Remove DCHECK for invalidated accounts

To allow reauthentication of secondary accounts from ARC, remove
check for account value. Secondary accounts which have been added
directly from ARC may not be in the list of Chrome accounts.

If invalidated account is in ARC, but not in Chrome OS Account
Manager, return an error.

Bug: b/137921583
Change-Id: I4a0a904481e1afc39a17e2a755987b7aaad72da1
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1746173
Commit-Queue: Anastasiia Nikolaienko <anastasiian@chromium.org>
Reviewed-by: Hidehiko Abe <hidehiko@chromium.org>
Reviewed-by: Yury Khmel <khmel@chromium.org>
Reviewed-by: Mattias Nissler <mnissler@chromium.org>
Reviewed-by: Kush Sinha <sinhak@chromium.org>
Cr-Commit-Position: refs/heads/master@{#695184}

chrome/browser/chromeos/arc/arc_optin_uma.cc

@@ -209,6 +209,7 @@ std::ostream& operator<<(std::ostream& os, const ProvisioningResult& result) {
     MAP_PROVISIONING_RESULT(ARC_DISABLED);
     MAP_PROVISIONING_RESULT(SUCCESS_ALREADY_PROVISIONED);
     MAP_PROVISIONING_RESULT(UNSUPPORTED_ACCOUNT_TYPE);
+    MAP_PROVISIONING_RESULT(CHROME_ACCOUNT_NOT_FOUND);
   }
 
 #undef MAP_PROVISIONING_RESULT

chrome/browser/chromeos/arc/arc_optin_uma.h

@@ -163,7 +163,10 @@ enum class ProvisioningResult : int {
   // Account type is not supported for authorization.
   UNSUPPORTED_ACCOUNT_TYPE = 22,
 
-  kMaxValue = UNSUPPORTED_ACCOUNT_TYPE,
+  // Account is not present in Chrome OS Account Manager.
+  CHROME_ACCOUNT_NOT_FOUND = 23,
+
+  kMaxValue = CHROME_ACCOUNT_NOT_FOUND,
 };
 
 enum class OptInFlowResult : int {

chrome/browser/chromeos/arc/auth/arc_auth_service.cc

@@ -10,6 +10,7 @@
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/memory/singleton.h"
+#include "base/optional.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/time/time.h"
 #include "chrome/browser/chromeos/account_manager/account_manager_migrator.h"
@@ -99,6 +100,7 @@ ProvisioningResult ConvertArcSignInStatusToProvisioningResult(
     MAP_PROVISIONING_RESULT(SUCCESS);
     MAP_PROVISIONING_RESULT(SUCCESS_ALREADY_PROVISIONED);
     MAP_PROVISIONING_RESULT(UNSUPPORTED_ACCOUNT_TYPE);
+    MAP_PROVISIONING_RESULT(CHROME_ACCOUNT_NOT_FOUND);
   }
 #undef MAP_PROVISIONING_RESULT
 
@@ -172,11 +174,14 @@ bool IsPrimaryOrDeviceLocalAccount(
   if (user->IsDeviceLocalAccount())
     return true;
 
-  const std::string gaia_id =
+  const base::Optional<AccountInfo> account_info =
       identity_manager
           ->FindExtendedAccountInfoForAccountWithRefreshTokenByEmailAddress(
-              account_name)
-          ->gaia;
+              account_name);
+  if (!account_info)
+    return false;
+
+  const std::string& gaia_id = account_info->gaia;
   DCHECK(!gaia_id.empty());
   return IsPrimaryGaiaAccount(gaia_id);
 }
@@ -664,12 +669,16 @@ void ArcAuthService::FetchSecondaryAccountInfo(
     const std::string& account_name,
     RequestAccountInfoCallback callback) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
-
   base::Optional<AccountInfo> account_info =
       identity_manager_
           ->FindExtendedAccountInfoForAccountWithRefreshTokenByEmailAddress(
               account_name);
-  DCHECK(account_info.has_value());
+  if (!account_info.has_value()) {
+    // Account is in ARC, but not in Chrome OS Account Manager.
+    std::move(callback).Run(mojom::ArcSignInStatus::CHROME_ACCOUNT_NOT_FOUND,
+                            nullptr);
+    return;
+  }
 
   const std::string& account_id = account_info->account_id;
   DCHECK(!account_id.empty());

chrome/browser/chromeos/arc/auth/arc_auth_service_browsertest.cc

@@ -505,6 +505,22 @@ IN_PROC_BROWSER_TEST_F(ArcAuthServiceTest,
             auth_instance().sign_in_status());
 }
 
+IN_PROC_BROWSER_TEST_F(
+    ArcAuthServiceTest,
+    FetchSecondaryAccountInfoReturnsErrorForNotFoundAccounts) {
+  SetAccountAndProfile(user_manager::USER_TYPE_REGULAR);
+  // Don't add account with kSecondaryAccountEmail.
+
+  base::RunLoop run_loop;
+  auth_instance().RequestAccountInfo(kSecondaryAccountEmail,
+                                     run_loop.QuitClosure());
+  run_loop.Run();
+
+  EXPECT_FALSE(auth_instance().account_info());
+  EXPECT_EQ(mojom::ArcSignInStatus::CHROME_ACCOUNT_NOT_FOUND,
+            auth_instance().sign_in_status());
+}
+
 IN_PROC_BROWSER_TEST_F(ArcAuthServiceTest, FetchGoogleAccountsFromArc) {
   SetAccountAndProfile(user_manager::USER_TYPE_REGULAR);
 

components/arc/mojom/auth.mojom

@@ -78,6 +78,9 @@ enum ArcSignInStatus {
 
   // Account type is not supported for authorization.
   [MinVersion=16] UNSUPPORTED_ACCOUNT_TYPE = 20,
+
+  // Account is not present in Chrome OS Account Manager.
+  [MinVersion=17] CHROME_ACCOUNT_NOT_FOUND = 21,
 };
 
 // These values describe account check status.

tools/metrics/histograms/enums.xml

@@ -2708,6 +2708,7 @@ Unknown properties are collapsed to zero. -->
   <int value="20" label="Disabled"/>
   <int value="21" label="Already provisioned"/>
   <int value="22" label="Unsupported account type"/>
+  <int value="23" label="Account is not present in Chrome"/>
 </enum>
 
 <enum name="ArcSdkVersionUpgradeType">