Supervised users: When an extension requires new permissions, send request to custodian

chrome/browser/extensions/extension_service.cc

Index: chrome/browser/extensions/extension_service.cc
diff --git a/chrome/browser/extensions/extension_service.cc b/chrome/browser/extensions/extension_service.cc
index 3708493cb3b45db6b09a9ac4b75290f1f201157b..adf572587109a3fa4f5336bf81a460c15ae47c5e 100644
--- a/chrome/browser/extensions/extension_service.cc
+++ b/chrome/browser/extensions/extension_service.cc
@@ -84,6 +84,11 @@
 #include "extensions/common/permissions/permission_message_provider.h"
 #include "extensions/common/permissions/permissions_data.h"
 
+#if defined(ENABLE_SUPERVISED_USERS)
+#include "chrome/browser/supervised_user/supervised_user_service.h"
+#include "chrome/browser/supervised_user/supervised_user_service_factory.h"
+#endif
+
 #if defined(OS_CHROMEOS)
 #include "chrome/browser/chromeos/extensions/install_limiter.h"
 #include "storage/browser/fileapi/file_system_backend.h"
@@ -110,13 +115,18 @@ using extensions::SharedModuleInfo;
 using extensions::SharedModuleService;
 using extensions::UnloadedExtensionInfo;
 
-namespace errors = extensions::manifest_errors;
-
 namespace {
 
 // Wait this many seconds after an extensions becomes idle before updating it.
 const int kUpdateIdleDelay = 5;
 
+#if defined(ENABLE_SUPERVISED_USERS)
+// Callback for SupervisedUserService::AddExtensionUpdateRequest.
+void ExtensionUpdateRequestSent(const std::string& id, bool success) {
+  LOG_IF(WARNING, !success) << "Failed sending update request for " << id;
+}
+#endif
+
 }  // namespace
 
 // ExtensionService.
@@ -1660,6 +1670,19 @@ void ExtensionService::CheckPermissionsIncrease(const Extension* extension,
     }
     extension_prefs_->SetExtensionState(extension->id(), Extension::DISABLED);
     extension_prefs_->SetDidExtensionEscalatePermissions(extension, true);
+
+#if defined(ENABLE_SUPERVISED_USERS)

[not at google - send to devlin, 2015/03/03 17:51:15]

What is stopping the existing logic - wherever that is - for kicking in and
showing the install dialogue?

Also I'd feel more comfortable with a test.

[Marc Treib, 2015/03/04 11:15:38]

I assume you meant the re-enable dialog? All the UI entry points to do that are
disabled (except for any ones that I missed), see
https://codereview.chromium.org/925563002/.

If you're really talking about install, see
https://code.google.com/p/chromium/codesearch#chromium/src/chrome/browser/sup....
There already was an existing test for extension updates with increased
permissions in a supervised profile. I've updated it to also check that a
request is created.

[not at google - send to devlin, 2015/03/04 17:43:36]

Yeah sorry, I meant the re-enable.

It would be so very nice if all of this permissions flow were in a single place
(not in ExtensionService) so that it was more obvious that the dialogue won't
show up. We already have PermissionsUpdater, seems like a logical sort of place
to have it.

Oh well.
Thanks.

+    // If a custodian-installed extension is disabled for a supervised user due
+    // to a permissions increase, send a request to the custodian, since the
+    // supervised user itself can't re-enable the extension.
+    if (extensions::util::IsExtensionSupervised(extension, profile_)) {
+      SupervisedUserService* supervised_user_service =
+          SupervisedUserServiceFactory::GetForProfile(profile_);
+      supervised_user_service->AddExtensionUpdateRequest(
+          extension->id(),
+          base::Bind(ExtensionUpdateRequestSent, extension->id()));
+    }
+#endif
   }
   if (disable_reasons != Extension::DISABLE_NONE) {
     extension_prefs_->AddDisableReason(