1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 #ifndef CHROME_BROWSER_CHROMEOS_POLICY_DEVICE_LOCAL_ACCOUNT_POLICY_SERVICE_H_
6 #define CHROME_BROWSER_CHROMEOS_POLICY_DEVICE_LOCAL_ACCOUNT_POLICY_SERVICE_H_
12 #include "base/basictypes.h"
13 #include "base/callback.h"
14 #include "base/compiler_specific.h"
15 #include "base/files/file_path.h"
16 #include "base/memory/ref_counted.h"
17 #include "base/memory/scoped_ptr.h"
18 #include "base/memory/weak_ptr.h"
19 #include "base/observer_list.h"
20 #include "chrome/browser/chromeos/extensions/device_local_account_external_policy_loader.h"
21 #include "chrome/browser/chromeos/policy/device_local_account_extension_tracker.h"
22 #include "chrome/browser/chromeos/policy/device_local_account_external_data_manager.h"
23 #include "chrome/browser/chromeos/settings/cros_settings.h"
24 #include "components/policy/core/common/cloud/cloud_policy_core.h"
25 #include "components/policy/core/common/cloud/cloud_policy_store.h"
26 #include "components/policy/core/common/cloud/component_cloud_policy_service.h"
27 #include "components/policy/core/common/schema_registry.h"
30 class SequencedTaskRunner;
34 class DeviceSettingsService;
35 class SessionManagerClient;
39 class URLRequestContextGetter;
44 struct DeviceLocalAccount;
45 class DeviceLocalAccountExternalDataService;
46 class DeviceLocalAccountPolicyStore;
47 class DeviceManagementService;
49 // The main switching central that downloads, caches, refreshes, etc. policy for
50 // a single device-local account.
51 class DeviceLocalAccountPolicyBroker
52 : public CloudPolicyStore::Observer,
53 public ComponentCloudPolicyService::Delegate {
55 // |policy_update_callback| will be invoked to notify observers that the
56 // policy for |account| has been updated.
57 // |task_runner| is the runner for policy refresh tasks.
58 DeviceLocalAccountPolicyBroker(
59 const DeviceLocalAccount& account,
60 const base::FilePath& component_policy_cache_path,
61 scoped_ptr<DeviceLocalAccountPolicyStore> store,
62 scoped_refptr<DeviceLocalAccountExternalDataManager>
63 external_data_manager,
64 const base::Closure& policy_updated_callback,
65 const scoped_refptr<base::SequencedTaskRunner>& task_runner);
66 virtual ~DeviceLocalAccountPolicyBroker();
68 // Initialize the broker, loading its |store_|.
71 // For the difference between |account_id| and |user_id|, see the
72 // documentation of DeviceLocalAccount.
73 const std::string& account_id() const { return account_id_; }
74 const std::string& user_id() const { return user_id_; }
76 scoped_refptr<chromeos::DeviceLocalAccountExternalPolicyLoader>
77 extension_loader() const { return extension_loader_; }
79 CloudPolicyCore* core() { return &core_; }
80 const CloudPolicyCore* core() const { return &core_; }
82 scoped_refptr<DeviceLocalAccountExternalDataManager> external_data_manager() {
83 return external_data_manager_;
86 ComponentCloudPolicyService* component_policy_service() const {
87 return component_policy_service_.get();
90 SchemaRegistry* schema_registry() { return &schema_registry_; }
92 // Fire up the cloud connection for fetching policy for the account from the
93 // cloud if this is an enterprise-managed device.
94 void ConnectIfPossible(
95 chromeos::DeviceSettingsService* device_settings_service,
96 DeviceManagementService* device_management_service,
97 scoped_refptr<net::URLRequestContextGetter> request_context);
99 // Reads the refresh delay from policy and configures the refresh scheduler.
100 void UpdateRefreshDelay();
102 // Retrieves the display name for the account as stored in policy. Returns an
103 // empty string if the policy is not present.
104 std::string GetDisplayName() const;
106 // CloudPolicyStore::Observer:
107 virtual void OnStoreLoaded(CloudPolicyStore* store) override;
108 virtual void OnStoreError(CloudPolicyStore* store) override;
110 // ComponentCloudPolicyService::Delegate:
111 virtual void OnComponentCloudPolicyUpdated() override;
114 void CreateComponentCloudPolicyService(
115 const scoped_refptr<net::URLRequestContextGetter>& request_context);
117 const std::string account_id_;
118 const std::string user_id_;
119 const base::FilePath component_policy_cache_path_;
120 SchemaRegistry schema_registry_;
121 const scoped_ptr<DeviceLocalAccountPolicyStore> store_;
122 DeviceLocalAccountExtensionTracker extension_tracker_;
123 scoped_refptr<DeviceLocalAccountExternalDataManager> external_data_manager_;
124 scoped_refptr<chromeos::DeviceLocalAccountExternalPolicyLoader>
126 CloudPolicyCore core_;
127 scoped_ptr<ComponentCloudPolicyService> component_policy_service_;
128 base::Closure policy_update_callback_;
130 DISALLOW_COPY_AND_ASSIGN(DeviceLocalAccountPolicyBroker);
133 // Manages user policy blobs for device-local accounts present on the device.
134 // The actual policy blobs are brokered by session_manager (to prevent file
135 // manipulation), and we're making signature checks on the policy blobs to
136 // ensure they're issued by the device owner.
137 class DeviceLocalAccountPolicyService {
139 // Interface for interested parties to observe policy changes.
142 virtual ~Observer() {}
144 // Policy for the given |user_id| has changed.
145 virtual void OnPolicyUpdated(const std::string& user_id) = 0;
147 // The list of accounts has been updated.
148 virtual void OnDeviceLocalAccountsChanged() = 0;
151 DeviceLocalAccountPolicyService(
152 chromeos::SessionManagerClient* session_manager_client,
153 chromeos::DeviceSettingsService* device_settings_service,
154 chromeos::CrosSettings* cros_settings,
155 scoped_refptr<base::SequencedTaskRunner> store_background_task_runner,
156 scoped_refptr<base::SequencedTaskRunner> extension_cache_task_runner,
157 scoped_refptr<base::SequencedTaskRunner>
158 external_data_service_backend_task_runner,
159 scoped_refptr<base::SequencedTaskRunner> io_task_runner,
160 scoped_refptr<net::URLRequestContextGetter> request_context);
161 virtual ~DeviceLocalAccountPolicyService();
163 // Shuts down the service and prevents further policy fetches from the cloud.
166 // Initializes the cloud policy service connection.
167 void Connect(DeviceManagementService* device_management_service);
169 // Get the policy broker for a given |user_id|. Returns NULL if that |user_id|
170 // does not belong to an existing device-local account.
171 DeviceLocalAccountPolicyBroker* GetBrokerForUser(const std::string& user_id);
173 // Indicates whether policy has been successfully fetched for the given
175 bool IsPolicyAvailableForUser(const std::string& user_id);
177 void AddObserver(Observer* observer);
178 void RemoveObserver(Observer* observer);
181 typedef std::map<std::string, DeviceLocalAccountPolicyBroker*>
184 // Returns |true| if the directory in which force-installed extensions are
185 // cached for |account_id| is busy, either because a broker that was using
186 // this directory has not shut down completely yet or because the directory is
188 bool IsExtensionCacheDirectoryBusy(const std::string& account_id);
190 // Starts any extension caches that are not running yet but can be started now
191 // because their cache directories are no longer busy.
192 void StartExtensionCachesIfPossible();
194 // Checks whether a broker exists for |account_id|. If so, starts the broker's
195 // extension cache and returns |true|. Otherwise, returns |false|.
196 bool StartExtensionCacheForAccountIfPresent(const std::string& account_id);
198 // Called back when any extension caches belonging to device-local accounts
199 // that no longer exist have been removed at start-up.
200 void OnOrphanedExtensionCachesDeleted();
202 // Called back when the extension cache for |account_id| has been shut down.
203 void OnObsoleteExtensionCacheShutdown(const std::string& account_id);
205 // Called back when the extension cache for |account_id| has been removed.
206 void OnObsoleteExtensionCacheDeleted(const std::string& account_id);
208 // Re-queries the list of defined device-local accounts from device settings
209 // and updates |policy_brokers_| to match that list.
210 void UpdateAccountList();
212 // Calls |UpdateAccountList| if there are no previous calls pending.
213 void UpdateAccountListIfNonePending();
215 // Deletes brokers in |map| and clears it.
216 void DeleteBrokers(PolicyBrokerMap* map);
218 // Find the broker for a given |store|. Returns NULL if |store| is unknown.
219 DeviceLocalAccountPolicyBroker* GetBrokerForStore(CloudPolicyStore* store);
221 // Notifies the |observers_| that the policy for |user_id| has changed.
222 void NotifyPolicyUpdated(const std::string& user_id);
224 ObserverList<Observer, true> observers_;
226 chromeos::SessionManagerClient* session_manager_client_;
227 chromeos::DeviceSettingsService* device_settings_service_;
228 chromeos::CrosSettings* cros_settings_;
230 DeviceManagementService* device_management_service_;
232 // The device-local account policy brokers, keyed by user ID.
233 PolicyBrokerMap policy_brokers_;
235 // Whether a call to UpdateAccountList() is pending because |cros_settings_|
236 // are not trusted yet.
237 bool waiting_for_cros_settings_;
239 // Orphaned extension caches are removed at startup. This tracks the status of
241 enum OrphanExtensionCacheDeletionState {
246 OrphanExtensionCacheDeletionState orphan_extension_cache_deletion_state_;
248 // Account IDs whose extension cache directories are busy, either because a
249 // broker for the account has not shut down completely yet or because the
250 // directory is being deleted.
251 std::set<std::string> busy_extension_cache_directories_;
253 const scoped_refptr<base::SequencedTaskRunner> store_background_task_runner_;
254 const scoped_refptr<base::SequencedTaskRunner> extension_cache_task_runner_;
256 scoped_ptr<DeviceLocalAccountExternalDataService> external_data_service_;
258 scoped_refptr<net::URLRequestContextGetter> request_context_;
260 const scoped_ptr<chromeos::CrosSettings::ObserverSubscription>
261 local_accounts_subscription_;
263 // Path to the directory that contains the cached policy for components
264 // for device-local accounts.
265 base::FilePath component_policy_cache_root_;
267 base::WeakPtrFactory<DeviceLocalAccountPolicyService> weak_factory_;
269 DISALLOW_COPY_AND_ASSIGN(DeviceLocalAccountPolicyService);
272 } // namespace policy
274 #endif // CHROME_BROWSER_CHROMEOS_POLICY_DEVICE_LOCAL_ACCOUNT_POLICY_SERVICE_H_