Add device disabling to OOBE flow

chrome/browser/chromeos/login/screens/device_disabled_screen.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/login/screens/device_disabled_screen.h"
 
 #include <string>
 
+#include "base/bind.h"
+#include "base/command_line.h"
 #include "base/logging.h"
+#include "base/prefs/pref_service.h"
 #include "base/values.h"
+#include "chrome/browser/browser_process.h"
+#include "chrome/browser/browser_process_platform_part.h"
 #include "chrome/browser/chromeos/login/screens/screen_observer.h"
 #include "chrome/browser/chromeos/login/wizard_controller.h"
+#include "chrome/browser/chromeos/policy/browser_policy_connector_chromeos.h"
+#include "chrome/browser/chromeos/policy/enterprise_install_attributes.h"
+#include "chrome/browser/chromeos/policy/server_backed_device_state.h"
+#include "chrome/common/pref_names.h"
+#include "chromeos/chromeos_switches.h"
+#include "components/policy/core/common/cloud/cloud_policy_constants.h"
 
 namespace chromeos {
 
 DeviceDisabledScreen::DeviceDisabledScreen(ScreenObserver* observer,
                                            DeviceDisabledScreenActor* actor)
     : BaseScreen(observer),
-      actor_(actor) {
+      showing_(false),
+      actor_(actor),
+      weak_factory_(this) {
   DCHECK(actor_);
   if (actor_)
     actor_->SetDelegate(this);
 }
 
 DeviceDisabledScreen::~DeviceDisabledScreen() {
   if (actor_)
     actor_->SetDelegate(NULL);

[Joao da Silva, 2014/10/24 09:07:30]

nullptr

[bartfab (slow), 2014/10/24 11:13:51]

Done.

 }
 
 void DeviceDisabledScreen::PrepareToShow() {
 }
 
 void DeviceDisabledScreen::Show() {
-  if (actor_)
-    actor_->Show();
+  if (!actor_)

[Joao da Silva, 2014/10/24 09:07:30]

|| showing_?

[bartfab (slow), 2014/10/24 11:13:52]

Done.

+    return;
+
+  bool is_device_disabled = false;
+  g_browser_process->local_state()->GetDictionary(
+      prefs::kServerBackedDeviceState)->GetBoolean(policy::kDeviceStateDisabled,

[Nikita (slow), 2014/10/24 10:26:12]

If device_mode is policy::DEVICE_MODE_PENDING then this boolean is initialized
to true?

[bartfab (slow), 2014/10/24 11:13:52]

The value of |is_device_disabled| is independent of |device_mode|'s
initialization status. If |is_device_disabled| is false, we should not show the
screen and we can return straight away. If |is_device_disabled| is true, we
would like to show the screen. But we want to make sure we only do it during
OOBE, not due to some kind of corruption or attack that flipped this flag to
true on an already owned device. This is why we proceed with further checks if
|is_device_disabled| is true only.

[Nikita (slow), 2014/10/24 13:57:28]

So if is_device_disabled is true and you proceed in this method and then there's
additional check for policy::DEVICE_MODE_PENDING. Is it possible that
is_device_disabled can changed after that?

[bartfab (slow), 2014/10/24 14:02:18]

In theory, yes, it could happen. And we handled it correctly: If the mode is
policy::DEVICE_MODE_PENDING, we wait for the mode to change and then run the
whole method from the start again. If is_device_disabled has changed to false at
that point, we bail out on the second run.

+                                                   &is_device_disabled);
+  if (!is_device_disabled ||
+      CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kDisableDeviceDisabling)) {
+    // Skip the screen if the device is not marked as disabled or device
+    // disabling has been turned off by flag.
+    IndicateDeviceNotDisabled();
+    return;
+  }
+
+  policy::BrowserPolicyConnectorChromeOS* connector =
+      g_browser_process->platform_part()->browser_policy_connector_chromeos();
+  if (connector->GetDeviceMode() == policy::DEVICE_MODE_PENDING) {
+    // Ensure that the device mode is known before proceeding.
+    connector->GetInstallAttributes()->ReadImmutableAttributes(
+        base::Bind(&DeviceDisabledScreen::Show,

[Nikita (slow), 2014/10/24 10:26:12]

What would be the UI transition if this check results in DEVICE_NOT_DISABLED?
Will UI continue to show spinner from previous screen?

[bartfab (slow), 2014/10/24 11:13:51]

Yes, the previous screen will still be showing. Only when we reach
actor_->Show() at the end of this method does the previous screen get replaced
by this one in the UI.

+                   weak_factory_.GetWeakPtr()));
+    return;
+  }
+
+  if (connector->GetDeviceMode() != policy::DEVICE_MODE_NOT_SET) {
+    // Skip the screen if the device is owned already. The device disabling
+    // screen should only be shown during OOBE.

[Joao da Silva, 2014/10/24 09:07:30]

Just so I understand, how do we disable devices that are already owned?

[bartfab (slow), 2014/10/24 11:13:52]

In this CL, we don't :). It will be done in a follow-up CL.

+    IndicateDeviceNotDisabled();
+    return;
+  }
+
+  showing_ = true;
+
+  std::string message;
+  g_browser_process->local_state()->GetDictionary(
+      prefs::kServerBackedDeviceState)->GetString(
+          policy::kDeviceStateDisabledMessage,
+          &message);
+  actor_->Show(message);
 }
 
 void DeviceDisabledScreen::Hide() {
+  if (!showing_)
+    return;
+  showing_ = false;
+
   if (actor_)
     actor_->Hide();
 }
 
 std::string DeviceDisabledScreen::GetName() const {
   return WizardController::kDeviceDisabledScreenName;
 }
 
 void DeviceDisabledScreen::OnActorDestroyed(DeviceDisabledScreenActor* actor) {
   if (actor_ == actor)
     actor_ = NULL;

[Joao da Silva, 2014/10/24 09:07:30]

nullptr

[bartfab (slow), 2014/10/24 11:13:51]

Done.

 }
 
+void DeviceDisabledScreen::IndicateDeviceNotDisabled() {
+  get_screen_observer()->OnExit(ScreenObserver::DEVICE_NOT_DISABLED);
+}
+
 }  // namespace chromeos