Remove DenyCertForHost from SSLHostStateDelegate API.

content/browser/ssl/ssl_policy_backend.h

Index: content/browser/ssl/ssl_policy_backend.h
diff --git a/content/browser/ssl/ssl_policy_backend.h b/content/browser/ssl/ssl_policy_backend.h
index 5997b289aabda4616b9e923ebd7242f5060e7418..9a5d61656066df7746792a893bc4f40376bfa0cb 100644
--- a/content/browser/ssl/ssl_policy_backend.h
+++ b/content/browser/ssl/ssl_policy_backend.h
@@ -10,12 +10,12 @@
 
 #include "base/basictypes.h"
 #include "base/strings/string16.h"
+#include "content/public/browser/ssl_host_state_delegate.h"
 #include "net/cert/cert_status_flags.h"
 #include "net/cert/x509_certificate.h"
 
 namespace content {
 class NavigationControllerImpl;
-class SSLHostStateDelegate;
 
 class SSLPolicyBackend {
  public:
@@ -27,25 +27,22 @@ class SSLPolicyBackend {
   // Returns whether the specified host ran insecure content.
   bool DidHostRunInsecureContent(const std::string& host, int pid) const;
 
-  // Records that |cert| is not permitted to be used for |host| in the future,
-  // for a specific error type.
-  void DenyCertForHost(net::X509Certificate* cert,
-                       const std::string& host,
-                       net::CertStatus error);
-
   // Records that |cert| is permitted to be used for |host| in the future, for
   // a specific error type.
   void AllowCertForHost(net::X509Certificate* cert,
                         const std::string& host,
                         net::CertStatus error);
 
-  // Queries whether |cert| is allowed or denied for |host|. Returns true in
+  // Queries whether |cert| is allowed for |host|. Returns true in
   // |expired_previous_decision| if a user decision had been made previously but
-  // that decision has expired, otherwise false.
-  net::CertPolicy::Judgment QueryPolicy(net::X509Certificate* cert,
-                                        const std::string& host,
-                                        net::CertStatus error,
-                                        bool* expired_previous_decision);
+  // that decision has expired, otherwise false. Since the API does not
+  // currently provide a way to deny certs, QueryPolicy guarantees to return
+  // either ALLOWED or UNKNOWN but never DENIED.
+  SSLHostStateDelegate::CertJudgment QueryPolicy(
+      net::X509Certificate* cert,
+      const std::string& host,
+      net::CertStatus error,
+      bool* expired_previous_decision);
 
  private:
   // SSL state delegate specific for each host.