Lock only when there is at least one supervised user on the machine.

BUG=420746

Review URL: https://codereview.chromium.org/633233002

Cr-Commit-Position: refs/heads/master@{#302412}

chrome/browser/profiles/profile_window.cc

@@ -318,11 +318,25 @@ void LockProfile(Profile* profile) {
 
 bool IsLockAvailable(Profile* profile) {
   DCHECK(profile);
+  if (!switches::IsNewProfileManagement())
+    return false;
+
   const std::string& hosted_domain = profile->GetPrefs()->
       GetString(prefs::kGoogleServicesHostedDomain);
-  return switches::IsNewProfileManagement() &&
-         (hosted_domain == Profile::kNoHostedDomainFound ||
-         hosted_domain == "google.com");
+  // TODO(mlerman): Prohibit only users who authenticate using SAML. Until then,
+  // prohibited users who use hosted domains (aside from google.com).
+  if (hosted_domain != Profile::kNoHostedDomainFound &&
+      hosted_domain != "google.com") {
+    return false;
+  }
+
+  const ProfileInfoCache& cache =
+      g_browser_process->profile_manager()->GetProfileInfoCache();
+  for (size_t i = 0; i < cache.GetNumberOfProfiles(); ++i) {
+    if (cache.ProfileIsSupervisedAtIndex(i))
+      return true;
+  }
+  return false;
 }
 
 void CreateGuestProfileForUserManager(

chrome/browser/ui/cocoa/profiles/profile_chooser_controller_unittest.mm

@@ -499,6 +499,8 @@ TEST_F(ProfileChooserControllerTest, SignedInProfileLockEnabled) {
   // The preference, not the email, determines whether the profile can lock.
   browser()->profile()->GetPrefs()->SetString(
       prefs::kGoogleServicesHostedDomain, "google.com");
+  // Lock is only available where a supervised user is present.
+  cache->SetSupervisedUserIdOfProfileAtIndex(1, kEmail);
 
   StartProfileChooserController();
   NSArray* subviews = [[[controller() window] contentView] subviews];