Simplify PlatformVerificationFlow::CheckConsent() logic.

chrome/browser/chromeos/attestation/platform_verification_flow.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/chromeos/attestation/platform_verification_flow.h"
 
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "base/message_loop/message_loop.h"
 #include "base/metrics/histogram.h"
@@ skipping 198 matching lines @@
     return;
   }
   BoolDBusMethodCallback dbus_callback = base::Bind(
       &DBusCallback,
       base::Bind(&PlatformVerificationFlow::CheckConsent, this, context),
       base::Bind(&ReportError, context.callback, INTERNAL_ERROR));
   cryptohome_client_->TpmAttestationIsEnrolled(dbus_callback);
 }
 
 void PlatformVerificationFlow::CheckConsent(const ChallengeContext& context,
-                                            bool attestation_enrolled) {
-  PrefService* pref_service = delegate_->GetPrefs(context.web_contents);
+                                            bool /* attestation_enrolled */) {
+  content::WebContents* web_contents = context.web_contents;
+
+  bool enabled_for_origin = false;
+  bool found =
+      GetOriginPref(delegate_->GetContentSettings(web_contents),
+                    delegate_->GetURL(web_contents), &enabled_for_origin);
+  if (found && !enabled_for_origin) {
+    VLOG(1) << "Platform verification denied because the origin has been "
+            << "blocked by the user.";
+    ReportError(context.callback, USER_REJECTED);
+    return;
+  }
+
+  PrefService* pref_service = delegate_->GetPrefs(web_contents);
   if (!pref_service) {
     LOG(ERROR) << "Failed to get user prefs.";
     ReportError(context.callback, INTERNAL_ERROR);
     return;
   }
-  bool consent_required = (
-      // Consent required if attestation has never been enrolled on this device.
-      !attestation_enrolled ||
-      // Consent required if this is the first use of attestation for content
-      // protection on this device.
-      !pref_service->GetBoolean(prefs::kRAConsentFirstTime) ||
-      // Consent required if consent has never been given for this domain.
-      !GetDomainPref(delegate_->GetContentSettings(context.web_contents),
-                     delegate_->GetURL(context.web_contents),
-                     NULL));
+
+  // Consent required if user has never given consent for this origin, or if
+  // user has never given consent to attestation for content protection on this
+  // device.
+  bool consent_required =
+      !found || !pref_service->GetBoolean(prefs::kRAConsentGranted);
+
   Delegate::ConsentCallback consent_callback = base::Bind(
       &PlatformVerificationFlow::OnConsentResponse,
       this,
       context,
       consent_required);
   if (consent_required) {
     // TODO(xhwang): Using delegate_->GetURL() here is not right. The consent
     // may be requested by a frame from a different origin. This will be solved
     // when http://crbug.com/454847 is fixed.
     delegate_->ShowConsentPrompt(
         context.web_contents,
         delegate_->GetURL(context.web_contents).GetOrigin(), consent_callback);
   } else {
     consent_callback.Run(CONSENT_RESPONSE_NONE);
   }
 }
 
 void PlatformVerificationFlow::RegisterProfilePrefs(
     user_prefs::PrefRegistrySyncable* prefs) {
-  prefs->RegisterBooleanPref(prefs::kRAConsentFirstTime,
-                             false,
+  prefs->RegisterBooleanPref(prefs::kRAConsentGranted,
+                             false,  // Default value.
                              user_prefs::PrefRegistrySyncable::UNSYNCABLE_PREF);
 }
 
 void PlatformVerificationFlow::OnConsentResponse(
     const ChallengeContext& context,
     bool consent_required,
     ConsentResponse consent_response) {
   if (consent_required) {
     if (consent_response == CONSENT_RESPONSE_NONE) {
       // No user response - do not proceed and do not modify any settings.
@@ skipping 145 matching lines @@
   if (!pref_service) {
     LOG(ERROR) << "Failed to get user prefs.";
     return false;
   }
   if (!pref_service->GetBoolean(prefs::kEnableDRM)) {
     VLOG(1) << "Platform verification denied because content protection "
             << "identifiers have been disabled by the user.";
     return false;
   }
 
-  // Check the user preference for this domain.
-  bool enabled_for_domain = false;
-  bool found = GetDomainPref(delegate_->GetContentSettings(web_contents),
-                             delegate_->GetURL(web_contents),
-                             &enabled_for_domain);
-  if (found && !enabled_for_domain) {
-    VLOG(1) << "Platform verification denied because the domain has been "
+  // Check the user preference for this origin.
+  bool enabled_for_origin = false;
+  bool found =
+      GetOriginPref(delegate_->GetContentSettings(web_contents),
+                    delegate_->GetURL(web_contents), &enabled_for_origin);
+  if (found && !enabled_for_origin) {
+    VLOG(1) << "Platform verification denied because the origin has been "
             << "blocked by the user.";
     return false;
   }
   return true;
 }
 
 bool PlatformVerificationFlow::UpdateSettings(
     content::WebContents* web_contents,
     ConsentResponse consent_response) {
   PrefService* pref_service = delegate_->GetPrefs(web_contents);
   if (!pref_service) {
     LOG(ERROR) << "Failed to get user prefs.";
     return false;
   }
-  pref_service->SetBoolean(prefs::kRAConsentFirstTime, true);
-  RecordDomainConsent(delegate_->GetContentSettings(web_contents),
+
+  if (consent_response == CONSENT_RESPONSE_ALLOW) {
+    pref_service->SetBoolean(prefs::kRAConsentGranted, true);
+  }
+
+  RecordOriginConsent(delegate_->GetContentSettings(web_contents),
                       delegate_->GetURL(web_contents),
                       (consent_response == CONSENT_RESPONSE_ALLOW));
   return true;
 }
 
-bool PlatformVerificationFlow::GetDomainPref(
+bool PlatformVerificationFlow::GetOriginPref(
     HostContentSettingsMap* content_settings,
     const GURL& url,
     bool* pref_value) {
   CHECK(content_settings);
   CHECK(url.is_valid());
   ContentSetting setting = content_settings->GetContentSetting(
       url,
       url,
       CONTENT_SETTINGS_TYPE_PROTECTED_MEDIA_IDENTIFIER,
       std::string());
   if (setting != CONTENT_SETTING_ALLOW && setting != CONTENT_SETTING_BLOCK)
     return false;
   if (pref_value)
     *pref_value = (setting == CONTENT_SETTING_ALLOW);
   return true;
 }
 
-void PlatformVerificationFlow::RecordDomainConsent(
+void PlatformVerificationFlow::RecordOriginConsent(
     HostContentSettingsMap* content_settings,
     const GURL& url,
-    bool allow_domain) {
+    bool allow_origin) {
   CHECK(content_settings);
   CHECK(url.is_valid());
   // Build a pattern to represent scheme and host.
   scoped_ptr<ContentSettingsPattern::BuilderInterface> builder(
       ContentSettingsPattern::CreateBuilder(false));
   builder->WithScheme(url.scheme())
          ->WithDomainWildcard()
          ->WithHost(url.host())
          ->WithPathWildcard();
   if (!url.port().empty())
     builder->WithPort(url.port());
   else if (url.SchemeIs(url::kHttpsScheme))
     builder->WithPort(kDefaultHttpsPort);
   else if (url.SchemeIs(url::kHttpScheme))
     builder->WithPortWildcard();
   ContentSettingsPattern pattern = builder->Build();
   if (pattern.IsValid()) {
-    ContentSetting setting = allow_domain ? CONTENT_SETTING_ALLOW
-                                          : CONTENT_SETTING_BLOCK;
+    ContentSetting setting =
+        allow_origin ? CONTENT_SETTING_ALLOW : CONTENT_SETTING_BLOCK;
     content_settings->SetContentSetting(
         pattern,
         pattern,
         CONTENT_SETTINGS_TYPE_PROTECTED_MEDIA_IDENTIFIER,
         std::string(),
         setting);
   } else {
     LOG(WARNING) << "Not recording action: invalid URL pattern";
   }
 }
 
 bool PlatformVerificationFlow::IsExpired(const std::string& certificate) {
   scoped_refptr<net::X509Certificate> x509(
       net::X509Certificate::CreateFromBytes(certificate.data(),
                                             certificate.length()));
   if (!x509.get() || x509->valid_expiry().is_null()) {
     LOG(WARNING) << "Failed to parse certificate, cannot check expiry.";
     return false;
   }
   return (base::Time::Now() > x509->valid_expiry());
 }
 
 }  // namespace attestation
 }  // namespace chromeos