Add Ephemeral Guest profiles.

This CL adds a new Guest profile type without the enforced OTR layer
over it. In subsequent CLs, all calls to |IsGuestSession| function
should be audited and based on whether they are needed for new profiles
or not, would be covered by |IsEphemeralGuestProfile| as well.

Please refer to go/guest-on-disk for more context.

Bug: 1125474
Change-Id: I2516e3d0822c6753ddb2421e2756ac51c38e49df
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2434925Reviewed-by: Peter Kasting <pkasting@chromium.org>
Reviewed-by: Mihai Sardarescu <msarda@chromium.org>
Commit-Queue: Ramin Halavati <rhalavati@chromium.org>
Cr-Commit-Position: refs/heads/master@{#813627}

chrome/browser/profiles/off_the_record_profile_impl.cc

@@ -144,7 +144,10 @@ void OffTheRecordProfileImpl::Init() {
 
   // Must be done before CreateBrowserContextServices(), since some of them
   // change behavior based on whether the provided context is a guest session.
-  set_is_guest_profile(profile_->IsGuestSession());
+  // TODO(https://crbug.com/1125474): Remove |IsEphemeralGuestProfile| when
+  // Incognito is disabled for ephemeral Guest profiles.
+  set_is_guest_profile(profile_->IsGuestSession() ||
+                       profile_->IsEphemeralGuestProfile());
 
   BrowserContextDependencyManager::GetInstance()->CreateBrowserContextServices(
       this);

chrome/browser/profiles/profile.cc

@@ -19,6 +19,7 @@
 #include "chrome/browser/signin/identity_manager_factory.h"
 #include "chrome/browser/sync/profile_sync_service_factory.h"
 #include "chrome/common/buildflags.h"
+#include "chrome/common/chrome_features.h"
 #include "chrome/common/pref_names.h"
 #include "components/data_reduction_proxy/core/browser/data_reduction_proxy_prefs.h"
 #include "components/keyed_service/content/browser_context_dependency_manager.h"
@@ -371,7 +372,20 @@ bool Profile::IsRegularProfile() const {
 }
 
 bool Profile::IsIncognitoProfile() const {
-  return IsPrimaryOTRProfile() && !IsGuestSession();
+  // TODO(https://crbug.com/1125474): Remove |IsEphemeralGuestProfile| when
+  // Incognito is disabled for ephemeral Guest profiles.
+  return IsPrimaryOTRProfile() && !IsGuestSession() &&
+         !IsEphemeralGuestProfile();
+}
+
+// static
+bool Profile::IsEphemeralGuestProfileEnabled() {
+#if defined(OS_WIN) || defined(OS_LINUX) || defined(OS_MAC)
+  return base::FeatureList::IsEnabled(
+      features::kEnableEphemeralGuestProfilesOnDesktop);
+#else
+  return false;
+#endif
 }
 
 bool Profile::IsGuestSession() const {
@@ -390,10 +404,14 @@ bool Profile::IsGuestSession() const {
                ->session_type == crosapi::mojom::SessionType::kGuestSession;
   }
 #endif  // BUILDFLAG(IS_LACROS)
-  return is_guest_profile_;
+  return is_guest_profile_ && !IsEphemeralGuestProfileEnabled();
 #endif  // defined(OS_CHROMEOS)
 }
 
+bool Profile::IsEphemeralGuestProfile() const {
+  return is_guest_profile_ && IsEphemeralGuestProfileEnabled();
+}
+
 bool Profile::IsSystemProfile() const {
   return is_system_profile_;
 }

chrome/browser/profiles/profile.h

@@ -411,10 +411,24 @@ class Profile : public content::BrowserContext {
   // OffTheRecord profile used for incognito mode and guest sessions.
   bool IsPrimaryOTRProfile() const;
 
-  // Returns whether it is a guest session. This covers both the guest profile
-  // and its parent.
+  // Returns whether ephemeral Guest profiles are enabled.
+  static bool IsEphemeralGuestProfileEnabled();
+
+  // Returns whether it is a Guest session. This covers both regular and
+  // off-the-record profiles of a Guest session.
+  // This function only returns true for non-ephemeral Guest sessions.
+  // TODO(https://crbug.com/1125474): Audit all use cases and consider adding
+  // |IsEphemeralGuestProfile|. Remove after audit is done on all relevant
+  // platforms and non-ephemeral Guest profiles are deprecated.
   virtual bool IsGuestSession() const;
 
+  // Returns whether it is an ephemeral Guest profile. This covers both regular
+  // and off-the-record profiles of a Guest session.
+  // TODO(https://crbug.com/1125474): After auditing all use cases of
+  // |IsGuestSession| on all platforms and removal of all calls to
+  // |IsGuestSession|, rename to |IsGuestProfile|.
+  virtual bool IsEphemeralGuestProfile() const;
+
   // Returns whether it is a system profile.
   virtual bool IsSystemProfile() const;
 

chrome/browser/profiles/profile_manager.cc

@@ -793,8 +793,16 @@ base::FilePath ProfileManager::GetGuestProfilePath() {
 
   ProfileManager* profile_manager = g_browser_process->profile_manager();
 
-  base::FilePath guest_path = profile_manager->user_data_dir();
-  return guest_path.Append(chrome::kGuestProfileDir);
+  // TODO(https://crbug.com/1125474): Consider adding a different naming system
+  // for Guest profiles.
+  if (profile_manager->guest_profile_path_.empty()) {
+    profile_manager->guest_profile_path_ =
+        Profile::IsEphemeralGuestProfileEnabled()
+            ? profile_manager->GenerateNextProfileDirectoryPath()
+            : profile_manager->user_data_dir().Append(chrome::kGuestProfileDir);
+  }
+
+  return profile_manager->guest_profile_path_;
 }
 
 // static
@@ -1616,6 +1624,27 @@ void ProfileManager::FinishDeletingProfile(
   // Prevents CreateProfileAsync from re-creating the profile.
   MarkProfileDirectoryForDeletion(profile_dir);
 }
+
+// static
+void ProfileManager::CleanUpGuestProfile() {
+// ChromeOS handles guest data independently.
+#if !defined(OS_CHROMEOS)
+  ProfileManager* profile_manager = g_browser_process->profile_manager();
+
+  Profile* profile =
+      profile_manager->GetProfileByPath(profile_manager->GetGuestProfilePath());
+  if (profile) {
+    // Clear all browsing data once a Guest Session completes. The Guest
+    // profile has BrowserContextKeyedServices that the ProfileDestroyer
+    // can't delete it properly.
+    // TODO(https://crbug.com/88586): Delete the guest when regular profiles
+    // become deletable when not needed.
+    profiles::RemoveBrowsingDataForProfile(GetGuestProfilePath());
+  }
+  profile_manager->guest_profile_path_.clear();
+#endif  //! defined(OS_CHROMEOS)
+}
+
 #endif  // !defined(OS_ANDROID)
 
 ProfileManager::ProfileInfo* ProfileManager::RegisterProfile(
@@ -1726,6 +1755,9 @@ void ProfileManager::AddProfileToStorage(Profile* profile) {
       storage.GetProfileAttributesWithPath(profile->GetPath(), &entry);
   DCHECK(has_entry);
 
+  if (profile->IsEphemeralGuestProfile())
+    profile->GetPrefs()->SetBoolean(prefs::kForceEphemeralProfiles, true);
+
   if (profile->GetPrefs()->GetBoolean(prefs::kForceEphemeralProfiles))
     entry->SetIsEphemeral(true);
 
@@ -1775,7 +1807,7 @@ void ProfileManager::SaveActiveProfiles() {
   for (it = active_profiles_.begin(); it != active_profiles_.end(); ++it) {
     // crbug.com/823338 -> CHECK that the profiles aren't guest or incognito,
     // causing a crash during session restore.
-    CHECK(!(*it)->IsGuestSession())
+    CHECK((!(*it)->IsGuestSession()) && (!(*it)->IsEphemeralGuestProfile()))
         << "Guest profiles shouldn't be saved as active profiles";
     CHECK(!(*it)->IsOffTheRecord())
         << "OTR profiles shouldn't be saved as active profiles";
@@ -1829,6 +1861,9 @@ void ProfileManager::OnBrowserClosed(Browser* browser) {
       return;
   }
 
+  if (profile->IsGuestSession() || profile->IsEphemeralGuestProfile())
+    CleanUpGuestProfile();
+
   base::FilePath path = profile->GetPath();
   if (IsProfileDirectoryMarkedForDeletion(path)) {
     // Do nothing if the profile is already being deleted.

chrome/browser/profiles/profile_manager.h

@@ -215,6 +215,9 @@ class ProfileManager : public content::NotificationObserver,
   // that case the callback will be called when profile creation is complete.
   void ScheduleProfileForDeletion(const base::FilePath& profile_dir,
                                   ProfileLoadedCallback callback);
+
+  // Deletes Guest profile's browsing data.
+  static void CleanUpGuestProfile();
 #endif
 
   // Autoloads profiles if they are running background apps.
@@ -458,6 +461,9 @@ class ProfileManager : public content::NotificationObserver,
   // Controls whether to initialize some services. Only disabled for testing.
   bool do_final_services_init_ = true;
 
+  // Path to Guest profile. Can be empty when the profile does not exist.
+  base::FilePath guest_profile_path_;
+
   // TODO(chrome/browser/profiles/OWNERS): Usage of this in profile_manager.cc
   // should likely be turned into DCHECK_CURRENTLY_ON(BrowserThread::UI) for
   // consistency with surrounding code in the same file but that wasn't trivial

chrome/browser/ui/browser.cc

@@ -602,19 +602,9 @@ Browser::~Browser() {
   //
   // Non-primary OffTheRecord profiles should not be destroyed directly by
   // Browser (e.g. for offscreen tabs, https://crbug.com/664351).
-  if (profile_->IsPrimaryOTRProfile() &&
+  if (profile_->IsIncognitoProfile() &&
       !BrowserList::IsOffTheRecordBrowserInUse(profile_) &&
       !profile_->GetOriginalProfile()->IsSystemProfile()) {
-    if (profile_->IsGuestSession()) {
-// ChromeOS handles guest data independently.
-#if !defined(OS_CHROMEOS)
-      // Clear all browsing data once a Guest Session completes. The Guest
-      // profile has BrowserContextKeyedServices that the Incognito profile
-      // doesn't, so the ProfileDestroyer can't delete it properly.
-      // TODO(mlerman): Delete the guest using an improved ProfileDestroyer.
-      profiles::RemoveBrowsingDataForProfile(profile_->GetPath());
-#endif
-    } else {
 #if BUILDFLAG(ENABLE_PRINT_PREVIEW)
       // The Printing Background Manager holds onto preview dialog WebContents
       // whose corresponding print jobs have not yet fully spooled. Make sure
@@ -627,7 +617,6 @@ Browser::~Browser() {
       // its cache and cookies once it gets destroyed at the appropriate time.
       ProfileDestroyer::DestroyProfileWhenAppropriate(profile_);
   }
-  }
 
   // There may be pending file dialogs, we need to tell them that we've gone
   // away so they don't try and call back to us.