Add a policy for the user experience of disabled features

Add a user policy to select the user experience of disabled features
listed in another policy 'SystemFeaturesDisableList'.

Bug: 1142785
Change-Id: I276eced7c9968e66988fbd2413ed09de35ee0bd9
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2512886
Commit-Queue: Anqing Zhao <anqing@chromium.org>
Reviewed-by: Sergey Poromov <poromov@chromium.org>
Reviewed-by: Aya Elsayed <ayaelattar@chromium.org>
Cr-Commit-Position: refs/heads/master@{#828982}

chrome/browser/chromeos/policy/system_features_disable_list_policy_handler.cc

@@ -19,6 +19,9 @@ const char kBrowserSettingsFeature[] = "browser_settings";
 const char kOsSettingsFeature[] = "os_settings";
 const char kScanningFeature[] = "scanning";
 
+const char kBlockedDisableMode[] = "blocked";
+const char kHiddenDisableMode[] = "hidden";
+
 const char kSystemFeaturesDisableListHistogram[] =
     "Enterprise.SystemFeaturesDisableList";
 
@@ -32,6 +35,8 @@ SystemFeaturesDisableListPolicyHandler::
 void SystemFeaturesDisableListPolicyHandler::RegisterPrefs(
     PrefRegistrySimple* registry) {
   registry->RegisterListPref(policy_prefs::kSystemFeaturesDisableList);
+  registry->RegisterStringPref(policy_prefs::kSystemFeaturesDisableMode,
+                               kBlockedDisableMode);
 }
 
 void SystemFeaturesDisableListPolicyHandler::ApplyList(

chrome/browser/chromeos/policy/system_features_disable_list_policy_handler.h

@@ -27,11 +27,23 @@ enum SystemFeature {
   kMaxValue = SCANNING
 };
 
+// A disabling mode that decides the user experience when a system feature is
+// added into SystemFeaturesDisableList policy.
+enum class SystemFeatureDisableMode {
+  kUnknownDisableMode = 0,
+  kBlocked = 1,  // The disabled feature is blocked.
+  kHidden = 2,   // The disabled feature is blocked and hidden.
+  kMaxValue = kHidden
+};
+
 extern const char kCameraFeature[];
 extern const char kBrowserSettingsFeature[];
 extern const char kOsSettingsFeature[];
 extern const char kScanningFeature[];
 
+extern const char kBlockedDisableMode[];
+extern const char kHiddenDisableMode[];
+
 extern const char kSystemFeaturesDisableListHistogram[];
 
 class SystemFeaturesDisableListPolicyHandler

chrome/browser/policy/configuration_policy_handler_list_factory.cc

@@ -1125,6 +1125,9 @@ const PolicyToPreferenceMapEntry kSimplePolicyMap[] = {
   { key::kDeviceArcDataSnapshotHours,
     arc::prefs::kArcSnapshotHours,
     base::Value::Type::DICTIONARY },
+  { key::kSystemFeaturesDisableMode,
+    policy::policy_prefs::kSystemFeaturesDisableMode,
+    base::Value::Type::STRING },
 #else  // defined(OS_CHROMEOS)
   { key::kMetricsReportingEnabled,
     metrics::prefs::kMetricsReportingEnabled,

chrome/test/data/policy/policy_test_cases.json

@@ -4041,6 +4041,16 @@
     ]
   },
 
+  "SystemFeaturesDisableMode": {
+    "os": ["chromeos"],
+    "policy_pref_mapping_test": [
+      {
+        "policies": { "SystemFeaturesDisableMode": "hidden" },
+        "prefs": { "policy.system_features_disable_mode": { "local_state": true } }
+      }
+    ]
+  },
+
   "SessionLengthLimit": {
     "os": ["chromeos"],
     "policy_pref_mapping_test": [

components/policy/core/common/policy_pref_names.cc

@@ -19,6 +19,10 @@ const char kSafeSitesFilterBehavior[] = "policy.safe_sites_filter_behavior";
 // "SystemFeaturesDisableList").
 const char kSystemFeaturesDisableList[] = "policy.system_features_disable_list";
 
+// Enum specifying the user experience of disabled features.
+// See the SystemFeaturesDisableMode policy for details.
+const char kSystemFeaturesDisableMode[] = "policy.system_features_disable_mode";
+
 // Blocks access to the listed host patterns.
 const char kUrlBlacklist[] = "policy.url_blacklist";
 

components/policy/core/common/policy_pref_names.h

@@ -18,6 +18,7 @@ POLICY_EXPORT extern const char kLastPolicyStatisticsUpdate[];
 POLICY_EXPORT extern const char kNativeWindowOcclusionEnabled[];
 POLICY_EXPORT extern const char kSafeSitesFilterBehavior[];
 POLICY_EXPORT extern const char kSystemFeaturesDisableList[];
+POLICY_EXPORT extern const char kSystemFeaturesDisableMode[];
 POLICY_EXPORT extern const char kUrlBlacklist[];
 POLICY_EXPORT extern const char kUrlWhitelist[];
 POLICY_EXPORT extern const char kUserPolicyRefreshRate[];

components/policy/resources/policy_templates.json

@@ -10966,12 +10966,54 @@
       'tags': [],
       'desc': '''Allows you to set a list of <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome OS</ex></ph> features to be disabled.
 
-      Disabling any of these features means that the user can't access it from the UI and will see it as "disabled by admin".
+      Disabling any of these features means that the user can't access it from the UI and will see it as "disabled by admin". The user experience of disabled features is decided by <ph name="SYSTEM_FEATURES_DISABLE_MODE">SystemFeaturesDisableMode</ph>
 
       If the policy is left not set, all <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome OS</ex></ph> features will be enabled by default and the user can use any of them.
 
       Note: The scanning feature is currently disabled by default via a feature flag. If the user enables the feature via the feature flag, the feature can still be disabled by this policy.''',
     },
+    {
+      'name': 'SystemFeaturesDisableMode',
+      'owners': ['anqing@chromium.org'],
+      'type': 'string-enum',
+      'schema': {
+        'type': 'string',
+        'enum': [
+          'blocked',
+          'hidden',
+        ],
+      },
+      'items': [
+        {
+          'name': 'blocked',
+          'value': 'blocked',
+          'caption': '''Block the disabled features''',
+        },
+        {
+          'name': 'hidden',
+          'value': 'hidden',
+          'caption': '''Hide and block the disabled features''',
+        },
+      ],
+      'future_on': ['chrome_os'],
+      'features': {
+        'can_be_recommended': False,
+        'dynamic_refresh': True,
+        'per_profile': False,
+      },
+      'example_value': 'blocked',
+      'default': 'blocked',
+      'id': 807,
+      'caption': '''Set the user experience of disabled features''',
+      'tags': [],
+      'desc': '''Controls the user experience of disabled features listed in <ph name="SYSTEM_FEATURES_DISABLE_LIST">SystemFeaturesDisableList</ph>.
+
+      If this policy is set to "blocked", the disabled features will become unusable but still visible to users.
+
+      If this policy is set to "hidden", the disabled features will become unusable and invisible to users.
+
+      If this policy is left unset or has an invalid value, the disable mode of system features will be "blocked".''',
+    },
     {
       'name': 'FloatingAccessibilityMenuEnabled',
       'owners': ['apotapchuk@chromium.org'],
@@ -24745,6 +24787,6 @@ The recommended way to configure policy on Windows is via GPO, although provisio
   'placeholders': [],
   'deleted_policy_ids': [114, 115, 204, 205, 206, 412, 476, 544, 546, 562, 569, 578, 583, 585, 586, 587, 588, 589, 590, 591, 600, 668, 669],
   'deleted_atomic_policy_group_ids': [19],
-  'highest_id_currently_used': 806,
+  'highest_id_currently_used': 807,
   'highest_atomic_group_id_currently_used': 40
 }

tools/metrics/histograms/enums.xml

@@ -22570,6 +22570,7 @@ Called by update_document_policy_enum.py.-->
   <int value="804" label="FullscreenAlertEnabled"/>
   <int value="805" label="NTPCardsVisible"/>
   <int value="806" label="BasicAuthOverHttpEnabled"/>
+  <int value="807" label="SystemFeaturesDisableMode"/>
 </enum>
 
 <enum name="EnterprisePolicyDeviceIdValidity">