Initial RemoteCommandsInvalidator

This CL adds the invalidator class for remote commands service.

BUG=480982

Review URL: https://codereview.chromium.org/1094493003

Cr-Commit-Position: refs/heads/master@{#330114}

chrome/browser/chromeos/policy/browser_policy_connector_chromeos.cc

@@ -28,6 +28,7 @@
 #include "chrome/browser/chromeos/policy/device_network_configuration_updater.h"
 #include "chrome/browser/chromeos/policy/enrollment_config.h"
 #include "chrome/browser/chromeos/policy/enterprise_install_attributes.h"
+#include "chrome/browser/chromeos/policy/remote_commands/affiliated_remote_commands_invalidator.h"
 #include "chrome/browser/chromeos/policy/server_backed_state_keys_broker.h"
 #include "chrome/browser/chromeos/settings/cros_settings.h"
 #include "chrome/browser/chromeos/settings/device_settings_service.h"
@@ -198,6 +199,10 @@ void BrowserPolicyConnectorChromeOS::Init(
         enterprise_management::DeviceRegisterRequest::DEVICE,
         device_cloud_policy_manager_->core(),
         affiliated_invalidation_service_provider_.get()));
+    device_remote_commands_invalidator_.reset(
+        new AffiliatedRemoteCommandsInvalidator(
+            device_cloud_policy_manager_->core(),
+            affiliated_invalidation_service_provider_.get()));
   }
 
   SetTimezoneIfPolicyAvailable();

chrome/browser/chromeos/policy/browser_policy_connector_chromeos.h

@@ -24,10 +24,11 @@ class URLRequestContextGetter;
 
 namespace policy {
 
+class AffiliatedCloudPolicyInvalidator;
 class AffiliatedInvalidationServiceProvider;
+class AffiliatedRemoteCommandsInvalidator;
 class ConsumerManagementService;
 class DeviceCloudPolicyInitializer;
-class AffiliatedCloudPolicyInvalidator;
 class DeviceLocalAccountPolicyService;
 class DeviceManagementService;
 struct EnrollmentConfig;
@@ -164,6 +165,8 @@ class BrowserPolicyConnectorChromeOS
   scoped_ptr<DeviceLocalAccountPolicyService>
       device_local_account_policy_service_;
   scoped_ptr<AffiliatedCloudPolicyInvalidator> device_cloud_policy_invalidator_;
+  scoped_ptr<AffiliatedRemoteCommandsInvalidator>
+      device_remote_commands_invalidator_;
 
   // This policy provider is used on Chrome OS to feed user policy into the
   // global PolicyService instance. This works by installing the cloud policy

chrome/browser/chromeos/policy/remote_commands/affiliated_remote_commands_invalidator.cc

+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/chromeos/policy/remote_commands/affiliated_remote_commands_invalidator.h"
+
+#include "chrome/browser/policy/cloud/remote_commands_invalidator_impl.h"
+
+namespace policy {
+
+AffiliatedRemoteCommandsInvalidator::AffiliatedRemoteCommandsInvalidator(
+    CloudPolicyCore* core,
+    AffiliatedInvalidationServiceProvider* invalidation_service_provider)
+    : core_(core),
+      invalidation_service_provider_(invalidation_service_provider) {
+  invalidation_service_provider_->RegisterConsumer(this);
+}
+
+AffiliatedRemoteCommandsInvalidator::~AffiliatedRemoteCommandsInvalidator() {
+  invalidation_service_provider_->UnregisterConsumer(this);
+}
+
+void AffiliatedRemoteCommandsInvalidator::OnInvalidationServiceSet(
+    invalidation::InvalidationService* invalidation_service) {
+  // Destroy this invalidator if it exists.
+  if (invalidator_) {
+    invalidator_->Shutdown();
+    invalidator_.reset();
+  }
+  // Create a new one if required.
+  if (invalidation_service) {
+    invalidator_.reset(new RemoteCommandsInvalidatorImpl(core_));
+    invalidator_->Initialize(invalidation_service);
+  }
+}
+
+}  // namespace policy

chrome/browser/chromeos/policy/remote_commands/affiliated_remote_commands_invalidator.h

+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_CHROMEOS_POLICY_REMOTE_COMMANDS_AFFILIATED_REMOTE_COMMANDS_INVALIDATOR_H_
+#define CHROME_BROWSER_CHROMEOS_POLICY_REMOTE_COMMANDS_AFFILIATED_REMOTE_COMMANDS_INVALIDATOR_H_
+
+#include "base/macros.h"
+#include "base/memory/scoped_ptr.h"
+#include "chrome/browser/chromeos/policy/affiliated_invalidation_service_provider.h"
+
+namespace policy {
+
+class CloudPolicyCore;
+class RemoteCommandsInvalidatorImpl;
+
+// This is a wrapper class to be used for device commands and device-local
+// account commands.
+class AffiliatedRemoteCommandsInvalidator
+    : public AffiliatedInvalidationServiceProvider::Consumer {
+ public:
+  AffiliatedRemoteCommandsInvalidator(
+      CloudPolicyCore* core,
+      AffiliatedInvalidationServiceProvider* invalidation_service_provider);
+  ~AffiliatedRemoteCommandsInvalidator() override;
+
+  // AffiliatedInvalidationServiceProvider::Consumer:
+  void OnInvalidationServiceSet(
+      invalidation::InvalidationService* invalidation_service) override;
+
+ private:
+  CloudPolicyCore* const core_;
+  AffiliatedInvalidationServiceProvider* const invalidation_service_provider_;
+
+  scoped_ptr<RemoteCommandsInvalidatorImpl> invalidator_;
+
+  DISALLOW_COPY_AND_ASSIGN(AffiliatedRemoteCommandsInvalidator);
+};
+
+}  // namespace policy
+
+#endif  // CHROME_BROWSER_CHROMEOS_POLICY_REMOTE_COMMANDS_AFFILIATED_REMOTE_COMMANDS_INVALIDATOR_H_

chrome/browser/policy/cloud/DEPS

@@ -38,7 +38,9 @@ specific_include_rules = {
     "+content/public/test",
   ],
 
-  r"cloud_policy_invalidator_unittest\.cc": [
+  r"(cloud_policy_invalidator_unittest|"
+  r"remote_commands_invalidator_unittest)"
+  r"\.cc": [
     "+chrome/browser/invalidation/fake_invalidation_service.h",
   ],
 }

chrome/browser/policy/cloud/remote_commands_invalidator.cc

+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/policy/cloud/remote_commands_invalidator.h"
+
+#include <string>
+
+#include "base/logging.h"
+#include "components/invalidation/invalidation.h"
+#include "components/invalidation/invalidation_service.h"
+#include "components/invalidation/invalidation_util.h"
+#include "components/invalidation/invalidator_state.h"
+#include "components/invalidation/object_id_invalidation_map.h"
+#include "components/invalidation/single_object_invalidation_set.h"
+
+namespace policy {
+
+RemoteCommandsInvalidator::RemoteCommandsInvalidator() {
+}
+
+RemoteCommandsInvalidator::~RemoteCommandsInvalidator() {
+  DCHECK_EQ(SHUT_DOWN, state_);
+}
+
+void RemoteCommandsInvalidator::Initialize(
+    invalidation::InvalidationService* invalidation_service) {
+  DCHECK_EQ(SHUT_DOWN, state_);
+  DCHECK(thread_checker_.CalledOnValidThread());
+
+  DCHECK(invalidation_service);
+  invalidation_service_ = invalidation_service;
+
+  state_ = STOPPED;
+  OnInitialize();
+}
+
+void RemoteCommandsInvalidator::Shutdown() {
+  DCHECK_NE(SHUT_DOWN, state_);
+  DCHECK(thread_checker_.CalledOnValidThread());
+
+  Stop();
+
+  state_ = SHUT_DOWN;
+  OnShutdown();
+}
+
+void RemoteCommandsInvalidator::Start() {
+  DCHECK_EQ(STOPPED, state_);
+  DCHECK(thread_checker_.CalledOnValidThread());
+  state_ = STARTED;
+
+  OnStart();
+}
+
+void RemoteCommandsInvalidator::Stop() {
+  DCHECK_NE(SHUT_DOWN, state_);
+  DCHECK(thread_checker_.CalledOnValidThread());
+
+  if (state_ == STARTED) {
+    Unregister();
+    state_ = STOPPED;
+
+    OnStop();
+  }
+}
+
+void RemoteCommandsInvalidator::OnInvalidatorStateChange(
+    syncer::InvalidatorState state) {
+  DCHECK_EQ(STARTED, state_);
+  DCHECK(thread_checker_.CalledOnValidThread());
+
+  invalidation_service_enabled_ = state == syncer::INVALIDATIONS_ENABLED;
+  UpdateInvalidationsEnabled();
+}
+
+void RemoteCommandsInvalidator::OnIncomingInvalidation(
+    const syncer::ObjectIdInvalidationMap& invalidation_map) {
+  DCHECK_EQ(STARTED, state_);
+  DCHECK(thread_checker_.CalledOnValidThread());
+
+  if (!invalidation_service_enabled_)
+    LOG(WARNING) << "Unexpected invalidation received.";
+
+  const syncer::SingleObjectInvalidationSet& list =
+      invalidation_map.ForObject(object_id_);
+  if (list.IsEmpty()) {
+    NOTREACHED();
+    return;
+  }
+
+  // Acknowledge all invalidations.
+  for (const auto& it : list)
+    it.Acknowledge();
+
+  DoRemoteCommandsFetch();
+}
+
+std::string RemoteCommandsInvalidator::GetOwnerName() const {
+  return "RemoteCommands";
+}
+
+void RemoteCommandsInvalidator::ReloadPolicyData(
+    const enterprise_management::PolicyData* policy) {
+  DCHECK(thread_checker_.CalledOnValidThread());
+
+  if (state_ != STARTED)
+    return;
+
+  // Create the ObjectId based on the policy data.
+  // If the policy does not specify an the ObjectId, then unregister.
+  if (!policy || !policy->has_command_invalidation_source() ||
+      !policy->has_command_invalidation_name()) {
+    Unregister();
+    return;
+  }
+  const invalidation::ObjectId object_id(policy->command_invalidation_source(),
+                                         policy->command_invalidation_name());
+
+  // If the policy object id in the policy data is different from the currently
+  // registered object id, update the object registration.
+  if (!is_registered_ || !(object_id == object_id_))
+    Register(object_id);
+}
+
+void RemoteCommandsInvalidator::Register(
+    const invalidation::ObjectId& object_id) {
+  // Register this handler with the invalidation service if needed.
+  if (!is_registered_) {
+    OnInvalidatorStateChange(invalidation_service_->GetInvalidatorState());
+    invalidation_service_->RegisterInvalidationHandler(this);
+    is_registered_ = true;
+  }
+
+  object_id_ = object_id;
+  UpdateInvalidationsEnabled();
+
+  // Update registration with the invalidation service.
+  syncer::ObjectIdSet ids;
+  ids.insert(object_id);
+  invalidation_service_->UpdateRegisteredInvalidationIds(this, ids);
+}
+
+void RemoteCommandsInvalidator::Unregister() {
+  if (is_registered_) {
+    invalidation_service_->UpdateRegisteredInvalidationIds(
+        this, syncer::ObjectIdSet());
+    invalidation_service_->UnregisterInvalidationHandler(this);
+    is_registered_ = false;
+    UpdateInvalidationsEnabled();
+  }
+}
+
+void RemoteCommandsInvalidator::UpdateInvalidationsEnabled() {
+  invalidations_enabled_ = invalidation_service_enabled_ && is_registered_;
+}
+
+}  // namespace policy

chrome/browser/policy/cloud/remote_commands_invalidator.h

+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_POLICY_CLOUD_REMOTE_COMMANDS_INVALIDATOR_H_
+#define CHROME_BROWSER_POLICY_CLOUD_REMOTE_COMMANDS_INVALIDATOR_H_
+
+#include "base/macros.h"
+#include "base/threading/thread_checker.h"
+#include "components/invalidation/invalidation_handler.h"
+#include "google/cacheinvalidation/include/types.h"
+#include "policy/proto/device_management_backend.pb.h"
+
+namespace invalidation {
+class InvalidationService;
+}  // namespace invalidation
+
+namespace policy {
+
+// This class provides basic intefaces for an invalidator for remote commands
+// services. It's not interacting with CloudPolicyClient/CloudPolicyCore
+// directly, instead, it handles the interacting with invalidation service
+// only and leaves interfaces to integrate with subclasses.
+class RemoteCommandsInvalidator : public syncer::InvalidationHandler {
+ public:
+  RemoteCommandsInvalidator();
+  ~RemoteCommandsInvalidator() override;
+
+  // Initialize this invalidator to pair with |invalidation_service|. Must be
+  // called before Start().
+  void Initialize(invalidation::InvalidationService* invalidation_service);
+
+  // Shutdown this invalidator. Will stop the invalidator first, and after
+  // shutting down, the invalidator can't be started anymore unless it's
+  // initialized again.
+  void Shutdown();
+
+  // Starts to process invalidations.
+  void Start();
+
+  // Stops to process invalidation. May only be called after Start() has been
+  // called.
+  void Stop();
+
+  // Helpful accessors.
+  invalidation::InvalidationService* invalidation_service() {
+    return invalidation_service_;
+  }
+  bool invalidations_enabled() { return invalidations_enabled_; }
+
+  // syncer::InvalidationHandler:
+  void OnInvalidatorStateChange(syncer::InvalidatorState state) override;
+  void OnIncomingInvalidation(
+      const syncer::ObjectIdInvalidationMap& invalidation_map) override;
+  std::string GetOwnerName() const override;
+
+ protected:
+  virtual void OnInitialize() = 0;
+  virtual void OnShutdown() = 0;
+  virtual void OnStart() = 0;
+  virtual void OnStop() = 0;
+
+  // Subclasses must override this method to implement the actual remote
+  // commands fetch.
+  virtual void DoRemoteCommandsFetch() = 0;
+
+  // Subclasses must call this function to set the object id for remote command
+  // invalidations.
+  void ReloadPolicyData(const enterprise_management::PolicyData* policy);
+
+ private:
+  // Registers the given object with the invalidation service.
+  void Register(const invalidation::ObjectId& object_id);
+
+  // Unregisters the current object with the invalidation service.
+  void Unregister();
+
+  // Updates invalidations_enabled_.
+  void UpdateInvalidationsEnabled();
+
+  // The state of the object.
+  enum State {
+    SHUT_DOWN,
+    STOPPED,
+    STARTED,
+  };
+  State state_ = SHUT_DOWN;
+
+  // The invalidation service.
+  invalidation::InvalidationService* invalidation_service_ = nullptr;
+
+  // Whether the invalidator currently has the ability to receive invalidations.
+  // This is true if the invalidation service is enabled and the invalidator
+  // has registered for a remote commands object.
+  bool invalidations_enabled_ = false;
+
+  // Whether the invalidation service is currently enabled.
+  bool invalidation_service_enabled_ = false;
+
+  // Whether this object has registered for remote commands invalidations.
+  bool is_registered_ = false;
+
+  // The object id representing the remote commands in the invalidation service.
+  invalidation::ObjectId object_id_;
+
+  // A thread checker to make sure that callbacks are invoked on the correct
+  // thread.
+  base::ThreadChecker thread_checker_;
+
+  DISALLOW_COPY_AND_ASSIGN(RemoteCommandsInvalidator);
+};
+
+}  // namespace policy
+
+#endif  // CHROME_BROWSER_POLICY_CLOUD_REMOTE_COMMANDS_INVALIDATOR_H_

chrome/browser/policy/cloud/remote_commands_invalidator_impl.cc

+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/policy/cloud/remote_commands_invalidator_impl.h"
+
+#include "base/logging.h"
+#include "components/policy/core/common/remote_commands/remote_commands_service.h"
+
+namespace policy {
+
+RemoteCommandsInvalidatorImpl::RemoteCommandsInvalidatorImpl(
+    CloudPolicyCore* core)
+    : core_(core) {
+  DCHECK(core_);
+}
+
+void RemoteCommandsInvalidatorImpl::OnInitialize() {
+  core_->AddObserver(this);
+  if (core_->remote_commands_service())
+    OnRemoteCommandsServiceStarted(core_);
+}
+
+void RemoteCommandsInvalidatorImpl::OnShutdown() {
+  core_->RemoveObserver(this);
+}
+
+void RemoteCommandsInvalidatorImpl::OnStart() {
+  core_->store()->AddObserver(this);
+  OnStoreLoaded(core_->store());
+}
+
+void RemoteCommandsInvalidatorImpl::OnStop() {
+  core_->store()->RemoveObserver(this);
+}
+
+void RemoteCommandsInvalidatorImpl::DoRemoteCommandsFetch() {
+  DCHECK(core_->remote_commands_service());
+  core_->remote_commands_service()->FetchRemoteCommands();
+}
+
+void RemoteCommandsInvalidatorImpl::OnCoreConnected(CloudPolicyCore* core) {
+}
+
+void RemoteCommandsInvalidatorImpl::OnRefreshSchedulerStarted(
+    CloudPolicyCore* core) {
+}
+
+void RemoteCommandsInvalidatorImpl::OnCoreDisconnecting(CloudPolicyCore* core) {
+  Stop();
+}
+
+void RemoteCommandsInvalidatorImpl::OnRemoteCommandsServiceStarted(
+    CloudPolicyCore* core) {
+  Start();
+}
+
+void RemoteCommandsInvalidatorImpl::OnStoreLoaded(CloudPolicyStore* core) {
+  ReloadPolicyData(core_->store()->policy());
+}
+
+void RemoteCommandsInvalidatorImpl::OnStoreError(CloudPolicyStore* core) {
+}
+
+}  // namespace policy

chrome/browser/policy/cloud/remote_commands_invalidator_impl.h

+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_POLICY_CLOUD_REMOTE_COMMANDS_INVALIDATOR_IMPL_H_
+#define CHROME_BROWSER_POLICY_CLOUD_REMOTE_COMMANDS_INVALIDATOR_IMPL_H_
+
+#include "base/macros.h"
+#include "chrome/browser/policy/cloud/remote_commands_invalidator.h"
+#include "components/policy/core/common/cloud/cloud_policy_core.h"
+#include "components/policy/core/common/cloud/cloud_policy_store.h"
+
+namespace policy {
+
+// Implementation of invalidator for remote commands services. This class
+// listens to events from CloudPolicyCore and CloudPolicyStore and builds
+// with RemoteCommandsInvalidator to complete the tasks.
+class RemoteCommandsInvalidatorImpl : public RemoteCommandsInvalidator,
+                                      public CloudPolicyCore::Observer,
+                                      public CloudPolicyStore::Observer {
+ public:
+  explicit RemoteCommandsInvalidatorImpl(CloudPolicyCore* core);
+
+  // RemoteCommandsInvalidator:
+  void OnInitialize() override;
+  void OnShutdown() override;
+  void OnStart() override;
+  void OnStop() override;
+  void DoRemoteCommandsFetch() override;
+
+  // CloudPolicyCore::Observer:
+  void OnCoreConnected(CloudPolicyCore* core) override;
+  void OnRefreshSchedulerStarted(CloudPolicyCore* core) override;
+  void OnCoreDisconnecting(CloudPolicyCore* core) override;
+  void OnRemoteCommandsServiceStarted(CloudPolicyCore* core) override;
+
+  // CloudPolicyStore::Observer:
+  void OnStoreLoaded(CloudPolicyStore* store) override;
+  void OnStoreError(CloudPolicyStore* store) override;
+
+ private:
+  CloudPolicyCore* const core_;
+
+  DISALLOW_COPY_AND_ASSIGN(RemoteCommandsInvalidatorImpl);
+};
+
+}  // namespace policy
+
+#endif  // CHROME_BROWSER_POLICY_CLOUD_REMOTE_COMMANDS_INVALIDATOR_IMPL_H_

chrome/browser/policy/cloud/remote_commands_invalidator_unittest.cc

+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/policy/cloud/remote_commands_invalidator.h"
+
+#include "base/message_loop/message_loop.h"
+#include "base/run_loop.h"
+#include "chrome/browser/invalidation/fake_invalidation_service.h"
+#include "components/invalidation/invalidation.h"
+#include "components/invalidation/invalidation_util.h"
+#include "components/invalidation/invalidator_registrar.h"
+#include "components/invalidation/invalidator_state.h"
+#include "components/invalidation/mock_ack_handler.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace em = enterprise_management;
+
+using ::testing::Mock;
+using ::testing::StrictMock;
+
+namespace policy {
+
+class MockRemoteCommandInvalidator : public RemoteCommandsInvalidator {
+ public:
+  MockRemoteCommandInvalidator() {}
+
+  MOCK_METHOD0(OnInitialize, void());
+  MOCK_METHOD0(OnShutdown, void());
+  MOCK_METHOD0(OnStart, void());
+  MOCK_METHOD0(OnStop, void());
+  MOCK_METHOD0(DoRemoteCommandsFetch, void());
+
+  void SetInvalidationObjectID(const invalidation::ObjectId& object_id) {
+    em::PolicyData policy_data;
+    policy_data.set_command_invalidation_source(object_id.source());
+    policy_data.set_command_invalidation_name(object_id.name());
+    ReloadPolicyData(&policy_data);
+  }
+
+  void ClearInvalidationObjectID() {
+    const em::PolicyData policy_data;
+    ReloadPolicyData(&policy_data);
+  }
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(MockRemoteCommandInvalidator);
+};
+
+class RemoteCommandsInvalidatorTest : public testing::Test {
+ public:
+  RemoteCommandsInvalidatorTest()
+      : kTestingObjectId1(123456, "abcdef"),
+        kTestingObjectId2(654321, "defabc") {
+  }
+
+  void EnableInvalidationService() {
+    invalidation_service_.SetInvalidatorState(syncer::INVALIDATIONS_ENABLED);
+  }
+
+  void DisableInvalidationService() {
+    invalidation_service_.SetInvalidatorState(
+        syncer::TRANSIENT_INVALIDATION_ERROR);
+  }
+
+  syncer::Invalidation FireInvalidation(
+      const invalidation::ObjectId& object_id) {
+    const syncer::Invalidation invalidation =
+        syncer::Invalidation::InitUnknownVersion(object_id);
+    invalidation_service_.EmitInvalidationForTest(invalidation);
+    return invalidation;
+  }
+
+  bool IsInvalidationSent(const syncer::Invalidation& invalidation) {
+    return !invalidation_service_.GetMockAckHandler()->IsUnsent(invalidation);
+  }
+
+  bool IsInvalidationAcknowledged(const syncer::Invalidation& invalidation) {
+    return invalidation_service_.GetMockAckHandler()->IsAcknowledged(
+        invalidation);
+  }
+
+  bool IsInvalidatorRegistered() {
+    return !invalidation_service_.invalidator_registrar()
+                .GetRegisteredIds(&invalidator_)
+                .empty();
+  }
+
+  void VerifyExpectations() {
+    Mock::VerifyAndClearExpectations(&invalidator_);
+  }
+
+ protected:
+  // Initialize and start the invalidator.
+  void InitializeAndStart() {
+    EXPECT_CALL(invalidator_, OnInitialize()).Times(1);
+    invalidator_.Initialize(&invalidation_service_);
+    VerifyExpectations();
+
+    EXPECT_CALL(invalidator_, OnStart()).Times(1);
+    invalidator_.Start();
+
+    VerifyExpectations();
+  }
+
+  // Stop and shutdown the invalidator.
+  void StopAndShutdown() {
+    EXPECT_CALL(invalidator_, OnStop()).Times(1);
+    EXPECT_CALL(invalidator_, OnShutdown()).Times(1);
+    invalidator_.Shutdown();
+
+    VerifyExpectations();
+  }
+
+  // Fire an invalidation to verify that invalidation is not working.
+  void VerifyInvalidationDisabled(const invalidation::ObjectId& object_id) {
+    const syncer::Invalidation invalidation = FireInvalidation(object_id);
+
+    base::RunLoop().RunUntilIdle();
+    EXPECT_FALSE(IsInvalidationSent(invalidation));
+  }
+
+  // Fire an invalidation to verify that invalidation works.
+  void VerifyInvalidationEnabled(const invalidation::ObjectId& object_id) {
+    EXPECT_TRUE(invalidator_.invalidations_enabled());
+
+    EXPECT_CALL(invalidator_, DoRemoteCommandsFetch()).Times(1);
+    const syncer::Invalidation invalidation = FireInvalidation(object_id);
+
+    base::RunLoop().RunUntilIdle();
+    EXPECT_TRUE(IsInvalidationSent(invalidation));
+    EXPECT_TRUE(IsInvalidationAcknowledged(invalidation));
+    VerifyExpectations();
+  }
+
+  const invalidation::ObjectId kTestingObjectId1;
+  const invalidation::ObjectId kTestingObjectId2;
+
+  base::MessageLoop loop_;
+
+  invalidation::FakeInvalidationService invalidation_service_;
+  StrictMock<MockRemoteCommandInvalidator> invalidator_;
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(RemoteCommandsInvalidatorTest);
+};
+
+// Verifies that only the fired invalidations will be received.
+TEST_F(RemoteCommandsInvalidatorTest, FiredInvalidation) {
+  InitializeAndStart();
+
+  // Invalidator won't work at this point.
+  EXPECT_FALSE(invalidator_.invalidations_enabled());
+
+  // Load the policy data, it should work now.
+  invalidator_.SetInvalidationObjectID(kTestingObjectId1);
+  EXPECT_TRUE(invalidator_.invalidations_enabled());
+
+  base::RunLoop().RunUntilIdle();
+  // No invalidation will be received if no invalidation is fired.
+  VerifyExpectations();
+
+  // Fire an invalidation with different object id, no invalidation will be
+  // received.
+  const syncer::Invalidation invalidation1 =
+      FireInvalidation(kTestingObjectId2);
+
+  base::RunLoop().RunUntilIdle();
+  EXPECT_FALSE(IsInvalidationSent(invalidation1));
+  VerifyExpectations();
+
+  // Fire the invalidation, it should be acknowledged and trigger a remote
+  // commands fetch.
+  EXPECT_CALL(invalidator_, DoRemoteCommandsFetch()).Times(1);
+  const syncer::Invalidation invalidation2 =
+      FireInvalidation(kTestingObjectId1);
+
+  base::RunLoop().RunUntilIdle();
+  EXPECT_TRUE(IsInvalidationSent(invalidation2));
+  EXPECT_TRUE(IsInvalidationAcknowledged(invalidation2));
+  VerifyExpectations();
+
+  StopAndShutdown();
+}
+
+// Verifies that no invalidation will be received when invalidator is shutdown.
+TEST_F(RemoteCommandsInvalidatorTest, ShutDown) {
+  EXPECT_FALSE(invalidator_.invalidations_enabled());
+  FireInvalidation(kTestingObjectId1);
+
+  base::RunLoop().RunUntilIdle();
+  EXPECT_FALSE(invalidator_.invalidations_enabled());
+}
+
+// Verifies that no invalidation will be received when invalidator is stopped.
+TEST_F(RemoteCommandsInvalidatorTest, Stopped) {
+  EXPECT_CALL(invalidator_, OnInitialize()).Times(1);
+  invalidator_.Initialize(&invalidation_service_);
+  VerifyExpectations();
+
+  EXPECT_FALSE(invalidator_.invalidations_enabled());
+  FireInvalidation(kTestingObjectId2);
+
+  base::RunLoop().RunUntilIdle();
+  EXPECT_FALSE(invalidator_.invalidations_enabled());
+
+  EXPECT_CALL(invalidator_, OnShutdown()).Times(1);
+  invalidator_.Shutdown();
+}
+
+// Verifies that stated/stopped state changes work as expected.
+TEST_F(RemoteCommandsInvalidatorTest, StartedStateChange) {
+  InitializeAndStart();
+
+  // Invalidator requires object id to work.
+  VerifyInvalidationDisabled(kTestingObjectId1);
+  EXPECT_FALSE(invalidator_.invalidations_enabled());
+  invalidator_.SetInvalidationObjectID(kTestingObjectId1);
+  VerifyInvalidationEnabled(kTestingObjectId1);
+
+  // Stop and restart invalidator.
+  EXPECT_CALL(invalidator_, OnStop()).Times(1);
+  invalidator_.Stop();
+  VerifyExpectations();
+
+  VerifyInvalidationDisabled(kTestingObjectId1);
+  EXPECT_FALSE(invalidator_.invalidations_enabled());
+
+  EXPECT_CALL(invalidator_, OnStart()).Times(1);
+  invalidator_.Start();
+  VerifyExpectations();
+
+  // Invalidator requires object id to work.
+  invalidator_.SetInvalidationObjectID(kTestingObjectId1);
+  VerifyInvalidationEnabled(kTestingObjectId1);
+
+  StopAndShutdown();
+}
+
+// Verifies that registered state changes work as expected.
+TEST_F(RemoteCommandsInvalidatorTest, RegistedStateChange) {
+  InitializeAndStart();
+
+  invalidator_.SetInvalidationObjectID(kTestingObjectId1);
+  VerifyInvalidationEnabled(kTestingObjectId1);
+
+  invalidator_.SetInvalidationObjectID(kTestingObjectId2);
+  VerifyInvalidationEnabled(kTestingObjectId2);
+  VerifyInvalidationDisabled(kTestingObjectId1);
+
+  invalidator_.SetInvalidationObjectID(kTestingObjectId1);
+  VerifyInvalidationEnabled(kTestingObjectId1);
+  VerifyInvalidationDisabled(kTestingObjectId2);
+
+  invalidator_.ClearInvalidationObjectID();
+  VerifyInvalidationDisabled(kTestingObjectId1);
+  VerifyInvalidationDisabled(kTestingObjectId2);
+  EXPECT_FALSE(invalidator_.invalidations_enabled());
+
+  invalidator_.SetInvalidationObjectID(kTestingObjectId2);
+  VerifyInvalidationEnabled(kTestingObjectId2);
+  VerifyInvalidationDisabled(kTestingObjectId1);
+
+  StopAndShutdown();
+}
+
+// Verifies that invalidation service enabled state changes work as expected.
+TEST_F(RemoteCommandsInvalidatorTest, InvalidationServiceEnabledStateChanged) {
+  InitializeAndStart();
+
+  invalidator_.SetInvalidationObjectID(kTestingObjectId1);
+  VerifyInvalidationEnabled(kTestingObjectId1);
+
+  DisableInvalidationService();
+  EXPECT_FALSE(invalidator_.invalidations_enabled());
+
+  EnableInvalidationService();
+  VerifyInvalidationEnabled(kTestingObjectId1);
+
+  EnableInvalidationService();
+  VerifyInvalidationEnabled(kTestingObjectId1);
+
+  DisableInvalidationService();
+  EXPECT_FALSE(invalidator_.invalidations_enabled());
+
+  DisableInvalidationService();
+  EXPECT_FALSE(invalidator_.invalidations_enabled());
+
+  StopAndShutdown();
+}
+
+}  // namespace policy

chrome/chrome_browser.gypi

@@ -2076,6 +2076,10 @@
       'browser/policy/cloud/cloud_policy_invalidator.h',
       'browser/policy/cloud/policy_header_service_factory.cc',
       'browser/policy/cloud/policy_header_service_factory.h',
+      'browser/policy/cloud/remote_commands_invalidator.cc',
+      'browser/policy/cloud/remote_commands_invalidator.h',
+      'browser/policy/cloud/remote_commands_invalidator_impl.cc',
+      'browser/policy/cloud/remote_commands_invalidator_impl.h',
       'browser/policy/cloud/user_cloud_policy_invalidator.cc',
       'browser/policy/cloud/user_cloud_policy_invalidator.h',
       'browser/policy/cloud/user_cloud_policy_invalidator_factory.cc',

chrome/chrome_browser_chromeos.gypi

@@ -855,6 +855,8 @@
         'browser/chromeos/policy/remote_commands/device_command_screenshot_job.h',
         'browser/chromeos/policy/remote_commands/device_commands_factory_chromeos.cc',
         'browser/chromeos/policy/remote_commands/device_commands_factory_chromeos.h',
+        'browser/chromeos/policy/remote_commands/affiliated_remote_commands_invalidator.cc',
+        'browser/chromeos/policy/remote_commands/affiliated_remote_commands_invalidator.h',
         'browser/chromeos/policy/remote_commands/screenshot_delegate.cc',
         'browser/chromeos/policy/remote_commands/screenshot_delegate.h',
         'browser/chromeos/policy/server_backed_device_state.cc',

chrome/chrome_tests_unit.gypi

@@ -970,6 +970,7 @@
     'chrome_unit_tests_configuration_policy_sources': [
       'browser/net/proxy_policy_handler_unittest.cc',
       'browser/policy/cloud/cloud_policy_invalidator_unittest.cc',
+      'browser/policy/cloud/remote_commands_invalidator_unittest.cc',
       'browser/policy/cloud/user_policy_signin_service_unittest.cc',
       'browser/policy/file_selection_dialogs_policy_handler_unittest.cc',
       'browser/policy/javascript_policy_handler_unittest.cc',

components/policy/core/common/cloud/cloud_policy_core.cc

@@ -19,6 +19,10 @@ namespace policy {
 
 CloudPolicyCore::Observer::~Observer() {}
 
+void CloudPolicyCore::Observer::OnRemoteCommandsServiceStarted(
+    CloudPolicyCore* core) {
+}
+
 CloudPolicyCore::CloudPolicyCore(
     const std::string& policy_type,
     const std::string& settings_entity_id,
@@ -59,6 +63,8 @@ void CloudPolicyCore::StartRemoteCommandsService(
 
   // Do an initial remote commands fetch immediately.
   remote_commands_service_->FetchRemoteCommands();
+
+  FOR_EACH_OBSERVER(Observer, observers_, OnRemoteCommandsServiceStarted(this));
 }
 
 void CloudPolicyCore::RefreshSoon() {

components/policy/core/common/cloud/cloud_policy_core.h

@@ -50,6 +50,10 @@ class POLICY_EXPORT CloudPolicyCore {
 
     // Called before the core is disconnected.
     virtual void OnCoreDisconnecting(CloudPolicyCore* core) = 0;
+
+    // Called after the remote commands service is started. Defaults to be
+    // empty.
+    virtual void OnRemoteCommandsServiceStarted(CloudPolicyCore* core);
   };
 
   // |task_runner| is the runner for policy refresh tasks.

components/policy/proto/device_management_backend.proto

@@ -350,6 +350,18 @@ message PolicyData {
   // Indicates the state that the device should be in.
   optional DeviceState device_state = 17;
 
+  // The object source which hosts command queue objects within the
+  // invalidation service. This value is combined with
+  // command_invalidation_name to form the object ID used to
+  // register for invalidations to the command queue.
+  optional int32 command_invalidation_source = 18;
+
+  // The name which uniquely identifies this device’s queue within
+  // the invalidation service object source. This value is combined
+  // with command_invalidation_source to form the object ID used to
+  // register for invalidations to the command queue.
+  optional bytes command_invalidation_name = 19;
+
   // The free-text location info the admin enters to associate the device
   // with a location.
   optional string annotated_location = 20;