Implement new-style CloudPolicyStore for Chrome OS device policy.

chrome/browser/policy/device_policy_decoder_chromeos.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#include "chrome/browser/policy/device_policy_cache.h"
+#include "chrome/browser/policy/device_policy_decoder_chromeos.h"
 
 #include <limits>
-#include <string>
-#include <vector>
 
-#include "base/basictypes.h"
-#include "base/bind.h"
-#include "base/callback.h"
-#include "base/compiler_specific.h"
 #include "base/logging.h"
-#include "base/metrics/histogram.h"
 #include "base/values.h"
 #include "chrome/browser/policy/app_pack_updater.h"
-#include "chrome/browser/policy/cloud_policy_data_store.h"
 #include "chrome/browser/policy/enterprise_install_attributes.h"
-#include "chrome/browser/policy/enterprise_metrics.h"
 #include "chrome/browser/policy/policy_map.h"
 #include "chrome/browser/policy/proto/chrome_device_policy.pb.h"
-#include "chrome/browser/policy/proto/device_management_backend.pb.h"
-#include "chrome/browser/policy/proto/device_management_local.pb.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
 #include "chromeos/dbus/update_engine_client.h"
-#include "google_apis/gaia/gaia_auth_util.h"
 #include "policy/policy_constants.h"
 #include "third_party/cros_system_api/dbus/service_constants.h"
 
 using google::protobuf::RepeatedField;
 using google::protobuf::RepeatedPtrField;
 
 namespace em = enterprise_management;
 
+namespace policy {
+
 namespace {
 
 // Decodes a protobuf integer to an IntegerValue. The caller assumes ownership
 // of the return Value*. Returns NULL in case the input value is out of bounds.
 Value* DecodeIntegerValue(google::protobuf::int64 value) {
   if (value < std::numeric_limits<int>::min() ||
       value > std::numeric_limits<int>::max()) {
     LOG(WARNING) << "Integer value " << value
                  << " out of numeric limits, ignoring.";
     return NULL;
@@ skipping 10 matching lines @@
     flimflam::kTypeBluetooth,
     flimflam::kTypeCellular,
   };
 
   if (value < 0 || value >= static_cast<int>(arraysize(kConnectionTypes)))
     return NULL;
 
   return Value::CreateStringValue(kConnectionTypes[value]);
 }
 
-}  // namespace
-
-namespace policy {
-
-DevicePolicyCache::DevicePolicyCache(
-    CloudPolicyDataStore* data_store,
-    EnterpriseInstallAttributes* install_attributes)
-    : data_store_(data_store),
-      install_attributes_(install_attributes),
-      device_settings_service_(chromeos::DeviceSettingsService::Get()),
-      ALLOW_THIS_IN_INITIALIZER_LIST(weak_ptr_factory_(this)),
-      policy_fetch_pending_(false) {
-  device_settings_service_->AddObserver(this);
-}
-
-DevicePolicyCache::DevicePolicyCache(
-    CloudPolicyDataStore* data_store,
-    EnterpriseInstallAttributes* install_attributes,
-    chromeos::DeviceSettingsService* device_settings_service)
-    : data_store_(data_store),
-      install_attributes_(install_attributes),
-      device_settings_service_(device_settings_service),
-      ALLOW_THIS_IN_INITIALIZER_LIST(weak_ptr_factory_(this)),
-      policy_fetch_pending_(false) {
-  device_settings_service_->AddObserver(this);
-}
-
-DevicePolicyCache::~DevicePolicyCache() {
-  device_settings_service_->RemoveObserver(this);
-}
-
-void DevicePolicyCache::Load() {
-  DeviceSettingsUpdated();
-}
-
-bool DevicePolicyCache::SetPolicy(const em::PolicyFetchResponse& policy) {
-  DCHECK(IsReady());
-
-  // Make sure we have an enterprise device.
-  std::string registration_domain(install_attributes_->GetDomain());
-  if (registration_domain.empty()) {
-    LOG(WARNING) << "Refusing to accept policy on non-enterprise device.";
-    UMA_HISTOGRAM_ENUMERATION(kMetricPolicy,
-                              kMetricPolicyFetchNonEnterpriseDevice,
-                              kMetricPolicySize);
-    InformNotifier(CloudPolicySubsystem::LOCAL_ERROR,
-                   CloudPolicySubsystem::POLICY_LOCAL_ERROR);
-    return false;
-  }
-
-  // Check the user this policy is for against the device-locked name.
-  em::PolicyData policy_data;
-  if (!policy_data.ParseFromString(policy.policy_data())) {
-    LOG(WARNING) << "Invalid policy protobuf";
-    UMA_HISTOGRAM_ENUMERATION(kMetricPolicy, kMetricPolicyFetchInvalidPolicy,
-                              kMetricPolicySize);
-    InformNotifier(CloudPolicySubsystem::LOCAL_ERROR,
-                   CloudPolicySubsystem::POLICY_LOCAL_ERROR);
-    return false;
-  }
-
-  // Existing installations may not have a canonicalized version of the
-  // registration domain in install attributes, so lower-case the data here.
-  if (registration_domain != gaia::ExtractDomainName(policy_data.username())) {
-    LOG(WARNING) << "Refusing policy blob for " << policy_data.username()
-                 << " which doesn't match domain " << registration_domain;
-    UMA_HISTOGRAM_ENUMERATION(kMetricPolicy, kMetricPolicyFetchUserMismatch,
-                              kMetricPolicySize);
-    InformNotifier(CloudPolicySubsystem::LOCAL_ERROR,
-                   CloudPolicySubsystem::POLICY_LOCAL_ERROR);
-    return false;
-  }
-
-  set_last_policy_refresh_time(base::Time::NowFromSystemTime());
-
-  // Start a store operation.
-  policy_fetch_pending_ = true;
-  device_settings_service_->Store(
-      policy.SerializeAsString(),
-      base::Bind(&DevicePolicyCache::PolicyStoreOpCompleted,
-                 weak_ptr_factory_.GetWeakPtr()));
-  return true;
-}
-
-void DevicePolicyCache::SetUnmanaged() {
-  LOG(WARNING) << "Tried to set DevicePolicyCache to 'unmanaged'!";
-  // This is not supported for DevicePolicyCache.
-}
-
-void DevicePolicyCache::SetFetchingDone() {
-  // Don't send the notification just yet if there is a pending policy
-  // store/reload cycle.
-  if (!policy_fetch_pending_)
-    CloudPolicyCacheBase::SetFetchingDone();
-}
-
-void DevicePolicyCache::OwnershipStatusChanged() {}
-
-void DevicePolicyCache::DeviceSettingsUpdated() {
-  DCHECK(CalledOnValidThread());
-  chromeos::DeviceSettingsService::Status status =
-      device_settings_service_->status();
-  const em::PolicyData* policy_data = device_settings_service_->policy_data();
-  if (status == chromeos::DeviceSettingsService::STORE_SUCCESS &&
-      !policy_data) {
-    // Initial policy load is still pending.
-    return;
-  }
-
-  if (!IsReady()) {
-    std::string device_token;
-    InstallInitialPolicy(status, policy_data, &device_token);
-    SetTokenAndFlagReady(device_token);
-  } else {  // In other words, IsReady() == true
-    if (status != chromeos::DeviceSettingsService::STORE_SUCCESS ||
-        !policy_data) {
-      if (status == chromeos::DeviceSettingsService::STORE_VALIDATION_ERROR) {
-        UMA_HISTOGRAM_ENUMERATION(kMetricPolicy, kMetricPolicyFetchBadSignature,
-                                  kMetricPolicySize);
-        InformNotifier(CloudPolicySubsystem::LOCAL_ERROR,
-                       CloudPolicySubsystem::SIGNATURE_MISMATCH);
-      } else {
-        UMA_HISTOGRAM_ENUMERATION(kMetricPolicy, kMetricPolicyFetchOtherFailed,
-                                  kMetricPolicySize);
-        InformNotifier(CloudPolicySubsystem::LOCAL_ERROR,
-                       CloudPolicySubsystem::POLICY_LOCAL_ERROR);
-      }
-    } else {
-      em::PolicyFetchResponse policy_response;
-      CHECK(policy_data->SerializeToString(
-          policy_response.mutable_policy_data()));
-      bool ok = SetPolicyInternal(policy_response, NULL, false);
-      if (ok) {
-        UMA_HISTOGRAM_ENUMERATION(kMetricPolicy, kMetricPolicyFetchOK,
-                                  kMetricPolicySize);
-      }
-    }
-  }
-}
-
-bool DevicePolicyCache::DecodePolicyData(const em::PolicyData& policy_data,
-                                         PolicyMap* policies) {
-  em::ChromeDeviceSettingsProto policy;
-  if (!policy.ParseFromString(policy_data.policy_value())) {
-    LOG(WARNING) << "Failed to parse ChromeDeviceSettingsProto.";
-    return false;
-  }
-  DecodeDevicePolicy(policy, policies);
-  return true;
-}
-
-void DevicePolicyCache::PolicyStoreOpCompleted() {
-  DCHECK(CalledOnValidThread());
-  chromeos::DeviceSettingsService::Status status =
-      device_settings_service_->status();
-  if (status != chromeos::DeviceSettingsService::STORE_SUCCESS) {
-    UMA_HISTOGRAM_ENUMERATION(kMetricPolicy, kMetricPolicyStoreFailed,
-                              kMetricPolicySize);
-    if (status == chromeos::DeviceSettingsService::STORE_VALIDATION_ERROR) {
-      UMA_HISTOGRAM_ENUMERATION(kMetricPolicy, kMetricPolicyFetchBadSignature,
-                                kMetricPolicySize);
-      InformNotifier(CloudPolicySubsystem::LOCAL_ERROR,
-                     CloudPolicySubsystem::SIGNATURE_MISMATCH);
-    } else {
-      UMA_HISTOGRAM_ENUMERATION(kMetricPolicy, kMetricPolicyFetchOtherFailed,
-                                kMetricPolicySize);
-      InformNotifier(CloudPolicySubsystem::LOCAL_ERROR,
-                     CloudPolicySubsystem::POLICY_LOCAL_ERROR);
-    }
-    CheckFetchingDone();
-    return;
-  }
-  UMA_HISTOGRAM_ENUMERATION(kMetricPolicy, kMetricPolicyStoreSucceeded,
-                            kMetricPolicySize);
-
-  CheckFetchingDone();
-}
-
-void DevicePolicyCache::InstallInitialPolicy(
-    chromeos::DeviceSettingsService::Status status,
-    const em::PolicyData* policy_data,
-    std::string* device_token) {
-  if (status == chromeos::DeviceSettingsService::STORE_NO_POLICY ||
-      status == chromeos::DeviceSettingsService::STORE_KEY_UNAVAILABLE) {
-    InformNotifier(CloudPolicySubsystem::UNENROLLED,
-                   CloudPolicySubsystem::NO_DETAILS);
-    return;
-  }
-  if (!policy_data) {
-    LOG(WARNING) << "Failed to parse PolicyData protobuf.";
-    UMA_HISTOGRAM_ENUMERATION(kMetricPolicy, kMetricPolicyLoadFailed,
-                              kMetricPolicySize);
-    InformNotifier(CloudPolicySubsystem::LOCAL_ERROR,
-                   CloudPolicySubsystem::POLICY_LOCAL_ERROR);
-    return;
-  }
-  if (!policy_data->has_request_token() ||
-      policy_data->request_token().empty()) {
-    SetUnmanagedInternal(base::Time::NowFromSystemTime());
-    InformNotifier(CloudPolicySubsystem::UNMANAGED,
-                   CloudPolicySubsystem::NO_DETAILS);
-    // TODO(jkummerow): Reminder: When we want to feed device-wide settings
-    // made by a local owner into this cache, we need to call
-    // SetPolicyInternal() here.
-    return;
-  }
-  if (!policy_data->has_username() || !policy_data->has_device_id()) {
-    UMA_HISTOGRAM_ENUMERATION(kMetricPolicy, kMetricPolicyLoadFailed,
-                              kMetricPolicySize);
-    InformNotifier(CloudPolicySubsystem::LOCAL_ERROR,
-                   CloudPolicySubsystem::POLICY_LOCAL_ERROR);
-    return;
-  }
-  UMA_HISTOGRAM_ENUMERATION(kMetricPolicy, kMetricPolicyLoadSucceeded,
-                            kMetricPolicySize);
-  data_store_->set_user_name(policy_data->username());
-  data_store_->set_device_id(policy_data->device_id());
-  *device_token = policy_data->request_token();
-  base::Time timestamp;
-  em::PolicyFetchResponse policy_response;
-  CHECK(policy_data->SerializeToString(policy_response.mutable_policy_data()));
-  if (SetPolicyInternal(policy_response, &timestamp, true))
-    set_last_policy_refresh_time(timestamp);
-}
-
-void DevicePolicyCache::SetTokenAndFlagReady(const std::string& device_token) {
-  // We need to call SetDeviceToken unconditionally to indicate the cache has
-  // finished loading.
-  data_store_->SetDeviceToken(device_token, true);
-  SetReady();
-}
-
-void DevicePolicyCache::CheckFetchingDone() {
-  if (policy_fetch_pending_) {
-    CloudPolicyCacheBase::SetFetchingDone();
-    policy_fetch_pending_ = false;
-  }
-}
-
-void DevicePolicyCache::DecodeDevicePolicy(
-    const em::ChromeDeviceSettingsProto& policy,
-    PolicyMap* policies) {
-  // Decode the various groups of policies.
-  DecodeLoginPolicies(policy, policies);
-  DecodeKioskPolicies(policy, policies, install_attributes_);
-  DecodeNetworkPolicies(policy, policies, install_attributes_);
-  DecodeReportingPolicies(policy, policies);
-  DecodeAutoUpdatePolicies(policy, policies);
-  DecodeGenericPolicies(policy, policies);
-}
-
-// static
-void DevicePolicyCache::DecodeLoginPolicies(
-    const em::ChromeDeviceSettingsProto& policy,
-    PolicyMap* policies) {
+void DecodeLoginPolicies(const em::ChromeDeviceSettingsProto& policy,
+                         PolicyMap* policies) {
   if (policy.has_guest_mode_enabled()) {
     const em::GuestModeEnabledProto& container(policy.guest_mode_enabled());
     if (container.has_guest_mode_enabled()) {
       policies->Set(key::kDeviceGuestModeEnabled,
                     POLICY_LEVEL_MANDATORY,
                     POLICY_SCOPE_MACHINE,
                     Value::CreateBooleanValue(container.guest_mode_enabled()));
     }
   }
 
@@ skipping 40 matching lines @@
     if (container.has_ephemeral_users_enabled()) {
       policies->Set(key::kDeviceEphemeralUsersEnabled,
                     POLICY_LEVEL_MANDATORY,
                     POLICY_SCOPE_MACHINE,
                     Value::CreateBooleanValue(
                         container.ephemeral_users_enabled()));
     }
   }
 }
 
-// static
-void DevicePolicyCache::DecodeKioskPolicies(
-    const em::ChromeDeviceSettingsProto& policy,
-    PolicyMap* policies,
-    EnterpriseInstallAttributes* install_attributes) {
+void DecodeKioskPolicies(const em::ChromeDeviceSettingsProto& policy,
+                         PolicyMap* policies,
+                         EnterpriseInstallAttributes* install_attributes) {
   // No policies if this is not KIOSK.
   if (install_attributes->GetMode() != DEVICE_MODE_KIOSK)
     return;
 
   if (policy.has_forced_logout_timeouts()) {
     const em::ForcedLogoutTimeoutsProto& container(
         policy.forced_logout_timeouts());
     if (container.has_idle_logout_timeout()) {
       policies->Set(key::kDeviceIdleLogoutTimeout,
                     POLICY_LEVEL_MANDATORY,
@@ skipping 51 matching lines @@
     for (int i = 0; i < container.app_id_size(); ++i)
       pinned_apps_list->Append(Value::CreateStringValue(container.app_id(i)));
 
     policies->Set(key::kPinnedLauncherApps,
                   POLICY_LEVEL_RECOMMENDED,
                   POLICY_SCOPE_MACHINE,
                   pinned_apps_list);
   }
 }
 
-// static
-void DevicePolicyCache::DecodeNetworkPolicies(
-    const em::ChromeDeviceSettingsProto& policy,
-    PolicyMap* policies,
-    EnterpriseInstallAttributes* install_attributes) {
+void DecodeNetworkPolicies(const em::ChromeDeviceSettingsProto& policy,
+                           PolicyMap* policies,
+                           EnterpriseInstallAttributes* install_attributes) {
   if (policy.has_device_proxy_settings()) {
     const em::DeviceProxySettingsProto& container(
         policy.device_proxy_settings());
     scoped_ptr<DictionaryValue> proxy_settings(new DictionaryValue);
     if (container.has_proxy_mode())
       proxy_settings->SetString(key::kProxyMode, container.proxy_mode());
     if (container.has_proxy_server())
       proxy_settings->SetString(key::kProxyServer, container.proxy_server());
     if (container.has_proxy_pac_url())
       proxy_settings->SetString(key::kProxyPacUrl, container.proxy_pac_url());
@@ skipping 30 matching lines @@
       policy.open_network_configuration().has_open_network_configuration()) {
     std::string config(
         policy.open_network_configuration().open_network_configuration());
     policies->Set(key::kDeviceOpenNetworkConfiguration,
                   POLICY_LEVEL_MANDATORY,
                   POLICY_SCOPE_MACHINE,
                   Value::CreateStringValue(config));
   }
 }
 
-// static
-void DevicePolicyCache::DecodeReportingPolicies(
-    const em::ChromeDeviceSettingsProto& policy,
-    PolicyMap* policies) {
+void DecodeReportingPolicies(const em::ChromeDeviceSettingsProto& policy,
+                             PolicyMap* policies) {
   if (policy.has_device_reporting()) {
     const em::DeviceReportingProto& container(policy.device_reporting());
     if (container.has_report_version_info()) {
       policies->Set(key::kReportDeviceVersionInfo,
                     POLICY_LEVEL_MANDATORY,
                     POLICY_SCOPE_MACHINE,
                     Value::CreateBooleanValue(container.report_version_info()));
     }
     if (container.has_report_activity_times()) {
       policies->Set(key::kReportDeviceActivityTimes,
@@ skipping 10 matching lines @@
     }
     if (container.has_report_location()) {
       policies->Set(key::kReportDeviceLocation,
                     POLICY_LEVEL_MANDATORY,
                     POLICY_SCOPE_MACHINE,
                     Value::CreateBooleanValue(container.report_location()));
     }
   }
 }
 
-// static
-void DevicePolicyCache::DecodeAutoUpdatePolicies(
-    const em::ChromeDeviceSettingsProto& policy,
-    PolicyMap* policies) {
+void DecodeAutoUpdatePolicies(const em::ChromeDeviceSettingsProto& policy,
+                              PolicyMap* policies) {
   if (policy.has_release_channel()) {
     const em::ReleaseChannelProto& container(policy.release_channel());
     if (container.has_release_channel()) {
       std::string channel(container.release_channel());
       policies->Set(key::kChromeOsReleaseChannel,
                     POLICY_LEVEL_MANDATORY,
                     POLICY_SCOPE_MACHINE,
                     Value::CreateStringValue(channel));
       // TODO(dubroy): Once http://crosbug.com/17015 is implemented, we won't
       // have to pass the channel in here, only ping the update engine to tell
@@ skipping 49 matching lines @@
           allowed_connection_types->Append(value);
       }
       policies->Set(key::kDeviceUpdateAllowedConnectionTypes,
                     POLICY_LEVEL_MANDATORY,
                     POLICY_SCOPE_MACHINE,
                     allowed_connection_types);
     }
   }
 }
 
-// static
-void DevicePolicyCache::DecodeGenericPolicies(
-    const em::ChromeDeviceSettingsProto& policy,
-    PolicyMap* policies) {
+void DecodeGenericPolicies(const em::ChromeDeviceSettingsProto& policy,
+                           PolicyMap* policies) {
   if (policy.has_device_policy_refresh_rate()) {
     const em::DevicePolicyRefreshRateProto& container(
         policy.device_policy_refresh_rate());
     if (container.has_device_policy_refresh_rate()) {
       policies->Set(key::kDevicePolicyRefreshRate,
                     POLICY_LEVEL_MANDATORY,
                     POLICY_SCOPE_MACHINE,
                     DecodeIntegerValue(container.device_policy_refresh_rate()));
     }
   }
@@ skipping 29 matching lines @@
     if (policy.system_timezone().has_timezone()) {
       policies->Set(key::kSystemTimezone,
                     POLICY_LEVEL_MANDATORY,
                     POLICY_SCOPE_MACHINE,
                     Value::CreateStringValue(
                         policy.system_timezone().timezone()));
     }
   }
 }
 
+}  // namespace
+
+void DecodeDevicePolicy(const em::ChromeDeviceSettingsProto& policy,
+                        PolicyMap* policies,
+                        EnterpriseInstallAttributes* install_attributes) {
+  // Decode the various groups of policies.
+  DecodeLoginPolicies(policy, policies);
+  DecodeKioskPolicies(policy, policies, install_attributes);
+  DecodeNetworkPolicies(policy, policies, install_attributes);
+  DecodeReportingPolicies(policy, policies);
+  DecodeAutoUpdatePolicies(policy, policies);
+  DecodeGenericPolicies(policy, policies);
+}
+
 }  // namespace policy