src/chrome/browser/supervised_user/supervised_user_service.cc

   1 // Copyright 2014 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chrome/browser/supervised_user/supervised_user_service.h"
   6
   7 #include "base/command_line.h"
   8 #include "base/files/file_path.h"
   9 #include "base/memory/ref_counted.h"
  10 #include "base/prefs/pref_service.h"
  11 #include "base/strings/string_number_conversions.h"
  12 #include "base/strings/utf_string_conversions.h"
  13 #include "chrome/browser/browser_process.h"
  14 #include "chrome/browser/profiles/profile.h"
  15 #include "chrome/browser/profiles/profile_info_cache.h"
  16 #include "chrome/browser/profiles/profile_manager.h"
  17 #include "chrome/browser/signin/profile_oauth2_token_service_factory.h"
  18 #include "chrome/browser/signin/signin_manager_factory.h"
  19 #include "chrome/browser/supervised_user/custodian_profile_downloader_service.h"
  20 #include "chrome/browser/supervised_user/custodian_profile_downloader_service_factory.h"
  21 #include "chrome/browser/supervised_user/experimental/supervised_user_blacklist_downloader.h"
  22 #include "chrome/browser/supervised_user/permission_request_creator_apiary.h"
  23 #include "chrome/browser/supervised_user/permission_request_creator_sync.h"
  24 #include "chrome/browser/supervised_user/supervised_user_constants.h"
  25 #include "chrome/browser/supervised_user/supervised_user_pref_mapping_service.h"
  26 #include "chrome/browser/supervised_user/supervised_user_pref_mapping_service_factory.h"
  27 #include "chrome/browser/supervised_user/supervised_user_registration_utility.h"
  28 #include "chrome/browser/supervised_user/supervised_user_service_observer.h"
  29 #include "chrome/browser/supervised_user/supervised_user_settings_service.h"
  30 #include "chrome/browser/supervised_user/supervised_user_settings_service_factory.h"
  31 #include "chrome/browser/supervised_user/supervised_user_shared_settings_service_factory.h"
  32 #include "chrome/browser/supervised_user/supervised_user_site_list.h"
  33 #include "chrome/browser/supervised_user/supervised_user_sync_service.h"
  34 #include "chrome/browser/supervised_user/supervised_user_sync_service_factory.h"
  35 #include "chrome/browser/sync/profile_sync_service.h"
  36 #include "chrome/browser/sync/profile_sync_service_factory.h"
  37 #include "chrome/browser/ui/browser.h"
  38 #include "chrome/browser/ui/browser_list.h"
  39 #include "chrome/common/chrome_switches.h"
  40 #include "chrome/common/pref_names.h"
  41 #include "chrome/grit/generated_resources.h"
  42 #include "components/pref_registry/pref_registry_syncable.h"
  43 #include "components/signin/core/browser/profile_oauth2_token_service.h"
  44 #include "components/signin/core/browser/signin_manager.h"
  45 #include "components/signin/core/browser/signin_manager_base.h"
  46 #include "content/public/browser/browser_thread.h"
  47 #include "content/public/browser/user_metrics.h"
  48 #include "google_apis/gaia/google_service_auth_error.h"
  49 #include "ui/base/l10n/l10n_util.h"
  50
  51 #if defined(OS_CHROMEOS)
  52 #include "chrome/browser/chromeos/login/users/chrome_user_manager.h"
  53 #include "chrome/browser/chromeos/login/users/supervised_user_manager.h"
  54 #include "components/user_manager/user_manager.h"
  55 #endif
  56
  57 #if defined(ENABLE_EXTENSIONS)
  58 #include "chrome/browser/extensions/extension_service.h"
  59 #include "chrome/common/extensions/api/supervised_user_private/supervised_user_handler.h"
  60 #include "extensions/browser/extension_registry.h"
  61 #include "extensions/browser/extension_system.h"
  62 #include "extensions/common/extension_set.h"
  63 #endif
  64
  65 #if defined(ENABLE_THEMES)
  66 #include "chrome/browser/themes/theme_service.h"
  67 #include "chrome/browser/themes/theme_service_factory.h"
  68 #endif
  69
  70 using base::DictionaryValue;
  71 using base::UserMetricsAction;
  72 using content::BrowserThread;
  73
  74 SupervisedUserService::URLFilterContext::URLFilterContext()
  75     : ui_url_filter_(new SupervisedUserURLFilter),
  76       io_url_filter_(new SupervisedUserURLFilter) {}
  77 SupervisedUserService::URLFilterContext::~URLFilterContext() {}
  78
  79 SupervisedUserURLFilter*
  80 SupervisedUserService::URLFilterContext::ui_url_filter() const {
  81   return ui_url_filter_.get();
  82 }
  83
  84 SupervisedUserURLFilter*
  85 SupervisedUserService::URLFilterContext::io_url_filter() const {
  86   return io_url_filter_.get();
  87 }
  88
  89 void SupervisedUserService::URLFilterContext::SetDefaultFilteringBehavior(
  90     SupervisedUserURLFilter::FilteringBehavior behavior) {
  91   ui_url_filter_->SetDefaultFilteringBehavior(behavior);
  92   BrowserThread::PostTask(
  93       BrowserThread::IO,
  94       FROM_HERE,
  95       base::Bind(&SupervisedUserURLFilter::SetDefaultFilteringBehavior,
  96                  io_url_filter_.get(), behavior));
  97 }
  98
  99 void SupervisedUserService::URLFilterContext::LoadWhitelists(
 100     ScopedVector<SupervisedUserSiteList> site_lists) {
 101   // SupervisedUserURLFilter::LoadWhitelists takes ownership of |site_lists|,
 102   // so we make an additional copy of it.
 103   /// TODO(bauerb): This is kinda ugly.
 104   ScopedVector<SupervisedUserSiteList> site_lists_copy;
 105   for (ScopedVector<SupervisedUserSiteList>::iterator it = site_lists.begin();
 106        it != site_lists.end(); ++it) {
 107     site_lists_copy.push_back((*it)->Clone());
 108   }
 109   ui_url_filter_->LoadWhitelists(site_lists.Pass());
 110   BrowserThread::PostTask(
 111       BrowserThread::IO,
 112       FROM_HERE,
 113       base::Bind(&SupervisedUserURLFilter::LoadWhitelists,
 114                  io_url_filter_, base::Passed(&site_lists_copy)));
 115 }
 116
 117 void SupervisedUserService::URLFilterContext::LoadBlacklist(
 118     const base::FilePath& path) {
 119   // For now, support loading only once. If we want to support re-load, we'll
 120   // have to clear the blacklist pointer in the url filters first.
 121   DCHECK_EQ(0u, blacklist_.GetEntryCount());
 122   blacklist_.ReadFromFile(
 123       path,
 124       base::Bind(&SupervisedUserService::URLFilterContext::OnBlacklistLoaded,
 125                  base::Unretained(this)));
 126 }
 127
 128 void SupervisedUserService::URLFilterContext::SetManualHosts(
 129     scoped_ptr<std::map<std::string, bool> > host_map) {
 130   ui_url_filter_->SetManualHosts(host_map.get());
 131   BrowserThread::PostTask(
 132       BrowserThread::IO,
 133       FROM_HERE,
 134       base::Bind(&SupervisedUserURLFilter::SetManualHosts,
 135                  io_url_filter_, base::Owned(host_map.release())));
 136 }
 137
 138 void SupervisedUserService::URLFilterContext::SetManualURLs(
 139     scoped_ptr<std::map<GURL, bool> > url_map) {
 140   ui_url_filter_->SetManualURLs(url_map.get());
 141   BrowserThread::PostTask(
 142       BrowserThread::IO,
 143       FROM_HERE,
 144       base::Bind(&SupervisedUserURLFilter::SetManualURLs,
 145                  io_url_filter_, base::Owned(url_map.release())));
 146 }
 147
 148 void SupervisedUserService::URLFilterContext::OnBlacklistLoaded() {
 149   ui_url_filter_->SetBlacklist(&blacklist_);
 150   BrowserThread::PostTask(
 151       BrowserThread::IO,
 152       FROM_HERE,
 153       base::Bind(&SupervisedUserURLFilter::SetBlacklist,
 154                  io_url_filter_,
 155                  &blacklist_));
 156 }
 157
 158 SupervisedUserService::SupervisedUserService(Profile* profile)
 159     : profile_(profile),
 160       active_(false),
 161       delegate_(NULL),
 162 #if defined(ENABLE_EXTENSIONS)
 163       extension_registry_observer_(this),
 164 #endif
 165       waiting_for_sync_initialization_(false),
 166       is_profile_active_(false),
 167       elevated_for_testing_(false),
 168       did_init_(false),
 169       did_shutdown_(false),
 170       weak_ptr_factory_(this) {
 171 }
 172
 173 SupervisedUserService::~SupervisedUserService() {
 174   DCHECK(!did_init_ || did_shutdown_);
 175 }
 176
 177 void SupervisedUserService::Shutdown() {
 178   if (!did_init_)
 179     return;
 180   DCHECK(!did_shutdown_);
 181   did_shutdown_ = true;
 182   if (ProfileIsSupervised()) {
 183     content::RecordAction(UserMetricsAction("ManagedUsers_QuitBrowser"));
 184   }
 185   SetActive(false);
 186
 187   ProfileSyncService* sync_service =
 188       ProfileSyncServiceFactory::GetForProfile(profile_);
 189   // Can be null in tests.
 190   if (sync_service)
 191     sync_service->RemovePreferenceProvider(this);
 192 }
 193
 194 bool SupervisedUserService::ProfileIsSupervised() const {
 195   return profile_->IsSupervised();
 196 }
 197
 198 void SupervisedUserService::OnCustodianInfoChanged() {
 199   FOR_EACH_OBSERVER(
 200       SupervisedUserServiceObserver, observer_list_, OnCustodianInfoChanged());
 201 }
 202
 203 // static
 204 void SupervisedUserService::RegisterProfilePrefs(
 205     user_prefs::PrefRegistrySyncable* registry) {
 206   registry->RegisterDictionaryPref(
 207       prefs::kSupervisedUserManualHosts,
 208       user_prefs::PrefRegistrySyncable::UNSYNCABLE_PREF);
 209   registry->RegisterDictionaryPref(
 210       prefs::kSupervisedUserManualURLs,
 211       user_prefs::PrefRegistrySyncable::UNSYNCABLE_PREF);
 212   registry->RegisterIntegerPref(
 213       prefs::kDefaultSupervisedUserFilteringBehavior,
 214       SupervisedUserURLFilter::ALLOW,
 215       user_prefs::PrefRegistrySyncable::UNSYNCABLE_PREF);
 216   registry->RegisterStringPref(
 217       prefs::kSupervisedUserCustodianEmail, std::string(),
 218       user_prefs::PrefRegistrySyncable::UNSYNCABLE_PREF);
 219   registry->RegisterStringPref(
 220       prefs::kSupervisedUserCustodianName, std::string(),
 221       user_prefs::PrefRegistrySyncable::UNSYNCABLE_PREF);
 222   registry->RegisterStringPref(
 223       prefs::kSupervisedUserCustodianProfileImageURL, std::string(),
 224       user_prefs::PrefRegistrySyncable::UNSYNCABLE_PREF);
 225   registry->RegisterStringPref(
 226       prefs::kSupervisedUserCustodianProfileURL, std::string(),
 227       user_prefs::PrefRegistrySyncable::UNSYNCABLE_PREF);
 228   registry->RegisterStringPref(
 229       prefs::kSupervisedUserSecondCustodianEmail, std::string(),
 230       user_prefs::PrefRegistrySyncable::UNSYNCABLE_PREF);
 231   registry->RegisterStringPref(
 232       prefs::kSupervisedUserSecondCustodianName, std::string(),
 233       user_prefs::PrefRegistrySyncable::UNSYNCABLE_PREF);
 234   registry->RegisterStringPref(
 235       prefs::kSupervisedUserSecondCustodianProfileImageURL, std::string(),
 236       user_prefs::PrefRegistrySyncable::UNSYNCABLE_PREF);
 237   registry->RegisterStringPref(
 238       prefs::kSupervisedUserSecondCustodianProfileURL, std::string(),
 239       user_prefs::PrefRegistrySyncable::UNSYNCABLE_PREF);
 240   registry->RegisterBooleanPref(prefs::kSupervisedUserCreationAllowed, true,
 241       user_prefs::PrefRegistrySyncable::UNSYNCABLE_PREF);
 242 }
 243
 244 void SupervisedUserService::SetDelegate(Delegate* delegate) {
 245   if (delegate) {
 246     // Changing delegates isn't allowed.
 247     DCHECK(!delegate_);
 248   } else {
 249     // If the delegate is removed, deactivate first to give the old delegate a
 250     // chance to clean up.
 251     SetActive(false);
 252   }
 253   delegate_ = delegate;
 254 }
 255
 256 scoped_refptr<const SupervisedUserURLFilter>
 257 SupervisedUserService::GetURLFilterForIOThread() {
 258   return url_filter_context_.io_url_filter();
 259 }
 260
 261 SupervisedUserURLFilter* SupervisedUserService::GetURLFilterForUIThread() {
 262   return url_filter_context_.ui_url_filter();
 263 }
 264
 265 // Items not on any list must return -1 (CATEGORY_NOT_ON_LIST in history.js).
 266 // Items on a list, but with no category, must return 0 (CATEGORY_OTHER).
 267 #define CATEGORY_NOT_ON_LIST -1;
 268 #define CATEGORY_OTHER 0;
 269
 270 int SupervisedUserService::GetCategory(const GURL& url) {
 271   std::vector<SupervisedUserSiteList::Site*> sites;
 272   GetURLFilterForUIThread()->GetSites(url, &sites);
 273   if (sites.empty())
 274     return CATEGORY_NOT_ON_LIST;
 275
 276   return (*sites.begin())->category_id;
 277 }
 278
 279 // static
 280 void SupervisedUserService::GetCategoryNames(CategoryList* list) {
 281   SupervisedUserSiteList::GetCategoryNames(list);
 282 }
 283
 284 std::string SupervisedUserService::GetCustodianEmailAddress() const {
 285 #if defined(OS_CHROMEOS)
 286   return chromeos::ChromeUserManager::Get()
 287       ->GetSupervisedUserManager()
 288       ->GetManagerDisplayEmail(
 289           user_manager::UserManager::Get()->GetActiveUser()->email());
 290 #else
 291   return profile_->GetPrefs()->GetString(prefs::kSupervisedUserCustodianEmail);
 292 #endif
 293 }
 294
 295 std::string SupervisedUserService::GetCustodianName() const {
 296 #if defined(OS_CHROMEOS)
 297   return base::UTF16ToUTF8(
 298       chromeos::ChromeUserManager::Get()
 299           ->GetSupervisedUserManager()
 300           ->GetManagerDisplayName(
 301               user_manager::UserManager::Get()->GetActiveUser()->email()));
 302 #else
 303   std::string name = profile_->GetPrefs()->GetString(
 304       prefs::kSupervisedUserCustodianName);
 305   return name.empty() ? GetCustodianEmailAddress() : name;
 306 #endif
 307 }
 308
 309 void SupervisedUserService::AddNavigationBlockedCallback(
 310     const NavigationBlockedCallback& callback) {
 311   navigation_blocked_callbacks_.push_back(callback);
 312 }
 313
 314 void SupervisedUserService::DidBlockNavigation(
 315     content::WebContents* web_contents) {
 316   for (std::vector<NavigationBlockedCallback>::iterator it =
 317            navigation_blocked_callbacks_.begin();
 318        it != navigation_blocked_callbacks_.end(); ++it) {
 319     it->Run(web_contents);
 320   }
 321 }
 322
 323 void SupervisedUserService::AddObserver(
 324     SupervisedUserServiceObserver* observer) {
 325   observer_list_.AddObserver(observer);
 326 }
 327
 328 void SupervisedUserService::RemoveObserver(
 329     SupervisedUserServiceObserver* observer) {
 330   observer_list_.RemoveObserver(observer);
 331 }
 332
 333 #if defined(ENABLE_EXTENSIONS)
 334 std::string SupervisedUserService::GetDebugPolicyProviderName() const {
 335   // Save the string space in official builds.
 336 #ifdef NDEBUG
 337   NOTREACHED();
 338   return std::string();
 339 #else
 340   return "Supervised User Service";
 341 #endif
 342 }
 343
 344 bool SupervisedUserService::UserMayLoad(const extensions::Extension* extension,
 345                                         base::string16* error) const {
 346   base::string16 tmp_error;
 347   if (ExtensionManagementPolicyImpl(extension, &tmp_error))
 348     return true;
 349
 350   bool was_installed_by_default = extension->was_installed_by_default();
 351   bool was_installed_by_custodian = extension->was_installed_by_custodian();
 352 #if defined(OS_CHROMEOS)
 353   // On Chrome OS all external sources are controlled by us so it means that
 354   // they are "default". Method was_installed_by_default returns false because
 355   // extensions creation flags are ignored in case of default extensions with
 356   // update URL(the flags aren't passed to OnExternalExtensionUpdateUrlFound).
 357   // TODO(dpolukhin): remove this Chrome OS specific code as soon as creation
 358   // flags are not ignored.
 359   was_installed_by_default =
 360       extensions::Manifest::IsExternalLocation(extension->location());
 361 #endif
 362   if (extensions::Manifest::IsComponentLocation(extension->location()) ||
 363       was_installed_by_default ||
 364       was_installed_by_custodian) {
 365     return true;
 366   }
 367
 368   if (error)
 369     *error = tmp_error;
 370   return false;
 371 }
 372
 373 bool SupervisedUserService::UserMayModifySettings(
 374     const extensions::Extension* extension,
 375     base::string16* error) const {
 376   return ExtensionManagementPolicyImpl(extension, error);
 377 }
 378
 379 void SupervisedUserService::OnExtensionLoaded(
 380     content::BrowserContext* browser_context,
 381     const extensions::Extension* extension) {
 382   if (!extensions::SupervisedUserInfo::GetContentPackSiteList(extension)
 383            .empty()) {
 384     UpdateSiteLists();
 385   }
 386 }
 387 void SupervisedUserService::OnExtensionUnloaded(
 388     content::BrowserContext* browser_context,
 389     const extensions::Extension* extension,
 390     extensions::UnloadedExtensionInfo::Reason reason) {
 391   if (!extensions::SupervisedUserInfo::GetContentPackSiteList(extension)
 392            .empty()) {
 393     UpdateSiteLists();
 394   }
 395 }
 396 #endif  // defined(ENABLE_EXTENSIONS)
 397
 398 syncer::ModelTypeSet SupervisedUserService::GetPreferredDataTypes() const {
 399   if (!ProfileIsSupervised())
 400     return syncer::ModelTypeSet();
 401
 402   syncer::ModelTypeSet result;
 403   result.Put(syncer::SESSIONS);
 404   result.Put(syncer::EXTENSIONS);
 405   result.Put(syncer::EXTENSION_SETTINGS);
 406   result.Put(syncer::APPS);
 407   result.Put(syncer::APP_SETTINGS);
 408   result.Put(syncer::APP_NOTIFICATIONS);
 409   result.Put(syncer::APP_LIST);
 410   return result;
 411 }
 412
 413 void SupervisedUserService::OnStateChanged() {
 414   ProfileSyncService* service =
 415       ProfileSyncServiceFactory::GetForProfile(profile_);
 416   if (waiting_for_sync_initialization_ && service->sync_initialized() &&
 417       service->backend_mode() == ProfileSyncService::SYNC) {
 418     waiting_for_sync_initialization_ = false;
 419     service->RemoveObserver(this);
 420     FinishSetupSync();
 421     return;
 422   }
 423
 424   DLOG_IF(ERROR, service->GetAuthError().state() ==
 425                      GoogleServiceAuthError::INVALID_GAIA_CREDENTIALS)
 426       << "Credentials rejected";
 427 }
 428
 429 void SupervisedUserService::SetupSync() {
 430   StartSetupSync();
 431   FinishSetupSyncWhenReady();
 432 }
 433
 434 void SupervisedUserService::StartSetupSync() {
 435   // Tell the sync service that setup is in progress so we don't start syncing
 436   // until we've finished configuration.
 437   ProfileSyncServiceFactory::GetForProfile(profile_)->SetSetupInProgress(true);
 438 }
 439
 440 void SupervisedUserService::FinishSetupSyncWhenReady() {
 441   // If we're already waiting for the Sync backend, there's nothing to do here.
 442   if (waiting_for_sync_initialization_)
 443     return;
 444
 445   // Continue in FinishSetupSync() once the Sync backend has been initialized.
 446   ProfileSyncService* service =
 447       ProfileSyncServiceFactory::GetForProfile(profile_);
 448   if (service->sync_initialized() &&
 449       service->backend_mode() == ProfileSyncService::SYNC) {
 450     FinishSetupSync();
 451   } else {
 452     service->AddObserver(this);
 453     waiting_for_sync_initialization_ = true;
 454   }
 455 }
 456
 457 void SupervisedUserService::FinishSetupSync() {
 458   ProfileSyncService* service =
 459       ProfileSyncServiceFactory::GetForProfile(profile_);
 460   DCHECK(service->sync_initialized() &&
 461          service->backend_mode() == ProfileSyncService::SYNC);
 462
 463   // Sync nothing (except types which are set via GetPreferredDataTypes).
 464   bool sync_everything = false;
 465   syncer::ModelTypeSet synced_datatypes;
 466   service->OnUserChoseDatatypes(sync_everything, synced_datatypes);
 467
 468   // Notify ProfileSyncService that we are done with configuration.
 469   service->SetSetupInProgress(false);
 470   service->SetSyncSetupCompleted();
 471 }
 472
 473 #if defined(ENABLE_EXTENSIONS)
 474 bool SupervisedUserService::ExtensionManagementPolicyImpl(
 475     const extensions::Extension* extension,
 476     base::string16* error) const {
 477   // |extension| can be NULL in unit_tests.
 478   if (!ProfileIsSupervised() || (extension && extension->is_theme()))
 479     return true;
 480
 481   if (elevated_for_testing_)
 482     return true;
 483
 484   if (error)
 485     *error = l10n_util::GetStringUTF16(IDS_EXTENSIONS_LOCKED_SUPERVISED_USER);
 486   return false;
 487 }
 488
 489 ScopedVector<SupervisedUserSiteList>
 490 SupervisedUserService::GetActiveSiteLists() {
 491   ScopedVector<SupervisedUserSiteList> site_lists;
 492   ExtensionService* extension_service =
 493       extensions::ExtensionSystem::Get(profile_)->extension_service();
 494   // Can be NULL in unit tests.
 495   if (!extension_service)
 496     return site_lists.Pass();
 497
 498   const extensions::ExtensionSet* extensions = extension_service->extensions();
 499   for (extensions::ExtensionSet::const_iterator it = extensions->begin();
 500        it != extensions->end(); ++it) {
 501     const extensions::Extension* extension = it->get();
 502     if (!extension_service->IsExtensionEnabled(extension->id()))
 503       continue;
 504
 505     extensions::ExtensionResource site_list =
 506         extensions::SupervisedUserInfo::GetContentPackSiteList(extension);
 507     if (!site_list.empty()) {
 508       site_lists.push_back(new SupervisedUserSiteList(extension->id(),
 509                                                       site_list.GetFilePath()));
 510     }
 511   }
 512
 513   return site_lists.Pass();
 514 }
 515
 516 void SupervisedUserService::SetExtensionsActive() {
 517   extensions::ExtensionSystem* extension_system =
 518       extensions::ExtensionSystem::Get(profile_);
 519   extensions::ManagementPolicy* management_policy =
 520       extension_system->management_policy();
 521
 522   if (active_) {
 523     if (management_policy)
 524       management_policy->RegisterProvider(this);
 525
 526     extension_registry_observer_.Add(
 527         extensions::ExtensionRegistry::Get(profile_));
 528   } else {
 529     if (management_policy)
 530       management_policy->UnregisterProvider(this);
 531
 532     extension_registry_observer_.RemoveAll();
 533   }
 534 }
 535 #endif  // defined(ENABLE_EXTENSIONS)
 536
 537 SupervisedUserSettingsService* SupervisedUserService::GetSettingsService() {
 538   return SupervisedUserSettingsServiceFactory::GetForProfile(profile_);
 539 }
 540
 541 void SupervisedUserService::OnSupervisedUserIdChanged() {
 542   std::string supervised_user_id =
 543       profile_->GetPrefs()->GetString(prefs::kSupervisedUserId);
 544   SetActive(!supervised_user_id.empty());
 545 }
 546
 547 void SupervisedUserService::OnDefaultFilteringBehaviorChanged() {
 548   DCHECK(ProfileIsSupervised());
 549
 550   int behavior_value = profile_->GetPrefs()->GetInteger(
 551       prefs::kDefaultSupervisedUserFilteringBehavior);
 552   SupervisedUserURLFilter::FilteringBehavior behavior =
 553       SupervisedUserURLFilter::BehaviorFromInt(behavior_value);
 554   url_filter_context_.SetDefaultFilteringBehavior(behavior);
 555
 556   FOR_EACH_OBSERVER(
 557       SupervisedUserServiceObserver, observer_list_, OnURLFilterChanged());
 558 }
 559
 560 void SupervisedUserService::UpdateSiteLists() {
 561 #if defined(ENABLE_EXTENSIONS)
 562   url_filter_context_.LoadWhitelists(GetActiveSiteLists());
 563
 564   FOR_EACH_OBSERVER(
 565       SupervisedUserServiceObserver, observer_list_, OnURLFilterChanged());
 566 #endif
 567 }
 568
 569 void SupervisedUserService::LoadBlacklist(const base::FilePath& path,
 570                                           const GURL& url) {
 571   if (!url.is_valid()) {
 572     LoadBlacklistFromFile(path);
 573     return;
 574   }
 575
 576   DCHECK(!blacklist_downloader_.get());
 577   blacklist_downloader_.reset(new SupervisedUserBlacklistDownloader(
 578       url,
 579       path,
 580       profile_->GetRequestContext(),
 581       base::Bind(&SupervisedUserService::OnBlacklistDownloadDone,
 582                  base::Unretained(this), path)));
 583 }
 584
 585 void SupervisedUserService::LoadBlacklistFromFile(const base::FilePath& path) {
 586   url_filter_context_.LoadBlacklist(path);
 587
 588   FOR_EACH_OBSERVER(
 589       SupervisedUserServiceObserver, observer_list_, OnURLFilterChanged());
 590 }
 591
 592 void SupervisedUserService::OnBlacklistDownloadDone(const base::FilePath& path,
 593                                                     bool success) {
 594   if (success) {
 595     LoadBlacklistFromFile(path);
 596   } else {
 597     LOG(WARNING) << "Blacklist download failed";
 598   }
 599   blacklist_downloader_.reset();
 600 }
 601
 602 bool SupervisedUserService::AccessRequestsEnabled() {
 603   ProfileSyncService* service =
 604       ProfileSyncServiceFactory::GetForProfile(profile_);
 605   GoogleServiceAuthError::State state = service->GetAuthError().state();
 606   // We allow requesting access if Sync is working or has a transient error.
 607   return (state == GoogleServiceAuthError::NONE ||
 608           state == GoogleServiceAuthError::CONNECTION_FAILED ||
 609           state == GoogleServiceAuthError::SERVICE_UNAVAILABLE);
 610 }
 611
 612 void SupervisedUserService::OnPermissionRequestIssued() {
 613   // TODO(akuegel): Figure out how to show the result of issuing the permission
 614   // request in the UI. Currently, we assume the permission request was created
 615   // successfully.
 616 }
 617
 618 void SupervisedUserService::AddAccessRequest(const GURL& url) {
 619   permissions_creator_->CreatePermissionRequest(
 620       SupervisedUserURLFilter::Normalize(url),
 621       base::Bind(&SupervisedUserService::OnPermissionRequestIssued,
 622                  weak_ptr_factory_.GetWeakPtr()));
 623 }
 624
 625 SupervisedUserService::ManualBehavior
 626 SupervisedUserService::GetManualBehaviorForHost(
 627     const std::string& hostname) {
 628   const base::DictionaryValue* dict =
 629       profile_->GetPrefs()->GetDictionary(prefs::kSupervisedUserManualHosts);
 630   bool allow = false;
 631   if (!dict->GetBooleanWithoutPathExpansion(hostname, &allow))
 632     return MANUAL_NONE;
 633
 634   return allow ? MANUAL_ALLOW : MANUAL_BLOCK;
 635 }
 636
 637 SupervisedUserService::ManualBehavior
 638 SupervisedUserService::GetManualBehaviorForURL(
 639     const GURL& url) {
 640   const base::DictionaryValue* dict =
 641       profile_->GetPrefs()->GetDictionary(prefs::kSupervisedUserManualURLs);
 642   GURL normalized_url = SupervisedUserURLFilter::Normalize(url);
 643   bool allow = false;
 644   if (!dict->GetBooleanWithoutPathExpansion(normalized_url.spec(), &allow))
 645     return MANUAL_NONE;
 646
 647   return allow ? MANUAL_ALLOW : MANUAL_BLOCK;
 648 }
 649
 650 void SupervisedUserService::GetManualExceptionsForHost(
 651     const std::string& host,
 652     std::vector<GURL>* urls) {
 653   const base::DictionaryValue* dict =
 654       profile_->GetPrefs()->GetDictionary(prefs::kSupervisedUserManualURLs);
 655   for (base::DictionaryValue::Iterator it(*dict); !it.IsAtEnd(); it.Advance()) {
 656     GURL url(it.key());
 657     if (url.host() == host)
 658       urls->push_back(url);
 659   }
 660 }
 661
 662 void SupervisedUserService::InitSync(const std::string& refresh_token) {
 663   StartSetupSync();
 664
 665   ProfileOAuth2TokenService* token_service =
 666       ProfileOAuth2TokenServiceFactory::GetForProfile(profile_);
 667   token_service->UpdateCredentials(supervised_users::kSupervisedUserPseudoEmail,
 668                                    refresh_token);
 669
 670   FinishSetupSyncWhenReady();
 671 }
 672
 673 void SupervisedUserService::Init() {
 674   DCHECK(!did_init_);
 675   did_init_ = true;
 676   DCHECK(GetSettingsService()->IsReady());
 677
 678   pref_change_registrar_.Init(profile_->GetPrefs());
 679   pref_change_registrar_.Add(
 680       prefs::kSupervisedUserId,
 681       base::Bind(&SupervisedUserService::OnSupervisedUserIdChanged,
 682           base::Unretained(this)));
 683
 684   ProfileSyncService* sync_service =
 685       ProfileSyncServiceFactory::GetForProfile(profile_);
 686   // Can be null in tests.
 687   if (sync_service)
 688     sync_service->AddPreferenceProvider(this);
 689
 690   SetActive(ProfileIsSupervised());
 691 }
 692
 693 void SupervisedUserService::SetActive(bool active) {
 694   if (active_ == active)
 695     return;
 696   active_ = active;
 697
 698   if (!delegate_ || !delegate_->SetActive(active_)) {
 699     if (active_) {
 700       SupervisedUserPrefMappingServiceFactory::GetForBrowserContext(profile_)
 701           ->Init();
 702
 703       CommandLine* command_line = CommandLine::ForCurrentProcess();
 704       if (command_line->HasSwitch(switches::kSupervisedUserSyncToken)) {
 705         InitSync(
 706             command_line->GetSwitchValueASCII(
 707                 switches::kSupervisedUserSyncToken));
 708       }
 709
 710       ProfileOAuth2TokenService* token_service =
 711           ProfileOAuth2TokenServiceFactory::GetForProfile(profile_);
 712       token_service->LoadCredentials(
 713           supervised_users::kSupervisedUserPseudoEmail);
 714
 715       SetupSync();
 716     }
 717   }
 718
 719   // Now activate/deactivate anything not handled by the delegate yet.
 720
 721 #if defined(ENABLE_THEMES)
 722   // Re-set the default theme to turn the SU theme on/off.
 723   ThemeService* theme_service = ThemeServiceFactory::GetForProfile(profile_);
 724   if (theme_service->UsingDefaultTheme() || theme_service->UsingSystemTheme()) {
 725     ThemeServiceFactory::GetForProfile(profile_)->UseDefaultTheme();
 726   }
 727 #endif
 728
 729   ProfileSyncService* sync_service =
 730       ProfileSyncServiceFactory::GetForProfile(profile_);
 731   sync_service->SetEncryptEverythingAllowed(!active_);
 732
 733   SupervisedUserSettingsService* settings_service = GetSettingsService();
 734   settings_service->SetActive(active_);
 735
 736 #if defined(ENABLE_EXTENSIONS)
 737   SetExtensionsActive();
 738 #endif
 739
 740   if (active_) {
 741     if (CommandLine::ForCurrentProcess()->HasSwitch(
 742             switches::kPermissionRequestApiUrl)) {
 743       permissions_creator_ =
 744           PermissionRequestCreatorApiary::CreateWithProfile(profile_);
 745     } else {
 746       PrefService* pref_service = profile_->GetPrefs();
 747       permissions_creator_.reset(new PermissionRequestCreatorSync(
 748           settings_service,
 749           SupervisedUserSharedSettingsServiceFactory::GetForBrowserContext(
 750               profile_),
 751           GetSupervisedUserName(),
 752           pref_service->GetString(prefs::kSupervisedUserId)));
 753     }
 754
 755     pref_change_registrar_.Add(
 756         prefs::kDefaultSupervisedUserFilteringBehavior,
 757         base::Bind(&SupervisedUserService::OnDefaultFilteringBehaviorChanged,
 758             base::Unretained(this)));
 759     pref_change_registrar_.Add(prefs::kSupervisedUserManualHosts,
 760         base::Bind(&SupervisedUserService::UpdateManualHosts,
 761                    base::Unretained(this)));
 762     pref_change_registrar_.Add(prefs::kSupervisedUserManualURLs,
 763         base::Bind(&SupervisedUserService::UpdateManualURLs,
 764                    base::Unretained(this)));
 765     pref_change_registrar_.Add(prefs::kSupervisedUserCustodianName,
 766         base::Bind(&SupervisedUserService::OnCustodianInfoChanged,
 767                    base::Unretained(this)));
 768     pref_change_registrar_.Add(prefs::kSupervisedUserCustodianEmail,
 769         base::Bind(&SupervisedUserService::OnCustodianInfoChanged,
 770                    base::Unretained(this)));
 771     pref_change_registrar_.Add(prefs::kSupervisedUserCustodianProfileImageURL,
 772         base::Bind(&SupervisedUserService::OnCustodianInfoChanged,
 773                    base::Unretained(this)));
 774     pref_change_registrar_.Add(prefs::kSupervisedUserCustodianProfileURL,
 775         base::Bind(&SupervisedUserService::OnCustodianInfoChanged,
 776                    base::Unretained(this)));
 777     pref_change_registrar_.Add(prefs::kSupervisedUserSecondCustodianName,
 778         base::Bind(&SupervisedUserService::OnCustodianInfoChanged,
 779                    base::Unretained(this)));
 780     pref_change_registrar_.Add(prefs::kSupervisedUserSecondCustodianEmail,
 781         base::Bind(&SupervisedUserService::OnCustodianInfoChanged,
 782                    base::Unretained(this)));
 783     pref_change_registrar_.Add(
 784         prefs::kSupervisedUserSecondCustodianProfileImageURL,
 785         base::Bind(&SupervisedUserService::OnCustodianInfoChanged,
 786                    base::Unretained(this)));
 787     pref_change_registrar_.Add(prefs::kSupervisedUserSecondCustodianProfileURL,
 788         base::Bind(&SupervisedUserService::OnCustodianInfoChanged,
 789                    base::Unretained(this)));
 790
 791     // Initialize the filter.
 792     OnDefaultFilteringBehaviorChanged();
 793     UpdateSiteLists();
 794     UpdateManualHosts();
 795     UpdateManualURLs();
 796     bool use_blacklist =
 797         CommandLine::ForCurrentProcess()->HasSwitch(
 798             switches::kEnableSupervisedUserBlacklist);
 799     if (delegate_ && use_blacklist) {
 800       base::FilePath blacklist_path = delegate_->GetBlacklistPath();
 801       if (!blacklist_path.empty())
 802         LoadBlacklist(blacklist_path, delegate_->GetBlacklistURL());
 803     }
 804
 805 #if !defined(OS_ANDROID)
 806     // TODO(bauerb): Get rid of the platform-specific #ifdef here.
 807     // http://crbug.com/313377
 808     BrowserList::AddObserver(this);
 809 #endif
 810   } else {
 811     permissions_creator_.reset();
 812
 813     pref_change_registrar_.Remove(
 814         prefs::kDefaultSupervisedUserFilteringBehavior);
 815     pref_change_registrar_.Remove(prefs::kSupervisedUserManualHosts);
 816     pref_change_registrar_.Remove(prefs::kSupervisedUserManualURLs);
 817
 818     if (waiting_for_sync_initialization_)
 819       ProfileSyncServiceFactory::GetForProfile(profile_)->RemoveObserver(this);
 820
 821 #if !defined(OS_ANDROID)
 822     // TODO(bauerb): Get rid of the platform-specific #ifdef here.
 823     // http://crbug.com/313377
 824     BrowserList::RemoveObserver(this);
 825 #endif
 826   }
 827 }
 828
 829 void SupervisedUserService::RegisterAndInitSync(
 830     SupervisedUserRegistrationUtility* registration_utility,
 831     Profile* custodian_profile,
 832     const std::string& supervised_user_id,
 833     const AuthErrorCallback& callback) {
 834   DCHECK(ProfileIsSupervised());
 835   DCHECK(!custodian_profile->IsSupervised());
 836
 837   base::string16 name = base::UTF8ToUTF16(
 838       profile_->GetPrefs()->GetString(prefs::kProfileName));
 839   int avatar_index = profile_->GetPrefs()->GetInteger(
 840       prefs::kProfileAvatarIndex);
 841   SupervisedUserRegistrationInfo info(name, avatar_index);
 842   registration_utility->Register(
 843       supervised_user_id,
 844       info,
 845       base::Bind(&SupervisedUserService::OnSupervisedUserRegistered,
 846                  weak_ptr_factory_.GetWeakPtr(), callback, custodian_profile));
 847
 848   // Fetch the custodian's profile information, to store the name.
 849   // TODO(pamg): If --google-profile-info (flag: switches::kGoogleProfileInfo)
 850   // is ever enabled, take the name from the ProfileInfoCache instead.
 851   CustodianProfileDownloaderService* profile_downloader_service =
 852       CustodianProfileDownloaderServiceFactory::GetForProfile(
 853           custodian_profile);
 854   profile_downloader_service->DownloadProfile(
 855       base::Bind(&SupervisedUserService::OnCustodianProfileDownloaded,
 856                  weak_ptr_factory_.GetWeakPtr()));
 857 }
 858
 859 void SupervisedUserService::OnCustodianProfileDownloaded(
 860     const base::string16& full_name) {
 861   profile_->GetPrefs()->SetString(prefs::kSupervisedUserCustodianName,
 862                                   base::UTF16ToUTF8(full_name));
 863 }
 864
 865 void SupervisedUserService::OnSupervisedUserRegistered(
 866     const AuthErrorCallback& callback,
 867     Profile* custodian_profile,
 868     const GoogleServiceAuthError& auth_error,
 869     const std::string& token) {
 870   if (auth_error.state() == GoogleServiceAuthError::NONE) {
 871     InitSync(token);
 872     SigninManagerBase* signin =
 873         SigninManagerFactory::GetForProfile(custodian_profile);
 874     profile_->GetPrefs()->SetString(prefs::kSupervisedUserCustodianEmail,
 875                                     signin->GetAuthenticatedUsername());
 876
 877     // The supervised user profile is now ready for use.
 878     ProfileManager* profile_manager = g_browser_process->profile_manager();
 879     ProfileInfoCache& cache = profile_manager->GetProfileInfoCache();
 880     size_t index = cache.GetIndexOfProfileWithPath(profile_->GetPath());
 881     cache.SetIsOmittedProfileAtIndex(index, false);
 882   } else {
 883     DCHECK_EQ(std::string(), token);
 884   }
 885
 886   callback.Run(auth_error);
 887 }
 888
 889 void SupervisedUserService::UpdateManualHosts() {
 890   const base::DictionaryValue* dict =
 891       profile_->GetPrefs()->GetDictionary(prefs::kSupervisedUserManualHosts);
 892   scoped_ptr<std::map<std::string, bool> > host_map(
 893       new std::map<std::string, bool>());
 894   for (base::DictionaryValue::Iterator it(*dict); !it.IsAtEnd(); it.Advance()) {
 895     bool allow = false;
 896     bool result = it.value().GetAsBoolean(&allow);
 897     DCHECK(result);
 898     (*host_map)[it.key()] = allow;
 899   }
 900   url_filter_context_.SetManualHosts(host_map.Pass());
 901
 902   FOR_EACH_OBSERVER(
 903       SupervisedUserServiceObserver, observer_list_, OnURLFilterChanged());
 904 }
 905
 906 void SupervisedUserService::UpdateManualURLs() {
 907   const base::DictionaryValue* dict =
 908       profile_->GetPrefs()->GetDictionary(prefs::kSupervisedUserManualURLs);
 909   scoped_ptr<std::map<GURL, bool> > url_map(new std::map<GURL, bool>());
 910   for (base::DictionaryValue::Iterator it(*dict); !it.IsAtEnd(); it.Advance()) {
 911     bool allow = false;
 912     bool result = it.value().GetAsBoolean(&allow);
 913     DCHECK(result);
 914     (*url_map)[GURL(it.key())] = allow;
 915   }
 916   url_filter_context_.SetManualURLs(url_map.Pass());
 917
 918   FOR_EACH_OBSERVER(
 919       SupervisedUserServiceObserver, observer_list_, OnURLFilterChanged());
 920 }
 921
 922 void SupervisedUserService::OnBrowserSetLastActive(Browser* browser) {
 923   bool profile_became_active = profile_->IsSameProfile(browser->profile());
 924   if (!is_profile_active_ && profile_became_active)
 925     content::RecordAction(UserMetricsAction("ManagedUsers_OpenProfile"));
 926   else if (is_profile_active_ && !profile_became_active)
 927     content::RecordAction(UserMetricsAction("ManagedUsers_SwitchProfile"));
 928
 929   is_profile_active_ = profile_became_active;
 930 }
 931
 932 std::string SupervisedUserService::GetSupervisedUserName() const {
 933 #if defined(OS_CHROMEOS)
 934   // The active user can be NULL in unit tests.
 935   if (user_manager::UserManager::Get()->GetActiveUser()) {
 936     return UTF16ToUTF8(user_manager::UserManager::Get()->GetUserDisplayName(
 937         user_manager::UserManager::Get()->GetActiveUser()->GetUserID()));
 938   }
 939   return std::string();
 940 #else
 941   return profile_->GetPrefs()->GetString(prefs::kProfileName);
 942 #endif
 943 }