Add device disabling to OOBE flow

components/policy/proto/device_management_backend.proto

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 syntax = "proto2";
 
 option optimize_for = LITE_RUNTIME;
 
 package enterprise_management;
 
@@ skipping 581 matching lines @@
 // device-determined device state keys.
 message DeviceStateKeyUpdateRequest {
   // The client-determined state keys. To the server, these look like 32 bytes
   // of random data. The client should generate these keys using a deterministic
   // algorithm that takes stable device identifiers as an input and produces a
   // key as the output, possibly by running the identifiers through a
   // cryptographic hash function such as SHA-256.
   repeated bytes server_backed_state_key = 1;
 }
 
+message DisabledState {
+  // A message to the finder/thief that should be shown on the screen.
+  optional string message = 1;
+}
+
 // Server to client message carrying the device state response. Because the
 // request is not authenticated, the only protection against state extraction
 // from server is the unpredictability of the server-backed state ID. Thus, the
 // response should not contain any sensitive data. If the server doesn't know
 // the requested identifier, it just return a message with restore_mode set to
 // RESTORE_MODE_NONE.
 message DeviceStateRetrievalResponse {
   // Restorative action to take after device reset.
   enum RestoreMode {
     // No state restoration.
     RESTORE_MODE_NONE = 0;
     // Enterprise enrollment requested, but user may skip.
     RESTORE_MODE_REENROLLMENT_REQUESTED = 1;
     // Enterprise enrollment is enforced and cannot be skipped.
     RESTORE_MODE_REENROLLMENT_ENFORCED = 2;
   };
   // The server-indicated restore mode.
   optional RestoreMode restore_mode = 1 [default = RESTORE_MODE_NONE];
 
   // Primary domain the device is associated with.
   optional string management_domain = 2;
+
+  // The device is disabled and no logins are possible when this is set.
+  optional DisabledState disabled_state = 3;
 }
 
 // Sent by the client to the server to pair the Host device with the Controller
 // device. The HTTP request contains an end-user OAuth token and only succeeds
 // if both Host and Controller devices belong to the end-user domain.
 message DevicePairingRequest {
 
   // The device ID of the Host device.
   optional string host_device_id = 1;
 
@@ skipping 206 matching lines @@
 
   // Device-state retrieval.
   optional DeviceStateRetrievalResponse device_state_retrieval_response = 11;
 
   // Response to device pairing request.
   optional DevicePairingResponse device_pairing_response = 12;
 
   // Response to check device pairing request.
   optional CheckDevicePairingResponse check_device_pairing_response = 13;
 }