Disallow secondary accounts in ARC for Child users

Block propagation of secondary accounts to ARC for Child users.

Bug: 1017160
Change-Id: I7530ecb07a58b686d0dedb1367ffa1ab543e7a4b
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1904074
Commit-Queue: Anastasiia Nikolaienko <anastasiian@chromium.org>
Reviewed-by: Kush Sinha <sinhak@chromium.org>
Reviewed-by: Yury Khmel <khmel@chromium.org>
Cr-Commit-Position: refs/heads/master@{#719570}

chrome/browser/chromeos/arc/auth/arc_auth_service.cc

@@ -557,6 +557,11 @@ void ArcAuthService::OnRefreshTokenUpdatedForAccount(
   if (!arc::IsArcProvisioned(profile_))
     return;
 
+  // For child device accounts do not allow the propagation of secondary
+  // accounts from Chrome OS Account Manager to ARC.
+  if (profile_->IsChild() && !IsPrimaryGaiaAccount(account_info.gaia))
+    return;
+
   if (identity_manager_->HasAccountWithRefreshTokenInPersistentErrorState(
           account_info.account_id)) {
     VLOG(1) << "Ignoring account update due to lack of a valid token: "

chrome/browser/chromeos/arc/auth/arc_auth_service_browsertest.cc

@@ -1032,4 +1032,19 @@ IN_PROC_BROWSER_TEST_F(ArcAuthServiceTest, ChildTransition) {
   }
 }
 
+IN_PROC_BROWSER_TEST_F(ArcAuthServiceTest,
+                       RegularUserSecondaryAccountsArePropagated) {
+  SetAccountAndProfile(user_manager::USER_TYPE_REGULAR);
+  SeedAccountInfo(kSecondaryAccountEmail);
+  EXPECT_EQ(2, auth_instance().num_account_upserted_calls());
+}
+
+IN_PROC_BROWSER_TEST_F(ArcAuthServiceTest,
+                       ChildUserSecondaryAccountsNotPropagated) {
+  SetAccountAndProfile(user_manager::USER_TYPE_CHILD);
+  SeedAccountInfo(kSecondaryAccountEmail);
+  EXPECT_TRUE(profile()->IsChild());
+  EXPECT_EQ(1, auth_instance().num_account_upserted_calls());
+}
+
 }  // namespace arc