Sync more DMServer proto comments to the client.

components/policy/proto/device_management_backend.proto

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 syntax = "proto2";
 
 option optimize_for = LITE_RUNTIME;
 
 package enterprise_management;
 
@@ skipping 465 matching lines @@
   // is supplied.
   // Or, client might not have verification public key (legacy Chrome build
   // before verification key was introduced, or outdated build which has
   // old/compromised verification key). In that case, verification signature
   // cannot be provided.
   // If client is missing both public keys (old signing key and verification
   // key), then we are unable to produce any valid signature and client must
   // drop such PolicyFetchResponse.
   optional bytes new_public_key_verification_data = 8;
 
-  // If new_public_key is specified, this field contains a signature
-  // of a PolicyPublicKeyAndDomain protobuf, signed using a key only
-  // available to DMServer. The public key portion of this well-known key is
-  // embedded into the Chrome binary. The hash of that embedded key is passed
-  // to DMServer as verification_key_hash field in PolicyFetchRequest. DMServer
-  // will pick a private key on the server which matches the hash (matches
-  // public key on the client). If DMServer is unable to find matching key, it
-  // will return an error instead of policy data.
-  // In case hash was not specified, DMServer will leave verification signature
-  // field empty (legacy behavior).
-  // In addition to the checks between new_public_key
-  // and new_public_key_signature described above, Chrome also verifies
-  // new_public_key with the embedded public key and
-  // new_public_key_verification_signature.
+  // If new_public_key is specified, this field contains the signature of a
+  // PublicKeyVerificationData protobuf, signed using a key only available to
+  // DMServer. The public key portion of this well-known key is embedded into
+  // the Chrome binary. The hash of that embedded key is passed to DMServer as
+  // verification_key_hash field in PolicyFetchRequest. DMServer picks a private
+  // key on the server which matches the hash (matches public key on the
+  // client). If DMServer is unable to find matching key, it returns an error
+  // instead of policy data. In case a hash was not specified, DMServer leaves
+  // the verification signature field empty (legacy behavior).
+  // This signature is provided to better protect first key delivery (since the
+  // browser does not possess the previous signing key, DMServer cannot compute
+  // new_public_key_signature).
+  // See http://go/chrome-nac-server-design for more information.
   optional bytes new_public_key_verification_data_signature = 9;
 }
 
 // DEPRECATED ON THE SERVER: Protobuf used to generate the deprecated
 // new_public_key_verification_signature field.
 message PolicyPublicKeyAndDomain {
   // The public key to sign (taken from the |new_public_key| field in
   // PolicyFetchResponse).
   optional bytes new_public_key = 1;
 
@@ skipping 792 matching lines @@
   optional CheckAndroidManagementRequest check_android_management_request = 17;
 
   // Request to register with a registration certificate.
   optional CertificateBasedDeviceRegisterRequest
       certificate_based_register_request = 18;
 
 }
 
 // Response from server to device.
 //
-// The server uses the following numbers as HTTP status codes
-// to report top-level errors.
+// For release clients, DMServer returns errors using HTTP Status Code, so that
+// clients only need to check one place for all error codes.  It is also easier
+// to perform log analysis and customer support since HTTP Status Code is easily
+// visible in the logs.
+//
+// The following list defines the error code returned by this API:
 //
 // 200 OK: valid response is returned to client.
 // 400 Bad Request: invalid argument.
 // 401 Unauthorized: invalid auth cookie or DM token.
 // 403 Forbidden: device management is not allowed.
 // 404 Not Found: the request URL is invalid.
 // 410 Device Not Found: the device id is not found.
 // 491 Request Pending: the request is pending approval.
 // 500 Internal Server Error: most likely a bug in DM server.
 // 503 Service Unavailable: most likely a backend error.
@@ skipping 74 matching lines @@
   // Response to update device attribute.
   optional DeviceAttributeUpdateResponse device_attribute_update_response = 16;
 
   // Response to GCM id update request.
   optional GcmIdUpdateResponse gcm_id_update_response = 17;
 
   // Response to check Android management request.
   optional CheckAndroidManagementResponse
       check_android_management_response = 18;
 }