Add policy controlled permission block list for extensions

chrome/browser/extensions/api/permissions/permissions_apitest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/api/permissions/permissions_api.h"
 #include "chrome/browser/extensions/extension_apitest.h"
+#include "chrome/browser/extensions/extension_management_test_util.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ui/browser.h"
+#include "components/policy/core/browser/browser_policy_connector.h"
+#include "components/policy/core/common/mock_configuration_policy_provider.h"
 #include "extensions/browser/extension_prefs.h"
 #include "extensions/common/permissions/permission_set.h"
 #include "extensions/common/switches.h"
 #include "net/dns/mock_host_resolver.h"
 
 namespace extensions {
 
 namespace {
 
 static void AddPattern(URLPatternSet* extent, const std::string& pattern) {
   int schemes = URLPattern::SCHEME_ALL;
   extent->AddPattern(URLPattern(schemes, pattern));
 }
 
 }  // namespace
 
 class ExperimentalApiTest : public ExtensionApiTest {
 public:
  void SetUpCommandLine(CommandLine* command_line) override {
     ExtensionApiTest::SetUpCommandLine(command_line);
     command_line->AppendSwitch(switches::kEnableExperimentalExtensionApis);
   }
 };
 
+class ExtensionApiTestWithManagementPolicy : public ExtensionApiTest {
+ public:
+  void SetUpInProcessBrowserTestFixture() override {
+    ExtensionApiTest::SetUpInProcessBrowserTestFixture();
+    EXPECT_CALL(policy_provider_, IsInitializationComplete(testing::_))
+        .WillRepeatedly(testing::Return(true));
+    policy_provider_.SetAutoRefresh();
+    policy::BrowserPolicyConnector::SetPolicyProviderForTesting(
+        &policy_provider_);
+  }
+
+ protected:
+  policy::MockConfigurationPolicyProvider policy_provider_;
+};
+
 IN_PROC_BROWSER_TEST_F(ExtensionApiTest, PermissionsFail) {
   ASSERT_TRUE(RunExtensionTest("permissions/disabled")) << message_;
 
   // Since the experimental APIs require a flag, this will fail even though
   // it's enabled.
   // TODO(erikkay) This test is currently broken because LoadExtension in
   // ExtensionBrowserTest doesn't actually fail, it just times out.  To fix this
   // I'll need to add an EXTENSION_LOAD_ERROR notification, which is probably
   // too much for the branch.  I'll enable this on trunk later.
   //ASSERT_FALSE(RunExtensionTest("permissions/enabled"))) << message_;
@@ skipping 78 matching lines @@
 // callback.
 IN_PROC_BROWSER_TEST_F(ExtensionApiTest, OptionalPermissionsRetainGesture) {
   PermissionsRequestFunction::SetAutoConfirmForTests(true);
   PermissionsRequestFunction::SetIgnoreUserGestureForTests(false);
   host_resolver()->AddRule("*.com", "127.0.0.1");
   ASSERT_TRUE(StartEmbeddedTestServer());
   EXPECT_TRUE(RunExtensionTest("permissions/optional_retain_gesture"))
       << message_;
 }
 
+// Test that optional permissions blocked by enterprise policy will be denied
+// automatically.
+IN_PROC_BROWSER_TEST_F(ExtensionApiTestWithManagementPolicy,
+                       OptionalPermissionsPolicyBlocked) {
+  // Set enterprise policy to block some API permissions.
+  {
+    ExtensionManagementPolicyUpdater pref(&policy_provider_);
+    pref.AddBlockedPermission("*", "management");
+  }
+  // Set auto confirm UI flag.
+  PermissionsRequestFunction::SetAutoConfirmForTests(true);
+  PermissionsRequestFunction::SetIgnoreUserGestureForTests(true);
+  EXPECT_TRUE(RunExtensionTest("permissions/optional_policy_blocked"))
+      << message_;
+}
+
 // Tests that an extension can't gain access to file: URLs without the checkbox
 // entry in prefs. There shouldn't be a warning either.
 IN_PROC_BROWSER_TEST_F(ExtensionApiTest, OptionalPermissionsFileAccess) {
   // There shouldn't be a warning, so we shouldn't need to autoconfirm.
   PermissionsRequestFunction::SetAutoConfirmForTests(false);
   PermissionsRequestFunction::SetIgnoreUserGestureForTests(true);
 
   ExtensionPrefs* prefs = ExtensionPrefs::Get(browser()->profile());
 
   EXPECT_TRUE(
@@ skipping 14 matching lines @@
 
 // Test requesting, querying, and removing host permissions for host
 // permissions that are a subset of the optional permissions.
 IN_PROC_BROWSER_TEST_F(ExtensionApiTest, HostSubsets) {
   PermissionsRequestFunction::SetAutoConfirmForTests(true);
   PermissionsRequestFunction::SetIgnoreUserGestureForTests(true);
   EXPECT_TRUE(RunExtensionTest("permissions/host_subsets")) << message_;
 }
 
 }  // namespace extensions