Add EDU login flow: EduAccountLoginHandler

Add EDU account login handler to fetch user's family members and
getting ReAuthProof token for parent.

Bug: 1043108
Change-Id: Icf4b2782a4e6f114f452468baf09d2478db8d58c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2033156
Commit-Queue: Anastasiia Nikolaienko <anastasiian@chromium.org>
Reviewed-by: Demetrios Papadopoulos <dpapad@chromium.org>
Reviewed-by: Kyle Horimoto <khorimoto@chromium.org>
Cr-Commit-Position: refs/heads/master@{#739305}

chrome/browser/ui/BUILD.gn

@@ -1760,6 +1760,8 @@ jumbo_static_library("ui") {
       "webui/chromeos/cryptohome_web_ui_handler.h",
       "webui/chromeos/drive_internals_ui.cc",
       "webui/chromeos/drive_internals_ui.h",
+      "webui/chromeos/edu_account_login_handler_chromeos.cc",
+      "webui/chromeos/edu_account_login_handler_chromeos.h",
       "webui/chromeos/first_run/first_run_actor.cc",
       "webui/chromeos/first_run/first_run_actor.h",
       "webui/chromeos/first_run/first_run_handler.cc",

chrome/browser/ui/webui/chromeos/edu_account_login_handler_chromeos.cc

+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/ui/webui/chromeos/edu_account_login_handler_chromeos.h"
+
+#include <utility>
+
+#include "base/bind.h"
+#include "base/callback.h"
+#include "base/logging.h"
+#include "base/values.h"
+#include "chrome/browser/browser_process.h"
+#include "chrome/browser/browser_process_platform_part.h"
+#include "chrome/browser/profiles/profile_manager.h"
+#include "chrome/browser/signin/identity_manager_factory.h"
+#include "chromeos/components/account_manager/account_manager.h"
+#include "chromeos/components/account_manager/account_manager_factory.h"
+#include "content/public/browser/storage_partition.h"
+#include "google_apis/gaia/gaia_constants.h"
+
+namespace chromeos {
+
+EduAccountLoginHandler::EduAccountLoginHandler(
+    const base::RepeatingClosure& close_dialog_closure)
+    : close_dialog_closure_(close_dialog_closure) {}
+
+EduAccountLoginHandler::~EduAccountLoginHandler() {
+  close_dialog_closure_.Run();
+}
+
+void EduAccountLoginHandler::RegisterMessages() {
+  web_ui()->RegisterMessageCallback(
+      "getParents",
+      base::BindRepeating(&EduAccountLoginHandler::HandleGetParents,
+                          base::Unretained(this)));
+  web_ui()->RegisterMessageCallback(
+      "parentSignin",
+      base::BindRepeating(&EduAccountLoginHandler::HandleParentSignin,
+                          base::Unretained(this)));
+}
+
+void EduAccountLoginHandler::OnJavascriptDisallowed() {
+  family_fetcher_.reset();
+  access_token_fetcher_.reset();
+  gaia_auth_fetcher_.reset();
+  get_parents_callback_id_.clear();
+  parent_signin_callback_id_.clear();
+}
+
+void EduAccountLoginHandler::HandleGetParents(const base::ListValue* args) {
+  AllowJavascript();
+
+  CHECK_EQ(args->GetList().size(), 1u);
+
+  if (!get_parents_callback_id_.empty()) {
+    // HandleGetParents call is already in progress, reject the callback.
+    RejectJavascriptCallback(args->GetList()[0], base::Value());
+    return;
+  }
+  DCHECK(args->GetString(0, &get_parents_callback_id_));
+
+  FetchFamilyMembers();
+}
+
+void EduAccountLoginHandler::HandleParentSignin(const base::ListValue* args) {
+  const base::Value::ConstListView& args_list = args->GetList();
+  CHECK_EQ(args_list.size(), 3u);
+  CHECK(args_list[0].is_string());
+
+  if (!parent_signin_callback_id_.empty()) {
+    // HandleParentSignin call is already in progress, reject the callback.
+    RejectJavascriptCallback(args_list[0], base::Value());
+    return;
+  }
+  DCHECK(args->GetString(0, &parent_signin_callback_id_));
+
+  const base::DictionaryValue* parent = nullptr;
+  args_list[1].GetAsDictionary(&parent);
+  CHECK(parent);
+  const base::Value* obfuscated_gaia_id_value =
+      parent->FindKey("obfuscatedGaiaId");
+  DCHECK(obfuscated_gaia_id_value);
+  std::string obfuscated_gaia_id = obfuscated_gaia_id_value->GetString();
+
+  std::string password;
+  args_list[2].GetAsString(&password);
+
+  FetchAccessToken(obfuscated_gaia_id, password);
+}
+
+void EduAccountLoginHandler::FetchFamilyMembers() {
+  DCHECK(!family_fetcher_);
+  Profile* profile = Profile::FromWebUI(web_ui());
+  chromeos::AccountManager* account_manager =
+      g_browser_process->platform_part()
+          ->GetAccountManagerFactory()
+          ->GetAccountManager(profile->GetPath().value());
+  DCHECK(account_manager);
+
+  family_fetcher_ = std::make_unique<FamilyInfoFetcher>(
+      this, IdentityManagerFactory::GetForProfile(profile),
+      account_manager->GetUrlLoaderFactory());
+  family_fetcher_->StartGetFamilyMembers();
+}
+
+void EduAccountLoginHandler::FetchAccessToken(
+    const std::string& obfuscated_gaia_id,
+    const std::string& password) {
+  DCHECK(!access_token_fetcher_);
+  Profile* profile = Profile::FromWebUI(web_ui());
+  signin::IdentityManager* identity_manager =
+      IdentityManagerFactory::GetForProfile(profile);
+  OAuth2AccessTokenManager::ScopeSet scopes;
+  scopes.insert(GaiaConstants::kAccountsReauthOAuth2Scope);
+  access_token_fetcher_ =
+      std::make_unique<signin::PrimaryAccountAccessTokenFetcher>(
+          "EduAccountLoginHandler", identity_manager, scopes,
+          base::BindOnce(
+              &EduAccountLoginHandler::CreateReAuthProofTokenForParent,
+              base::Unretained(this), std::move(obfuscated_gaia_id),
+              std::move(password)),
+          signin::PrimaryAccountAccessTokenFetcher::Mode::kImmediate);
+}
+
+void EduAccountLoginHandler::FetchReAuthProofTokenForParent(
+    const std::string& child_oauth_access_token,
+    const std::string& parent_obfuscated_gaia_id,
+    const std::string& parent_credential) {
+  DCHECK(!gaia_auth_fetcher_);
+  Profile* profile = Profile::FromWebUI(web_ui());
+  chromeos::AccountManager* account_manager =
+      g_browser_process->platform_part()
+          ->GetAccountManagerFactory()
+          ->GetAccountManager(profile->GetPath().value());
+  DCHECK(account_manager);
+
+  gaia_auth_fetcher_ = std::make_unique<GaiaAuthFetcher>(
+      this, gaia::GaiaSource::kChrome, account_manager->GetUrlLoaderFactory());
+  gaia_auth_fetcher_->StartCreateReAuthProofTokenForParent(
+      child_oauth_access_token, parent_obfuscated_gaia_id, parent_credential);
+}
+
+void EduAccountLoginHandler::OnGetFamilyMembersSuccess(
+    const std::vector<FamilyInfoFetcher::FamilyMember>& members) {
+  family_fetcher_.reset();
+  base::ListValue parents;
+
+  for (const auto& member : members) {
+    if (member.role != FamilyInfoFetcher::HEAD_OF_HOUSEHOLD &&
+        member.role != FamilyInfoFetcher::PARENT) {
+      continue;
+    }
+
+    base::DictionaryValue parent;
+    parent.SetStringKey("email", member.email);
+    parent.SetStringKey("displayName", member.display_name);
+    parent.SetStringKey("profileImageUrl", member.profile_image_url);
+    parent.SetStringKey("obfuscatedGaiaId", member.obfuscated_gaia_id);
+
+    parents.Append(std::move(parent));
+  }
+  ResolveJavascriptCallback(base::Value(get_parents_callback_id_), parents);
+  get_parents_callback_id_.clear();
+}
+
+void EduAccountLoginHandler::OnFailure(FamilyInfoFetcher::ErrorCode error) {
+  family_fetcher_.reset();
+  RejectJavascriptCallback(base::Value(get_parents_callback_id_),
+                           base::ListValue());
+  get_parents_callback_id_.clear();
+}
+
+void EduAccountLoginHandler::CreateReAuthProofTokenForParent(
+    const std::string& parent_obfuscated_gaia_id,
+    const std::string& parent_credential,
+    GoogleServiceAuthError error,
+    signin::AccessTokenInfo access_token_info) {
+  access_token_fetcher_.reset();
+  if (error.state() != GoogleServiceAuthError::NONE) {
+    LOG(ERROR)
+        << "Could not get access token to create ReAuthProofToken for parent"
+        << error.ToString();
+    base::DictionaryValue result;
+    result.SetBoolKey("wrongPassword", false);
+    RejectJavascriptCallback(base::Value(parent_signin_callback_id_), result);
+    parent_signin_callback_id_.clear();
+    return;
+  }
+
+  FetchReAuthProofTokenForParent(access_token_info.token,
+                                 parent_obfuscated_gaia_id, parent_credential);
+}
+
+void EduAccountLoginHandler::OnReAuthProofTokenSuccess(
+    const std::string& reauth_proof_token) {
+  gaia_auth_fetcher_.reset();
+  ResolveJavascriptCallback(base::Value(parent_signin_callback_id_),
+                            base::Value(reauth_proof_token));
+  parent_signin_callback_id_.clear();
+}
+
+void EduAccountLoginHandler::OnReAuthProofTokenFailure(
+    const GaiaAuthConsumer::ReAuthProofTokenStatus error) {
+  LOG(ERROR) << "Failed to fetch ReAuthProofToken for the parent, error="
+             << static_cast<int>(error);
+  gaia_auth_fetcher_.reset();
+
+  base::DictionaryValue result;
+  result.SetBoolKey(
+      "wrongPassword",
+      error == GaiaAuthConsumer::ReAuthProofTokenStatus::kInvalidGrant);
+  RejectJavascriptCallback(base::Value(parent_signin_callback_id_), result);
+  parent_signin_callback_id_.clear();
+}
+
+}  // namespace chromeos

chrome/browser/ui/webui/chromeos/edu_account_login_handler_chromeos.h

+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_UI_WEBUI_CHROMEOS_EDU_ACCOUNT_LOGIN_HANDLER_CHROMEOS_H_
+#define CHROME_BROWSER_UI_WEBUI_CHROMEOS_EDU_ACCOUNT_LOGIN_HANDLER_CHROMEOS_H_
+
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "chrome/browser/profiles/profile.h"
+#include "chrome/browser/supervised_user/child_accounts/family_info_fetcher.h"
+#include "components/signin/public/identity_manager/access_token_info.h"
+#include "components/signin/public/identity_manager/primary_account_access_token_fetcher.h"
+#include "content/public/browser/web_ui_message_handler.h"
+#include "google_apis/gaia/gaia_auth_consumer.h"
+#include "google_apis/gaia/gaia_auth_fetcher.h"
+
+namespace chromeos {
+
+// Handler for EDU account login flow.
+class EduAccountLoginHandler : public content::WebUIMessageHandler,
+                               public FamilyInfoFetcher::Consumer,
+                               public GaiaAuthConsumer {
+ public:
+  explicit EduAccountLoginHandler(
+      const base::RepeatingClosure& close_dialog_closure);
+  ~EduAccountLoginHandler() override;
+  EduAccountLoginHandler(const EduAccountLoginHandler&) = delete;
+  EduAccountLoginHandler& operator=(const EduAccountLoginHandler&) = delete;
+
+ private:
+  FRIEND_TEST_ALL_PREFIXES(EduAccountLoginHandlerTest, HandleGetParentsSuccess);
+  FRIEND_TEST_ALL_PREFIXES(EduAccountLoginHandlerTest, HandleGetParentsFailure);
+  FRIEND_TEST_ALL_PREFIXES(EduAccountLoginHandlerTest,
+                           HandleParentSigninSuccess);
+  FRIEND_TEST_ALL_PREFIXES(EduAccountLoginHandlerTest,
+                           HandleParentSigninAccessTokenFailure);
+  FRIEND_TEST_ALL_PREFIXES(EduAccountLoginHandlerTest,
+                           HandleParentSigninReAuthProofTokenFailure);
+
+  // content::WebUIMessageHandler:
+  void RegisterMessages() override;
+  void OnJavascriptDisallowed() override;
+
+  void HandleGetParents(const base::ListValue* args);
+  void HandleCloseDialog(const base::ListValue* args);
+  void HandleParentSignin(const base::ListValue* args);
+
+  virtual void FetchFamilyMembers();
+  virtual void FetchAccessToken(const std::string& obfuscated_gaia_id,
+                                const std::string& password);
+
+  virtual void FetchReAuthProofTokenForParent(
+      const std::string& child_oauth_access_token,
+      const std::string& parent_obfuscated_gaia_id,
+      const std::string& parent_credential);
+
+  // FamilyInfoFetcher::Consumer implementation.
+  void OnGetFamilyMembersSuccess(
+      const std::vector<FamilyInfoFetcher::FamilyMember>& members) override;
+  void OnFailure(FamilyInfoFetcher::ErrorCode error) override;
+
+  // signin::PrimaryAccountAccessTokenFetcher callback
+  void CreateReAuthProofTokenForParent(
+      const std::string& parent_obfuscated_gaia_id,
+      const std::string& parent_credential,
+      GoogleServiceAuthError error,
+      signin::AccessTokenInfo access_token_info);
+
+  // GaiaAuthConsumer overrides.
+  void OnReAuthProofTokenSuccess(
+      const std::string& reauth_proof_token) override;
+  void OnReAuthProofTokenFailure(
+      const GaiaAuthConsumer::ReAuthProofTokenStatus error) override;
+
+  // Used for getting parent RAPT token.
+  std::unique_ptr<GaiaAuthFetcher> gaia_auth_fetcher_;
+
+  // Used for getting child access token.
+  std::unique_ptr<signin::PrimaryAccountAccessTokenFetcher>
+      access_token_fetcher_;
+  base::RepeatingClosure close_dialog_closure_;
+  std::unique_ptr<FamilyInfoFetcher> family_fetcher_;
+  std::string get_parents_callback_id_;
+  std::string parent_signin_callback_id_;
+};
+
+}  // namespace chromeos
+
+#endif  // CHROME_BROWSER_UI_WEBUI_CHROMEOS_EDU_ACCOUNT_LOGIN_HANDLER_CHROMEOS_H_

chrome/browser/ui/webui/chromeos/edu_account_login_handler_unittest.cc

+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/ui/webui/chromeos/edu_account_login_handler_chromeos.h"
+
+#include <memory>
+
+#include "base/json/json_writer.h"
+#include "base/values.h"
+#include "components/signin/public/identity_manager/identity_manager.h"
+#include "components/signin/public/identity_manager/identity_test_environment.h"
+#include "content/public/test/test_web_ui.h"
+#include "services/network/public/cpp/shared_url_loader_factory.h"
+#include "services/network/public/cpp/weak_wrapper_shared_url_loader_factory.h"
+#include "services/network/test/test_url_loader_factory.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace chromeos {
+
+namespace {
+
+constexpr char kFakeParentGaiaId[] = "someObfuscatedGaiaId";
+constexpr char kFakeParentCredential[] = "someParentCredential";
+constexpr char kFakeAccessToken[] = "someAccessToken";
+
+std::vector<FamilyInfoFetcher::FamilyMember> GetFakeFamilyMembers() {
+  std::vector<FamilyInfoFetcher::FamilyMember> members;
+  members.push_back(FamilyInfoFetcher::FamilyMember(
+      kFakeParentGaiaId, FamilyInfoFetcher::HEAD_OF_HOUSEHOLD, "Homer Simpson",
+      "homer@simpson.com", "http://profile.url/homer",
+      "http://profile.url/homer/image"));
+  members.push_back(FamilyInfoFetcher::FamilyMember(
+      "anotherObfuscatedGaiaId", FamilyInfoFetcher::PARENT, "Marge Simpson",
+      std::string(), "http://profile.url/marge", std::string()));
+  members.push_back(FamilyInfoFetcher::FamilyMember(
+      "obfuscatedGaiaId3", FamilyInfoFetcher::CHILD, "Lisa Simpson",
+      "lisa@gmail.com", std::string(), "http://profile.url/lisa/image"));
+  members.push_back(FamilyInfoFetcher::FamilyMember(
+      "obfuscatedGaiaId4", FamilyInfoFetcher::CHILD, "Bart Simpson",
+      "bart@bart.bart", std::string(), std::string()));
+  members.push_back(FamilyInfoFetcher::FamilyMember(
+      "obfuscatedGaiaId5", FamilyInfoFetcher::MEMBER, std::string(),
+      std::string(), std::string(), std::string()));
+  return members;
+}
+
+base::DictionaryValue GetFakeParent() {
+  base::DictionaryValue parent;
+  parent.SetStringKey("email", "homer@simpson.com");
+  parent.SetStringKey("displayName", "Homer Simpson");
+  parent.SetStringKey("profileImageUrl", "http://profile.url/homer/image");
+  parent.SetStringKey("obfuscatedGaiaId", kFakeParentGaiaId);
+  return parent;
+}
+
+base::ListValue GetFakeParentsListValue() {
+  base::ListValue parents;
+  parents.Append(GetFakeParent());
+
+  base::DictionaryValue parent2;
+  parent2.SetStringKey("email", std::string());
+  parent2.SetStringKey("displayName", "Marge Simpson");
+  parent2.SetStringKey("profileImageUrl", std::string());
+  parent2.SetStringKey("obfuscatedGaiaId", "anotherObfuscatedGaiaId");
+  parents.Append(std::move(parent2));
+
+  return parents;
+}
+
+class MockEduAccountLoginHandler : public EduAccountLoginHandler {
+ public:
+  explicit MockEduAccountLoginHandler(
+      const base::RepeatingClosure& close_dialog_closure)
+      : EduAccountLoginHandler(close_dialog_closure) {}
+  using EduAccountLoginHandler::set_web_ui;
+
+  MOCK_METHOD(void, FetchFamilyMembers, (), (override));
+  MOCK_METHOD(void,
+              FetchAccessToken,
+              (const std::string& obfuscated_gaia_id,
+               const std::string& password),
+              (override));
+  MOCK_METHOD(void,
+              FetchReAuthProofTokenForParent,
+              (const std::string& child_oauth_access_token,
+               const std::string& parent_obfuscated_gaia_id,
+               const std::string& parent_credential),
+              (override));
+};
+}  // namespace
+
+class EduAccountLoginHandlerTest : public testing::Test {
+ public:
+  EduAccountLoginHandlerTest() {}
+
+  void SetUp() override {
+    handler_ = std::make_unique<MockEduAccountLoginHandler>(base::DoNothing());
+    handler_->set_web_ui(web_ui());
+  }
+
+  void VerifyJavascriptCallbackResolved(
+      const content::TestWebUI::CallData& data,
+      const std::string& event_name,
+      bool success = true) {
+    EXPECT_EQ("cr.webUIResponse", data.function_name());
+
+    std::string callback_id;
+    ASSERT_TRUE(data.arg1()->GetAsString(&callback_id));
+    EXPECT_EQ(event_name, callback_id);
+
+    bool callback_success = false;
+    ASSERT_TRUE(data.arg2()->GetAsBoolean(&callback_success));
+    EXPECT_EQ(success, callback_success);
+  }
+
+  MockEduAccountLoginHandler* handler() const { return handler_.get(); }
+
+  content::TestWebUI* web_ui() { return &web_ui_; }
+
+ private:
+  std::unique_ptr<MockEduAccountLoginHandler> handler_;
+  content::TestWebUI web_ui_;
+};
+
+TEST_F(EduAccountLoginHandlerTest, HandleGetParentsSuccess) {
+  constexpr char callback_id[] = "handle-get-parents-callback";
+  base::ListValue list_args;
+  list_args.AppendString(callback_id);
+
+  EXPECT_CALL(*handler(), FetchFamilyMembers());
+  handler()->HandleGetParents(&list_args);
+
+  // Simulate successful fetching of family members.
+  handler()->OnGetFamilyMembersSuccess(GetFakeFamilyMembers());
+  const content::TestWebUI::CallData& data = *web_ui()->call_data().back();
+  VerifyJavascriptCallbackResolved(data, callback_id);
+
+  ASSERT_EQ(GetFakeParentsListValue(), *data.arg3());
+}
+
+TEST_F(EduAccountLoginHandlerTest, HandleGetParentsFailure) {
+  constexpr char callback_id[] = "handle-get-parents-callback";
+  base::ListValue list_args;
+  list_args.AppendString(callback_id);
+
+  EXPECT_CALL(*handler(), FetchFamilyMembers());
+  handler()->HandleGetParents(&list_args);
+
+  // Simulate failed fetching of family members.
+  handler()->OnFailure(FamilyInfoFetcher::ErrorCode::NETWORK_ERROR);
+  const content::TestWebUI::CallData& data = *web_ui()->call_data().back();
+  VerifyJavascriptCallbackResolved(data, callback_id, false /*success*/);
+
+  ASSERT_EQ(base::ListValue(), *data.arg3());
+}
+
+TEST_F(EduAccountLoginHandlerTest, HandleParentSigninSuccess) {
+  handler()->AllowJavascriptForTesting();
+
+  constexpr char callback_id[] = "handle-parent-signin-callback";
+  base::ListValue list_args;
+  list_args.AppendString(callback_id);
+  list_args.Append(GetFakeParent());
+  list_args.Append(kFakeParentCredential);
+
+  EXPECT_CALL(*handler(),
+              FetchAccessToken(kFakeParentGaiaId, kFakeParentCredential));
+  handler()->HandleParentSignin(&list_args);
+
+  EXPECT_CALL(*handler(),
+              FetchReAuthProofTokenForParent(
+                  kFakeAccessToken, kFakeParentGaiaId, kFakeParentCredential));
+  handler()->CreateReAuthProofTokenForParent(
+      kFakeParentGaiaId, kFakeParentCredential,
+      GoogleServiceAuthError(GoogleServiceAuthError::NONE),
+      signin::AccessTokenInfo(kFakeAccessToken,
+                              base::Time::Now() + base::TimeDelta::FromHours(1),
+                              "id_token"));
+
+  constexpr char fake_rapt[] = "fakeReauthProofToken";
+  // Simulate successful fetching of ReAuthProofToken.
+  handler()->OnReAuthProofTokenSuccess(fake_rapt);
+  const content::TestWebUI::CallData& data = *web_ui()->call_data().back();
+  VerifyJavascriptCallbackResolved(data, callback_id);
+
+  ASSERT_EQ(base::Value(fake_rapt), *data.arg3());
+}
+
+TEST_F(EduAccountLoginHandlerTest, HandleParentSigninAccessTokenFailure) {
+  handler()->AllowJavascriptForTesting();
+
+  constexpr char callback_id[] = "handle-parent-signin-callback";
+  base::ListValue list_args;
+  list_args.AppendString(callback_id);
+  list_args.Append(GetFakeParent());
+  list_args.Append(kFakeParentCredential);
+
+  EXPECT_CALL(*handler(),
+              FetchAccessToken(kFakeParentGaiaId, kFakeParentCredential));
+  handler()->HandleParentSignin(&list_args);
+
+  handler()->CreateReAuthProofTokenForParent(
+      kFakeParentGaiaId, kFakeParentCredential,
+      GoogleServiceAuthError(GoogleServiceAuthError::SERVICE_ERROR),
+      signin::AccessTokenInfo());
+  const content::TestWebUI::CallData& data = *web_ui()->call_data().back();
+  VerifyJavascriptCallbackResolved(data, callback_id, false /*success*/);
+
+  base::DictionaryValue result;
+  result.SetBoolKey("wrongPassword", false);
+  ASSERT_EQ(result, *data.arg3());
+}
+
+TEST_F(EduAccountLoginHandlerTest, HandleParentSigninReAuthProofTokenFailure) {
+  handler()->AllowJavascriptForTesting();
+
+  constexpr char callback_id[] = "handle-parent-signin-callback";
+  base::ListValue list_args;
+  list_args.AppendString(callback_id);
+  list_args.Append(GetFakeParent());
+  list_args.Append(kFakeParentCredential);
+
+  EXPECT_CALL(*handler(),
+              FetchAccessToken(kFakeParentGaiaId, kFakeParentCredential));
+  handler()->HandleParentSignin(&list_args);
+
+  EXPECT_CALL(*handler(),
+              FetchReAuthProofTokenForParent(
+                  kFakeAccessToken, kFakeParentGaiaId, kFakeParentCredential));
+  handler()->CreateReAuthProofTokenForParent(
+      kFakeParentGaiaId, kFakeParentCredential,
+      GoogleServiceAuthError(GoogleServiceAuthError::NONE),
+      signin::AccessTokenInfo(kFakeAccessToken,
+                              base::Time::Now() + base::TimeDelta::FromHours(1),
+                              "id_token"));
+
+  // Simulate failed fetching of ReAuthProofToken.
+  handler()->OnReAuthProofTokenFailure(
+      GaiaAuthConsumer::ReAuthProofTokenStatus::kInvalidGrant);
+  const content::TestWebUI::CallData& data = *web_ui()->call_data().back();
+  VerifyJavascriptCallbackResolved(data, callback_id, false);
+
+  base::DictionaryValue result;
+  result.SetBoolKey("wrongPassword", true);
+  ASSERT_EQ(result, *data.arg3());
+}
+
+}  // namespace chromeos

chrome/browser/ui/webui/signin/inline_login_ui.cc

@@ -26,6 +26,7 @@
 #include "content/public/common/content_switches.h"
 
 #if defined(OS_CHROMEOS)
+#include "chrome/browser/ui/webui/chromeos/edu_account_login_handler_chromeos.h"
 #include "chrome/browser/ui/webui/signin/inline_login_handler_chromeos.h"
 #else
 #include "chrome/browser/ui/webui/signin/inline_login_handler_impl.h"
@@ -115,6 +116,9 @@ InlineLoginUI::InlineLoginUI(content::WebUI* web_ui) : WebDialogUI(web_ui) {
       std::make_unique<chromeos::InlineLoginHandlerChromeOS>(
           base::BindRepeating(&WebDialogUIBase::CloseDialog,
                               weak_factory_.GetWeakPtr(), nullptr /* args */)));
+  web_ui->AddMessageHandler(std::make_unique<chromeos::EduAccountLoginHandler>(
+      base::BindRepeating(&WebDialogUIBase::CloseDialog,
+                          weak_factory_.GetWeakPtr(), nullptr /* args */)));
 #else
   web_ui->AddMessageHandler(std::make_unique<InlineLoginHandlerImpl>());
 #endif  // defined(OS_CHROMEOS)

chrome/test/BUILD.gn

@@ -3618,6 +3618,7 @@ test("unit_tests") {
   if (is_chromeos) {
     sources += [
       "../browser/ui/webui/chromeos/add_supervision/add_supervision_handler_utils_unittest.cc",
+      "../browser/ui/webui/chromeos/edu_account_login_handler_unittest.cc",
       "../renderer/chromeos_delayed_callback_group_unittest.cc",
     ]
   }