingDay(id, last_active_ping_day);
     }
     if (active_bit)
       prefs->SetActiveBit(id, true);
 
-    ExtensionUpdater updater(
-        &service, service.extension_prefs(), service.pref_service(),
-        service.profile(), kUpdateFrequencySecs, NULL);
+    ExtensionUpdater updater(&service,
+                             service.extension_prefs(),
+                             service.pref_service(),
+                             service.profile(),
+                             kUpdateFrequencySecs,
+                             NULL,
+                             make_scoped_ptr<IdentityProvider>(NULL));
     ExtensionUpdater::CheckParams params;
     updater.Start();
     updater.CheckNow(params);
 
     // Make the updater do manifest fetching, and note the urls it tries to
     // fetch.
     std::vector<GURL> fetched_urls;
     net::TestURLFetcher* fetcher =
       factory.GetFetcherByID(ExtensionDownloader::kManifestFetcherId);
     EXPECT_TRUE(fetcher != NULL && fetcher->delegate() != NULL);
@@ skipping 70 matching lines @@
   // the first time we fetched the extension, or 2) We sent a ping value of
   // >= 1 day for the extension.
   void TestHandleManifestResults() {
     ServiceForManifestTests service(prefs_.get());
     GURL update_url("http://www.google.com/manifest");
     ExtensionList tmp;
     service.CreateTestExtensions(1, 1, &tmp, &update_url.spec(),
                                  Manifest::INTERNAL);
     service.set_extensions(tmp, ExtensionList());
 
-    ExtensionUpdater updater(
-        &service, service.extension_prefs(), service.pref_service(),
-        service.profile(), kUpdateFrequencySecs, NULL);
+    ExtensionUpdater updater(&service,
+                             service.extension_prefs(),
+                             service.pref_service(),
+                             service.profile(),
+                             kUpdateFrequencySecs,
+                             NULL,
+                             make_scoped_ptr<IdentityProvider>(NULL));
     updater.Start();
     ResetDownloader(
         &updater,
-        new ExtensionDownloader(&updater, service.request_context()));
+        new ExtensionDownloader(&updater, service.request_context(), NULL));
 
     ManifestFetchData fetch_data(update_url, 0);
     const Extension* extension = tmp[0].get();
     fetch_data.AddExtension(extension->id(),
                             extension->VersionString(),
                             &kNeverPingedData,
                             kEmptyUpdateUrlData,
                             std::string());
     UpdateManifest::Results results;
     results.daystart_elapsed_seconds = 750;
@@ skipping 77 matching lines @@
 }
 
 TEST_F(ExtensionUpdaterTest, TestSingleExtensionDownloadingFailureWithRetry) {
   TestSingleExtensionDownloading(false, true, true);
 }
 
 TEST_F(ExtensionUpdaterTest, TestSingleExtensionDownloadingFailurePending) {
   TestSingleExtensionDownloading(true, false, true);
 }
 
-TEST_F(ExtensionUpdaterTest, SingleProtectedExtensionDownloading) {
-  TestSingleProtectedExtensionDownloading(true, false, 0, 0);
+TEST_F(ExtensionUpdaterTest, ProtectedDownloadCookieAuth) {
+  TestProtectedDownload(
+      "https://chrome.google.com/webstore/download",
+      false, false,  // No OAuth2 support
+      0, 0);
 }
 
-TEST_F(ExtensionUpdaterTest, SingleProtectedExtensionDownloadingFailure) {
-  TestSingleProtectedExtensionDownloading(true, true, 0, 0);
+TEST_F(ExtensionUpdaterTest, ProtectedDownloadCookieFailure) {
+  TestProtectedDownload(
+      "https://chrome.google.com/webstore/download",
+      false, false,  // No OAuth2 support
+      0, -1);  // max_authuser=-1 simulates no valid authuser value.
 }
 
-TEST_F(ExtensionUpdaterTest, SingleProtectedExtensionDownloadingNoHTTPS) {
-  TestSingleProtectedExtensionDownloading(false, false, 0, 0);
+TEST_F(ExtensionUpdaterTest, ProtectedDownloadWithNonDefaultAuthUser1) {
+  TestProtectedDownload("https://google.com", false, false, 1, 1);
 }
 
-TEST_F(ExtensionUpdaterTest,
-       SingleProtectedExtensionDownloadingWithNonDefaultAuthUser1) {
-  TestSingleProtectedExtensionDownloading(true, true, 2, 1);
+TEST_F(ExtensionUpdaterTest, ProtectedDownloadWithNonDefaultAuthUser2) {
+  TestProtectedDownload("https://google.com", false, false, 2, 2);
 }
 
-TEST_F(ExtensionUpdaterTest,
-       SingleProtectedExtensionDownloadingWithNonDefaultAuthUser2) {
-  TestSingleProtectedExtensionDownloading(true, true, 2, 2);
+TEST_F(ExtensionUpdaterTest, ProtectedDownloadAuthUserExhaustionFailure) {
+  TestProtectedDownload("https://google.com", false, false, 2, 5);
 }
 
-TEST_F(ExtensionUpdaterTest,
-       SingleProtectedExtensionDownloadingAuthUserExhaustionFailure) {
-  TestSingleProtectedExtensionDownloading(true, true, 2, 5);
+TEST_F(ExtensionUpdaterTest, ProtectedDownloadWithOAuth2Token) {
+  TestProtectedDownload(
+      "https://google.com",
+      true, true,
+      0, -1);
+}
+
+TEST_F(ExtensionUpdaterTest, ProtectedDownloadWithOAuth2Failure) {
+  TestProtectedDownload(
+      "https://google.com",
+      true, false,
+      0, -1);
+}
+
+TEST_F(ExtensionUpdaterTest, ProtectedDownloadNoOAuth2WithNonGoogleDomain) {
+  TestProtectedDownload(
+      "https://not-google.com",
+      true, true,
+      0, -1);
+}
+
+TEST_F(ExtensionUpdaterTest, ProtectedDownloadFailWithoutHTTPS) {
+  TestProtectedDownload(
+      "http://google.com",
+      true, true,
+      0, 0);
 }
 
 TEST_F(ExtensionUpdaterTest, TestMultipleExtensionDownloadingUpdatesFail) {
   TestMultipleExtensionDownloading(false);
 }
 TEST_F(ExtensionUpdaterTest, TestMultipleExtensionDownloadingUpdatesSucceed) {
   TestMultipleExtensionDownloading(true);
 }
 
 TEST_F(ExtensionUpdaterTest, TestManifestRetryDownloading) {
   TestManifestRetryDownloading();
 }
 
 TEST_F(ExtensionUpdaterTest, TestGalleryRequestsWithOrganicBrand) {
   TestGalleryRequestsWithBrand(true);
 }
 
 TEST_F(ExtensionUpdaterTest, TestGalleryRequestsWithNonOrganicBrand) {
   TestGalleryRequestsWithBrand(false);
 }
 
 TEST_F(ExtensionUpdaterTest, TestHandleManifestResults) {
   TestHandleManifestResults();
 }
 
 TEST_F(ExtensionUpdaterTest, TestNonAutoUpdateableLocations) {
   net::TestURLFetcherFactory factory;
   ServiceForManifestTests service(prefs_.get());
-  ExtensionUpdater updater(&service, service.extension_prefs(),
-                           service.pref_service(), service.profile(),
-                           kUpdateFrequencySecs, NULL);
+  ExtensionUpdater updater(&service,
+                           service.extension_prefs(),
+                           service.pref_service(),
+                           service.profile(),
+                           kUpdateFrequencySecs,
+                           NULL,
+                           make_scoped_ptr<IdentityProvider>(NULL));
   MockExtensionDownloaderDelegate delegate;
   // Set the downloader directly, so that all its events end up in the mock
   // |delegate|.
   ExtensionDownloader* downloader =
-      new ExtensionDownloader(&delegate, service.request_context());
+      new ExtensionDownloader(&delegate, service.request_context(), NULL);
   ResetDownloader(&updater, downloader);
 
   // Non-internal non-external extensions should be rejected.
   ExtensionList extensions;
   service.CreateTestExtensions(1, 1, &extensions, NULL,
                                Manifest::INVALID_LOCATION);
   service.CreateTestExtensions(2, 1, &extensions, NULL, Manifest::INTERNAL);
   ASSERT_EQ(2u, extensions.size());
   const std::string& updateable_id = extensions[1]->id();
 
   // These expectations fail if the delegate's methods are invoked for the
   // first extension, which has a non-matching id.
   EXPECT_CALL(delegate, GetUpdateUrlData(updateable_id)).WillOnce(Return(""));
   EXPECT_CALL(delegate, GetPingDataForExtension(updateable_id, _));
 
   service.set_extensions(extensions, ExtensionList());
   ExtensionUpdater::CheckParams params;
   updater.Start();
   updater.CheckNow(params);
 }
 
 TEST_F(ExtensionUpdaterTest, TestUpdatingDisabledExtensions) {
   net::TestURLFetcherFactory factory;
   ServiceForManifestTests service(prefs_.get());
-  ExtensionUpdater updater(&service, service.extension_prefs(),
-                           service.pref_service(), service.profile(),
-                           kUpdateFrequencySecs, NULL);
+  ExtensionUpdater updater(&service,
+                           service.extension_prefs(),
+                           service.pref_service(),
+                           service.profile(),
+                           kUpdateFrequencySecs,
+                           NULL,
+                           make_scoped_ptr<IdentityProvider>(NULL));
   MockExtensionDownloaderDelegate delegate;
   // Set the downloader directly, so that all its events end up in the mock
   // |delegate|.
   ExtensionDownloader* downloader =
-      new ExtensionDownloader(&delegate, service.request_context());
+      new ExtensionDownloader(&delegate, service.request_context(), NULL);
   ResetDownloader(&updater, downloader);
 
   // Non-internal non-external extensions should be rejected.
   ExtensionList enabled_extensions;
   ExtensionList disabled_extensions;
   service.CreateTestExtensions(1, 1, &enabled_extensions, NULL,
       Manifest::INTERNAL);
   service.CreateTestExtensions(2, 1, &disabled_extensions, NULL,
       Manifest::INTERNAL);
   ASSERT_EQ(1u, enabled_extensions.size());
@@ skipping 11 matching lines @@
   ExtensionUpdater::CheckParams params;
   updater.Start();
   updater.CheckNow(params);
 }
 
 TEST_F(ExtensionUpdaterTest, TestManifestFetchesBuilderAddExtension) {
   net::TestURLFetcherFactory factory;
   MockService service(prefs_.get());
   MockExtensionDownloaderDelegate delegate;
   scoped_ptr<ExtensionDownloader> downloader(
-      new ExtensionDownloader(&delegate, service.request_context()));
+      new ExtensionDownloader(&delegate, service.request_context(), NULL));
   EXPECT_EQ(0u, ManifestFetchersCount(downloader.get()));
 
   // First, verify that adding valid extensions does invoke the callbacks on
   // the delegate.
   std::string id = id_util::GenerateId("foo");
   EXPECT_CALL(delegate, GetPingDataForExtension(id, _)).WillOnce(Return(false));
   EXPECT_TRUE(
       downloader->AddPendingExtension(id, GURL("http://example.com/update"),
                                       0));
   downloader->StartAllPending(NULL);
@@ skipping 10 matching lines @@
   // Extensions with empty IDs should be rejected.
   EXPECT_FALSE(downloader->AddPendingExtension(std::string(), GURL(), 0));
   downloader->StartAllPending(NULL);
   EXPECT_EQ(1u, ManifestFetchersCount(downloader.get()));
 
   // TODO(akalin): Test that extensions with empty update URLs
   // converted from user scripts are rejected.
 
   // Reset the ExtensionDownloader so that it drops the current fetcher.
   downloader.reset(
-      new ExtensionDownloader(&delegate, service.request_context()));
+      new ExtensionDownloader(&delegate, service.request_context(), NULL));
   EXPECT_EQ(0u, ManifestFetchersCount(downloader.get()));
 
   // Extensions with empty update URLs should have a default one
   // filled in.
   id = id_util::GenerateId("foo3");
   EXPECT_CALL(delegate, GetPingDataForExtension(id, _)).WillOnce(Return(false));
   EXPECT_TRUE(downloader->AddPendingExtension(id, GURL(), 0));
   downloader->StartAllPending(NULL);
   EXPECT_EQ(1u, ManifestFetchersCount(downloader.get()));
 
   net::TestURLFetcher* fetcher =
       factory.GetFetcherByID(ExtensionDownloader::kManifestFetcherId);
   ASSERT_TRUE(fetcher);
   EXPECT_FALSE(fetcher->GetOriginalURL().is_empty());
 }
 
 TEST_F(ExtensionUpdaterTest, TestStartUpdateCheckMemory) {
   net::TestURLFetcherFactory factory;
   MockService service(prefs_.get());
   MockExtensionDownloaderDelegate delegate;
-  ExtensionDownloader downloader(&delegate, service.request_context());
+  ExtensionDownloader downloader(&delegate, service.request_context(), NULL);
 
   StartUpdateCheck(&downloader, new ManifestFetchData(GURL(), 0));
   // This should delete the newly-created ManifestFetchData.
   StartUpdateCheck(&downloader, new ManifestFetchData(GURL(), 0));
   // This should add into |manifests_pending_|.
   StartUpdateCheck(&downloader, new ManifestFetchData(GURL(
       GURL("http://www.google.com")), 0));
   // The dtor of |downloader| should delete the pending fetchers.
 }
 
 TEST_F(ExtensionUpdaterTest, TestCheckSoon) {
   ServiceForManifestTests service(prefs_.get());
   net::TestURLFetcherFactory factory;
-  ExtensionUpdater updater(
-      &service, service.extension_prefs(), service.pref_service(),
-      service.profile(), kUpdateFrequencySecs, NULL);
+  ExtensionUpdater updater(&service,
+                           service.extension_prefs(),
+                           service.pref_service(),
+                           service.profile(),
+                           kUpdateFrequencySecs,
+                           NULL,
+                           make_scoped_ptr<IdentityProvider>(NULL));
   EXPECT_FALSE(updater.WillCheckSoon());
   updater.Start();
   EXPECT_FALSE(updater.WillCheckSoon());
   updater.CheckSoon();
   EXPECT_TRUE(updater.WillCheckSoon());
   updater.CheckSoon();
   EXPECT_TRUE(updater.WillCheckSoon());
   RunUntilIdle();
   EXPECT_FALSE(updater.WillCheckSoon());
   updater.CheckSoon();
   EXPECT_TRUE(updater.WillCheckSoon());
   updater.Stop();
   EXPECT_FALSE(updater.WillCheckSoon());
 }
 
 // TODO(asargent) - (http://crbug.com/12780) add tests for:
 // -prodversionmin (shouldn't update if browser version too old)
 // -manifests & updates arriving out of order / interleaved
 // -malformed update url (empty, file://, has query, has a # fragment, etc.)
 // -An extension gets uninstalled while updates are in progress (so it doesn't
 //  "come back from the dead")
 // -An extension gets manually updated to v3 while we're downloading v2 (ie
 //  you don't get downgraded accidentally)
 // -An update manifest mentions multiple updates
 
 }  // namespace extensions