Handle response of not initialized sync token API.

If the password sync token API was not initialized (e.g. by in-session
password change) token fetch on user online sign-in fails since the API
returns an empty list of tokens. In order to fix this case we added
token creation on first unsuccessful fetch attempt. As a result a valid
token will be created on first password change or first online sign-in
from any user device.

Bug: b/173394869
Change-Id: Iacad53c1306a41f22749818ccd5d3d65b26e4d3a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2547296Reviewed-by: Denis Kuznetsov [CET] <antrim@chromium.org>
Reviewed-by: Maksim Ivanov <emaxx@chromium.org>
Reviewed-by: Roman Sorokin [CET] <rsorokin@chromium.org>
Commit-Queue: Maciek Slusarczyk <mslus@chromium.org>
Cr-Commit-Position: refs/heads/master@{#829307}

chrome/browser/chromeos/login/saml/password_sync_token_verifier.cc

@@ -171,9 +171,16 @@ void PasswordSyncTokenVerifier::OnTokenVerified(bool is_valid) {
 void PasswordSyncTokenVerifier::OnApiCallFailed(
     PasswordSyncTokenFetcher::ErrorType error_type) {
   retry_backoff_.InformOfRequest(false);
-  // Schedule next token check with interval calculated with exponential
-  // backoff.
-  RecheckAfter(retry_backoff_.GetTimeUntilRelease());
+  password_sync_token_fetcher_.reset();
+  if (error_type == PasswordSyncTokenFetcher::ErrorType::kGetNoList ||
+      error_type == PasswordSyncTokenFetcher::ErrorType::kGetNoToken) {
+    // Token sync API has not been initialized yet. Create a sync token.
+    CreateTokenAsync();
+  } else {
+    // Schedule next token check with interval calculated with exponential
+    // backoff.
+    RecheckAfter(retry_backoff_.GetTimeUntilRelease());
+  }
 }
 
 }  // namespace chromeos

chrome/browser/chromeos/login/saml/password_sync_token_verifier_unittest.cc

@@ -201,6 +201,19 @@ TEST_F(PasswordSyncTokenVerifierTest, SyncTokenNotSet) {
       kSyncToken);
 }
 
+TEST_F(PasswordSyncTokenVerifierTest, InitialSyncTokenListEmpty) {
+  CreatePasswordSyncTokenVerifier();
+  verifier_->FetchSyncTokenOnReauth();
+  verifier_->OnApiCallFailed(PasswordSyncTokenFetcher::ErrorType::kGetNoList);
+  verifier_->OnTokenCreated(kSyncToken);
+  EXPECT_EQ(
+      user_manager::known_user::GetPasswordSyncToken(saml_login_account_id_),
+      kSyncToken);
+  EXPECT_EQ(
+      primary_profile_->GetPrefs()->GetString(prefs::kSamlPasswordSyncToken),
+      kSyncToken);
+}
+
 TEST_F(PasswordSyncTokenVerifierTest, SyncTokenInitForUser) {
   CreatePasswordSyncTokenVerifier();
   verifier_->FetchSyncTokenOnReauth();