Fix up Owner settings on first load

chrome/browser/chromeos/ownership/owner_settings_service_chromeos.h

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_CHROMEOS_OWNERSHIP_OWNER_SETTINGS_SERVICE_CHROMEOS_H_
 #define CHROME_BROWSER_CHROMEOS_OWNERSHIP_OWNER_SETTINGS_SERVICE_CHROMEOS_H_
 
 #include <string>
 #include <vector>
 
@@ skipping 47 matching lines @@
     std::string request_token;
     std::string device_id;
   };
 
   ~OwnerSettingsServiceChromeOS() override;
 
   static OwnerSettingsServiceChromeOS* FromWebUI(content::WebUI* web_ui);
 
   void OnTPMTokenReady(bool tpm_token_enabled);
 
+  bool HasPendingChanges() const;
+
   // ownership::OwnerSettingsService implementation:
   bool HandlesSetting(const std::string& setting) override;
   bool Set(const std::string& setting, const base::Value& value) override;
   bool AppendToList(const std::string& setting,
                     const base::Value& value) override;
   bool RemoveFromList(const std::string& setting,
                       const base::Value& value) override;
   bool CommitTentativeDeviceSettings(
       scoped_ptr<enterprise_management::PolicyData> policy) override;
 
@@ skipping 15 matching lines @@
       const ManagementSettings& settings,
       const OnManagementSettingsSetCallback& callback);
 
   // Checks if the user is the device owner, without the user profile having to
   // been initialized. Should be used only if login state is in safe mode.
   static void IsOwnerForSafeModeAsync(
       const std::string& user_hash,
       const scoped_refptr<ownership::OwnerKeyUtil>& owner_key_util,
       const IsOwnerCallback& callback);
 
-  // Assembles PolicyData based on |settings|, |policy_data| and
-  // |user_id|.
+  // Assembles PolicyData based on |settings|, |policy_data|, |user_id| and
+  // |pending_management_settings|. Applies local-owner policy fixups if needed.
   static scoped_ptr<enterprise_management::PolicyData> AssemblePolicy(
       const std::string& user_id,
       const enterprise_management::PolicyData* policy_data,
-      const enterprise_management::ChromeDeviceSettingsProto* settings);
+      bool apply_pending_mangement_settings,
+      const ManagementSettings& pending_management_settings,
+      enterprise_management::ChromeDeviceSettingsProto* settings);
 
   // Updates device |settings|.
   static void UpdateDeviceSettings(
       const std::string& path,
       const base::Value& value,
       enterprise_management::ChromeDeviceSettingsProto& settings);
 
-  bool has_pending_changes() const {
-    return !pending_changes_.empty() || tentative_settings_.get() ||
-           has_pending_management_settings_;
-  }
-
  protected:
   OwnerSettingsServiceChromeOS(
       DeviceSettingsService* device_settings_service,
       Profile* profile,
       const scoped_refptr<ownership::OwnerKeyUtil>& owner_key_util);
 
  private:
   friend class OwnerSettingsServiceChromeOSFactory;
 
+  // Perform fixups required to ensure sensical local-owner device policy:
+  //  1) user whitelisting must be explicitly allowed or disallowed, and
+  //  2) the owner user must be on the whitelist, if it's enforced.
+  static void FixupLocalOwnerPolicy(
+      const std::string& user_id,
+      enterprise_management::ChromeDeviceSettingsProto* settings);
+
   // OwnerSettingsService protected interface overrides:
 
   // Reloads private key from profile's NSS slots, responds via |callback|.
   void ReloadKeypairImpl(const base::Callback<
       void(const scoped_refptr<ownership::PublicKey>& public_key,
            const scoped_refptr<ownership::PrivateKey>& private_key)>& callback)
       override;
 
   // Possibly notifies DeviceSettingsService that owner's keypair is loaded.
   void OnPostKeypairLoadedActions() override;
@@ skipping 21 matching lines @@
 
   // User ID this service instance belongs to.
   std::string user_id_;
 
   // Whether profile still needs to be initialized.
   bool waiting_for_profile_creation_;
 
   // Whether TPM token still needs to be initialized.
   bool waiting_for_tpm_token_;
 
+  // True if local-owner policy fixups are still pending.
+  bool has_pending_fixups_;
+
   // A set of pending changes to device settings.
   base::ScopedPtrHashMap<std::string, base::Value> pending_changes_;
 
   // True if there're pending changes to management settings.
   bool has_pending_management_settings_;
 
   // A set of pending changes to management settings.
   ManagementSettings pending_management_settings_;
 
   // A set of callbacks that need to be run after management settings
@@ skipping 10 matching lines @@
   base::WeakPtrFactory<OwnerSettingsServiceChromeOS> weak_factory_;
 
   base::WeakPtrFactory<OwnerSettingsServiceChromeOS> store_settings_factory_;
 
   DISALLOW_COPY_AND_ASSIGN(OwnerSettingsServiceChromeOS);
 };
 
 }  // namespace chromeos
 
 #endif  // CHROME_BROWSER_CHROMEOS_OWNERSHIP_OWNER_SETTINGS_SERVICE_CHROMEOS_H_