kiosk: Support update url for enterprise.

- Bring back kiosk update url in device local account policy;
- Use the update url from policy to initialize kiosk cache;

BUG=345123
TEST=KioskEnterpriseTest.PrivateStore

Review URL: https://codereview.chromium.org/676913002

Cr-Commit-Position: refs/heads/master@{#301437}

chrome/browser/chromeos/app_mode/fake_cws.cc

@@ -31,10 +31,34 @@ const char kCrxDownloadPath[] = "/chromeos/app_mode/webstore/downloads/";
 
 }  // namespace
 
+FakeCWS::FakeCWS() : update_check_count_(0) {
+}
+
+FakeCWS::~FakeCWS() {
+}
+
 void FakeCWS::Init(EmbeddedTestServer* embedded_test_server) {
-  SetupWebStore(embedded_test_server->base_url());
-  SetupWebStoreGalleryUrl();
-  SetupCrxDownloadAndUpdateUrls(embedded_test_server);
+  has_update_template_ =
+      "chromeos/app_mode/webstore/update_check/has_update.xml";
+  no_update_template_ = "chromeos/app_mode/webstore/update_check/no_update.xml";
+  update_check_end_point_ = "/update_check.xml";
+
+  SetupWebStoreURL(embedded_test_server->base_url());
+  OverrideGalleryCommandlineSwitches();
+  embedded_test_server->RegisterRequestHandler(
+      base::Bind(&FakeCWS::HandleRequest, base::Unretained(this)));
+}
+
+void FakeCWS::InitAsPrivateStore(EmbeddedTestServer* embedded_test_server,
+                                 const std::string& update_check_end_point) {
+  has_update_template_ =
+      "chromeos/app_mode/webstore/update_check/has_update_private_store.xml";
+  no_update_template_ = "chromeos/app_mode/webstore/update_check/no_update.xml";
+  update_check_end_point_ = update_check_end_point;
+
+  SetupWebStoreURL(embedded_test_server->base_url());
+  embedded_test_server->RegisterRequestHandler(
+      base::Bind(&FakeCWS::HandleRequest, base::Unretained(this)));
 }
 
 void FakeCWS::SetUpdateCrx(const std::string& app_id,
@@ -54,7 +78,7 @@ void FakeCWS::SetUpdateCrx(const std::string& app_id,
   const std::string sha256_hex = base::HexEncode(sha256.c_str(), sha256.size());
 
   SetUpdateCheckContent(
-      "chromeos/app_mode/webstore/update_check/has_update.xml",
+      has_update_template_,
       crx_download_url,
       app_id,
       sha256_hex,
@@ -64,7 +88,7 @@ void FakeCWS::SetUpdateCrx(const std::string& app_id,
 }
 
 void FakeCWS::SetNoUpdate(const std::string& app_id) {
-  SetUpdateCheckContent("chromeos/app_mode/webstore/update_check/no_update.xml",
+  SetUpdateCheckContent(no_update_template_,
                         GURL(),
                         app_id,
                         "",
@@ -73,39 +97,36 @@ void FakeCWS::SetNoUpdate(const std::string& app_id) {
                         &update_check_content_);
 }
 
-void FakeCWS::SetupWebStore(const GURL& test_server_url) {
+int FakeCWS::GetUpdateCheckCountAndReset() {
+  int current_count = update_check_count_;
+  update_check_count_ = 0;
+  return current_count;
+}
+
+void FakeCWS::SetupWebStoreURL(const GURL& test_server_url) {
   std::string webstore_host(kWebstoreDomain);
   GURL::Replacements replace_webstore_host;
   replace_webstore_host.SetHostStr(webstore_host);
   web_store_url_ = test_server_url.ReplaceComponents(replace_webstore_host);
 }
 
-void FakeCWS::SetupWebStoreGalleryUrl() {
-  CommandLine::ForCurrentProcess()->AppendSwitchASCII(
+void FakeCWS::OverrideGalleryCommandlineSwitches() {
+  DCHECK(web_store_url_.is_valid());
+
+  CommandLine* command_line = CommandLine::ForCurrentProcess();
+
+  command_line->AppendSwitchASCII(
       ::switches::kAppsGalleryURL,
       web_store_url_.Resolve("/chromeos/app_mode/webstore").spec());
-}
 
-void FakeCWS::SetupCrxDownloadAndUpdateUrls(
-    EmbeddedTestServer* embedded_test_server) {
-  SetupCrxDownloadUrl();
-  SetupCrxUpdateUrl(embedded_test_server);
-}
-
-void FakeCWS::SetupCrxDownloadUrl() {
   std::string downloads_path = std::string(kCrxDownloadPath).append("%s.crx");
   GURL downloads_url = web_store_url_.Resolve(downloads_path);
-  CommandLine::ForCurrentProcess()->AppendSwitchASCII(
-      ::switches::kAppsGalleryDownloadURL, downloads_url.spec());
-}
-
-void FakeCWS::SetupCrxUpdateUrl(EmbeddedTestServer* embedded_test_server) {
-  GURL update_url = web_store_url_.Resolve("/update_check.xml");
-  CommandLine::ForCurrentProcess()->AppendSwitchASCII(
-      ::switches::kAppsGalleryUpdateURL, update_url.spec());
+  command_line->AppendSwitchASCII(::switches::kAppsGalleryDownloadURL,
+                                  downloads_url.spec());
 
-  embedded_test_server->RegisterRequestHandler(
-      base::Bind(&FakeCWS::HandleRequest, base::Unretained(this)));
+  GURL update_url = web_store_url_.Resolve(update_check_end_point_);
+  command_line->AppendSwitchASCII(::switches::kAppsGalleryUpdateURL,
+                                  update_url.spec());
 }
 
 void FakeCWS::SetUpdateCheckContent(const std::string& update_check_file,
@@ -133,7 +154,8 @@ scoped_ptr<HttpResponse> FakeCWS::HandleRequest(const HttpRequest& request) {
   GURL request_url = GURL("http://localhost").Resolve(request.relative_url);
   std::string request_path = request_url.path();
   if (!update_check_content_.empty() &&
-      request_path.find("/update_check.xml") != std::string::npos) {
+      request_path.find(update_check_end_point_) != std::string::npos) {
+    ++update_check_count_;
     scoped_ptr<BasicHttpResponse> http_response(new BasicHttpResponse());
     http_response->set_code(net::HTTP_OK);
     http_response->set_content_type("text/xml");

chrome/browser/chromeos/app_mode/fake_cws.h

@@ -12,26 +12,41 @@
 
 namespace chromeos {
 
+// Simple fake CWS update check request handler that returns a fixed update
+// check response. The response is created either from SetUpdateCrx() or
+// SetNoUpdate().
 class FakeCWS {
  public:
-  FakeCWS() {}
-  virtual ~FakeCWS() {}
+  FakeCWS();
+  ~FakeCWS();
 
+  // Initializes as CWS request handler and overrides app gallery command line
+  // switches.
   void Init(net::test_server::EmbeddedTestServer* embedded_test_server);
-  // Sets up the kiosk app update response.
+
+  // Initializes as a private store handler using the given server and URL end
+  // point. Private store does not override app gallery command lines and use a
+  // slightly different template (as documented on
+  // https://developer.chrome.com/extensions/autoupdate).
+  void InitAsPrivateStore(
+      net::test_server::EmbeddedTestServer* embedded_test_server,
+      const std::string& update_check_end_point);
+
+  // Sets up the update check response with has_update template.
   void SetUpdateCrx(const std::string& app_id,
                     const std::string& crx_file,
                     const std::string& version);
+
+  // Sets up the update check response with no_update template.
   void SetNoUpdate(const std::string& app_id);
 
+  // Returns the current |update_check_count_| and resets it.
+  int GetUpdateCheckCountAndReset();
+
  private:
-  void SetupWebStore(const GURL& test_server_url);
-  void SetupWebStoreGalleryUrl();
-  void SetupCrxDownloadAndUpdateUrls(
-      net::test_server::EmbeddedTestServer* embedded_test_server);
-  void SetupCrxDownloadUrl();
-  void SetupCrxUpdateUrl(
-      net::test_server::EmbeddedTestServer* embedded_test_server);
+  void SetupWebStoreURL(const GURL& test_server_url);
+  void OverrideGalleryCommandlineSwitches();
+
   // Sets up |update_check_content_| used in update request response later by
   // kiosk app update server request handler |HandleRequest|.
   void SetUpdateCheckContent(const std::string& update_check_file,
@@ -41,12 +56,19 @@ class FakeCWS {
                              const std::string& crx_size,
                              const std::string& version,
                              std::string* update_check_content);
+
   // Request handler for kiosk app update server.
   scoped_ptr<net::test_server::HttpResponse> HandleRequest(
       const net::test_server::HttpRequest& request);
 
   GURL web_store_url_;
+
+  std::string has_update_template_;
+  std::string no_update_template_;
+  std::string update_check_end_point_;
+
   std::string update_check_content_;
+  int update_check_count_;
 
   DISALLOW_COPY_AND_ASSIGN(FakeCWS);
 };

chrome/browser/chromeos/app_mode/kiosk_app_data.cc

@@ -257,11 +257,13 @@ class KioskAppData::WebstoreDataParser
 
 KioskAppData::KioskAppData(KioskAppDataDelegate* delegate,
                            const std::string& app_id,
-                           const std::string& user_id)
+                           const std::string& user_id,
+                           const GURL& update_url)
     : delegate_(delegate),
       status_(STATUS_INIT),
       app_id_(app_id),
-      user_id_(user_id) {
+      user_id_(user_id),
+      update_url_(update_url) {
 }
 
 KioskAppData::~KioskAppData() {}

chrome/browser/chromeos/app_mode/kiosk_app_data.h

@@ -13,6 +13,7 @@
 #include "base/memory/weak_ptr.h"
 #include "chrome/browser/extensions/webstore_data_fetcher_delegate.h"
 #include "ui/gfx/image/image_skia.h"
+#include "url/gurl.h"
 
 class Profile;
 
@@ -51,7 +52,8 @@ class KioskAppData : public base::SupportsWeakPtr<KioskAppData>,
 
   KioskAppData(KioskAppDataDelegate* delegate,
                const std::string& app_id,
-               const std::string& user_id);
+               const std::string& user_id,
+               const GURL& update_url);
   virtual ~KioskAppData();
 
   // Loads app data from cache. If there is no cached data, fetches it
@@ -70,6 +72,7 @@ class KioskAppData : public base::SupportsWeakPtr<KioskAppData>,
   const std::string& app_id() const { return app_id_; }
   const std::string& user_id() const { return user_id_; }
   const std::string& name() const { return name_; }
+  const GURL& update_url() const { return update_url_; }
   const gfx::ImageSkia& icon() const { return icon_; }
   const base::RefCountedString* raw_icon() const {
     return raw_icon_.get();
@@ -129,6 +132,7 @@ class KioskAppData : public base::SupportsWeakPtr<KioskAppData>,
   std::string app_id_;
   std::string user_id_;
   std::string name_;
+  GURL update_url_;
   gfx::ImageSkia icon_;
   scoped_refptr<base::RefCountedString> raw_icon_;
 

chrome/browser/chromeos/app_mode/kiosk_app_manager.cc

@@ -35,6 +35,7 @@
 #include "chromeos/settings/cros_settings_names.h"
 #include "components/ownership/owner_key_util.h"
 #include "content/public/browser/browser_thread.h"
+#include "extensions/common/extension_urls.h"
 
 namespace chromeos {
 
@@ -275,7 +276,8 @@ void KioskAppManager::AddApp(const std::string& app_id) {
   device_local_accounts.push_back(policy::DeviceLocalAccount(
       policy::DeviceLocalAccount::TYPE_KIOSK_APP,
       GenerateKioskAppAccountId(app_id),
-      app_id));
+      app_id,
+      std::string()));
 
   policy::SetDeviceLocalAccounts(CrosSettings::Get(), device_local_accounts);
 }
@@ -517,16 +519,14 @@ void KioskAppManager::UpdateAppData() {
     if (it->account_id == auto_login_account_id)
       auto_launch_app_id_ = it->kiosk_app_id;
 
-    // TODO(mnissler): Support non-CWS update URLs.
-
     std::map<std::string, KioskAppData*>::iterator old_it =
         old_apps.find(it->kiosk_app_id);
     if (old_it != old_apps.end()) {
       apps_.push_back(old_it->second);
       old_apps.erase(old_it);
     } else {
-      KioskAppData* new_app =
-          new KioskAppData(this, it->kiosk_app_id, it->user_id);
+      KioskAppData* new_app = new KioskAppData(
+          this, it->kiosk_app_id, it->user_id, GURL(it->kiosk_app_update_url));
       apps_.push_back(new_app);  // Takes ownership of |new_app|.
       new_app->Load();
     }
@@ -550,7 +550,15 @@ void KioskAppManager::UpdateAppData() {
   scoped_ptr<base::DictionaryValue> prefs(new base::DictionaryValue);
   for (size_t i = 0; i < apps_.size(); ++i) {
     scoped_ptr<base::DictionaryValue> entry(new base::DictionaryValue);
-    entry->SetBoolean(extensions::ExternalProviderImpl::kIsFromWebstore, true);
+
+    if (apps_[i]->update_url().is_valid()) {
+      entry->SetString(extensions::ExternalProviderImpl::kExternalUpdateUrl,
+                       apps_[i]->update_url().spec());
+    } else {
+      entry->SetString(extensions::ExternalProviderImpl::kExternalUpdateUrl,
+                       extension_urls::GetWebstoreUpdateUrl().spec());
+    }
+
     prefs->Set(apps_[i]->app_id(), entry.release());
   }
   external_cache_->UpdateExtensionsList(prefs.Pass());

chrome/browser/chromeos/app_mode/startup_app_launcher.cc

@@ -358,11 +358,6 @@ void StartupAppLauncher::OnLaunchFailure(KioskAppLaunchError::Error error) {
   delegate_->OnLaunchFailed(error);
 }
 
-void StartupAppLauncher::OnUpdateCheckFinished() {
-  OnReadyToLaunch();
-  UpdateAppData();
-}
-
 void StartupAppLauncher::BeginInstall() {
   KioskAppManager::Get()->InstallFromCache(app_id_);
   if (extensions::ExtensionSystem::Get(profile_)
@@ -390,6 +385,7 @@ void StartupAppLauncher::BeginInstall() {
 
 void StartupAppLauncher::OnReadyToLaunch() {
   ready_to_launch_ = true;
+  UpdateAppData();
   delegate_->OnReadyToLaunch();
 }
 

chrome/browser/chromeos/app_mode/startup_app_launcher.h

@@ -85,9 +85,6 @@ class StartupAppLauncher : public base::SupportsWeakPtr<StartupAppLauncher>,
   void OnLaunchSuccess();
   void OnLaunchFailure(KioskAppLaunchError::Error error);
 
-  // Callbacks from ExtensionUpdater.
-  void OnUpdateCheckFinished();
-
   void BeginInstall();
   void OnReadyToLaunch();
   void UpdateAppData();

chrome/browser/chromeos/login/kiosk_browsertest.cc

@@ -291,7 +291,8 @@ class KioskFakeDiskMountManager : public file_manager::FakeDiskMountManager {
 
 class KioskTest : public OobeBaseTest {
  public:
-  KioskTest() : fake_cws_(new FakeCWS) {
+  KioskTest() : use_consumer_kiosk_mode_(true),
+                fake_cws_(new FakeCWS) {
     set_exit_when_last_browser_closes(false);
   }
 
@@ -374,7 +375,8 @@ class KioskTest : public OobeBaseTest {
   }
 
   void StartUIForAppLaunch() {
-    EnableConsumerKioskMode();
+    if (use_consumer_kiosk_mode_)
+      EnableConsumerKioskMode();
 
     // Start UI
     chromeos::WizardController::SkipPostLoginScreensForTesting();
@@ -425,7 +427,7 @@ class KioskTest : public OobeBaseTest {
     return *GetInstalledApp()->version();
   }
 
-  void WaitForAppLaunchAndOptionallyTerminateApp(bool terminate_app) {
+  void WaitForAppLaunchWithOptions(bool check_launch_data, bool terminate_app) {
     ExtensionTestMessageListener
         launch_data_check_listener("launchData.isKioskSession = true", false);
 
@@ -477,11 +479,13 @@ class KioskTest : public OobeBaseTest {
 
     // Check that the app had been informed that it is running in a kiosk
     // session.
-    EXPECT_TRUE(launch_data_check_listener.was_satisfied());
+    if (check_launch_data)
+      EXPECT_TRUE(launch_data_check_listener.was_satisfied());
   }
 
   void WaitForAppLaunchSuccess() {
-    WaitForAppLaunchAndOptionallyTerminateApp(true);
+    WaitForAppLaunchWithOptions(true /* check_launch_data */,
+                                true /* terminate_app */);
   }
 
   void WaitForAppLaunchNetworkTimeout() {
@@ -607,7 +611,12 @@ class KioskTest : public OobeBaseTest {
   const std::string& test_crx_file() const { return test_crx_file_; }
   FakeCWS* fake_cws() { return fake_cws_.get(); }
 
+  void set_use_consumer_kiosk_mode(bool use) {
+    use_consumer_kiosk_mode_ = use;
+  }
+
  private:
+  bool use_consumer_kiosk_mode_;
   std::string test_app_id_;
   std::string test_app_version_;
   std::string test_crx_file_;
@@ -1541,7 +1550,8 @@ IN_PROC_BROWSER_TEST_F(KioskUpdateTest, PRE_PreserveLocalData) {
 
   extensions::ResultCatcher catcher;
   StartAppLaunchFromLoginScreen(SimulateNetworkOnlineClosure());
-  WaitForAppLaunchAndOptionallyTerminateApp(false);
+  WaitForAppLaunchWithOptions(true /* check_launch_data */,
+                              false /* terminate_app */);
   ASSERT_TRUE(catcher.GetNextResult()) << catcher.message();
 }
 
@@ -1553,7 +1563,8 @@ IN_PROC_BROWSER_TEST_F(KioskUpdateTest, PreserveLocalData) {
   set_test_crx_file(test_app_id() + "_v2_read_and_verify_data.crx");
   extensions::ResultCatcher catcher;
   StartAppLaunchFromLoginScreen(SimulateNetworkOnlineClosure());
-  WaitForAppLaunchAndOptionallyTerminateApp(false);
+  WaitForAppLaunchWithOptions(true /* check_launch_data */,
+                              false /* terminate_app */);
 
   EXPECT_EQ("2.0.0", GetInstalledAppVersion().GetString());
   ASSERT_TRUE(catcher.GetNextResult()) << catcher.message();
@@ -1561,7 +1572,9 @@ IN_PROC_BROWSER_TEST_F(KioskUpdateTest, PreserveLocalData) {
 
 class KioskEnterpriseTest : public KioskTest {
  protected:
-  KioskEnterpriseTest() {}
+  KioskEnterpriseTest() {
+    set_use_consumer_kiosk_mode(false);
+  }
 
   virtual void SetUpInProcessBrowserTestFixture() override {
     device_policy_test_helper_.MarkAsEnterpriseOwned();
@@ -1571,35 +1584,7 @@ class KioskEnterpriseTest : public KioskTest {
   }
 
   virtual void SetUpOnMainThread() override {
-    set_test_app_id(kTestEnterpriseKioskApp);
-    set_test_app_version("1.0.0");
-    set_test_crx_file(test_app_id() + ".crx");
-    SetupTestAppUpdateCheck();
-
     KioskTest::SetUpOnMainThread();
-    // Configure kTestEnterpriseKioskApp in device policy.
-    em::DeviceLocalAccountsProto* accounts =
-        device_policy_test_helper_.device_policy()->payload()
-            .mutable_device_local_accounts();
-    em::DeviceLocalAccountInfoProto* account = accounts->add_account();
-    account->set_account_id(kTestEnterpriseAccountId);
-    account->set_type(
-        em::DeviceLocalAccountInfoProto::ACCOUNT_TYPE_KIOSK_APP);
-    account->mutable_kiosk_app()->set_app_id(kTestEnterpriseKioskApp);
-    accounts->set_auto_login_id(kTestEnterpriseAccountId);
-    em::PolicyData& policy_data =
-        device_policy_test_helper_.device_policy()->policy_data();
-    policy_data.set_service_account_identity(kTestEnterpriseServiceAccountId);
-    device_policy_test_helper_.device_policy()->Build();
-
-    base::RunLoop run_loop;
-    DBusThreadManager::Get()->GetSessionManagerClient()->StoreDevicePolicy(
-        device_policy_test_helper_.device_policy()->GetBlob(),
-        base::Bind(&KioskEnterpriseTest::StorePolicyCallback,
-                   run_loop.QuitClosure()));
-    run_loop.Run();
-
-    DeviceSettingsService::Get()->Load();
 
     // Configure OAuth authentication.
     GaiaUrls* gaia_urls = GaiaUrls::GetInstance();
@@ -1641,6 +1626,35 @@ class KioskEnterpriseTest : public KioskTest {
     callback.Run();
   }
 
+  void ConfigureKioskAppInPolicy(const std::string& account_id,
+                                 const std::string& app_id,
+                                 const std::string& update_url) {
+    em::DeviceLocalAccountsProto* accounts =
+        device_policy_test_helper_.device_policy()->payload()
+            .mutable_device_local_accounts();
+    em::DeviceLocalAccountInfoProto* account = accounts->add_account();
+    account->set_account_id(account_id);
+    account->set_type(
+        em::DeviceLocalAccountInfoProto::ACCOUNT_TYPE_KIOSK_APP);
+    account->mutable_kiosk_app()->set_app_id(app_id);
+    if (!update_url.empty())
+      account->mutable_kiosk_app()->set_update_url(update_url);
+    accounts->set_auto_login_id(account_id);
+    em::PolicyData& policy_data =
+        device_policy_test_helper_.device_policy()->policy_data();
+    policy_data.set_service_account_identity(kTestEnterpriseServiceAccountId);
+    device_policy_test_helper_.device_policy()->Build();
+
+    base::RunLoop run_loop;
+    DBusThreadManager::Get()->GetSessionManagerClient()->StoreDevicePolicy(
+        device_policy_test_helper_.device_policy()->GetBlob(),
+        base::Bind(&KioskEnterpriseTest::StorePolicyCallback,
+                   run_loop.QuitClosure()));
+    run_loop.Run();
+
+    DeviceSettingsService::Get()->Load();
+  }
+
   policy::DevicePolicyCrosTestHelper device_policy_test_helper_;
 
  private:
@@ -1648,21 +1662,18 @@ class KioskEnterpriseTest : public KioskTest {
 };
 
 IN_PROC_BROWSER_TEST_F(KioskEnterpriseTest, EnterpriseKioskApp) {
-  chromeos::WizardController::SkipPostLoginScreensForTesting();
-  chromeos::WizardController* wizard_controller =
-      chromeos::WizardController::default_controller();
-  wizard_controller->SkipToLoginForTesting(LoginScreenContext());
+  // Prepare Fake CWS to serve app crx.
+  set_test_app_id(kTestEnterpriseKioskApp);
+  set_test_app_version("1.0.0");
+  set_test_crx_file(test_app_id() + ".crx");
+  SetupTestAppUpdateCheck();
 
-  // Wait for the Kiosk App configuration to reload, then launch the app.
-  KioskAppManager::App app;
-  content::WindowedNotificationObserver app_config_waiter(
-      chrome::NOTIFICATION_KIOSK_APPS_LOADED,
-      base::Bind(&KioskAppManager::GetApp,
-                 base::Unretained(KioskAppManager::Get()),
-                 kTestEnterpriseKioskApp, &app));
-  FireKioskAppSettingsChanged();
-  app_config_waiter.Wait();
+  // Configure kTestEnterpriseKioskApp in device policy.
+  ConfigureKioskAppInPolicy(kTestEnterpriseAccountId,
+                            kTestEnterpriseKioskApp,
+                            "");
 
+  PrepareAppLaunch();
   LaunchApp(kTestEnterpriseKioskApp, false);
 
   // Wait for the Kiosk App to launch.
@@ -1705,6 +1716,39 @@ IN_PROC_BROWSER_TEST_F(KioskEnterpriseTest, EnterpriseKioskApp) {
   content::RunAllPendingInMessageLoop();
 }
 
+IN_PROC_BROWSER_TEST_F(KioskEnterpriseTest, PrivateStore) {
+  set_test_app_id(kTestEnterpriseKioskApp);
+
+  const char kPrivateStoreUpdate[] = "/private_store_update";
+  net::test_server::EmbeddedTestServer private_server;
+  ASSERT_TRUE(private_server.InitializeAndWaitUntilReady());
+
+  // |private_server| serves crx from test data dir.
+  base::FilePath test_data_dir;
+  PathService::Get(chrome::DIR_TEST_DATA, &test_data_dir);
+  private_server.ServeFilesFromDirectory(test_data_dir);
+
+  FakeCWS private_store;
+  private_store.InitAsPrivateStore(&private_server, kPrivateStoreUpdate);
+  private_store.SetUpdateCrx(kTestEnterpriseKioskApp,
+                             std::string(kTestEnterpriseKioskApp) + ".crx",
+                             "1.0.0");
+
+  // Configure kTestEnterpriseKioskApp in device policy.
+  ConfigureKioskAppInPolicy(kTestEnterpriseAccountId,
+                            kTestEnterpriseKioskApp,
+                            private_server.GetURL(kPrivateStoreUpdate).spec());
+
+  PrepareAppLaunch();
+  LaunchApp(kTestEnterpriseKioskApp, false);
+  WaitForAppLaunchWithOptions(false /* check_launch_data */,
+                              true /* terminate_app */);
+
+  // Private store should serve crx and CWS should not.
+  DCHECK_GT(private_store.GetUpdateCheckCountAndReset(), 0);
+  DCHECK_EQ(0, fake_cws()->GetUpdateCheckCountAndReset());
+}
+
 // Specialized test fixture for testing kiosk mode on the
 // hidden WebUI initialization flow for slow hardware.
 class KioskHiddenWebUITest : public KioskTest,

chrome/browser/chromeos/ownership/owner_settings_service_chromeos.cc

@@ -398,6 +398,12 @@ void OwnerSettingsServiceChromeOS::UpdateDeviceSettings(
                   &kiosk_app_id)) {
             account->mutable_kiosk_app()->set_app_id(kiosk_app_id);
           }
+          std::string kiosk_app_update_url;
+          if (entry_dict->GetStringWithoutPathExpansion(
+                  kAccountsPrefDeviceLocalAccountsKeyKioskAppUpdateURL,
+                  &kiosk_app_update_url)) {
+            account->mutable_kiosk_app()->set_update_url(kiosk_app_update_url);
+          }
         } else {
           NOTREACHED();
         }

chrome/browser/chromeos/policy/device_local_account.cc

@@ -29,11 +29,13 @@ const char kDeviceLocalAccountDomainSuffix[] = ".device-local.localhost";
 
 DeviceLocalAccount::DeviceLocalAccount(Type type,
                                        const std::string& account_id,
-                                       const std::string& kiosk_app_id)
+                                       const std::string& kiosk_app_id,
+                                       const std::string& kiosk_app_update_url)
     : type(type),
       account_id(account_id),
       user_id(GenerateDeviceLocalAccountUserId(account_id, type)),
-      kiosk_app_id(kiosk_app_id) {
+      kiosk_app_id(kiosk_app_id),
+      kiosk_app_update_url(kiosk_app_update_url) {
 }
 
 DeviceLocalAccount::~DeviceLocalAccount() {
@@ -106,6 +108,11 @@ void SetDeviceLocalAccounts(
       entry->SetStringWithoutPathExpansion(
           chromeos::kAccountsPrefDeviceLocalAccountsKeyKioskAppId,
           it->kiosk_app_id);
+      if (!it->kiosk_app_update_url.empty()) {
+        entry->SetStringWithoutPathExpansion(
+            chromeos::kAccountsPrefDeviceLocalAccountsKeyKioskAppUpdateURL,
+            it->kiosk_app_update_url);
+      }
     }
     list.Append(entry.release());
   }
@@ -150,6 +157,7 @@ std::vector<DeviceLocalAccount> GetDeviceLocalAccounts(
     }
 
     std::string kiosk_app_id;
+    std::string kiosk_app_update_url;
     if (type == DeviceLocalAccount::TYPE_KIOSK_APP) {
       if (!entry->GetStringWithoutPathExpansion(
               chromeos::kAccountsPrefDeviceLocalAccountsKeyKioskAppId,
@@ -158,6 +166,9 @@ std::vector<DeviceLocalAccount> GetDeviceLocalAccounts(
                    << i << ".";
         continue;
       }
+      entry->GetStringWithoutPathExpansion(
+          chromeos::kAccountsPrefDeviceLocalAccountsKeyKioskAppUpdateURL,
+          &kiosk_app_update_url);
     }
 
     if (!account_ids.insert(account_id).second) {
@@ -166,8 +177,11 @@ std::vector<DeviceLocalAccount> GetDeviceLocalAccounts(
       continue;
     }
 
-    accounts.push_back(DeviceLocalAccount(
-        static_cast<DeviceLocalAccount::Type>(type), account_id, kiosk_app_id));
+    accounts.push_back(
+        DeviceLocalAccount(static_cast<DeviceLocalAccount::Type>(type),
+                           account_id,
+                           kiosk_app_id,
+                           kiosk_app_update_url));
   }
   return accounts;
 }

chrome/browser/chromeos/policy/device_local_account.h

@@ -28,7 +28,8 @@ struct DeviceLocalAccount {
 
   DeviceLocalAccount(Type type,
                      const std::string& account_id,
-                     const std::string& kiosk_app_id);
+                     const std::string& kiosk_app_id,
+                     const std::string& kiosk_app_update_url);
   ~DeviceLocalAccount();
 
   Type type;
@@ -52,6 +53,7 @@ struct DeviceLocalAccount {
   std::string account_id;
   std::string user_id;
   std::string kiosk_app_id;
+  std::string kiosk_app_update_url;
 };
 
 std::string GenerateDeviceLocalAccountUserId(const std::string& account_id,

chrome/browser/chromeos/policy/device_policy_decoder_chromeos.cc

@@ -198,6 +198,11 @@ void DecodeLoginPolicies(const em::ChromeDeviceSettingsProto& policy,
               chromeos::kAccountsPrefDeviceLocalAccountsKeyKioskAppId,
               entry->kiosk_app().app_id());
         }
+        if (entry->kiosk_app().has_update_url()) {
+          entry_dict->SetStringWithoutPathExpansion(
+              chromeos::kAccountsPrefDeviceLocalAccountsKeyKioskAppUpdateURL,
+              entry->kiosk_app().update_url());
+        }
       } else if (entry->has_deprecated_public_session_id()) {
         // Deprecated public session specification.
         entry_dict->SetStringWithoutPathExpansion(

chrome/browser/chromeos/policy/proto/chrome_device_policy.proto

@@ -263,8 +263,10 @@ message KioskAppInfoProto {
   // specifies the Kiosk App to download and run.
   optional string app_id = 1;
 
-  // Obsolete: Kiosk Apps can only be installed from the Chrome Web Store.
-  optional string OBSOLETE_update_url = 2 [deprecated = true];
+  // Optional extension update URL to download the Kiosk App package from. If
+  // not specified, the app will be downloaded from the standard Chrome Web
+  // Store update URL.
+  optional string update_url = 2;
 }
 
 // Describes a single device-local account.

chrome/browser/chromeos/settings/device_settings_provider.cc

@@ -181,6 +181,11 @@ void DecodeLoginPolicies(
             kAccountsPrefDeviceLocalAccountsKeyKioskAppId,
             entry->kiosk_app().app_id());
       }
+      if (entry->kiosk_app().has_update_url()) {
+        entry_dict->SetStringWithoutPathExpansion(
+            kAccountsPrefDeviceLocalAccountsKeyKioskAppUpdateURL,
+            entry->kiosk_app().update_url());
+      }
     } else if (entry->has_deprecated_public_session_id()) {
       // Deprecated public session specification.
       entry_dict->SetStringWithoutPathExpansion(

chrome/test/data/chromeos/app_mode/webstore/update_check/has_update_private_store.xml

+<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><app appid="$AppId"><updatecheck codebase="$CrxDownloadUrl" version="$Version"/></app></gupdate>

chromeos/settings/cros_settings_names.cc

@@ -24,6 +24,8 @@ const char kAccountsPrefDeviceLocalAccountsKeyType[] =
     "type";
 const char kAccountsPrefDeviceLocalAccountsKeyKioskAppId[] =
     "kiosk_app_id";
+const char kAccountsPrefDeviceLocalAccountsKeyKioskAppUpdateURL[] =
+    "kiosk_app_update_url";
 const char kAccountsPrefDeviceLocalAccountAutoLoginId[] =
     "cros.accounts.deviceLocalAccountAutoLoginId";
 const char kAccountsPrefDeviceLocalAccountAutoLoginDelay[] =

chromeos/settings/cros_settings_names.h

@@ -21,6 +21,8 @@ CHROMEOS_EXPORT extern const char kAccountsPrefDeviceLocalAccountsKeyId[];
 CHROMEOS_EXPORT extern const char kAccountsPrefDeviceLocalAccountsKeyType[];
 CHROMEOS_EXPORT extern const char
     kAccountsPrefDeviceLocalAccountsKeyKioskAppId[];
+CHROMEOS_EXPORT extern const char
+    kAccountsPrefDeviceLocalAccountsKeyKioskAppUpdateURL[];
 CHROMEOS_EXPORT extern const char
     kAccountsPrefDeviceLocalAccountAutoLoginId[];
 CHROMEOS_EXPORT extern const char