Fix up Owner settings on first load

chrome/browser/chromeos/ownership/owner_settings_service_chromeos.h

Index: chrome/browser/chromeos/ownership/owner_settings_service_chromeos.h
diff --git a/chrome/browser/chromeos/ownership/owner_settings_service_chromeos.h b/chrome/browser/chromeos/ownership/owner_settings_service_chromeos.h
index f1394b4d42dea08ada001c382d492b1448e27faf..7ce4c3d28af64109c3efd80a2d5d0a49b2f4c1a6 100644
--- a/chrome/browser/chromeos/ownership/owner_settings_service_chromeos.h
+++ b/chrome/browser/chromeos/ownership/owner_settings_service_chromeos.h
@@ -100,12 +100,14 @@ class OwnerSettingsServiceChromeOS : public ownership::OwnerSettingsService,
       const scoped_refptr<ownership::OwnerKeyUtil>& owner_key_util,
       const IsOwnerCallback& callback);
 
-  // Assembles PolicyData based on |settings|, |policy_data| and
-  // |user_id|.
+  // Assembles PolicyData based on |settings|, |policy_data|, |user_id| and
+  // |pending_management_settings|. Applies local-owner policy fixups if needed.
   static scoped_ptr<enterprise_management::PolicyData> AssemblePolicy(
       const std::string& user_id,
       const enterprise_management::PolicyData* policy_data,
-      const enterprise_management::ChromeDeviceSettingsProto* settings);
+      bool apply_pending_mangement_settings,
+      const ManagementSettings& pending_management_settings,
+      enterprise_management::ChromeDeviceSettingsProto* settings);
 
   // Updates device |settings|.
   static void UpdateDeviceSettings(
@@ -115,7 +117,7 @@ class OwnerSettingsServiceChromeOS : public ownership::OwnerSettingsService,
 
   bool has_pending_changes() const {
     return !pending_changes_.empty() || tentative_settings_.get() ||
-           has_pending_management_settings_;
+           has_pending_management_settings_ || has_pending_fixups_;
   }
 
  protected:
@@ -127,6 +129,13 @@ class OwnerSettingsServiceChromeOS : public ownership::OwnerSettingsService,
  private:
   friend class OwnerSettingsServiceChromeOSFactory;
 
+  // Perform fixups required to ensure sensical local-owner device policy:
+  //  1) user whitelisting must be explicitly allowed or disallowed, and
+  //  2) the owner user must be on the whitelist, if it's enforced.
+  static void FixupLocalOwnerPolicy(
+      const std::string& user_id,
+      enterprise_management::ChromeDeviceSettingsProto* settings);
+
   // OwnerSettingsService protected interface overrides:
 
   // Reloads private key from profile's NSS slots, responds via |callback|.
@@ -168,6 +177,9 @@ class OwnerSettingsServiceChromeOS : public ownership::OwnerSettingsService,
   // Whether TPM token still needs to be initialized.
   bool waiting_for_tpm_token_;
 
+  // True if local-owner policy fixups are still pending.
+  bool has_pending_fixups_;
+
   // A set of pending changes to device settings.
   base::ScopedPtrHashMap<std::string, base::Value> pending_changes_;