Policy to disable/whitelist lock screen note taking apps

Adds a policy to control whether/which note taking apps are allowed
on the lock screen - the policy is implemented as a white-list of
apps that will be allowed as lock screen note taking apps (provided
the user enables them in settings).

The policy value is saved as kNoteTakingAppsAllowedOnLockScreen pref
that's being added in https://chromium-review.googlesource.com/c/572842

BUG=741053
[email protected]

(cherry picked from commit c45d9b1)

Change-Id: Ib1beb5ee3c7f4efad0eb8be99f894345adaf7530
Reviewed-on: https://chromium-review.googlesource.com/567556
Commit-Queue: Toni Barzic <[email protected]>
Reviewed-by: Maksim Ivanov <[email protected]>
Cr-Original-Commit-Position: refs/heads/master@{#489199}
Reviewed-on: https://chromium-review.googlesource.com/588382
Reviewed-by: Toni Barzic <[email protected]>
Cr-Commit-Position: refs/branch-heads/3163@{#73}
Cr-Branched-From: ff259ba-refs/heads/master@{#488528}

Author: Toni Barzic

chrome/browser/policy/configuration_policy_handler_list_factory.cc

@@ -1048,6 +1048,9 @@ std::unique_ptr<ConfigurationPolicyHandlerList> BuildHandlerList(
   handlers->AddHandler(
       base::MakeUnique<chromeos::KeyPermissionsPolicyHandler>(chrome_schema));
   handlers->AddHandler(base::WrapUnique(new DefaultGeolocationPolicyHandler()));
+  handlers->AddHandler(base::MakeUnique<extensions::ExtensionListPolicyHandler>(
+      key::kNoteTakingAppsLockScreenWhitelist,
+      prefs::kNoteTakingAppsLockScreenWhitelist, false /*allow_wildcards*/));
 #endif  // defined(OS_CHROMEOS)
 
 #if BUILDFLAG(ENABLE_PLUGINS)

chrome/browser/policy/policy_browsertest.cc

@@ -175,6 +175,7 @@
 #include "extensions/common/extension_set.h"
 #include "extensions/common/features/feature_channel.h"
 #include "extensions/common/manifest_handlers/shared_module_info.h"
+#include "extensions/common/switches.h"
 #include "media/media_features.h"
 #include "net/base/net_errors.h"
 #include "net/base/url_util.h"
@@ -208,6 +209,7 @@
 #include "chrome/browser/chromeos/accessibility/magnification_manager.h"
 #include "chrome/browser/chromeos/arc/arc_session_manager.h"
 #include "chrome/browser/chromeos/login/test/js_checker.h"
+#include "chrome/browser/chromeos/note_taking_helper.h"
 #include "chrome/browser/chromeos/system/timezone_resolver_manager.h"
 #include "chrome/browser/profiles/profile_manager.h"
 #include "chrome/browser/ui/ash/chrome_screenshot_grabber.h"
@@ -4446,4 +4448,106 @@ IN_PROC_BROWSER_TEST_F(NetworkTimePolicyTest, NetworkTimeQueriesDisabled) {
   EXPECT_EQ(1u, num_requests());
 }
 
+#if defined(OS_CHROMEOS)
+
+class NoteTakingOnLockScreenPolicyTest : public PolicyTest {
+ public:
+  NoteTakingOnLockScreenPolicyTest() = default;
+  ~NoteTakingOnLockScreenPolicyTest() override = default;
+
+  void SetUpCommandLine(base::CommandLine* command_line) override {
+    command_line->AppendSwitch(chromeos::switches::kEnableLockScreenApps);
+    // An app requires lockScreen permission to be enabled as a lock screen app.
+    // This permission is protected by a whitelist, so the test app has to be
+    // whitelisted as well.
+    command_line->AppendSwitchASCII(
+        extensions::switches::kWhitelistedExtensionID, kTestAppId);
+    PolicyTest::SetUpCommandLine(command_line);
+  }
+
+  void SetUserLevelPrefValue(const std::string& app_id,
+                             bool enabled_on_lock_screen) {
+    chromeos::NoteTakingHelper* helper = chromeos::NoteTakingHelper::Get();
+    ASSERT_TRUE(helper);
+
+    helper->SetPreferredApp(browser()->profile(), app_id);
+    helper->SetPreferredAppEnabledOnLockScreen(browser()->profile(),
+                                               enabled_on_lock_screen);
+  }
+
+  void SetPolicyValue(std::unique_ptr<base::Value> value) {
+    PolicyMap policies;
+    if (value) {
+      policies.Set(key::kNoteTakingAppsLockScreenWhitelist,
+                   POLICY_LEVEL_MANDATORY, POLICY_SCOPE_USER,
+                   POLICY_SOURCE_CLOUD, std::move(value), nullptr);
+    }
+    UpdateProviderPolicy(policies);
+  }
+
+  chromeos::NoteTakingLockScreenSupport GetAppLockScreenStatus(
+      const std::string& app_id) {
+    std::unique_ptr<chromeos::NoteTakingAppInfo> info =
+        chromeos::NoteTakingHelper::Get()->GetPreferredChromeAppInfo(
+            browser()->profile());
+    if (!info || info->app_id != app_id)
+      return chromeos::NoteTakingLockScreenSupport::kNotSupported;
+    return info->lock_screen_support;
+  }
+
+  // The test app ID.
+  static const char kTestAppId[];
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(NoteTakingOnLockScreenPolicyTest);
+};
+
+const char NoteTakingOnLockScreenPolicyTest::kTestAppId[] =
+    "cadfeochfldmbdgoccgbeianhamecbae";
+
+IN_PROC_BROWSER_TEST_F(NoteTakingOnLockScreenPolicyTest,
+                       DisableLockScreenNoteTakingByPolicy) {
+  scoped_refptr<const extensions::Extension> app =
+      LoadUnpackedExtension("lock_screen_apps/app_launch");
+  ASSERT_TRUE(app);
+  ASSERT_EQ(kTestAppId, app->id());
+
+  SetUserLevelPrefValue(app->id(), true);
+  EXPECT_EQ(chromeos::NoteTakingLockScreenSupport::kEnabled,
+            GetAppLockScreenStatus(app->id()));
+
+  SetPolicyValue(base::MakeUnique<base::ListValue>());
+  EXPECT_EQ(chromeos::NoteTakingLockScreenSupport::kNotAllowedByPolicy,
+            GetAppLockScreenStatus(app->id()));
+
+  SetPolicyValue(nullptr);
+  EXPECT_EQ(chromeos::NoteTakingLockScreenSupport::kEnabled,
+            GetAppLockScreenStatus(app->id()));
+}
+
+IN_PROC_BROWSER_TEST_F(NoteTakingOnLockScreenPolicyTest,
+                       WhitelistLockScreenNoteTakingAppByPolicy) {
+  scoped_refptr<const extensions::Extension> app =
+      LoadUnpackedExtension("lock_screen_apps/app_launch");
+  ASSERT_TRUE(app);
+  ASSERT_EQ(kTestAppId, app->id());
+
+  SetUserLevelPrefValue(app->id(), false);
+  EXPECT_EQ(chromeos::NoteTakingLockScreenSupport::kSupported,
+            GetAppLockScreenStatus(app->id()));
+
+  auto policy = base::MakeUnique<base::ListValue>();
+  policy->GetList().emplace_back(base::Value(kTestAppId));
+  SetPolicyValue(std::move(policy));
+
+  EXPECT_EQ(chromeos::NoteTakingLockScreenSupport::kSupported,
+            GetAppLockScreenStatus(app->id()));
+
+  SetUserLevelPrefValue(app->id(), true);
+  EXPECT_EQ(chromeos::NoteTakingLockScreenSupport::kEnabled,
+            GetAppLockScreenStatus(app->id()));
+}
+
+#endif  // defined(OS_CHROMEOS)
+
 }  // namespace policy

chrome/test/data/policy/policy_test_cases.json

@@ -3128,6 +3128,14 @@
     "test_policy": { "DeviceEcryptfsMigrationStrategy": 1 }
   },
 
+  "NoteTakingAppsLockScreenWhitelist": {
+    "os": ["chromeos"],
+    "test_policy": { "NoteTakingAppsLockScreenWhitelist": [] },
+    "pref_mappings": [
+      {"pref": "settings.note_taking_apps_lock_screen_whitelist"}
+    ]
+  },
+
   "----- Chrome Frame policies -------------------------------------------": {},
 
   "ChromeFrameRendererSettings": {

components/policy/resources/policy_templates.json

@@ -143,7 +143,7 @@
 #   persistent IDs for all fields (but not for groups!) are needed. These are
 #   specified by the 'id' keys of each policy. NEVER CHANGE EXISTING IDs,
 #   because doing so would break the deployed wire format!
-#   For your editing convenience: highest ID currently used: 376
+#   For your editing convenience: highest ID currently used: 377
 #   And don't forget to also update the EnterprisePolicies enum of
 #   histograms.xml (run 'python tools/metrics/histograms/update_policies.py').
 #
@@ -9782,6 +9782,35 @@
 
       This policy does not apply to kiosk users. If this policy is left not set, the device will behave as if 'DisallowArc' was chosen.''',
     },
+    {
+      'name': 'NoteTakingAppsLockScreenWhitelist',
+      'type': 'list',
+      'schema': {
+        'type': 'array',
+        'items': { 'type': 'string' },
+      },
+      'supported_on': [
+        'chrome_os:61-',
+      ],
+      'features': {
+        'dynamic_refresh': True,
+        'per_profile': True
+      },
+      'example_value': ['abcdefghabcdefghabcdefghabcdefgh'],
+      'id': 377,
+      'caption': '''Whitelist note-taking apps allowed on the <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome OS</ex></ph> lock screen''',
+      'tags': [],
+      'desc': '''Specifies list of apps that can be enabled as a note-taking app on the <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome OS</ex></ph> lock screen.
+
+      If the preferred note-taking app is enabled on the lock screen, the lock screen will contain UI element for launching the preferred note taking app.
+      When launched, the app will be able to create an app window on top of the lock screen, and create data items (notes) in the lock screen context. The app will be able to import created notes to the primary user session, when the session is unlocked. Currently, only Chrome note-taking apps are supported on the lock screen.
+
+      If the policy is set, the user will be allowed to enable an app on the lock screen only if the app's extension ID is contained in the policy list value.
+      As a consequence, setting this policy to an empty list will disable note-taking on the lock screen entirely.
+      Note that the policy containing an app ID does not necessarily mean that the user will be able to enable the app as a note-taking app on the lock screen - for example, on Chrome 61, the set of available apps is additionally restricted by the platform.
+
+      If the policy is left unset, there will be no restrictions on the set of apps the user can enable on the lock screen imposed by the policy.'''
+    },
   ],
   'messages': {
     # Messages that are not associated to any policies.

tools/metrics/histograms/enums.xml

@@ -11085,13 +11085,14 @@ uploading your change for review.  These are checked by presubmit scripts.
   <int value="367" label="InstantTetheringAllowed"/>
   <int value="368" label="RemoteAccessHostDomainList"/>
   <int value="369" label="RemoteAccessHostClientDomainList"/>
-  <int value="370" label="NetworkTimeQueriesEnabled"/>
+  <int value="370" label="BrowserNetworkTimeQueriesEnabled"/>
   <int value="371" label="DownloadRestrictions"/>
   <int value="372" label="DeviceSecondFactorAuthentication"/>
-  <int value="373" label="UseSystemDefaultPrinterAsDefault"/>
+  <int value="373" label="PrintPreviewUseSystemDefaultPrinter"/>
   <int value="374" label="DeviceEcryptfsMigrationStrategy"/>
   <int value="375" label="SafeBrowsingForTrustedSourcesEnabled"/>
   <int value="376" label="EcryptfsMigrationStrategy"/>
+  <int value="377" label="NoteTakingAppsLockScreenWhitelist"/>
 </enum>
 
 <enum name="EnterprisePolicyInvalidations">