Support 'cloud' attribution in policy_templates.json

Like 'deprecated' or 'future', 'cloud' will hide the policy from policy
templates and documentation. However, cloud policy will be treated as a
released policy.

Bug: 1067190
Change-Id: I9bbf195bb4805c7bf0f998f1d83917c82a320635
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2158014Reviewed-by: Julian Pastarmov <pastarmovj@chromium.org>
Commit-Queue: Owen Min <zmin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#761927}

components/policy/resources/policy_templates.json

@@ -145,6 +145,9 @@
 #   user. By default, each policy is mandatory and not recommended.
 #   'per_profile' controls whether a user policy applies to every user logging
 #   into the browser or only one profile.
+#   'cloud_only' Set to True if the policy is forced or recommended to set from
+#   Admin console only. This hides the policy from policy templates and
+#   documentation.
 #
 #   The 'max_size' key is used to specify the maximal size of the external data
 #   that a policy can reference, in bytes. This annotation is compulsory for

components/policy/tools/syntax_check_policy_template_json.py

@@ -584,6 +584,14 @@ class PolicyTemplateChecker(object):
           container_name='features',
           identifier=policy.get('name'))
 
+      # 'cloud_only' feature must be an optional boolean flag.
+      self._CheckContains(
+          features,
+          'cloud_only',
+          bool,
+          optional=True,
+          container_name='features')
+
       # Chrome OS policies may have a non-empty supported_chrome_os_management
       # list with either 'active_directory' or 'google_cloud' or both.
       supported_chrome_os_management = self._CheckContains(

components/policy/tools/template_writers/writers/template_writer.py

@@ -48,6 +48,18 @@ class TemplateWriter(object):
     '''
     return False
 
+  def IsCloudOnlyPolicySupported(self, policy):
+    '''Checks if the given cloud only policy is supported by the writer.
+
+    Args:
+      policy: The dictionary of the policy.
+
+    Returns:
+      True if the writer chooses to include the deprecated 'policy' in its
+      output.
+    '''
+    return False
+
   def IsPolicySupported(self, policy):
     '''Checks if the given policy is supported by the writer.
     In other words, the set of platforms supported by the writer
@@ -68,6 +80,10 @@ class TemplateWriter(object):
         not self.IsFuturePolicySupported(policy)):
       return False
 
+    if (self.IsCloudOnlyPolicy(policy)
+        and not self.IsCloudOnlyPolicySupported(policy)):
+      return False
+
     for supported_on in policy['supported_on']:
       if not self.IsVersionSupported(policy, supported_on):
         continue
@@ -78,13 +94,22 @@ class TemplateWriter(object):
         return True
     return False
 
+  def GetPolicyFeature(self, policy, feature_name, value=None):
+    '''Returns policy feature with |feature_name| if exsits. Otherwise, returns
+    |value|.'''
+    return policy.get('features', {}).get(feature_name, value)
+
   def CanBeRecommended(self, policy):
     '''Checks if the given policy can be recommended.'''
-    return policy.get('features', {}).get('can_be_recommended', False)
+    return self.GetPolicyFeature(policy, 'can_be_recommended', False)
 
   def CanBeMandatory(self, policy):
     '''Checks if the given policy can be mandatory.'''
-    return policy.get('features', {}).get('can_be_mandatory', True)
+    return self.GetPolicyFeature(policy, 'can_be_mandatory', True)
+
+  def IsCloudOnlyPolicy(self, policy):
+    '''Checks if the given policy is cloud only'''
+    return self.GetPolicyFeature(policy, 'cloud_only', False)
 
   def IsPolicyOrItemSupportedOnPlatform(self,
                                         item,

components/policy/tools/template_writers/writers/template_writer_unittest.py

@@ -152,6 +152,7 @@ class TemplateWriterUnittests(unittest.TestCase):
     tw = template_writer.TemplateWriter(None, None)
     self.assertFalse(tw.IsPolicySupported({'future': True}))
     self.assertFalse(tw.IsPolicySupported({'deprecated': True}))
+    self.assertFalse(tw.IsPolicySupported({'features': {'cloud_only': True}}))
 
   def testPoliciesIsSupportedOnCertainVersion(self):
     platform = 'win'