Handling non-critical update required for MinimumChromeVersion Policy

This CL adds the handling for non critical updates (warning time
greater than to zero) for the policy MinimumChromeVersionEnforced.
A timer is started based on the current warning time which triggers
when the deadline is reached.
To persist the deadline across reboots, 2 new prefs are stored in the
local state - one for timer start time and the other for warning time.
According to the policy requirements, the warning time for a user
cannot decrease for good user experience.

When a new policy is received and update is required, the policy
handler calculates the new deadline using the already existing timer
start time from the local state (if it exists). The local state is
updated with the new pref values and a timer is started to expire when
deadline is reached which then blocks user session. The policy handler
also observes BuildState for any updates in Chrome version. If Chrome
is updated before deadline, the timer is stopped and update is no
longer required.

The CL does not fully implement the policy.
Subsequent CLs will handle other cases of this policy like showing
in-session notifications in case of EOL and network limitations.

Bug: 1048607
Change-Id: Iddd3966a316b4f48417c3b8aeddefd70597f6799
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2189150
Commit-Queue: Saurabh Nijhara <snijhara@google.com>
Reviewed-by: Maksim Ivanov <emaxx@chromium.org>
Reviewed-by: Dominic Battré <battre@chromium.org>
Reviewed-by: Sergey Poromov <poromov@chromium.org>
Reviewed-by: Roman Sorokin [CET] <rsorokin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#769923}

chrome/browser/chromeos/BUILD.gn

@@ -67,6 +67,7 @@ source_set("chromeos") {
     "//ash/public/cpp",
     "//ash/public/mojom",
     "//ash/system/message_center/arc",
+    "//base/util/timer",
     "//build:branding_buildflags",
     "//chrome/app:command_ids",
     "//chrome/app/vector_icons",

chrome/browser/chromeos/policy/browser_policy_connector_chromeos.cc

@@ -312,6 +312,11 @@ void BrowserPolicyConnectorChromeOS::Shutdown() {
 
   device_scheduled_update_checker_.reset();
 
+  // The policy handler is registered as an observer to BuildState which gets
+  // destructed before BrowserPolicyConnectorChromeOS. So destruct the policy
+  // handler here so that it can de-register itself as an observer.
+  minimum_version_policy_handler_.reset();
+
   if (hostname_handler_)
     hostname_handler_->Shutdown();
 

chrome/browser/chromeos/policy/minimum_version_policy_handler.cc

@@ -7,17 +7,31 @@
 #include "base/bind.h"
 #include "base/memory/ref_counted.h"
 #include "base/time/default_clock.h"
+#include "base/time/time.h"
 #include "base/values.h"
+#include "chrome/browser/browser_process.h"
 #include "chrome/browser/chromeos/policy/minimum_version_policy_handler_delegate_impl.h"
+#include "chrome/browser/upgrade_detector/build_state.h"
+#include "chrome/common/pref_names.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
 #include "chromeos/settings/cros_settings_names.h"
 #include "chromeos/settings/cros_settings_provider.h"
+#include "components/prefs/pref_registry_simple.h"
+#include "components/prefs/pref_service.h"
 
 using MinimumVersionRequirement =
     policy::MinimumVersionPolicyHandler::MinimumVersionRequirement;
 
 namespace policy {
 
+namespace {
+
+PrefService* local_state() {
+  return g_browser_process->local_state();
+}
+
+}  // namespace
+
 const char MinimumVersionPolicyHandler::kChromeVersion[] = "chrome_version";
 const char MinimumVersionPolicyHandler::kWarningPeriod[] = "warning_period";
 const char MinimumVersionPolicyHandler::KEolWarningPeriod[] =
@@ -72,11 +86,14 @@ MinimumVersionPolicyHandler::MinimumVersionPolicyHandler(
       chromeos::kMinimumChromeVersionEnforced,
       base::Bind(&MinimumVersionPolicyHandler::OnPolicyChanged,
                  weak_factory_.GetWeakPtr()));
+
   // Fire it once so we're sure we get an invocation on startup.
   OnPolicyChanged();
 }
 
-MinimumVersionPolicyHandler::~MinimumVersionPolicyHandler() = default;
+MinimumVersionPolicyHandler::~MinimumVersionPolicyHandler() {
+  g_browser_process->GetBuildState()->RemoveObserver(this);
+}
 
 void MinimumVersionPolicyHandler::AddObserver(Observer* observer) {
   observers_.AddObserver(observer);
@@ -91,6 +108,18 @@ bool MinimumVersionPolicyHandler::CurrentVersionSatisfies(
   return delegate_->GetCurrentVersion().CompareTo(requirement.version()) >= 0;
 }
 
+//  static
+void MinimumVersionPolicyHandler::RegisterPrefs(PrefRegistrySimple* registry) {
+  registry->RegisterTimePref(prefs::kUpdateRequiredTimerStartTime,
+                             base::Time());
+  registry->RegisterTimeDeltaPref(prefs::kUpdateRequiredWarningPeriod,
+                                  base::TimeDelta());
+}
+
+bool MinimumVersionPolicyHandler::IsDeadlineTimerRunningForTesting() {
+  return update_required_deadline_timer_.IsRunning();
+}
+
 bool MinimumVersionPolicyHandler::IsPolicyApplicable() {
   bool device_managed = delegate_->IsEnterpriseManaged();
   bool is_kiosk = delegate_->IsKioskMode();
@@ -171,9 +200,13 @@ void MinimumVersionPolicyHandler::HandleUpdateNotRequired() {
 }
 
 void MinimumVersionPolicyHandler::Reset() {
-  state_.reset();
   requirements_met_ = true;
   deadline_reached = false;
+  eol_reached_ = false;
+  update_required_deadline_timer_.Stop();
+  g_browser_process->GetBuildState()->RemoveObserver(this);
+  state_.reset();
+  ResetLocalState();
 }
 
 void MinimumVersionPolicyHandler::FetchEolInfo() {
@@ -195,21 +228,112 @@ void MinimumVersionPolicyHandler::OnFetchEolInfo(
     const chromeos::UpdateEngineClient::EolInfo info) {
   if (info.eol_date.is_null() || info.eol_date > update_required_time_) {
     // End of life is not reached. Start update with |warning_time_|.
+    eol_reached_ = false;
     HandleUpdateRequired(state_->warning());
   } else {
     // End of life is reached. Start update with |eol_warning_time_|.
+    eol_reached_ = true;
     HandleUpdateRequired(state_->eol_warning());
   }
+  if (!fetch_eol_callback_.is_null())
+    std::move(fetch_eol_callback_).Run();
 }
 
 void MinimumVersionPolicyHandler::HandleUpdateRequired(
     base::TimeDelta warning_time) {
-  if (warning_time.is_zero())
+  const base::Time stored_timer_start_time =
+      local_state()->GetTime(prefs::kUpdateRequiredTimerStartTime);
+  const base::TimeDelta stored_warning_time =
+      local_state()->GetTimeDelta(prefs::kUpdateRequiredWarningPeriod);
+  base::Time previous_deadline = stored_timer_start_time + stored_warning_time;
+
+  // If update is already required, use the existing timer start time to
+  // calculate the new deadline. Else use |update_required_time_|. Do not reduce
+  // the warning time if policy is already applied.
+  base::Time deadline;
+  if (stored_timer_start_time.is_null()) {
+    deadline = update_required_time_ + warning_time;
+  } else {
+    deadline =
+        stored_timer_start_time + std::max(stored_warning_time, warning_time);
+  }
+
+  const bool deadline_reached = deadline <= update_required_time_;
+  if (deadline_reached) {
+    // As per the policy, the deadline for the user cannot reduce.
+    // This case can be encountered when :-
+    // a) Update was not required before and now critical update is required.
+    // b) Update was required and warning time has expired when device is
+    // rebooted.
     OnDeadlineReached();
-  // TODO(https://crbug.com/1048607): Handle the cases for network limitations
-  // and warning time greater than zero. This would include starting the timer,
-  // triggering update process if network is good and showing in-session
-  // notifications if required.
+    return;
+  }
+
+  // Need to start the timer even if the deadline is same as the previous one to
+  // handle the case of Chrome reboot.
+  if (deadline == previous_deadline &&
+      update_required_deadline_timer_.IsRunning()) {
+    return;
+  }
+
+  // This case can be encountered when :-
+  // a) Update was not required before and now update is required with a
+  // warning time. b) Policy has been updated with new values and update is
+  // still required.
+
+  // Hide update required screen if it is shown on the login screen.
+  if (delegate_->IsLoginSessionState()) {
+    delegate_->HideUpdateRequiredScreenIfShown();
+  }
+  // The |deadline| can only be equal to or greater than the
+  // |previous_deadline|. No need to update the local state if the deadline has
+  // not been extended.
+  if (deadline > previous_deadline)
+    UpdateLocalState(warning_time);
+  StartDeadlineTimer(deadline);
+  if (!eol_reached_)
+    StartObservingUpdate();
+  // TODO(https://crbug.com/1048607): Show in-session notifications in case of
+  // end-of-life and network limitations.
+}
+
+void MinimumVersionPolicyHandler::ResetLocalState() {
+  local_state()->ClearPref(prefs::kUpdateRequiredTimerStartTime);
+  local_state()->ClearPref(prefs::kUpdateRequiredWarningPeriod);
+}
+
+void MinimumVersionPolicyHandler::UpdateLocalState(
+    base::TimeDelta warning_time) {
+  base::Time timer_start_time =
+      local_state()->GetTime(prefs::kUpdateRequiredTimerStartTime);
+  if (timer_start_time.is_null()) {
+    local_state()->SetTime(prefs::kUpdateRequiredTimerStartTime,
+                           update_required_time_);
+  }
+  local_state()->SetTimeDelta(prefs::kUpdateRequiredWarningPeriod,
+                              warning_time);
+  local_state()->CommitPendingWrite();
+}
+
+void MinimumVersionPolicyHandler::StartDeadlineTimer(base::Time deadline) {
+  // Start the timer to expire when deadline is reached and the device is not
+  // updated to meet the policy requirements.
+  update_required_deadline_timer_.Start(
+      FROM_HERE, deadline,
+      base::BindOnce(&MinimumVersionPolicyHandler::OnDeadlineReached,
+                     weak_factory_.GetWeakPtr()));
+}
+
+void MinimumVersionPolicyHandler::StartObservingUpdate() {
+  auto* build_state = g_browser_process->GetBuildState();
+  if (!build_state->HasObserver(this))
+    build_state->AddObserver(this);
+}
+
+void MinimumVersionPolicyHandler::OnUpdate(const BuildState* build_state) {
+  // Reset the state if new version is greater or equal the required version.
+  if (build_state->installed_version()->CompareTo(state_->version()) >= 0)
+    Reset();
 }
 
 void MinimumVersionPolicyHandler::OnDeadlineReached() {

chrome/browser/chromeos/policy/minimum_version_policy_handler.h

@@ -11,20 +11,25 @@
 #include "base/memory/weak_ptr.h"
 #include "base/observer_list.h"
 #include "base/time/time.h"
+#include "base/util/timer/wall_clock_timer.h"
 #include "base/version.h"
 #include "chrome/browser/chromeos/settings/cros_settings.h"
+#include "chrome/browser/upgrade_detector/build_state_observer.h"
 #include "chromeos/dbus/update_engine_client.h"
 
+class PrefRegistrySimple;
+
 namespace base {
 class Clock;
 class DictionaryValue;
+class Time;
 }
 
 namespace policy {
 
 // This class observes the device setting |kMinimumChromeVersionEnforced|, and
 // checks if respective requirement is met.
-class MinimumVersionPolicyHandler {
+class MinimumVersionPolicyHandler : public BuildStateObserver {
  public:
   static const char kChromeVersion[];
   static const char kWarningPeriod[];
@@ -105,7 +110,10 @@ class MinimumVersionPolicyHandler {
 
   explicit MinimumVersionPolicyHandler(Delegate* delegate,
                                        chromeos::CrosSettings* cros_settings);
-  ~MinimumVersionPolicyHandler();
+  ~MinimumVersionPolicyHandler() override;
+
+  // BuildStateObserver
+  void OnUpdate(const BuildState* build_state) override;
 
   void AddObserver(Observer* observer);
   void RemoveObserver(Observer* observer);
@@ -119,11 +127,19 @@ class MinimumVersionPolicyHandler {
 
   bool DeadlineReached() { return deadline_reached; }
 
+  static void RegisterPrefs(PrefRegistrySimple* registry);
+
+  // Callback used in tests and invoked after end-of-life status has been
+  // fetched from the update_engine.
+  void set_fetch_eol_callback_for_testing(base::OnceClosure callback) {
+    fetch_eol_callback_ = std::move(callback);
+  }
+
+  bool IsDeadlineTimerRunningForTesting();
+
  private:
   void OnPolicyChanged();
-
   bool IsPolicyApplicable();
-
   void Reset();
 
   // Handles the state when update is required as per the policy. If on the
@@ -138,13 +154,29 @@ class MinimumVersionPolicyHandler {
   void FetchEolInfo();
 
   // Callback after fetching end-of-life info from the update_engine_client.
-  void OnFetchEolInfo(const chromeos::UpdateEngineClient::EolInfo info);
+  void OnFetchEolInfo(chromeos::UpdateEngineClient::EolInfo info);
 
   // Called when the warning time to apply updates has expired. If the user on
   // the login screen, the update required screen is shown else the current user
   // session is terminated to bring the user back to the login screen.
   void OnDeadlineReached();
 
+  // Starts the timer to expire when |deadline| is reached.
+  void StartDeadlineTimer(base::Time deadline);
+
+  // Starts observing the BuildState for any updates in Chrome and resets the
+  // state if new version satisfies the minimum version requirement.
+  void StartObservingUpdate();
+
+  // Updates pref |kUpdateRequiredWarningPeriod| in local state to
+  // |warning_time|. If |kUpdateRequiredTimerStartTime| is not null, it means
+  // update is already required and hence, the timer start time should not be
+  // updated.
+  void UpdateLocalState(base::TimeDelta warning_time);
+
+  // Resets the local state prefs to default values.
+  void ResetLocalState();
+
   // This delegate instance is owned by the owner of
   // MinimumVersionPolicyHandler. The owner is responsible to make sure that the
   // delegate lives throughout the life of the policy handler.
@@ -157,6 +189,7 @@ class MinimumVersionPolicyHandler {
   std::unique_ptr<MinimumVersionRequirement> state_;
 
   bool requirements_met_ = true;
+  bool eol_reached_ = false;
 
   // If this flag is true, user should restricted to use the session by logging
   // out and/or showing update required screen.
@@ -164,12 +197,17 @@ class MinimumVersionPolicyHandler {
 
   base::Time update_required_time_;
 
+  // Fires when the deadline to update the device has reached or passed.
+  util::WallClockTimer update_required_deadline_timer_;
+
   // Non-owning reference to CrosSettings. This class have shorter lifetime than
   // CrosSettings.
   chromeos::CrosSettings* cros_settings_;
 
   base::Clock* const clock_;
 
+  base::OnceClosure fetch_eol_callback_;
+
   std::unique_ptr<chromeos::CrosSettings::ObserverSubscription>
       policy_subscription_;
 

chrome/browser/chromeos/policy/minimum_version_policy_handler_browsertest.cc

@@ -30,11 +30,13 @@
 #include "chrome/browser/profiles/profile_manager.h"
 #include "chrome/browser/ui/webui/chromeos/login/gaia_screen_handler.h"
 #include "chrome/browser/ui/webui/chromeos/login/update_required_screen_handler.h"
+#include "chrome/common/pref_names.h"
 #include "chromeos/constants/chromeos_switches.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
 #include "chromeos/dbus/fake_update_engine_client.h"
 #include "chromeos/settings/cros_settings_names.h"
 #include "components/policy/proto/chrome_device_policy.pb.h"
+#include "components/prefs/pref_service.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/test/browser_test.h"
 #include "content/public/test/test_utils.h"
@@ -47,6 +49,12 @@ namespace policy {
 namespace {
 const char kNewVersion[] = "99999.4.2";
 const int kNoWarning = 0;
+const int kShortWarningInDays = 2;
+const int kLongWarningInDays = 10;
+constexpr base::TimeDelta kShortWarning =
+    base::TimeDelta::FromDays(kShortWarningInDays);
+constexpr base::TimeDelta kLongWarning =
+    base::TimeDelta::FromDays(kLongWarningInDays);
 const char kPublicSessionId[] = "demo@example.com";
 // This is a randomly chosen long delay in milliseconds to make sure that the
 // timer keeps running for a long time in case it is started.
@@ -70,6 +78,7 @@ class MinimumVersionPolicyTestBase : public chromeos::LoginManagerTest {
     LoginManagerTest::SetUpInProcessBrowserTestFixture();
     auto fake_update_engine_client =
         std::make_unique<chromeos::FakeUpdateEngineClient>();
+    fake_update_engine_client_ = fake_update_engine_client.get();
     chromeos::DBusThreadManager::GetSetterForTesting()->SetUpdateEngineClient(
         std::move(fake_update_engine_client));
   }
@@ -89,6 +98,7 @@ class MinimumVersionPolicyTestBase : public chromeos::LoginManagerTest {
   void SetMinimumChromeVersionPolicy(const base::Value& value);
 
   DevicePolicyCrosTestHelper helper_;
+  chromeos::FakeUpdateEngineClient* fake_update_engine_client_ = nullptr;
   chromeos::DeviceStateMixin device_state_{
       &mixin_host_,
       chromeos::DeviceStateMixin::State::OOBE_COMPLETED_CLOUD_ENROLLED};
@@ -219,6 +229,74 @@ IN_PROC_BROWSER_TEST_F(MinimumVersionPolicyTest, CriticalUpdateInSession) {
   EXPECT_EQ(user_manager::UserManager::Get()->GetLoggedInUsers().size(), 0u);
 }
 
+IN_PROC_BROWSER_TEST_F(MinimumVersionPolicyTest, NonCriticalUpdateGoodNetwork) {
+  // Login the user into the session and mark as managed.
+  Login();
+
+  // Check deadline timer is not running and local state is not set.
+  PrefService* prefs = g_browser_process->local_state();
+  base::Time timer_start_time =
+      prefs->GetTime(prefs::kUpdateRequiredTimerStartTime);
+  EXPECT_TRUE(timer_start_time.is_null());
+  EXPECT_FALSE(
+      GetMinimumVersionPolicyHandler()->IsDeadlineTimerRunningForTesting());
+
+  // Create and set policy value with short warning time.
+  base::Value requirement_short_warning(base::Value::Type::LIST);
+  requirement_short_warning.Append(
+      CreateRequirement(kNewVersion, kShortWarningInDays, kShortWarningInDays));
+  SetDevicePolicyAndWaitForSettingChange(requirement_short_warning);
+
+  // Policy handler sets the local state and starts the deadline timer.
+  timer_start_time = prefs->GetTime(prefs::kUpdateRequiredTimerStartTime);
+  EXPECT_FALSE(timer_start_time.is_null());
+  EXPECT_EQ(prefs->GetTimeDelta(prefs::kUpdateRequiredWarningPeriod),
+            kShortWarning);
+  EXPECT_TRUE(
+      GetMinimumVersionPolicyHandler()->IsDeadlineTimerRunningForTesting());
+
+  // Create and set policy value with long warning time.
+  base::Value requirement_long_warning(base::Value::Type::LIST);
+  requirement_long_warning.Append(
+      CreateRequirement(kNewVersion, kLongWarningInDays, kLongWarningInDays));
+  SetDevicePolicyAndWaitForSettingChange(requirement_long_warning);
+
+  // Warning time is increased but timer start time does not change.
+  EXPECT_EQ(prefs->GetTime(prefs::kUpdateRequiredTimerStartTime),
+            timer_start_time);
+  EXPECT_EQ(prefs->GetTimeDelta(prefs::kUpdateRequiredWarningPeriod),
+            kLongWarning);
+
+  // Create and set policy value with no warning time.
+  base::Value requirement_no_warning(base::Value::Type::LIST);
+  requirement_no_warning.Append(
+      CreateRequirement(kNewVersion, kNoWarning, kNoWarning));
+  SetDevicePolicyAndWaitForSettingChange(requirement_no_warning);
+
+  // Warning time is not reduced as policy does not allow to reduce deadline.
+  EXPECT_EQ(prefs->GetTime(prefs::kUpdateRequiredTimerStartTime),
+            timer_start_time);
+  EXPECT_EQ(prefs->GetTimeDelta(prefs::kUpdateRequiredWarningPeriod),
+            kLongWarning);
+
+  EXPECT_TRUE(
+      GetMinimumVersionPolicyHandler()->IsDeadlineTimerRunningForTesting());
+  EXPECT_TRUE(GetMinimumVersionPolicyHandler()->GetState());
+
+  // Simulate update installed from update_engine_client and check that timer
+  // and the local state is reset.
+  update_engine::StatusResult status;
+  status.set_current_operation(update_engine::Operation::UPDATED_NEED_REBOOT);
+  status.set_new_version("99999.9");
+  fake_update_engine_client_->set_default_status(status);
+  fake_update_engine_client_->NotifyObserversThatStatusChanged(status);
+
+  EXPECT_FALSE(
+      GetMinimumVersionPolicyHandler()->IsDeadlineTimerRunningForTesting());
+  EXPECT_FALSE(GetMinimumVersionPolicyHandler()->GetState());
+  EXPECT_TRUE(prefs->GetTime(prefs::kUpdateRequiredTimerStartTime).is_null());
+}
+
 IN_PROC_BROWSER_TEST_F(MinimumVersionPolicyTest,
                        CriticalUpdateInSessionUnmanagedUser) {
   // Login the user into the session.
@@ -386,4 +464,44 @@ IN_PROC_BROWSER_TEST_F(MinimumVersionPublicSessionAutoLoginTest,
                    ->IsAutoLoginTimerRunningForTesting());
 }
 
+class MinimumVersionTimerExpiredOnLogin
+    : public MinimumVersionPolicyTestBase,
+      public chromeos::LocalStateMixin::Delegate {
+ public:
+  MinimumVersionTimerExpiredOnLogin() = default;
+  ~MinimumVersionTimerExpiredOnLogin() override = default;
+
+  // chromeos::LocalStateMixin::Delegate:
+  void SetUpLocalState() override {
+    // Set up local state to reflect that update required deadline has passed
+    // when device is rebooted.
+    const base::TimeDelta delta = base::TimeDelta::FromDays(5);
+    PrefService* prefs = g_browser_process->local_state();
+    prefs->SetTime(prefs::kUpdateRequiredTimerStartTime,
+                   base::Time::Now() - delta);
+    prefs->SetTimeDelta(prefs::kUpdateRequiredWarningPeriod, kShortWarning);
+  }
+
+  // MinimumVersionPolicyTestBase:
+  void SetUpInProcessBrowserTestFixture() override {
+    MinimumVersionPolicyTestBase::SetUpInProcessBrowserTestFixture();
+    // Create and set policy value as a list of requirements.
+    base::Value requirement_list(base::Value::Type::LIST);
+    requirement_list.Append(CreateRequirement(kNewVersion, kShortWarningInDays,
+                                              kShortWarningInDays));
+    SetAndRefreshMinimumChromeVersionPolicy(requirement_list);
+  }
+
+ private:
+  chromeos::LocalStateMixin local_state_mixin_{&mixin_host_, this};
+};
+
+IN_PROC_BROWSER_TEST_F(MinimumVersionTimerExpiredOnLogin, DeadlinePassed) {
+  // Show update required screen as deadline to update the device has passed.
+  EXPECT_EQ(session_manager::SessionManager::Get()->session_state(),
+            session_manager::SessionState::LOGIN_PRIMARY);
+  chromeos::OobeScreenWaiter(chromeos::UpdateRequiredView::kScreenId).Wait();
+  EXPECT_TRUE(ash::LoginScreenTestApi::IsOobeDialogVisible());
+}
+
 }  // namespace policy

chrome/browser/chromeos/policy/minimum_version_policy_handler_unittest.cc

@@ -5,10 +5,13 @@
 #include "chrome/browser/chromeos/policy/minimum_version_policy_handler.h"
 
 #include "base/run_loop.h"
+#include "base/test/bind_test_util.h"
 #include "base/test/task_environment.h"
 #include "base/values.h"
 #include "chrome/browser/chromeos/settings/scoped_cros_settings_test_helper.h"
 #include "chrome/browser/chromeos/settings/scoped_testing_cros_settings.h"
+#include "chrome/test/base/scoped_testing_local_state.h"
+#include "chrome/test/base/testing_browser_process.h"
 #include "chromeos/dbus/dbus_thread_manager.h"
 #include "chromeos/dbus/fake_update_engine_client.h"
 #include "chromeos/settings/cros_settings_names.h"
@@ -77,16 +80,19 @@ class MinimumVersionPolicyHandlerTest
 
   void SetUserManaged(bool managed) { user_managed_ = managed; }
 
+  base::test::TaskEnvironment task_environment{
+      base::test::TaskEnvironment::TimeSource::MOCK_TIME};
+
  private:
   bool user_managed_ = true;
-
-  base::test::TaskEnvironment task_environment;
+  ScopedTestingLocalState local_state_;
   chromeos::ScopedTestingCrosSettings scoped_testing_cros_settings_;
   std::unique_ptr<base::Version> current_version_;
   std::unique_ptr<MinimumVersionPolicyHandler> minimum_version_policy_handler_;
 };
 
-MinimumVersionPolicyHandlerTest::MinimumVersionPolicyHandlerTest() {}
+MinimumVersionPolicyHandlerTest::MinimumVersionPolicyHandlerTest()
+    : local_state_(TestingBrowserProcess::GetGlobal()) {}
 
 void MinimumVersionPolicyHandlerTest::SetUp() {
   auto fake_update_engine_client =
@@ -170,7 +176,6 @@ TEST_F(MinimumVersionPolicyHandlerTest, RequirementsNotMetState) {
 
   // Create policy value as a list of requirements.
   base::Value requirement_list(base::Value::Type::LIST);
-
   base::Value new_version_short_warning =
       CreateRequirement(kNewVersion, kShortWarning, kNoWarning);
   auto strongest_requirement = MinimumVersionRequirement::CreateInstanceIfValid(
@@ -298,4 +303,41 @@ TEST_F(MinimumVersionPolicyHandlerTest, RequirementsMetState) {
   EXPECT_FALSE(GetState());
 }
 
+TEST_F(MinimumVersionPolicyHandlerTest, DeadlineTimerExpired) {
+  // Checks the user is logged out of the session when the deadline is reached.
+  EXPECT_TRUE(GetMinimumVersionPolicyHandler()->RequirementsAreSatisfied());
+
+  // This is needed to wait till EOL status is fetched from the update_engine.
+  base::RunLoop run_loop;
+  GetMinimumVersionPolicyHandler()->set_fetch_eol_callback_for_testing(
+      run_loop.QuitClosure());
+
+  // Expect calls to make sure that user is not logged out.
+  EXPECT_CALL(*this, RestartToLoginScreen()).Times(0);
+  EXPECT_CALL(*this, ShowUpdateRequiredScreen()).Times(0);
+
+  // Create and set pref value to invoke policy handler such that update is
+  // required with a long warning time.
+  base::Value requirement_list(base::Value::Type::LIST);
+  requirement_list.Append(
+      CreateRequirement(kNewVersion, kLongWarning, kLongWarning));
+  SetPolicyPref(std::move(requirement_list));
+
+  run_loop.Run();
+  EXPECT_TRUE(
+      GetMinimumVersionPolicyHandler()->IsDeadlineTimerRunningForTesting());
+  EXPECT_FALSE(GetMinimumVersionPolicyHandler()->RequirementsAreSatisfied());
+
+  testing::Mock::VerifyAndClearExpectations(this);
+
+  // Expire the timer and check that user is logged out of the session.
+  EXPECT_CALL(*this, IsLoginSessionState()).Times(1);
+  EXPECT_CALL(*this, RestartToLoginScreen()).Times(1);
+  const base::TimeDelta warning = base::TimeDelta::FromDays(kLongWarning);
+  task_environment.FastForwardBy(warning);
+  EXPECT_FALSE(
+      GetMinimumVersionPolicyHandler()->IsDeadlineTimerRunningForTesting());
+  EXPECT_FALSE(GetMinimumVersionPolicyHandler()->RequirementsAreSatisfied());
+}
+
 }  // namespace policy

chrome/browser/prefs/browser_prefs.cc

@@ -309,6 +309,7 @@
 #include "chrome/browser/chromeos/policy/device_cloud_policy_manager_chromeos.h"
 #include "chrome/browser/chromeos/policy/dm_token_storage.h"
 #include "chrome/browser/chromeos/policy/external_data_handlers/device_wallpaper_image_external_data_handler.h"
+#include "chrome/browser/chromeos/policy/minimum_version_policy_handler.h"
 #include "chrome/browser/chromeos/policy/policy_cert_service_factory.h"
 #include "chrome/browser/chromeos/policy/status_collector/device_status_collector.h"
 #include "chrome/browser/chromeos/policy/status_collector/status_collector.h"
@@ -763,6 +764,7 @@ void RegisterLocalState(PrefRegistrySimple* registry) {
   policy::DeviceStatusCollector::RegisterPrefs(registry);
   policy::DeviceWallpaperImageExternalDataHandler::RegisterPrefs(registry);
   policy::DMTokenStorage::RegisterPrefs(registry);
+  policy::MinimumVersionPolicyHandler::RegisterPrefs(registry);
   policy::PolicyCertServiceFactory::RegisterPrefs(registry);
   policy::TPMAutoUpdateModePolicyHandler::RegisterPrefs(registry);
   policy::WebUsbAllowDevicesForUrlsPolicyHandler::RegisterPrefs(registry);

chrome/common/pref_names.cc

@@ -1057,6 +1057,16 @@ const char kSettingsShowOSBanner[] = "settings.cros.show_os_banner";
 // urls to be used via the WebUSB API on the login screen.
 const char kDeviceLoginScreenWebUsbAllowDevicesForUrls[] =
     "device_login_screen_webusb_allow_devices_for_urls";
+
+// Int64 pref indicating the time in microseconds since Windows epoch when the
+// timer for update required which will block user session was started. If the
+// timer is not started the pref holds the default value base::Time().
+const char kUpdateRequiredTimerStartTime[] = "update_required_timer_start_time";
+
+// Int64 pref indicating the waiting time in microseconds after which the update
+// required timer will expire and block user session. If the timer is not
+// started the pref holds the default value base::TimeDelta().
+const char kUpdateRequiredWarningPeriod[] = "update_required_warning_period";
 #endif  // defined(OS_CHROMEOS)
 
 // A boolean pref set to true if a Home button to open the Home pages should be

chrome/common/pref_names.h

@@ -335,6 +335,8 @@ extern const char kLoginExtensionApiLaunchExtensionId[];
 extern const char kSettingsShowBrowserBanner[];
 extern const char kSettingsShowOSBanner[];
 extern const char kDeviceLoginScreenWebUsbAllowDevicesForUrls[];
+extern const char kUpdateRequiredTimerStartTime[];
+extern const char kUpdateRequiredWarningPeriod[];
 #endif  // defined(OS_CHROMEOS)
 extern const char kShowHomeButton[];
 extern const char kSpeechRecognitionFilterProfanities[];