Change SyncAuthManager to explicitly check error state of refresh token

When SyncAuthManager receives an OnRefreshTokenUpdatedForAccount()
observer callback from IdentityManager, it queries the value of the
|is_valid| parameter. However, we are going to be removing that
parameter altogether as it is confusing for the common case where
consumers *shouldn't* check it.

This CL changes SyncAuthManager to compute the validity internally by
querying the error state of the refresh token via IdentityManager.
There should be no functional change.

The logic of the computation of whether the refresh token is valid is
taken from the internal computation of the |is_valid| parameter that
IdentityManager does. As a followup, we can consider re-hiding that
logic inside IdentityManager via a helper method to reduce fragility.

Bug: 908412
Change-Id: I4842652dc63bea7169e4e915b5f4382e9291a0ea
Reviewed-on: https://chromium-review.googlesource.com/c/1350888
Commit-Queue: Marc Treib <treib@chromium.org>
Commit-Queue: Colin Blundell <blundell@chromium.org>
Reviewed-by: Marc Treib <treib@chromium.org>
Cr-Commit-Position: refs/heads/master@{#612120}

components/browser_sync/sync_auth_manager.cc

@@ -269,7 +269,25 @@ void SyncAuthManager::OnRefreshTokenUpdatedForAccount(
     return;
   }
 
-  if (!is_valid) {
+  // Compute the validity of the new refresh token: The identity code sets an
+  // account's refresh token to be invalid (error
+  // CREDENTIALS_REJECTED_BY_CLIENT) if the user signs out of that account on
+  // the web.
+  // TODO(blundell): Hide this logic inside IdentityManager.
+  // NOTE: We don't use |is_valid| because we will shortly be eliminating that
+  // parameter. TODO(https://crbug.com/908412): Eliminate that parameter and
+  // this comment.
+  bool is_refresh_token_valid = true;
+  GoogleServiceAuthError token_error =
+      identity_manager_->GetErrorStateOfRefreshTokenForAccount(
+          account_info.account_id);
+  if (token_error == GoogleServiceAuthError::FromInvalidGaiaCredentialsReason(
+                         GoogleServiceAuthError::InvalidGaiaCredentialsReason::
+                             CREDENTIALS_REJECTED_BY_CLIENT)) {
+    is_refresh_token_valid = false;
+  }
+
+  if (!is_refresh_token_valid) {
     // When the refresh token is replaced by an invalid token, Sync must be
     // stopped immediately, even if the current access token is still valid.
     // This happens e.g. when the user signs out of the web with Dice enabled.