Disable Chrome OS Account Manager for Public Sessions

Summary of changes:
  - Consolidate the logic of checking Chrome OS Account Manager's
    availability into 1 utility function.
  - Make this utility function return |false| for the availability of
    Chrome OS Account Manager in Public Sessions.

Bug: 926157
Change-Id: Ife2e5fffe95ca8c08c42376e80a5950785d4669f
Reviewed-on: https://chromium-review.googlesource.com/c/1486333
Commit-Queue: Kush Sinha <sinhak@chromium.org>
Reviewed-by: David Roger <droger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#636501}

chrome/browser/chromeos/BUILD.gn

@@ -293,6 +293,8 @@ source_set("chromeos") {
     "accessibility/switch_access_panel.h",
     "account_manager/account_manager_migrator.cc",
     "account_manager/account_manager_migrator.h",
+    "account_manager/account_manager_util.cc",
+    "account_manager/account_manager_util.h",
     "account_manager/account_migration_runner.cc",
     "account_manager/account_migration_runner.h",
     "android_sms/android_sms_app_manager.cc",

chrome/browser/chromeos/account_manager/account_manager_migrator.cc

@@ -20,6 +20,7 @@
 #include "base/time/time.h"
 #include "base/timer/timer.h"
 #include "chrome/browser/browser_process.h"
+#include "chrome/browser/chromeos/account_manager/account_manager_util.h"
 #include "chrome/browser/chromeos/arc/arc_session_manager.h"
 #include "chrome/browser/chromeos/arc/arc_util.h"
 #include "chrome/browser/chromeos/arc/auth/arc_auth_service.h"
@@ -31,7 +32,6 @@
 #include "chrome/common/pref_names.h"
 #include "chromeos/account_manager/account_manager.h"
 #include "chromeos/account_manager/account_manager_factory.h"
-#include "chromeos/constants/chromeos_switches.h"
 #include "components/account_id/account_id.h"
 #include "components/keyed_service/content/browser_context_dependency_manager.h"
 #include "components/prefs/pref_service.h"
@@ -472,7 +472,7 @@ AccountManagerMigrator::~AccountManagerMigrator() = default;
 void AccountManagerMigrator::Start() {
   DVLOG(1) << "AccountManagerMigrator::Start";
 
-  if (!chromeos::switches::IsAccountManagerEnabled())
+  if (!chromeos::IsAccountManagerAvailable(profile_))
     return;
 
   ran_migration_steps_ = false;

chrome/browser/chromeos/account_manager/account_manager_util.cc

+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/chromeos/account_manager/account_manager_util.h"
+
+#include "chrome/browser/chromeos/profiles/profile_helper.h"
+#include "chrome/browser/profiles/profiles_state.h"
+#include "chromeos/constants/chromeos_switches.h"
+
+namespace chromeos {
+
+bool IsAccountManagerAvailable(const Profile* const profile) {
+  if (!switches::IsAccountManagerEnabled())
+    return false;
+
+  // Signin Profile does not have any accounts associated with it.
+  if (chromeos::ProfileHelper::IsSigninProfile(profile))
+    return false;
+
+  // LockScreenAppProfile does not link to the user's cryptohome.
+  if (chromeos::ProfileHelper::IsLockScreenAppProfile(profile))
+    return false;
+
+  // Account Manager is unavailable on Guest (Incognito) Sessions.
+  if (profile->IsGuestSession() || profile->IsOffTheRecord())
+    return false;
+
+  // Account Manager is unavailable on Managed Guest Sessions / Public Sessions.
+  if (profiles::IsPublicSession())
+    return false;
+
+  // Available in all other cases.
+  return true;
+}
+
+}  // namespace chromeos

chrome/browser/chromeos/account_manager/account_manager_util.h

+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_CHROMEOS_ACCOUNT_MANAGER_ACCOUNT_MANAGER_UTIL_H_
+#define CHROME_BROWSER_CHROMEOS_ACCOUNT_MANAGER_ACCOUNT_MANAGER_UTIL_H_
+
+class Profile;
+
+namespace chromeos {
+
+bool IsAccountManagerAvailable(const Profile* const profile);
+
+}  // namespace chromeos
+
+#endif  // CHROME_BROWSER_CHROMEOS_ACCOUNT_MANAGER_ACCOUNT_MANAGER_UTIL_H_

chrome/browser/chromeos/arc/auth/arc_auth_service.cc

@@ -12,6 +12,7 @@
 #include "base/memory/singleton.h"
 #include "base/strings/utf_string_conversions.h"
 #include "base/time/time.h"
+#include "chrome/browser/chromeos/account_manager/account_manager_util.h"
 #include "chrome/browser/chromeos/arc/arc_optin_uma.h"
 #include "chrome/browser/chromeos/arc/arc_session_manager.h"
 #include "chrome/browser/chromeos/arc/arc_util.h"
@@ -25,7 +26,6 @@
 #include "chrome/browser/signin/identity_manager_factory.h"
 #include "chrome/browser/signin/signin_ui_util.h"
 #include "chrome/browser/ui/app_list/arc/arc_data_removal_dialog.h"
-#include "chromeos/constants/chromeos_switches.h"
 #include "components/arc/arc_bridge_service.h"
 #include "components/arc/arc_browser_context_keyed_service_factory_base.h"
 #include "components/arc/arc_features.h"
@@ -454,7 +454,7 @@ void ArcAuthService::OnRefreshTokenUpdatedForAccount(
   // proper Profile independent entity once we have that.
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
 
-  if (!chromeos::switches::IsAccountManagerEnabled())
+  if (!chromeos::IsAccountManagerAvailable(profile_))
     return;
 
   // Ignore the update if ARC has not been provisioned yet.
@@ -482,7 +482,7 @@ void ArcAuthService::OnExtendedAccountInfoRemoved(
     const AccountInfo& account_info) {
   DCHECK_CURRENTLY_ON(content::BrowserThread::UI);
 
-  if (!chromeos::switches::IsAccountManagerEnabled())
+  if (!chromeos::IsAccountManagerAvailable(profile_))
     return;
 
   DCHECK(!IsPrimaryGaiaAccount(account_info.gaia));
@@ -687,7 +687,7 @@ void ArcAuthService::SkipMergeSessionForTesting() {
 }
 
 void ArcAuthService::TriggerAccountsPushToArc() {
-  if (!chromeos::switches::IsAccountManagerEnabled())
+  if (!chromeos::IsAccountManagerAvailable(profile_))
     return;
 
   const std::vector<AccountInfo> accounts =

chrome/browser/signin/account_consistency_mode_manager.cc

@@ -21,7 +21,7 @@
 #include "google_apis/google_api_keys.h"
 
 #if defined(OS_CHROMEOS)
-#include "chromeos/constants/chromeos_switches.h"
+#include "chrome/browser/chromeos/account_manager/account_manager_util.h"
 #endif
 
 using signin::AccountConsistencyMethod;
@@ -210,11 +210,9 @@ AccountConsistencyModeManager::ComputeAccountConsistencyMethod(
       kAccountConsistencyFeature, kAccountConsistencyFeatureMethodParameter);
 
 #if defined(OS_CHROMEOS)
-  if (chromeos::switches::IsAccountManagerEnabled())
+  if (chromeos::IsAccountManagerAvailable(profile))
     return AccountConsistencyMethod::kMirror;
 
-  // TODO(sinhak): Clean this up. When Account Manager is released, Chrome OS
-  // will always have Mirror enabled for regular profiles.
   return (method_value == kAccountConsistencyFeatureMethodMirror ||
           profile->GetPrefs()->GetBoolean(
               prefs::kAccountConsistencyMirrorRequired))

chrome/browser/signin/profile_oauth2_token_service_factory.cc

@@ -34,10 +34,10 @@
 
 #if defined(OS_CHROMEOS)
 #include "chrome/browser/browser_process.h"
+#include "chrome/browser/chromeos/account_manager/account_manager_util.h"
 #include "chrome/browser/chromeos/oauth2_token_service_delegate.h"
 #include "chrome/browser/chromeos/profiles/profile_helper.h"
 #include "chromeos/account_manager/account_manager_factory.h"
-#include "chromeos/constants/chromeos_switches.h"
 #include "components/user_manager/user_manager.h"
 #endif  // defined(OS_CHROMEOS)
 
@@ -48,17 +48,6 @@
 namespace {
 
 #if defined(OS_CHROMEOS)
-bool ShouldCreateCrOsOAuthDelegate(Profile* profile) {
-  // Chrome OS Account Manager should only be instantiated in "regular"
-  // profiles. Do not try to create |ChromeOSOAuth2TokenServiceDelegate| (which
-  // uses CrOS Account Manager as the source of truth) for Signin Profile,
-  // Lock Screen Profile and Guest Sessions.
-  return chromeos::switches::IsAccountManagerEnabled() &&
-         !chromeos::ProfileHelper::IsSigninProfile(profile) &&
-         !chromeos::ProfileHelper::IsLockScreenAppProfile(profile) &&
-         !profile->IsGuestSession();
-}
-
 std::unique_ptr<chromeos::ChromeOSOAuth2TokenServiceDelegate>
 CreateCrOsOAuthDelegate(Profile* profile) {
   chromeos::AccountManagerFactory* factory =
@@ -130,7 +119,7 @@ std::unique_ptr<OAuth2TokenServiceDelegate> CreateOAuth2TokenServiceDelegate(
 #else  // defined(OS_ANDROID)
 
 #if defined(OS_CHROMEOS)
-  if (ShouldCreateCrOsOAuthDelegate(profile)) {
+  if (chromeos::IsAccountManagerAvailable(profile)) {
     return CreateCrOsOAuthDelegate(profile);
   }
 #endif  // defined(OS_CHROMEOS)
@@ -138,7 +127,7 @@ std::unique_ptr<OAuth2TokenServiceDelegate> CreateOAuth2TokenServiceDelegate(
   // Fall back to |MutableProfileOAuth2TokenServiceDelegate|:
   // 1. On all platforms other than Android and Chrome OS.
   // 2. On Chrome OS, if |ChromeOSOAuth2TokenServiceDelegate| cannot be used
-  // for this |profile|. See |ShouldCreateCrOsOAuthDelegate|.
+  // for this |profile|. See |chromeos::IsAccountManagerAvailable|.
   return CreateMutableProfileOAuthDelegate(profile);
 
 #endif  // defined(OS_ANDROID)

chrome/browser/signin/signin_error_notifier_ash.cc

@@ -14,6 +14,7 @@
 #include "base/strings/string16.h"
 #include "base/strings/utf_string_conversions.h"
 #include "build/build_config.h"
+#include "chrome/browser/chromeos/account_manager/account_manager_util.h"
 #include "chrome/browser/chromeos/login/user_flow.h"
 #include "chrome/browser/chromeos/login/users/chrome_user_manager.h"
 #include "chrome/browser/lifetime/application_lifetime.h"
@@ -31,7 +32,6 @@
 #include "chrome/grit/chromium_strings.h"
 #include "chrome/grit/generated_resources.h"
 #include "chrome/grit/theme_resources.h"
-#include "chromeos/constants/chromeos_switches.h"
 #include "components/account_id/account_id.h"
 #include "components/user_manager/user_manager.h"
 #include "services/identity/public/cpp/identity_manager.h"
@@ -100,7 +100,7 @@ void SigninErrorNotifier::OnErrorChanged() {
       return;
   }
 
-  if (!chromeos::switches::IsAccountManagerEnabled()) {
+  if (!chromeos::IsAccountManagerAvailable(profile_)) {
     // If this flag is disabled, Chrome OS does not have a concept of Secondary
     // Accounts. Preserve existing behavior.
     HandleDeviceAccountError();

chrome/browser/ui/webui/settings/md_settings_localized_strings_provider.cc

@@ -59,6 +59,7 @@
 #include "ash/public/cpp/ash_switches.h"
 #include "ash/public/interfaces/voice_interaction_controller.mojom.h"
 #include "base/system/sys_info.h"
+#include "chrome/browser/chromeos/account_manager/account_manager_util.h"
 #include "chrome/browser/chromeos/arc/arc_util.h"
 #include "chrome/browser/chromeos/assistant/assistant_util.h"
 #include "chrome/browser/chromeos/crostini/crostini_util.h"
@@ -1949,7 +1950,7 @@ void AddPeopleStrings(content::WebUIDataSource* html_source, Profile* profile) {
   // Used to control the display of Chrome OS Account Manager submenu in the
   // People section.
   html_source->AddBoolean("isAccountManagerEnabled",
-                          chromeos::switches::IsAccountManagerEnabled());
+                          chromeos::IsAccountManagerAvailable(profile));
 #endif
 
   html_source->AddBoolean(