Add the unlisted feature tag for policy templates

The unlisted tag is designed for policies that are not controlled by
admin directly but set by the device management server directly. Because
of that, the tag can only be used by cloud_only policies.

The unlisted policies will be hidden from all documentation and template
generators. On the  Chromium side, this is achieved by the cloud_only
tag.

Bug: 1117637
Change-Id: I8e6e2bdb681a3e68897ec9e41f285805dc2e37d4
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2436697Reviewed-by: Julian Pastarmov <pastarmovj@chromium.org>
Commit-Queue: Owen Min <zmin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#812112}

components/policy/resources/policy_templates.json

@@ -143,13 +143,18 @@
 #   'per_profile' controls whether a user policy applies to every user logging
 #   into the browser or only one profile.
 #   'cloud_only' Set to True if the policy is forced or recommended to set from
-#   Admin console only. This hides the policy from policy templates and
-#   documentation.
+#   Admin console only. This hides the policy from policy templates and Chrome
+#   documentation in policy_templates.zip. The documentation will NOT be hidden
+#   from the https://cloud.google.com/docs/chrome-enterprise/policies/.
 #   'platform_only' Set to True if the policy can only be set from platform
 #   policy but do not support Admin console. This is only used as a hint for
 #   Admin console.
 #   'internal_only' Set to True if the policy is used for internal development
 #   or testing purposes and will never be used by any external administrator.
+#   'unlisted' Set to True if the policy is controlled by Admin Console
+#   without any user interface for administrator. It can only be used for
+#   policies with the 'cloud_only' tag. Policy with the 'unlisted' tag will be
+#   hidden from all documentations, policy templates and Admin Console UI.
 #
 #   The 'max_size' key is used to specify the maximal size of the external data
 #   that a policy can reference, in bytes. This annotation is compulsory for
@@ -23636,6 +23641,10 @@ The recommended way to configure policy on Windows is via GPO, although provisio
       'desc': '''The name of the feature that indicates whether a policy is used for internal development or testing purposes.''',
       'text': '''Internal Only'''
     },
+    'doc_feature_unlisted': {
+      'desc': '''The name of the feature that indicates whether a policy is set from cloud without any user interface.''',
+      'text': '''Private Only'''
+    },
     'doc_deprecated': {
       'desc': '''Text appended in parentheses to the policy name to indicate that it has been deprecated''',
       'text': 'deprecated',

components/policy/tools/syntax_check_policy_template_json.py

@@ -749,9 +749,21 @@ class PolicyTemplateChecker(object):
                                           optional=True,
                                           container_name='features')
 
+      # 'private' feature must be an optional boolean flag.
+      is_unlisted = self._CheckContains(features,
+                                        'unlisted',
+                                        bool,
+                                        optional=True,
+                                        container_name='features')
+
       if cloud_only and platform_only:
-        self._Error("cloud_only and platfrom_only must not be true at the same "
-                    "time.")
+        self._Error(
+            'cloud_only and platfrom_only must not be true at the same '
+            'time.', 'policy', policy.get('name'))
+
+      if is_unlisted and not cloud_only:
+        self._Error('unlisted can only be used by cloud_only policy.', 'policy',
+                    policy.get('name'))
 
 
       # Chrome OS policies may have a non-empty supported_chrome_os_management