Add device disabling to OOBE flow

chrome/browser/chromeos/login/screens/device_disabled_screen.cc

Index: chrome/browser/chromeos/login/screens/device_disabled_screen.cc
diff --git a/chrome/browser/chromeos/login/screens/device_disabled_screen.cc b/chrome/browser/chromeos/login/screens/device_disabled_screen.cc
index 9812c75fb7294a483f116284ba6ae4905e5720e6..a251a66e284085162cd53b2f2dbd3c8608bbbb11 100644
--- a/chrome/browser/chromeos/login/screens/device_disabled_screen.cc
+++ b/chrome/browser/chromeos/login/screens/device_disabled_screen.cc
@@ -6,17 +6,30 @@
 
 #include <string>
 
+#include "base/bind.h"
+#include "base/command_line.h"
 #include "base/logging.h"
+#include "base/prefs/pref_service.h"
 #include "base/values.h"
+#include "chrome/browser/browser_process.h"
+#include "chrome/browser/browser_process_platform_part.h"
 #include "chrome/browser/chromeos/login/screens/screen_observer.h"
 #include "chrome/browser/chromeos/login/wizard_controller.h"
+#include "chrome/browser/chromeos/policy/browser_policy_connector_chromeos.h"
+#include "chrome/browser/chromeos/policy/enterprise_install_attributes.h"
+#include "chrome/browser/chromeos/policy/server_backed_device_state.h"
+#include "chrome/common/pref_names.h"
+#include "chromeos/chromeos_switches.h"
+#include "components/policy/core/common/cloud/cloud_policy_constants.h"
 
 namespace chromeos {
 
 DeviceDisabledScreen::DeviceDisabledScreen(ScreenObserver* observer,
                                            DeviceDisabledScreenActor* actor)
     : BaseScreen(observer),
-      actor_(actor) {
+      showing_(false),
+      actor_(actor),
+      weak_factory_(this) {
   DCHECK(actor_);
   if (actor_)
     actor_->SetDelegate(this);
@@ -31,11 +44,54 @@ void DeviceDisabledScreen::PrepareToShow() {
 }
 
 void DeviceDisabledScreen::Show() {
-  if (actor_)
-    actor_->Show();
+  if (!actor_)

[Joao da Silva, 2014/10/24 09:07:30]

|| showing_?

[bartfab (slow), 2014/10/24 11:13:52]

Done.

+    return;
+
+  bool is_device_disabled = false;
+  g_browser_process->local_state()->GetDictionary(
+      prefs::kServerBackedDeviceState)->GetBoolean(policy::kDeviceStateDisabled,

[Nikita (slow), 2014/10/24 10:26:12]

If device_mode is policy::DEVICE_MODE_PENDING then this boolean is initialized
to true?

[bartfab (slow), 2014/10/24 11:13:52]

The value of |is_device_disabled| is independent of |device_mode|'s
initialization status. If |is_device_disabled| is false, we should not show the
screen and we can return straight away. If |is_device_disabled| is true, we
would like to show the screen. But we want to make sure we only do it during
OOBE, not due to some kind of corruption or attack that flipped this flag to
true on an already owned device. This is why we proceed with further checks if
|is_device_disabled| is true only.

[Nikita (slow), 2014/10/24 13:57:28]

So if is_device_disabled is true and you proceed in this method and then there's
additional check for policy::DEVICE_MODE_PENDING. Is it possible that
is_device_disabled can changed after that?

[bartfab (slow), 2014/10/24 14:02:18]

In theory, yes, it could happen. And we handled it correctly: If the mode is
policy::DEVICE_MODE_PENDING, we wait for the mode to change and then run the
whole method from the start again. If is_device_disabled has changed to false at
that point, we bail out on the second run.

+                                                   &is_device_disabled);
+  if (!is_device_disabled ||
+      CommandLine::ForCurrentProcess()->HasSwitch(
+          switches::kDisableDeviceDisabling)) {
+    // Skip the screen if the device is not marked as disabled or device
+    // disabling has been turned off by flag.
+    IndicateDeviceNotDisabled();
+    return;
+  }
+
+  policy::BrowserPolicyConnectorChromeOS* connector =
+      g_browser_process->platform_part()->browser_policy_connector_chromeos();
+  if (connector->GetDeviceMode() == policy::DEVICE_MODE_PENDING) {
+    // Ensure that the device mode is known before proceeding.
+    connector->GetInstallAttributes()->ReadImmutableAttributes(
+        base::Bind(&DeviceDisabledScreen::Show,

[Nikita (slow), 2014/10/24 10:26:12]

What would be the UI transition if this check results in DEVICE_NOT_DISABLED?
Will UI continue to show spinner from previous screen?

[bartfab (slow), 2014/10/24 11:13:51]

Yes, the previous screen will still be showing. Only when we reach
actor_->Show() at the end of this method does the previous screen get replaced
by this one in the UI.

+                   weak_factory_.GetWeakPtr()));
+    return;
+  }
+
+  if (connector->GetDeviceMode() != policy::DEVICE_MODE_NOT_SET) {
+    // Skip the screen if the device is owned already. The device disabling
+    // screen should only be shown during OOBE.

[Joao da Silva, 2014/10/24 09:07:30]

Just so I understand, how do we disable devices that are already owned?

[bartfab (slow), 2014/10/24 11:13:52]

In this CL, we don't :). It will be done in a follow-up CL.

+    IndicateDeviceNotDisabled();
+    return;
+  }
+
+  showing_ = true;
+
+  std::string message;
+  g_browser_process->local_state()->GetDictionary(
+      prefs::kServerBackedDeviceState)->GetString(
+          policy::kDeviceStateDisabledMessage,
+          &message);
+  actor_->Show(message);
 }
 
 void DeviceDisabledScreen::Hide() {
+  if (!showing_)
+    return;
+  showing_ = false;
+
   if (actor_)
     actor_->Hide();
 }
@@ -49,4 +105,8 @@ void DeviceDisabledScreen::OnActorDestroyed(DeviceDisabledScreenActor* actor) {
     actor_ = NULL;

[Joao da Silva, 2014/10/24 09:07:30]

nullptr

[bartfab (slow), 2014/10/24 11:13:51]

Done.

 }
 
+void DeviceDisabledScreen::IndicateDeviceNotDisabled() {
+  get_screen_observer()->OnExit(ScreenObserver::DEVICE_NOT_DISABLED);
+}
+
 }  // namespace chromeos