Settings Virtual Prefs: Primary Cookie Setting Radio Buttons

Introduces new generated preference to support the Quad state radio
button which controls the primary cookie settings on the new Cookies
page.

This CL creates the generated preference and extends
settings_private.idl with a new userSelectableValues attribute to
support the complex partial management states this preference must be
capable of representing.

The new preference is not used in production code and only enough
management state functionality is included to test the additions to the
SettingsPrivate API.

Bug: 1063265
Change-Id: I15ac79021530efe6af11cb000f536549216263ba
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2199461Reviewed-by: Devlin <rdevlin.cronin@chromium.org>
Reviewed-by: Martin Šrámek <msramek@chromium.org>
Commit-Queue: Theodore Olsauskas-Warren <sauski@google.com>
Cr-Commit-Position: refs/heads/master@{#771432}

chrome/browser/content_settings/generated_cookie_prefs.cc

@@ -4,13 +4,67 @@
 
 #include "chrome/browser/content_settings/generated_cookie_prefs.h"
 
+#include "base/feature_list.h"
 #include "chrome/browser/content_settings/host_content_settings_map_factory.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/common/extensions/api/settings_private.h"
+#include "components/content_settings/core/browser/cookie_settings.h"
 #include "components/content_settings/core/browser/host_content_settings_map.h"
+#include "components/content_settings/core/common/features.h"
+#include "components/content_settings/core/common/pref_names.h"
+#include "components/prefs/pref_service.h"
+
+namespace settings_api = extensions::api::settings_private;
+
+namespace content_settings {
 
 namespace {
 
+// Implements the small subset of possible cookie controls management state
+// needed to support testing of the SettingsPrivate API. Only device policy
+// applied to the content setting is considered. Other sources of management
+// and the management of third party cookie blocking preferences are ignored.
+// This code is currently not reachable by production code.
+// TODO(crbug.com/1063265): Move complete management logic and exhaustive
+//    test cases from site_settings_helper.cc into this file and associated
+//    unit tests and remove this function.
+void ApplyCookieControlsManagedState(settings_api::PrefObject* pref_object,
+                                     Profile* profile) {
+  HostContentSettingsMap* map =
+      HostContentSettingsMapFactory::GetForProfile(profile);
+  std::string content_setting_provider;
+  auto content_setting = map->GetDefaultContentSetting(
+      ContentSettingsType::COOKIES, &content_setting_provider);
+  auto content_setting_source =
+      HostContentSettingsMap::GetSettingSourceFromProviderName(
+          content_setting_provider);
+
+  if (content_setting_source == SettingSource::SETTING_SOURCE_POLICY) {
+    pref_object->controlled_by =
+        settings_api::ControlledBy::CONTROLLED_BY_DEVICE_POLICY;
+    pref_object->enforcement = settings_api::Enforcement::ENFORCEMENT_ENFORCED;
+  } else {
+    // Other sources of management are currently ignored (see function comment).
+    return;
+  }
+
+  // If the content setting is not set to block, the user is still able to
+  // select from available third party cookie blocking options.
+  if (content_setting != ContentSetting::CONTENT_SETTING_BLOCK) {
+    pref_object->user_selectable_values =
+        std::make_unique<std::vector<std::unique_ptr<base::Value>>>();
+    pref_object->user_selectable_values->push_back(
+        std::make_unique<base::Value>(
+            static_cast<int>(CookiePrimarySetting::ALLOW_ALL)));
+    pref_object->user_selectable_values->push_back(
+        std::make_unique<base::Value>(static_cast<int>(
+            CookiePrimarySetting::BLOCK_THIRD_PARTY_INCOGNITO)));
+    pref_object->user_selectable_values->push_back(
+        std::make_unique<base::Value>(
+            static_cast<int>(CookiePrimarySetting::BLOCK_THIRD_PARTY)));
+  }
+}
+
 bool IsDefaultCookieContentSettingUserControlled(HostContentSettingsMap* map) {
   std::string content_setting_provider;
   map->GetDefaultContentSetting(ContentSettingsType::COOKIES,
@@ -18,16 +72,50 @@ bool IsDefaultCookieContentSettingUserControlled(HostContentSettingsMap* map) {
   auto content_setting_source =
       HostContentSettingsMap::GetSettingSourceFromProviderName(
           content_setting_provider);
-  return content_setting_source ==
-         content_settings::SettingSource::SETTING_SOURCE_USER;
+  return content_setting_source == SettingSource::SETTING_SOURCE_USER;
 }
 
-}  // namespace
+// Updates all user modifiable cookie content settings and preferences to match
+// the provided |controls_mode| and |content_setting|. This provides a
+// consistent interface to updating these when they are partially managed.
+// Returns SetPrefResult::SUCCESS if any settings could be changed, and
+// SetPrefResult::PREF_NOT_MODIFIABLE if no setting could be changed.
+extensions::settings_private::SetPrefResult SetAllCookieSettings(
+    Profile* profile,
+    CookieControlsMode controls_mode,
+    ContentSetting content_setting) {
+  bool setting_changed = false;
 
-namespace settings_api = extensions::api::settings_private;
+  auto* map = HostContentSettingsMapFactory::GetForProfile(profile);
+  if (IsDefaultCookieContentSettingUserControlled(map)) {
+    map->SetDefaultContentSetting(ContentSettingsType::COOKIES,
+                                  content_setting);
+    setting_changed = true;
+  }
 
-namespace content_settings {
+  auto* pref_service = profile->GetPrefs();
+  if (pref_service->FindPreference(prefs::kBlockThirdPartyCookies)
+          ->IsUserControlled()) {
+    pref_service->SetBoolean(
+        prefs::kBlockThirdPartyCookies,
+        controls_mode == CookieControlsMode::kBlockThirdParty);
+    setting_changed = true;
+  }
+  if (pref_service->FindPreference(prefs::kCookieControlsMode)
+          ->IsUserControlled()) {
+    pref_service->SetInteger(prefs::kCookieControlsMode,
+                             static_cast<int>(controls_mode));
+    setting_changed = true;
+  }
+
+  return setting_changed
+             ? extensions::settings_private::SetPrefResult::SUCCESS
+             : extensions::settings_private::SetPrefResult::PREF_NOT_MODIFIABLE;
+}
+
+}  // namespace
 
+const char kCookiePrimarySetting[] = "generated.cookie_primary_setting";
 const char kCookieSessionOnly[] = "generated.cookie_session_only";
 
 GeneratedCookiePrefBase::GeneratedCookiePrefBase(Profile* profile,
@@ -36,6 +124,16 @@ GeneratedCookiePrefBase::GeneratedCookiePrefBase(Profile* profile,
   host_content_settings_map_ =
       HostContentSettingsMapFactory::GetForProfile(profile_);
   content_settings_observer_.Add(host_content_settings_map_);
+
+  user_prefs_registrar_.Init(profile->GetPrefs());
+  user_prefs_registrar_.Add(
+      prefs::kBlockThirdPartyCookies,
+      base::Bind(&GeneratedCookiePrefBase::OnCookiePreferencesChanged,
+                 base::Unretained(this)));
+  user_prefs_registrar_.Add(
+      prefs::kCookieControlsMode,
+      base::Bind(&GeneratedCookiePrefBase::OnCookiePreferencesChanged,
+                 base::Unretained(this)));
 }
 
 GeneratedCookiePrefBase::~GeneratedCookiePrefBase() = default;
@@ -50,6 +148,83 @@ void GeneratedCookiePrefBase::OnContentSettingChanged(
   }
 }
 
+void GeneratedCookiePrefBase::OnCookiePreferencesChanged() {
+  NotifyObservers(pref_name_);
+}
+
+GeneratedCookiePrimarySettingPref::GeneratedCookiePrimarySettingPref(
+    Profile* profile)
+    : GeneratedCookiePrefBase(profile, kCookiePrimarySetting) {}
+
+extensions::settings_private::SetPrefResult
+GeneratedCookiePrimarySettingPref::SetPref(const base::Value* value) {
+  if (!value->is_int())
+    return extensions::settings_private::SetPrefResult::PREF_TYPE_MISMATCH;
+
+  auto current_content_setting =
+      host_content_settings_map_->GetDefaultContentSetting(
+          ContentSettingsType::COOKIES, nullptr);
+
+  auto allow_setting =
+      current_content_setting != ContentSetting::CONTENT_SETTING_BLOCK
+          ? current_content_setting
+          : ContentSetting::CONTENT_SETTING_ALLOW;
+
+  auto selection = static_cast<CookiePrimarySetting>(value->GetInt());
+  switch (selection) {
+    case (CookiePrimarySetting::ALLOW_ALL):
+      return SetAllCookieSettings(profile_, CookieControlsMode::kOff,
+                                  allow_setting);
+    case (CookiePrimarySetting::BLOCK_THIRD_PARTY_INCOGNITO):
+      return SetAllCookieSettings(profile_, CookieControlsMode::kIncognitoOnly,
+                                  allow_setting);
+    case (CookiePrimarySetting::BLOCK_THIRD_PARTY):
+      return SetAllCookieSettings(
+          profile_, CookieControlsMode::kBlockThirdParty, allow_setting);
+    case (CookiePrimarySetting::BLOCK_ALL):
+      return SetAllCookieSettings(profile_,
+                                  CookieControlsMode::kBlockThirdParty,
+                                  ContentSetting::CONTENT_SETTING_BLOCK);
+    default:
+      return extensions::settings_private::SetPrefResult::PREF_TYPE_MISMATCH;
+  }
+}
+
+std::unique_ptr<extensions::api::settings_private::PrefObject>
+GeneratedCookiePrimarySettingPref::GetPrefObject() const {
+  auto pref_object =
+      std::make_unique<extensions::api::settings_private::PrefObject>();
+  pref_object->key = pref_name_;
+  pref_object->type = extensions::api::settings_private::PREF_TYPE_NUMBER;
+
+  auto content_setting = host_content_settings_map_->GetDefaultContentSetting(
+      ContentSettingsType::COOKIES, nullptr);
+
+  auto block_third_party_pref_enabled =
+      profile_->GetPrefs()->GetBoolean(prefs::kBlockThirdPartyCookies);
+  auto cookie_controls_pref_value = static_cast<CookieControlsMode>(
+      profile_->GetPrefs()->GetInteger(prefs::kCookieControlsMode));
+
+  if (content_setting == ContentSetting::CONTENT_SETTING_BLOCK) {
+    pref_object->value = std::make_unique<base::Value>(
+        static_cast<int>(CookiePrimarySetting::BLOCK_ALL));
+  } else if (block_third_party_pref_enabled) {
+    pref_object->value = std::make_unique<base::Value>(
+        static_cast<int>(CookiePrimarySetting::BLOCK_THIRD_PARTY));
+  } else if (cookie_controls_pref_value == CookieControlsMode::kIncognitoOnly &&
+             base::FeatureList::IsEnabled(kImprovedCookieControls)) {
+    pref_object->value = std::make_unique<base::Value>(
+        static_cast<int>(CookiePrimarySetting::BLOCK_THIRD_PARTY_INCOGNITO));
+  } else {
+    pref_object->value = std::make_unique<base::Value>(
+        static_cast<int>(CookiePrimarySetting::ALLOW_ALL));
+  }
+
+  ApplyCookieControlsManagedState(pref_object.get(), profile_);
+
+  return pref_object;
+}
+
 GeneratedCookieSessionOnlyPref::GeneratedCookieSessionOnlyPref(Profile* profile)
     : GeneratedCookiePrefBase(profile, kCookieSessionOnly) {}
 

chrome/browser/content_settings/generated_cookie_prefs.h

@@ -15,6 +15,18 @@
 namespace content_settings {
 
 extern const char kCookieSessionOnly[];
+extern const char kCookiePrimarySetting[];
+
+// Must be kept in sync with the CookiesControl enum located in
+// chrome/browser/resources/settings/privacy_page/cookies_page.js
+// TODO(crbug.com/1063265): Rename JS enum to match this one when the generated
+//    preference is used in production code.
+enum class CookiePrimarySetting {
+  ALLOW_ALL,
+  BLOCK_THIRD_PARTY_INCOGNITO,
+  BLOCK_THIRD_PARTY,
+  BLOCK_ALL
+};
 
 // The base class for generated preferences which support WebUI cookie controls
 // that do not not map completely to individual preferences or content settings.
@@ -30,6 +42,7 @@ class GeneratedCookiePrefBase
                                const ContentSettingsPattern& secondary_pattern,
                                ContentSettingsType content_type,
                                const std::string& resource_identifier) override;
+  void OnCookiePreferencesChanged();
 
  protected:
   GeneratedCookiePrefBase(Profile* profile, const std::string& pref_name_);
@@ -38,6 +51,18 @@ class GeneratedCookiePrefBase
   const std::string pref_name_;
   ScopedObserver<HostContentSettingsMap, content_settings::Observer>
       content_settings_observer_{this};
+  PrefChangeRegistrar user_prefs_registrar_;
+};
+
+class GeneratedCookiePrimarySettingPref : public GeneratedCookiePrefBase {
+ public:
+  explicit GeneratedCookiePrimarySettingPref(Profile* profile);
+
+  // Generated Preference Interface.
+  extensions::settings_private::SetPrefResult SetPref(
+      const base::Value* value) override;
+  std::unique_ptr<extensions::api::settings_private::PrefObject> GetPrefObject()
+      const override;
 };
 
 class GeneratedCookieSessionOnlyPref : public GeneratedCookiePrefBase {

chrome/browser/content_settings/generated_cookie_prefs_unittest.cc

@@ -3,12 +3,18 @@
 // found in the LICENSE file.
 
 #include "chrome/browser/content_settings/generated_cookie_prefs.h"
+#include "base/test/scoped_feature_list.h"
 #include "chrome/browser/content_settings/host_content_settings_map_factory.h"
+#include "chrome/browser/extensions/api/settings_private/generated_pref.h"
 #include "chrome/common/extensions/api/settings_private.h"
 #include "chrome/test/base/testing_profile.h"
+#include "components/content_settings/core/browser/cookie_settings.h"
 #include "components/content_settings/core/browser/host_content_settings_map.h"
+#include "components/content_settings/core/common/features.h"
+#include "components/content_settings/core/common/pref_names.h"
 #include "components/content_settings/core/test/content_settings_mock_provider.h"
 #include "components/content_settings/core/test/content_settings_test_utils.h"
+#include "components/sync_preferences/testing_pref_service_syncable.h"
 #include "content/public/test/browser_task_environment.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -16,6 +22,41 @@ namespace settings_api = extensions::api::settings_private;
 
 namespace content_settings {
 
+namespace {
+
+// Sets the value of |generated_pref| to |pref_value| and then ensures that
+// the cookie content settings and preferences match |expected_content_setting|,
+// |expected_block_third_party|, and |expected_cookie_controls_mode|.
+// The value of the new PrefObject returned by the |generated_pref| is then
+// checked against |expected_pref_value|.
+void ValidatePrimarySettingPrefValue(
+    HostContentSettingsMap* map,
+    sync_preferences::TestingPrefServiceSyncable* prefs,
+    GeneratedCookiePrimarySettingPref* generated_pref,
+    CookiePrimarySetting pref_value,
+    ContentSetting expected_content_setting,
+    bool expected_block_third_party,
+    CookieControlsMode expected_cookie_controls_mode,
+    CookiePrimarySetting expected_pref_value) {
+  EXPECT_EQ(
+      generated_pref->SetPref(
+          std::make_unique<base::Value>(static_cast<int>(pref_value)).get()),
+      extensions::settings_private::SetPrefResult::SUCCESS);
+  EXPECT_EQ(
+      map->GetDefaultContentSetting(ContentSettingsType::COOKIES, nullptr),
+      expected_content_setting);
+  EXPECT_EQ(prefs->GetUserPref(prefs::kBlockThirdPartyCookies)->GetBool(),
+            expected_block_third_party);
+  EXPECT_EQ(static_cast<CookieControlsMode>(
+                prefs->GetUserPref(prefs::kCookieControlsMode)->GetInt()),
+            expected_cookie_controls_mode);
+  EXPECT_EQ(static_cast<CookiePrimarySetting>(
+                generated_pref->GetPrefObject()->value->GetInt()),
+            expected_pref_value);
+}
+
+}  // namespace
+
 class GeneratedCookiePrefsTest : public testing::Test {
  protected:
   TestingProfile* profile() { return &profile_; }
@@ -25,6 +66,132 @@ class GeneratedCookiePrefsTest : public testing::Test {
   TestingProfile profile_;
 };
 
+class TestGeneratedPrefObserver
+    : public extensions::settings_private::GeneratedPref::Observer {
+ public:
+  void OnGeneratedPrefChanged(const std::string& pref_name) override {
+    updated_pref_name_ = pref_name;
+  }
+  void Reset() { updated_pref_name_ = ""; }
+  std::string GetUpdatedPrefName() { return updated_pref_name_; }
+
+ protected:
+  std::string updated_pref_name_;
+};
+
+TEST_F(GeneratedCookiePrefsTest, PrimarySettingPref) {
+  auto pref =
+      std::make_unique<content_settings::GeneratedCookiePrimarySettingPref>(
+          profile());
+  HostContentSettingsMap* map =
+      HostContentSettingsMapFactory::GetForProfile(profile());
+  sync_preferences::TestingPrefServiceSyncable* prefs =
+      profile()->GetTestingPrefService();
+
+  // Setup a baseline content setting and preference state.
+  map->SetDefaultContentSetting(ContentSettingsType::COOKIES,
+                                ContentSetting::CONTENT_SETTING_ALLOW);
+  prefs->SetUserPref(prefs::kBlockThirdPartyCookies,
+                     std::make_unique<base::Value>(false));
+  prefs->SetUserPref(prefs::kCookieControlsMode,
+                     std::make_unique<base::Value>(
+                         static_cast<int>(CookieControlsMode::kOff)));
+
+  // Check that each of the four possible preference values sets the correct
+  // state and is correctly reflected in a newly returned PrefObject.
+  // First test this without the improved cookie controls enabled.
+  base::test::ScopedFeatureList scoped_feature_list;
+  scoped_feature_list.InitWithFeatures({}, {kImprovedCookieControls});
+  ValidatePrimarySettingPrefValue(
+      map, prefs, pref.get(), CookiePrimarySetting::BLOCK_ALL,
+      ContentSetting::CONTENT_SETTING_BLOCK, /* block 3P */ true,
+      CookieControlsMode::kBlockThirdParty, CookiePrimarySetting::BLOCK_ALL);
+  ValidatePrimarySettingPrefValue(
+      map, prefs, pref.get(), CookiePrimarySetting::BLOCK_THIRD_PARTY,
+      ContentSetting::CONTENT_SETTING_ALLOW, /* block 3P */ true,
+      CookieControlsMode::kBlockThirdParty,
+      CookiePrimarySetting::BLOCK_THIRD_PARTY);
+  ValidatePrimarySettingPrefValue(
+      map, prefs, pref.get(), CookiePrimarySetting::BLOCK_THIRD_PARTY_INCOGNITO,
+      ContentSetting::CONTENT_SETTING_ALLOW, /* block 3P */ false,
+      CookieControlsMode::kIncognitoOnly, CookiePrimarySetting::ALLOW_ALL);
+  ValidatePrimarySettingPrefValue(
+      map, prefs, pref.get(), CookiePrimarySetting::ALLOW_ALL,
+      ContentSetting::CONTENT_SETTING_ALLOW, /* block 3P */ false,
+      CookieControlsMode::kOff, CookiePrimarySetting::ALLOW_ALL);
+
+  // Enable improved cookie controls feature and check the pref is capable of
+  // returning the incognito setting.
+  scoped_feature_list.Reset();
+  scoped_feature_list.InitWithFeatures({kImprovedCookieControls}, {});
+  ValidatePrimarySettingPrefValue(
+      map, prefs, pref.get(), CookiePrimarySetting::BLOCK_THIRD_PARTY_INCOGNITO,
+      ContentSetting::CONTENT_SETTING_ALLOW, /* block 3P */ false,
+      CookieControlsMode::kIncognitoOnly,
+      CookiePrimarySetting::BLOCK_THIRD_PARTY_INCOGNITO);
+
+  // Confirm that a type mismatch is reported as such.
+  EXPECT_EQ(pref->SetPref(std::make_unique<base::Value>(true).get()),
+            extensions::settings_private::SetPrefResult::PREF_TYPE_MISMATCH);
+  // Check a numerical value outside of the acceptable range.
+  EXPECT_EQ(
+      pref->SetPref(std::make_unique<base::Value>(
+                        static_cast<int>(CookiePrimarySetting::BLOCK_ALL) + 1)
+                        .get()),
+      extensions::settings_private::SetPrefResult::PREF_TYPE_MISMATCH);
+
+  // Check that when the content settings is enforced by device policy to ALLOW
+  // the appropriate available values are returned. This test only covers the
+  // managed state functionality used to support testing of the SettingsPrivate
+  // API.
+  // TODO(crbug.com/1063265): Once all management logic has been implemented in
+  //    the generated preference move and refit the exhaustive set of test cases
+  //    from site_settings_helper_unittest.cc into this file.
+  auto provider = std::make_unique<content_settings::MockProvider>();
+  provider->SetWebsiteSetting(
+      ContentSettingsPattern::Wildcard(), ContentSettingsPattern::Wildcard(),
+      ContentSettingsType::COOKIES, std::string(),
+      std::make_unique<base::Value>(ContentSetting::CONTENT_SETTING_ALLOW));
+  content_settings::TestUtils::OverrideProvider(
+      map, std::move(provider), HostContentSettingsMap::POLICY_PROVIDER);
+  auto pref_object = pref->GetPrefObject();
+  EXPECT_EQ(pref_object->controlled_by,
+            settings_api::ControlledBy::CONTROLLED_BY_DEVICE_POLICY);
+  EXPECT_EQ(pref_object->enforcement,
+            settings_api::Enforcement::ENFORCEMENT_ENFORCED);
+  EXPECT_EQ(pref_object->user_selectable_values->size(), 3U);
+  EXPECT_EQ(static_cast<CookiePrimarySetting>(
+                (*pref_object->user_selectable_values)[0]->GetInt()),
+            CookiePrimarySetting::ALLOW_ALL);
+  EXPECT_EQ(static_cast<CookiePrimarySetting>(
+                (*pref_object->user_selectable_values)[1]->GetInt()),
+            CookiePrimarySetting::BLOCK_THIRD_PARTY_INCOGNITO);
+  EXPECT_EQ(static_cast<CookiePrimarySetting>(
+                (*pref_object->user_selectable_values)[2]->GetInt()),
+            CookiePrimarySetting::BLOCK_THIRD_PARTY);
+
+  // Confirm that when content settings are managed, un-managed preferences are
+  // still set.
+  ValidatePrimarySettingPrefValue(
+      map, prefs, pref.get(), CookiePrimarySetting::BLOCK_THIRD_PARTY,
+      ContentSetting::CONTENT_SETTING_ALLOW, /* block 3P */ true,
+      CookieControlsMode::kBlockThirdParty,
+      CookiePrimarySetting::BLOCK_THIRD_PARTY);
+
+  // Update source preferences and ensure that an observer is fired.
+  TestGeneratedPrefObserver test_observer;
+  pref->AddObserver(&test_observer);
+  prefs->SetUserPref(prefs::kBlockThirdPartyCookies,
+                     std::make_unique<base::Value>(false));
+  EXPECT_EQ(test_observer.GetUpdatedPrefName(), kCookiePrimarySetting);
+
+  test_observer.Reset();
+  prefs->SetUserPref(prefs::kCookieControlsMode,
+                     std::make_unique<base::Value>(
+                         static_cast<int>(CookieControlsMode::kOff)));
+  EXPECT_EQ(test_observer.GetUpdatedPrefName(), kCookiePrimarySetting);
+}
+
 TEST_F(GeneratedCookiePrefsTest, SessionOnlyPref) {
   auto pref =
       std::make_unique<content_settings::GeneratedCookieSessionOnlyPref>(

chrome/browser/extensions/api/settings_private/generated_prefs.cc

@@ -10,6 +10,7 @@
 #include "chrome/browser/extensions/api/settings_private/generated_pref.h"
 #include "chrome/browser/extensions/api/settings_private/prefs_util_enums.h"
 #include "chrome/common/extensions/api/settings_private.h"
+#include "components/content_settings/core/common/pref_names.h"
 
 #if defined(OS_CHROMEOS)
 #include "chrome/browser/extensions/api/settings_private/chromeos_resolve_time_zone_by_geolocation_method_short.h"
@@ -26,6 +27,9 @@ GeneratedPrefs::GeneratedPrefs(Profile* profile) {
   prefs_[kResolveTimezoneByGeolocationMethodShort] =
       CreateGeneratedResolveTimezoneByGeolocationMethodShort(profile);
 #endif
+  prefs_[content_settings::kCookiePrimarySetting] =
+      std::make_unique<content_settings::GeneratedCookiePrimarySettingPref>(
+          profile);
   prefs_[content_settings::kCookieSessionOnly] =
       std::make_unique<content_settings::GeneratedCookieSessionOnlyPref>(
           profile);

chrome/browser/extensions/api/settings_private/prefs_util.cc

@@ -294,6 +294,8 @@ const PrefsUtil::TypedPrefMap& PrefsUtil::GetWhitelistedKeys() {
       settings_api::PrefType::PREF_TYPE_DICTIONARY;
 
   // Site Settings prefs.
+  (*s_whitelist)[::content_settings::kCookiePrimarySetting] =
+      settings_api::PrefType::PREF_TYPE_NUMBER;
   (*s_whitelist)[::content_settings::kCookieSessionOnly] =
       settings_api::PrefType::PREF_TYPE_BOOLEAN;
   (*s_whitelist)[::prefs::kBlockThirdPartyCookies] =

chrome/browser/extensions/api/settings_private/settings_private_apitest.cc

@@ -18,6 +18,8 @@
 #include "chrome/common/extensions/api/settings_private.h"
 #include "chrome/common/pref_names.h"
 #include "components/content_settings/core/browser/host_content_settings_map.h"
+#include "components/content_settings/core/test/content_settings_mock_provider.h"
+#include "components/content_settings/core/test/content_settings_test_utils.h"
 #include "components/keyed_service/core/keyed_service.h"
 #include "components/policy/core/browser/browser_policy_connector.h"
 #include "components/policy/core/common/mock_configuration_policy_provider.h"
@@ -111,6 +113,18 @@ IN_PROC_BROWSER_TEST_F(SettingsPrivateApiTest, GetDisabledPref) {
   EXPECT_TRUE(RunSettingsSubtest("getDisabledPref")) << message_;
 }
 
+IN_PROC_BROWSER_TEST_F(SettingsPrivateApiTest, GetPartiallyManagedPref) {
+  auto provider = std::make_unique<content_settings::MockProvider>();
+  provider->SetWebsiteSetting(
+      ContentSettingsPattern::Wildcard(), ContentSettingsPattern::Wildcard(),
+      ContentSettingsType::COOKIES, std::string(),
+      std::make_unique<base::Value>(ContentSetting::CONTENT_SETTING_ALLOW));
+  content_settings::TestUtils::OverrideProvider(
+      HostContentSettingsMapFactory::GetForProfile(profile()),
+      std::move(provider), HostContentSettingsMap::POLICY_PROVIDER);
+  EXPECT_TRUE(RunSettingsSubtest("getPartiallyManagedPref")) << message_;
+}
+
 IN_PROC_BROWSER_TEST_F(SettingsPrivateApiTest, GetAllPrefs) {
   EXPECT_TRUE(RunSettingsSubtest("getAllPrefs")) << message_;
 }

chrome/common/extensions/api/settings_private.idl

@@ -60,6 +60,12 @@ namespace settingsPrivate {
     // The recommended value if enforcement == RECOMMENDED.
     any? recommendedValue;
 
+    // If enforcement == ENFORCED this optionally specifies preference values
+    // that are still available for selection by the user. If set, must contain
+    // at least 2 distinct values, as must contain |value| and
+    // |recommendedValue| (if present).
+    any[]? userSelectableValues;
+
     // If true, user control of the preference is disabled for reasons unrelated
     // to controlledBy (e.g. no signed-in profile is present). A false value is
     // a no-op.

chrome/test/BUILD.gn

@@ -1865,6 +1865,7 @@ if (!is_android) {
         "//chrome/common/extensions/api",
         "//chrome/services/media_gallery_util/public/cpp:browser_tests",
         "//chrome/test/media_router:browser_tests",
+        "//components/content_settings/core/test:test_support",
         "//components/guest_view/browser:test_support",
         "//components/keep_alive_registry",
         "//google_apis/drive:test_support",

chrome/test/data/extensions/api_test/settings_private/test.js

@@ -16,6 +16,10 @@ var kTestEnforcedPrefName = 'homepage_is_newtabpage';
 // Content settings are set in setting_private_apitest.cc such that this
 // preference is disabled.
 var kTestDisabledPrefName = 'generated.cookie_session_only';
+// Device policies are applied in setting_private_apitest.cc such that this
+// preference is partially managed.
+var kPartiallyManagedPrefName = 'generated.cookie_primary_setting';
+var kUserSelectableValues = [0, 1, 2];
 
 var kTestPageId = 'pageId';
 
@@ -104,6 +108,17 @@ var availableTests = [
       chrome.test.succeed();
     });
   },
+  function getPartiallyManagedPref() {
+    chrome.settingsPrivate.getPref(kPartiallyManagedPrefName, function(value) {
+      chrome.test.assertEq('object', typeof value);
+      callbackResult(true);
+      chrome.test.assertEq(
+          chrome.settingsPrivate.Enforcement.ENFORCED, value.enforcement);
+      value.userSelectableValues.sort();
+      chrome.test.assertEq(kUserSelectableValues, value.userSelectableValues);
+      chrome.test.succeed();
+    });
+  },
   function getPref_CrOSSetting() {
     chrome.settingsPrivate.getPref(
         'cros.accounts.allowBWSI',

third_party/closure_compiler/externs/settings_private.js

@@ -57,6 +57,7 @@ chrome.settingsPrivate.Enforcement = {
  *   controlledByName: (string|undefined),
  *   enforcement: (!chrome.settingsPrivate.Enforcement|undefined),
  *   recommendedValue: (*|undefined),
+ *   userSelectableValues: (!Array<*>|undefined),
  *   userControlDisabled: (boolean|undefined),
  *   extensionId: (string|undefined),
  *   extensionCanBeDisabled: (boolean|undefined)