Add user policy check in Plugin VM allowance logic

Checks for UserPluginVmAllowed user policy stored in PluginVmAllowed
pref in order to allow Plugin VM only if corresponding user policy is set to
true.

Test: unit_tests --gtest_filter="*PluginVm*"
Bug: 1081744
Change-Id: Id4e6eadc651a9dc2d30b7f137759bcdacae5ab5b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2198782
Commit-Queue: Olya Kalitova <okalitova@chromium.org>
Reviewed-by: Roman Sorokin [CET] <rsorokin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#768560}

chrome/browser/chromeos/plugin_vm/plugin_vm_test_helper.cc

@@ -99,6 +99,8 @@ PluginVmTestHelper::PluginVmTestHelper(TestingProfile* testing_profile)
 PluginVmTestHelper::~PluginVmTestHelper() = default;
 
 void PluginVmTestHelper::SetPolicyRequirementsToAllowPluginVm() {
+  testing_profile_->GetPrefs()->SetBoolean(plugin_vm::prefs::kPluginVmAllowed,
+                                           true);
   testing_profile_->ScopedCrosSettingsTestHelper()->SetBoolean(
       chromeos::kPluginVmAllowed, true);
   testing_profile_->ScopedCrosSettingsTestHelper()->SetString(

chrome/browser/chromeos/plugin_vm/plugin_vm_util.cc

@@ -55,7 +55,8 @@ static std::string& GetFakeUserId() {
 // * PluginVm feature should be enabled.
 // * Device should be enterprise enrolled:
 //   * User should be affiliated.
-//   * PluginVmAllowed should be set.
+//   * PluginVmAllowed device policy should be set to true.
+//   * UserPluginVmAllowed user policy should be set to true.
 // * At least one of the following should be set:
 //   * PluginVmLicenseKey policy.
 //   * PluginVmUserId policy.
@@ -93,7 +94,9 @@ bool IsPluginVmAllowedForProfile(const Profile* profile) {
           chromeos::kPluginVmAllowed, &plugin_vm_allowed_for_device)) {
     return false;
   }
-  if (!plugin_vm_allowed_for_device)
+  bool plugin_vm_allowed_for_user =
+      profile->GetPrefs()->GetBoolean(plugin_vm::prefs::kPluginVmAllowed);
+  if (!plugin_vm_allowed_for_device || !plugin_vm_allowed_for_user)
     return false;
 
   if (GetPluginVmLicenseKey().empty() && GetPluginVmUserId().empty())
@@ -224,7 +227,13 @@ PluginVmPolicySubscription::PluginVmPolicySubscription(
   DCHECK(chromeos::CrosSettings::IsInitialized());
   chromeos::CrosSettings* cros_settings = chromeos::CrosSettings::Get();
   // Subscriptions are automatically removed when this object is destroyed.
-  allowed_subscription_ = cros_settings->AddSettingsObserver(
+  user_allowed_pref_change_registrar_ = std::make_unique<PrefChangeRegistrar>();
+  user_allowed_pref_change_registrar_->Init(profile->GetPrefs());
+  user_allowed_pref_change_registrar_->Add(
+      plugin_vm::prefs::kPluginVmAllowed,
+      base::BindRepeating(&PluginVmPolicySubscription::OnPolicyChanged,
+                          base::Unretained(this)));
+  device_allowed_subscription_ = cros_settings->AddSettingsObserver(
       chromeos::kPluginVmAllowed,
       base::BindRepeating(&PluginVmPolicySubscription::OnPolicyChanged,
                           base::Unretained(this)));

chrome/browser/chromeos/plugin_vm/plugin_vm_util.h

@@ -122,8 +122,9 @@ class PluginVmPolicySubscription {
   // The user-provided callback method.
   PluginVmAllowedChanged callback_;
 
+  std::unique_ptr<PrefChangeRegistrar> user_allowed_pref_change_registrar_;
   std::unique_ptr<chromeos::CrosSettings::ObserverSubscription>
-      allowed_subscription_;
+      device_allowed_subscription_;
   std::unique_ptr<chromeos::CrosSettings::ObserverSubscription>
       license_subscription_;
   std::unique_ptr<base::CallbackList<void(void)>::Subscription>

chrome/browser/chromeos/plugin_vm/plugin_vm_util_unittest.cc

@@ -116,6 +116,11 @@ TEST_F(PluginVmUtilTest, AddPluginVmPolicyObserver) {
   EXPECT_CALL(*this, OnPolicyChanged(true));
   testing_profile_->ScopedCrosSettingsTestHelper()->SetBoolean(
       chromeos::kPluginVmAllowed, true);
+  testing::Mock::VerifyAndClearExpectations(this);
+
+  EXPECT_CALL(*this, OnPolicyChanged(false));
+  testing_profile_->GetPrefs()->SetBoolean(plugin_vm::prefs::kPluginVmAllowed,
+                                           false);
 }
 
 TEST_F(PluginVmUtilTest, DriveLinkDetection) {

chrome/browser/ui/views/plugin_vm/plugin_vm_installer_view_browsertest.cc

@@ -80,7 +80,7 @@ class PluginVmInstallerViewBrowserTest : public DialogBrowserTest {
   void AllowPluginVm() {
     EnterpriseEnrollDevice();
     SetUserWithAffiliation();
-    SetPluginVmDevicePolicies();
+    SetPluginVmPolicies();
     // Set correct PluginVmImage preference value.
     SetPluginVmImagePref(embedded_test_server()->GetURL(kZipFile).spec(),
                          kZipFileHash);
@@ -139,7 +139,11 @@ class PluginVmInstallerViewBrowserTest : public DialogBrowserTest {
                                                            "device_id");
   }
 
-  void SetPluginVmDevicePolicies() {
+  void SetPluginVmPolicies() {
+    // User polcies.
+    browser()->profile()->GetPrefs()->SetBoolean(
+        plugin_vm::prefs::kPluginVmAllowed, true);
+    // Device policies.
     scoped_testing_cros_settings_.device_settings()->Set(
         chromeos::kPluginVmAllowed, base::Value(true));
     scoped_testing_cros_settings_.device_settings()->Set(