Home | History | Annotate | Download | only in cloud 
      1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
      2 // Use of this source code is governed by a BSD-style license that can be
      3 // found in the LICENSE file.
      4 
      5 #include "base/files/file_path.h"
      6 #include "base/message_loop/message_loop.h"
      7 #include "base/message_loop/message_loop_proxy.h"
      8 #include "base/prefs/pref_service.h"
      9 #include "base/run_loop.h"
     10 #include "base/time/time.h"
     11 #include "chrome/browser/browser_process.h"
     12 #include "chrome/browser/chrome_notification_types.h"
     13 #include "chrome/browser/policy/cloud/user_cloud_policy_manager_factory.h"
     14 #include "chrome/browser/policy/cloud/user_policy_signin_service_factory.h"
     15 #include "chrome/browser/prefs/browser_prefs.h"
     16 #include "chrome/browser/profiles/profile.h"
     17 #include "chrome/browser/signin/fake_profile_oauth2_token_service.h"
     18 #include "chrome/browser/signin/fake_profile_oauth2_token_service_builder.h"
     19 #include "chrome/browser/signin/fake_signin_manager.h"
     20 #include "chrome/browser/signin/profile_oauth2_token_service_factory.h"
     21 #include "chrome/browser/signin/signin_manager_factory.h"
     22 #include "chrome/test/base/testing_browser_process.h"
     23 #include "chrome/test/base/testing_pref_service_syncable.h"
     24 #include "chrome/test/base/testing_profile.h"
     25 #include "components/policy/core/browser/browser_policy_connector.h"
     26 #include "components/policy/core/common/cloud/cloud_external_data_manager.h"
     27 #include "components/policy/core/common/cloud/cloud_policy_constants.h"
     28 #include "components/policy/core/common/cloud/mock_device_management_service.h"
     29 #include "components/policy/core/common/cloud/mock_user_cloud_policy_store.h"
     30 #include "components/policy/core/common/cloud/user_cloud_policy_manager.h"
     31 #include "components/policy/core/common/schema_registry.h"
     32 #include "components/signin/core/browser/signin_manager.h"
     33 #include "content/public/browser/browser_context.h"
     34 #include "content/public/browser/notification_details.h"
     35 #include "content/public/browser/notification_service.h"
     36 #include "content/public/browser/notification_source.h"
     37 #include "content/public/test/test_browser_thread_bundle.h"
     38 #include "google_apis/gaia/gaia_constants.h"
     39 #include "google_apis/gaia/google_service_auth_error.h"
     40 #include "net/http/http_status_code.h"
     41 #include "net/url_request/test_url_fetcher_factory.h"
     42 #include "net/url_request/url_request_context_getter.h"
     43 #include "net/url_request/url_request_status.h"
     44 #include "net/url_request/url_request_test_util.h"
     45 #include "testing/gmock/include/gmock/gmock.h"
     46 #include "testing/gtest/include/gtest/gtest.h"
     47 
     48 #if defined(OS_ANDROID)
     49 #include "chrome/browser/policy/cloud/user_policy_signin_service_mobile.h"
     50 #else
     51 #include "chrome/browser/policy/cloud/user_policy_signin_service.h"
     52 #endif
     53 
     54 namespace em = enterprise_management;
     55 
     56 using testing::AnyNumber;
     57 using testing::Mock;
     58 using testing::_;
     59 
     60 namespace policy {
     61 
     62 namespace {
     63 
     64 const char kTestUser[] = "testuser (at) test.com";
     65 
     66 #if !defined(OS_ANDROID)
     67 const char kValidTokenResponse[] =
     68     "{"
     69     "  \"access_token\": \"at1\","
     70     "  \"expires_in\": 3600,"
     71     "  \"token_type\": \"Bearer\""
     72     "}";
     73 #endif
     74 
     75 const char kHostedDomainResponse[] =
     76     "{"
     77     "  \"hd\": \"test.com\""
     78     "}";
     79 
     80 class SigninManagerFake : public FakeSigninManager {
     81  public:
     82   explicit SigninManagerFake(Profile* profile)
     83       : FakeSigninManager(profile) {
     84     Initialize(NULL);
     85   }
     86 
     87   void ForceSignOut() {
     88     // Allow signing out now.
     89     prohibit_signout_ = false;
     90     SignOut(signin_metrics::SIGNOUT_TEST);
     91   }
     92 
     93   static KeyedService* Build(content::BrowserContext* profile) {
     94     return new SigninManagerFake(static_cast<Profile*>(profile));
     95   }
     96 };
     97 
     98 UserCloudPolicyManager* BuildCloudPolicyManager(
     99     content::BrowserContext* context) {
    100   MockUserCloudPolicyStore *store = new MockUserCloudPolicyStore();
    101   EXPECT_CALL(*store, Load()).Times(AnyNumber());
    102 
    103   return new UserCloudPolicyManager(
    104       scoped_ptr<UserCloudPolicyStore>(store),
    105       base::FilePath(),
    106       scoped_ptr<CloudExternalDataManager>(),
    107       base::MessageLoopProxy::current(),
    108       base::MessageLoopProxy::current(),
    109       base::MessageLoopProxy::current());
    110 }
    111 
    112 class UserPolicySigninServiceTest : public testing::Test {
    113  public:
    114   UserPolicySigninServiceTest()
    115       : mock_store_(NULL),
    116         thread_bundle_(content::TestBrowserThreadBundle::IO_MAINLOOP),
    117         register_completed_(false) {}
    118 
    119   MOCK_METHOD1(OnPolicyRefresh, void(bool));
    120 
    121   void OnRegisterCompleted(const std::string& dm_token,
    122                            const std::string& client_id) {
    123     register_completed_ = true;
    124     dm_token_ = dm_token;
    125     client_id_ = client_id;
    126   }
    127 
    128   void RegisterPolicyClientWithCallback(UserPolicySigninService* service) {
    129     // Policy client registration on Android depends on Token Service having
    130     // a valid login token, while on other platforms, the login refresh token
    131     // is specified directly.
    132 #if defined(OS_ANDROID)
    133     GetTokenService()->IssueRefreshTokenForUser(kTestUser,
    134                                                 "oauth2_login_refresh_token");
    135 #endif
    136     service->RegisterForPolicy(
    137         kTestUser,
    138 #if !defined(OS_ANDROID)
    139         "mock_oauth_token",
    140 #endif
    141         base::Bind(&UserPolicySigninServiceTest::OnRegisterCompleted,
    142                    base::Unretained(this)));
    143     ASSERT_TRUE(IsRequestActive());
    144   }
    145 
    146   virtual void SetUp() OVERRIDE {
    147     UserPolicySigninServiceFactory::SetDeviceManagementServiceForTesting(
    148         &device_management_service_);
    149 
    150     local_state_.reset(new TestingPrefServiceSimple);
    151     chrome::RegisterLocalState(local_state_->registry());
    152     system_request_context_getter_ = new net::TestURLRequestContextGetter(
    153         base::MessageLoopProxy::current());
    154     TestingBrowserProcess::GetGlobal()->SetSystemRequestContext(
    155         system_request_context_getter_.get());
    156     TestingBrowserProcess::GetGlobal()->SetLocalState(local_state_.get());
    157 
    158     g_browser_process->browser_policy_connector()->Init(
    159         local_state_.get(), system_request_context_getter_);
    160 
    161     // Create a testing profile with cloud-policy-on-signin enabled, and bring
    162     // up a UserCloudPolicyManager with a MockUserCloudPolicyStore.
    163     scoped_ptr<TestingPrefServiceSyncable> prefs(
    164         new TestingPrefServiceSyncable());
    165     chrome::RegisterUserProfilePrefs(prefs->registry());
    166 
    167     // UserCloudPolicyManagerFactory isn't a real
    168     // BrowserContextKeyedServiceFactory (it derives from
    169     // BrowserContextKeyedBaseFactory and exposes its own APIs to get
    170     // instances) so we have to inject our testing factory via a special
    171     // API before creating the profile.
    172     UserCloudPolicyManagerFactory::GetInstance()->RegisterTestingFactory(
    173         BuildCloudPolicyManager);
    174     TestingProfile::Builder builder;
    175     builder.SetPrefService(scoped_ptr<PrefServiceSyncable>(prefs.Pass()));
    176     builder.AddTestingFactory(SigninManagerFactory::GetInstance(),
    177                               SigninManagerFake::Build);
    178     builder.AddTestingFactory(ProfileOAuth2TokenServiceFactory::GetInstance(),
    179                               BuildFakeProfileOAuth2TokenService);
    180 
    181     profile_ = builder.Build().Pass();
    182     url_factory_.set_remove_fetcher_on_delete(true);
    183 
    184     signin_manager_ = static_cast<SigninManagerFake*>(
    185         SigninManagerFactory::GetForProfile(profile_.get()));
    186     // Tests are responsible for freeing the UserCloudPolicyManager instances
    187     // they inject.
    188     manager_.reset(UserCloudPolicyManagerFactory::GetForBrowserContext(
    189         profile_.get()));
    190     manager_->Init(&schema_registry_);
    191     mock_store_ = static_cast<MockUserCloudPolicyStore*>(
    192         manager_->core()->store());
    193     DCHECK(mock_store_);
    194     AddProfile();
    195 
    196     Mock::VerifyAndClearExpectations(mock_store_);
    197   }
    198 
    199   virtual void TearDown() OVERRIDE {
    200     UserPolicySigninServiceFactory::SetDeviceManagementServiceForTesting(NULL);
    201     UserCloudPolicyManagerFactory::GetInstance()->ClearTestingFactory();
    202     // Free the profile before we clear out the browser prefs.
    203     profile_.reset();
    204     TestingBrowserProcess* testing_browser_process =
    205         TestingBrowserProcess::GetGlobal();
    206     testing_browser_process->SetLocalState(NULL);
    207     local_state_.reset();
    208     testing_browser_process->SetBrowserPolicyConnector(NULL);
    209     base::RunLoop run_loop;
    210     run_loop.RunUntilIdle();
    211   }
    212 
    213   virtual void AddProfile() {
    214     // For this test, the user should not be signed in yet.
    215     DCHECK(!signin_manager_->IsAuthenticated());
    216 
    217     // Initializing UserPolicySigninService while the user is not signed in
    218     // should result in the store being cleared to remove any lingering policy.
    219     EXPECT_CALL(*mock_store_, Clear());
    220 
    221     // Let the SigninService know that the profile has been created.
    222     content::NotificationService::current()->Notify(
    223         chrome::NOTIFICATION_PROFILE_ADDED,
    224         content::Source<Profile>(profile_.get()),
    225         content::NotificationService::NoDetails());
    226   }
    227 
    228   FakeProfileOAuth2TokenService* GetTokenService() {
    229     ProfileOAuth2TokenService* service =
    230         ProfileOAuth2TokenServiceFactory::GetForProfile(profile_.get());
    231     return static_cast<FakeProfileOAuth2TokenService*>(service);
    232   }
    233 
    234   bool IsRequestActive() {
    235     if (!GetTokenService()->GetPendingRequests().empty())
    236       return true;
    237     return url_factory_.GetFetcherByID(0);
    238   }
    239 
    240   void MakeOAuthTokenFetchSucceed() {
    241     ASSERT_TRUE(IsRequestActive());
    242 #if defined(OS_ANDROID)
    243     GetTokenService()->IssueTokenForAllPendingRequests("access_token",
    244                                                        base::Time::Now());
    245 #else
    246     net::TestURLFetcher* fetcher = url_factory_.GetFetcherByID(0);
    247     fetcher->set_response_code(net::HTTP_OK);
    248     fetcher->SetResponseString(kValidTokenResponse);
    249     fetcher->delegate()->OnURLFetchComplete(fetcher);
    250 #endif
    251   }
    252 
    253   void ReportHostedDomainStatus(bool is_hosted_domain) {
    254     ASSERT_TRUE(IsRequestActive());
    255     net::TestURLFetcher* fetcher = url_factory_.GetFetcherByID(0);
    256     fetcher->set_response_code(net::HTTP_OK);
    257     fetcher->SetResponseString(is_hosted_domain ? kHostedDomainResponse : "{}");
    258     fetcher->delegate()->OnURLFetchComplete(fetcher);
    259   }
    260 
    261   void TestSuccessfulSignin() {
    262     UserPolicySigninService* signin_service =
    263         UserPolicySigninServiceFactory::GetForProfile(profile_.get());
    264     EXPECT_CALL(*this, OnPolicyRefresh(true)).Times(0);
    265     RegisterPolicyClientWithCallback(signin_service);
    266 
    267     // Mimic successful oauth token fetch.
    268     MakeOAuthTokenFetchSucceed();
    269 
    270     // When the user is from a hosted domain, this should kick off client
    271     // registration.
    272     MockDeviceManagementJob* register_request = NULL;
    273     EXPECT_CALL(device_management_service_,
    274                 CreateJob(DeviceManagementRequestJob::TYPE_REGISTRATION, _))
    275         .WillOnce(device_management_service_.CreateAsyncJob(
    276             &register_request));
    277     EXPECT_CALL(device_management_service_, StartJob(_, _, _, _, _, _, _))
    278         .Times(1);
    279 
    280     // Now mimic the user being a hosted domain - this should cause a Register()
    281     // call.
    282     ReportHostedDomainStatus(true);
    283 
    284     // Should have no more outstanding requests.
    285     ASSERT_FALSE(IsRequestActive());
    286     Mock::VerifyAndClearExpectations(this);
    287     ASSERT_TRUE(register_request);
    288 
    289     // Mimic successful client registration - this should register the client
    290     // and invoke the callback.
    291     em::DeviceManagementResponse registration_blob;
    292     std::string expected_dm_token = "dm_token";
    293     registration_blob.mutable_register_response()->set_device_management_token(
    294         expected_dm_token);
    295     registration_blob.mutable_register_response()->set_enrollment_type(
    296         em::DeviceRegisterResponse::ENTERPRISE);
    297     register_request->SendResponse(DM_STATUS_SUCCESS, registration_blob);
    298 
    299     // UserCloudPolicyManager should not be initialized yet.
    300     ASSERT_FALSE(manager_->core()->service());
    301     EXPECT_TRUE(register_completed_);
    302     EXPECT_EQ(dm_token_, expected_dm_token);
    303 
    304     // Now call to fetch policy - this should fire off a fetch request.
    305     MockDeviceManagementJob* fetch_request = NULL;
    306     EXPECT_CALL(device_management_service_,
    307                 CreateJob(DeviceManagementRequestJob::TYPE_POLICY_FETCH, _))
    308         .WillOnce(device_management_service_.CreateAsyncJob(&fetch_request));
    309     EXPECT_CALL(device_management_service_, StartJob(_, _, _, _, _, _, _))
    310         .Times(1);
    311 
    312     signin_service->FetchPolicyForSignedInUser(
    313         kTestUser,
    314         dm_token_,
    315         client_id_,
    316         profile_->GetRequestContext(),
    317         base::Bind(&UserPolicySigninServiceTest::OnPolicyRefresh,
    318                    base::Unretained(this)));
    319 
    320     Mock::VerifyAndClearExpectations(this);
    321     ASSERT_TRUE(fetch_request);
    322 
    323     // UserCloudPolicyManager should now be initialized.
    324     EXPECT_EQ(mock_store_->signin_username_, kTestUser);
    325     ASSERT_TRUE(manager_->core()->service());
    326 
    327     // Make the policy fetch succeed - this should result in a write to the
    328     // store and ultimately result in a call to OnPolicyRefresh().
    329     EXPECT_CALL(*mock_store_, Store(_));
    330     EXPECT_CALL(*this, OnPolicyRefresh(true)).Times(1);
    331 
    332     // Create a fake policy blob to deliver to the client.
    333     em::DeviceManagementResponse policy_blob;
    334     em::PolicyData policy_data;
    335     policy_data.set_policy_type(dm_protocol::kChromeUserPolicyType);
    336     em::PolicyFetchResponse* policy_response =
    337         policy_blob.mutable_policy_response()->add_response();
    338     ASSERT_TRUE(policy_data.SerializeToString(
    339         policy_response->mutable_policy_data()));
    340     fetch_request->SendResponse(DM_STATUS_SUCCESS, policy_blob);
    341 
    342     // Complete the store which should cause the policy fetch callback to be
    343     // invoked.
    344     mock_store_->NotifyStoreLoaded();
    345     Mock::VerifyAndClearExpectations(this);
    346   }
    347 
    348   scoped_ptr<TestingProfile> profile_;
    349   MockUserCloudPolicyStore* mock_store_;  // Not owned.
    350   SchemaRegistry schema_registry_;
    351   scoped_ptr<UserCloudPolicyManager> manager_;
    352 
    353   // BrowserPolicyConnector and UrlFetcherFactory want to initialize and free
    354   // various components asynchronously via tasks, so create fake threads here.
    355   content::TestBrowserThreadBundle thread_bundle_;
    356 
    357   net::TestURLFetcherFactory url_factory_;
    358 
    359   SigninManagerFake* signin_manager_;
    360 
    361   // Used in conjunction with OnRegisterCompleted() to test client registration
    362   // callbacks.
    363   std::string dm_token_;
    364   std::string client_id_;
    365 
    366   // True if OnRegisterCompleted() was called.
    367   bool register_completed_;
    368 
    369   // Weak ptr to the MockDeviceManagementService (object is owned by the
    370   // BrowserPolicyConnector).
    371   MockDeviceManagementService device_management_service_;
    372 
    373   scoped_ptr<TestingPrefServiceSimple> local_state_;
    374   scoped_refptr<net::URLRequestContextGetter> system_request_context_getter_;
    375 };
    376 
    377 class UserPolicySigninServiceSignedInTest : public UserPolicySigninServiceTest {
    378  public:
    379   virtual void AddProfile() OVERRIDE {
    380     // UserCloudPolicyManager should not be initialized.
    381     ASSERT_FALSE(manager_->core()->service());
    382 
    383     // Set the user as signed in.
    384     SigninManagerFactory::GetForProfile(profile_.get())->
    385         SetAuthenticatedUsername(kTestUser);
    386 
    387     // Let the SigninService know that the profile has been created.
    388     content::NotificationService::current()->Notify(
    389         chrome::NOTIFICATION_PROFILE_ADDED,
    390         content::Source<Profile>(profile_.get()),
    391         content::NotificationService::NoDetails());
    392   }
    393 };
    394 
    395 TEST_F(UserPolicySigninServiceTest, InitWhileSignedOut) {
    396   // Make sure user is not signed in.
    397   ASSERT_FALSE(SigninManagerFactory::GetForProfile(profile_.get())->
    398       IsAuthenticated());
    399 
    400   // UserCloudPolicyManager should not be initialized.
    401   ASSERT_FALSE(manager_->core()->service());
    402 }
    403 
    404   // TODO(joaodasilva): these tests rely on issuing the OAuth2 login refresh
    405   // token after signin. Revisit this after figuring how to handle that on
    406   // Android.
    407 #if !defined(OS_ANDROID)
    408 
    409 TEST_F(UserPolicySigninServiceSignedInTest, InitWhileSignedIn) {
    410   // UserCloudPolicyManager should be initialized.
    411   ASSERT_TRUE(manager_->core()->service());
    412 
    413   // Complete initialization of the store.
    414   mock_store_->NotifyStoreLoaded();
    415 
    416   // No oauth access token yet, so client registration should be deferred.
    417   ASSERT_FALSE(IsRequestActive());
    418 
    419   // Make oauth token available.
    420   GetTokenService()->IssueRefreshTokenForUser(kTestUser,
    421                                               "oauth_login_refresh_token");
    422 
    423   // Client registration should be in progress since we now have an oauth token.
    424   EXPECT_EQ(mock_store_->signin_username_, kTestUser);
    425   ASSERT_TRUE(IsRequestActive());
    426 }
    427 
    428 TEST_F(UserPolicySigninServiceSignedInTest, InitWhileSignedInOAuthError) {
    429   // UserCloudPolicyManager should be initialized.
    430   ASSERT_TRUE(manager_->core()->service());
    431 
    432   // Complete initialization of the store.
    433   mock_store_->NotifyStoreLoaded();
    434 
    435   // No oauth access token yet, so client registration should be deferred.
    436   ASSERT_FALSE(IsRequestActive());
    437 
    438   // Make oauth token available.
    439   GetTokenService()->IssueRefreshTokenForUser(kTestUser,
    440                                               "oauth_login_refresh_token");
    441 
    442   // Client registration should be in progress since we now have an oauth token.
    443   ASSERT_TRUE(IsRequestActive());
    444 
    445   // Now fail the access token fetch.
    446   GoogleServiceAuthError error(
    447       GoogleServiceAuthError::INVALID_GAIA_CREDENTIALS);
    448   GetTokenService()->IssueErrorForAllPendingRequests(error);
    449   ASSERT_FALSE(IsRequestActive());
    450 }
    451 
    452 TEST_F(UserPolicySigninServiceTest, SignInAfterInit) {
    453   // UserCloudPolicyManager should not be initialized since there is no
    454   // signed-in user.
    455   ASSERT_FALSE(manager_->core()->service());
    456 
    457   // Now sign in the user.
    458   SigninManagerFactory::GetForProfile(profile_.get())->SetAuthenticatedUsername(
    459       kTestUser);
    460 
    461   // Complete initialization of the store.
    462   mock_store_->NotifyStoreLoaded();
    463 
    464   // Make oauth token available.
    465   GetTokenService()->IssueRefreshTokenForUser(kTestUser,
    466                                               "oauth_login_refresh_token");
    467 
    468   // UserCloudPolicyManager should be initialized.
    469   EXPECT_EQ(mock_store_->signin_username_, kTestUser);
    470   ASSERT_TRUE(manager_->core()->service());
    471 
    472   // Client registration should be in progress since we have an oauth token.
    473   ASSERT_TRUE(IsRequestActive());
    474 }
    475 
    476 TEST_F(UserPolicySigninServiceTest, SignInWithNonEnterpriseUser) {
    477   // UserCloudPolicyManager should not be initialized since there is no
    478   // signed-in user.
    479   ASSERT_FALSE(manager_->core()->service());
    480 
    481   // Now sign in a non-enterprise user (blacklisted gmail.com domain).
    482   SigninManagerFactory::GetForProfile(profile_.get())->SetAuthenticatedUsername(
    483       "non_enterprise_user (at) gmail.com");
    484 
    485   // Complete initialization of the store.
    486   mock_store_->NotifyStoreLoaded();
    487 
    488   // Make oauth token available.
    489   GetTokenService()->IssueRefreshTokenForUser(kTestUser,
    490                                               "oauth_login_refresh_token");
    491 
    492   // UserCloudPolicyManager should not be initialized and there should be no
    493   // DMToken request active.
    494   ASSERT_TRUE(!manager_->core()->service());
    495   ASSERT_FALSE(IsRequestActive());
    496 }
    497 
    498 TEST_F(UserPolicySigninServiceTest, UnregisteredClient) {
    499   // UserCloudPolicyManager should not be initialized since there is no
    500   // signed-in user.
    501   ASSERT_FALSE(manager_->core()->service());
    502 
    503   // Now sign in the user.
    504   SigninManagerFactory::GetForProfile(profile_.get())->SetAuthenticatedUsername(
    505       kTestUser);
    506 
    507   // Make oauth token available.
    508   GetTokenService()->IssueRefreshTokenForUser(kTestUser,
    509                                               "oauth_login_refresh_token");
    510 
    511   // UserCloudPolicyManager should be initialized.
    512   EXPECT_EQ(mock_store_->signin_username_, kTestUser);
    513   ASSERT_TRUE(manager_->core()->service());
    514 
    515   // Client registration should not be in progress since the store is not
    516   // yet initialized.
    517   ASSERT_FALSE(IsRequestActive());
    518 
    519   // Complete initialization of the store with no policy (unregistered client).
    520   mock_store_->NotifyStoreLoaded();
    521 
    522   // Client registration should be in progress since we have an oauth token.
    523   ASSERT_TRUE(IsRequestActive());
    524 }
    525 
    526 TEST_F(UserPolicySigninServiceTest, RegisteredClient) {
    527   // UserCloudPolicyManager should not be initialized since there is no
    528   // signed-in user.
    529   ASSERT_FALSE(manager_->core()->service());
    530 
    531   // Now sign in the user.
    532   SigninManagerFactory::GetForProfile(profile_.get())->SetAuthenticatedUsername(
    533       kTestUser);
    534 
    535   // Make oauth token available.
    536   GetTokenService()->IssueRefreshTokenForUser(kTestUser,
    537                                               "oauth_login_refresh_token");
    538 
    539   // UserCloudPolicyManager should be initialized.
    540   EXPECT_EQ(mock_store_->signin_username_, kTestUser);
    541   ASSERT_TRUE(manager_->core()->service());
    542 
    543   // Client registration should not be in progress since the store is not
    544   // yet initialized.
    545   ASSERT_FALSE(manager_->IsClientRegistered());
    546   ASSERT_FALSE(IsRequestActive());
    547 
    548   mock_store_->policy_.reset(new enterprise_management::PolicyData());
    549   mock_store_->policy_->set_request_token("fake token");
    550   mock_store_->policy_->set_device_id("fake client id");
    551 
    552   // Complete initialization of the store.
    553   mock_store_->NotifyStoreLoaded();
    554 
    555   // Client registration should not be in progress since the client should be
    556   // already registered.
    557   ASSERT_TRUE(manager_->IsClientRegistered());
    558   ASSERT_FALSE(IsRequestActive());
    559 }
    560 
    561 #endif  // !defined(OS_ANDROID)
    562 
    563 TEST_F(UserPolicySigninServiceSignedInTest, SignOutAfterInit) {
    564   // UserCloudPolicyManager should be initialized.
    565   EXPECT_EQ(mock_store_->signin_username_, kTestUser);
    566   ASSERT_TRUE(manager_->core()->service());
    567 
    568   // Signing out will clear the policy from the store.
    569   EXPECT_CALL(*mock_store_, Clear());
    570 
    571   // Now sign out.
    572   SigninManagerFactory::GetForProfile(profile_.get())->SignOut(
    573       signin_metrics::SIGNOUT_TEST);
    574 
    575   // UserCloudPolicyManager should be shut down.
    576   ASSERT_FALSE(manager_->core()->service());
    577 }
    578 
    579 TEST_F(UserPolicySigninServiceTest, RegisterPolicyClientOAuthFailure) {
    580   UserPolicySigninService* signin_service =
    581       UserPolicySigninServiceFactory::GetForProfile(profile_.get());
    582   RegisterPolicyClientWithCallback(signin_service);
    583   Mock::VerifyAndClearExpectations(this);
    584 
    585   // UserCloudPolicyManager should not be initialized.
    586   ASSERT_FALSE(manager_->core()->service());
    587   ASSERT_TRUE(IsRequestActive());
    588   EXPECT_FALSE(register_completed_);
    589 
    590   // Cause the access token fetch to fail - callback should be invoked.
    591 #if defined(OS_ANDROID)
    592   ASSERT_TRUE(!GetTokenService()->GetPendingRequests().empty());
    593   GetTokenService()->IssueErrorForAllPendingRequests(
    594       GoogleServiceAuthError::FromServiceError("fail"));
    595 #else
    596   net::TestURLFetcher* fetcher = url_factory_.GetFetcherByID(0);
    597   fetcher->set_status(net::URLRequestStatus(net::URLRequestStatus::FAILED, -1));
    598   fetcher->delegate()->OnURLFetchComplete(fetcher);
    599 #endif
    600 
    601   EXPECT_TRUE(register_completed_);
    602   EXPECT_TRUE(dm_token_.empty());
    603   EXPECT_FALSE(IsRequestActive());
    604 }
    605 
    606 TEST_F(UserPolicySigninServiceTest, RegisterPolicyClientNonHostedDomain) {
    607   UserPolicySigninService* signin_service =
    608       UserPolicySigninServiceFactory::GetForProfile(profile_.get());
    609   RegisterPolicyClientWithCallback(signin_service);
    610 
    611   // UserCloudPolicyManager should not be initialized.
    612   ASSERT_FALSE(manager_->core()->service());
    613   ASSERT_TRUE(IsRequestActive());
    614 
    615   // Cause the access token request to succeed.
    616   MakeOAuthTokenFetchSucceed();
    617 
    618   // Should be a follow-up fetch to check the hosted-domain status.
    619   ASSERT_TRUE(IsRequestActive());
    620   Mock::VerifyAndClearExpectations(this);
    621 
    622   EXPECT_FALSE(register_completed_);
    623 
    624   // Report that the user is not on a hosted domain - callback should be
    625   // invoked reporting a failed fetch.
    626   ReportHostedDomainStatus(false);
    627 
    628   // Since this is not a hosted domain, we should not issue a request for a
    629   // DMToken.
    630   EXPECT_TRUE(register_completed_);
    631   EXPECT_TRUE(dm_token_.empty());
    632   ASSERT_FALSE(IsRequestActive());
    633 }
    634 
    635 TEST_F(UserPolicySigninServiceTest, RegisterPolicyClientFailedRegistration) {
    636   UserPolicySigninService* signin_service =
    637       UserPolicySigninServiceFactory::GetForProfile(profile_.get());
    638   RegisterPolicyClientWithCallback(signin_service);
    639 
    640   // UserCloudPolicyManager should not be initialized.
    641   ASSERT_FALSE(manager_->core()->service());
    642 
    643   // Mimic successful oauth token fetch.
    644   MakeOAuthTokenFetchSucceed();
    645 
    646   EXPECT_FALSE(register_completed_);
    647 
    648   // When the user is from a hosted domain, this should kick off client
    649   // registration.
    650   MockDeviceManagementJob* register_request = NULL;
    651   EXPECT_CALL(device_management_service_,
    652               CreateJob(DeviceManagementRequestJob::TYPE_REGISTRATION, _))
    653       .WillOnce(device_management_service_.CreateAsyncJob(&register_request));
    654   EXPECT_CALL(device_management_service_, StartJob(_, _, _, _, _, _, _))
    655         .Times(1);
    656 
    657   // Now mimic the user being a hosted domain - this should cause a Register()
    658   // call.
    659   ReportHostedDomainStatus(true);
    660 
    661   // Should have no more outstanding requests.
    662   ASSERT_FALSE(IsRequestActive());
    663   Mock::VerifyAndClearExpectations(this);
    664   ASSERT_TRUE(register_request);
    665   EXPECT_FALSE(register_completed_);
    666 
    667   // Make client registration fail (hosted domain user that is not managed).
    668   register_request->SendResponse(DM_STATUS_SERVICE_MANAGEMENT_NOT_SUPPORTED,
    669                                  em::DeviceManagementResponse());
    670   EXPECT_TRUE(register_completed_);
    671   EXPECT_TRUE(dm_token_.empty());
    672 }
    673 
    674 TEST_F(UserPolicySigninServiceTest, RegisterPolicyClientSucceeded) {
    675   UserPolicySigninService* signin_service =
    676       UserPolicySigninServiceFactory::GetForProfile(profile_.get());
    677   RegisterPolicyClientWithCallback(signin_service);
    678 
    679   // Mimic successful oauth token fetch.
    680   MakeOAuthTokenFetchSucceed();
    681 
    682   // When the user is from a hosted domain, this should kick off client
    683   // registration.
    684   MockDeviceManagementJob* register_request = NULL;
    685   EXPECT_CALL(device_management_service_,
    686               CreateJob(DeviceManagementRequestJob::TYPE_REGISTRATION, _))
    687       .WillOnce(device_management_service_.CreateAsyncJob(&register_request));
    688   EXPECT_CALL(device_management_service_, StartJob(_, _, _, _, _, _, _))
    689       .Times(1);
    690 
    691   // Now mimic the user being a hosted domain - this should cause a Register()
    692   // call.
    693   ReportHostedDomainStatus(true);
    694 
    695   // Should have no more outstanding requests.
    696   ASSERT_FALSE(IsRequestActive());
    697   Mock::VerifyAndClearExpectations(this);
    698   ASSERT_TRUE(register_request);
    699   EXPECT_FALSE(register_completed_);
    700 
    701   em::DeviceManagementResponse registration_blob;
    702   std::string expected_dm_token = "dm_token";
    703   registration_blob.mutable_register_response()->set_device_management_token(
    704       expected_dm_token);
    705   registration_blob.mutable_register_response()->set_enrollment_type(
    706       em::DeviceRegisterResponse::ENTERPRISE);
    707   register_request->SendResponse(DM_STATUS_SUCCESS, registration_blob);
    708   Mock::VerifyAndClearExpectations(this);
    709   EXPECT_TRUE(register_completed_);
    710   EXPECT_EQ(dm_token_, expected_dm_token);
    711   // UserCloudPolicyManager should not be initialized.
    712   ASSERT_FALSE(manager_->core()->service());
    713 }
    714 
    715 TEST_F(UserPolicySigninServiceTest, FetchPolicyFailed) {
    716   // Initiate a policy fetch request.
    717   MockDeviceManagementJob* fetch_request = NULL;
    718   EXPECT_CALL(device_management_service_,
    719               CreateJob(DeviceManagementRequestJob::TYPE_POLICY_FETCH, _))
    720       .WillOnce(device_management_service_.CreateAsyncJob(&fetch_request));
    721   EXPECT_CALL(device_management_service_, StartJob(_, _, _, _, _, _, _))
    722       .Times(1);
    723   UserPolicySigninService* signin_service =
    724       UserPolicySigninServiceFactory::GetForProfile(profile_.get());
    725   signin_service->FetchPolicyForSignedInUser(
    726       kTestUser,
    727       "mock_dm_token",
    728       "mock_client_id",
    729       profile_->GetRequestContext(),
    730       base::Bind(&UserPolicySigninServiceTest::OnPolicyRefresh,
    731                  base::Unretained(this)));
    732   ASSERT_TRUE(fetch_request);
    733 
    734   // Make the policy fetch fail.
    735   EXPECT_CALL(*this, OnPolicyRefresh(false)).Times(1);
    736   fetch_request->SendResponse(DM_STATUS_REQUEST_FAILED,
    737                               em::DeviceManagementResponse());
    738 
    739   // UserCloudPolicyManager should be initialized.
    740   EXPECT_EQ(mock_store_->signin_username_, kTestUser);
    741   ASSERT_TRUE(manager_->core()->service());
    742 }
    743 
    744 TEST_F(UserPolicySigninServiceTest, FetchPolicySuccess) {
    745   ASSERT_NO_FATAL_FAILURE(TestSuccessfulSignin());
    746 }
    747 
    748 TEST_F(UserPolicySigninServiceTest, SignOutThenSignInAgain) {
    749   ASSERT_NO_FATAL_FAILURE(TestSuccessfulSignin());
    750 
    751   EXPECT_CALL(*mock_store_, Clear());
    752   signin_manager_->ForceSignOut();
    753   ASSERT_FALSE(manager_->core()->service());
    754 
    755   // Now sign in again.
    756   ASSERT_NO_FATAL_FAILURE(TestSuccessfulSignin());
    757 }
    758 
    759 TEST_F(UserPolicySigninServiceTest, PolicyFetchFailureTemporary) {
    760   ASSERT_NO_FATAL_FAILURE(TestSuccessfulSignin());
    761 
    762   ASSERT_TRUE(manager_->IsClientRegistered());
    763 
    764   // Kick off another policy fetch.
    765   MockDeviceManagementJob* fetch_request = NULL;
    766   EXPECT_CALL(device_management_service_,
    767               CreateJob(DeviceManagementRequestJob::TYPE_POLICY_FETCH, _))
    768       .WillOnce(device_management_service_.CreateAsyncJob(&fetch_request));
    769   EXPECT_CALL(device_management_service_, StartJob(_, _, _, _, _, _, _))
    770       .Times(1);
    771   manager_->RefreshPolicies();
    772   Mock::VerifyAndClearExpectations(this);
    773 
    774   // Now, fake a transient error from the server on this policy fetch. This
    775   // should have no impact on the cached policy.
    776   fetch_request->SendResponse(DM_STATUS_REQUEST_FAILED,
    777                               em::DeviceManagementResponse());
    778   base::RunLoop().RunUntilIdle();
    779   ASSERT_TRUE(manager_->IsClientRegistered());
    780 }
    781 
    782 TEST_F(UserPolicySigninServiceTest, PolicyFetchFailureDisableManagement) {
    783   ASSERT_NO_FATAL_FAILURE(TestSuccessfulSignin());
    784 
    785   EXPECT_TRUE(manager_->IsClientRegistered());
    786 #if !defined(OS_ANDROID)
    787   EXPECT_TRUE(signin_manager_->IsSignoutProhibited());
    788 #endif
    789 
    790   // Kick off another policy fetch.
    791   MockDeviceManagementJob* fetch_request = NULL;
    792   EXPECT_CALL(device_management_service_,
    793               CreateJob(DeviceManagementRequestJob::TYPE_POLICY_FETCH, _))
    794       .WillOnce(device_management_service_.CreateAsyncJob(&fetch_request));
    795   EXPECT_CALL(device_management_service_, StartJob(_, _, _, _, _, _, _))
    796       .Times(1);
    797   manager_->RefreshPolicies();
    798   Mock::VerifyAndClearExpectations(this);
    799 
    800   // Now, fake a SC_FORBIDDEN error from the server on this policy fetch. This
    801   // indicates that chrome management is disabled and will result in the cached
    802   // policy being removed and the manager shut down.
    803   EXPECT_CALL(*mock_store_, Clear());
    804   fetch_request->SendResponse(DM_STATUS_SERVICE_MANAGEMENT_NOT_SUPPORTED,
    805                               em::DeviceManagementResponse());
    806   base::RunLoop().RunUntilIdle();
    807   EXPECT_FALSE(manager_->IsClientRegistered());
    808 #if !defined(OS_ANDROID)
    809   EXPECT_FALSE(signin_manager_->IsSignoutProhibited());
    810 #endif
    811 }
    812 
    813 }  // namespace
    814 
    815 }  // namespace policy
    816