Enabled OSSettings to be disabled

After OSSettings is set to be disabled in ExtensionManagement,
it gets re-enabled because it's ComponentLocation & from_bookmark, so an
exception has to be added to enable admins to disable it.
This exception will go away when OSSettings is switched to WebApps,
which should happen very soon.

Bug: 1063404
Change-Id: I457fb5e86aedc54930fb795d90e9fa7650a4f938
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2124790Reviewed-by: Devlin <rdevlin.cronin@chromium.org>
Reviewed-by: Sergey Poromov <poromov@chromium.org>
Commit-Queue: Aya Elsayed <ayaelattar@google.com>
Cr-Commit-Position: refs/heads/master@{#755090}

chrome/browser/extensions/standard_management_policy_provider.cc

@@ -22,6 +22,10 @@
 #include "chrome/browser/supervised_user/supervised_user_features.h"
 #endif  // BUILDFLAG(ENABLE_SUPERVISED_USERS)
 
+#if defined(OS_CHROMEOS)
+#include "chrome/browser/chromeos/extensions/default_web_app_ids.h"
+#endif  // defined(OS_CHROMEOS)
+
 namespace extensions {
 
 namespace {
@@ -86,8 +90,14 @@ bool StandardManagementPolicyProvider::UserMayLoad(
   // dedicated policy to disable the camera, at which point the special check in
   // the 'if' statement should be removed.
   // TODO(http://crbug.com/1002935)
+  // TODO(crbug.com/1065865): The special check for kOsSettingsAppId should be
+  // removed once OSSettings is moved to WebApps.
   if (Manifest::IsComponentLocation(extension->location()) &&
-      extension->id() != extension_misc::kCameraAppId) {
+      extension->id() != extension_misc::kCameraAppId
+#if defined(OS_CHROMEOS)
+      && extension->id() != chromeos::default_web_apps::kOsSettingsAppId
+#endif  // defined(OS_CHROMEOS)
+  ) {
     return true;
   }
 
@@ -102,7 +112,13 @@ bool StandardManagementPolicyProvider::UserMayLoad(
   // by extension management policies. See crbug.com/786061.
   // TODO(calamity): This special case should be removed by removing bookmark
   // apps from external sources. See crbug.com/788245.
-  if (extension->from_bookmark())
+  // TODO(crbug.com/1065865): The special check for kOsSettingsAppId should be
+  // removed once OSSettings is moved to WebApps.
+  if (extension->from_bookmark()
+#if defined(OS_CHROMEOS)
+      && extension->id() != chromeos::default_web_apps::kOsSettingsAppId
+#endif  // defined(OS_CHROMEOS)
+  )
     return true;
 
   // Check whether the extension type is allowed.

chrome/browser/policy/extension_policy_browsertest.cc

@@ -62,6 +62,8 @@
 #endif
 
 #if defined(OS_CHROMEOS)
+#include "chrome/browser/chromeos/extensions/default_web_app_ids.h"
+#include "chrome/browser/web_applications/components/externally_installed_web_app_prefs.h"
 #include "chromeos/constants/chromeos_switches.h"
 #endif
 
@@ -204,6 +206,35 @@ class ExtensionPolicyTest : public PolicyTest {
     return details.ptr();
   }
 
+#if defined(OS_CHROMEOS)
+  const extensions::Extension* InstallOSSettings() {
+    WebApplicationInfo web_app;
+    web_app.title = base::ASCIIToUTF16("Settings");
+    web_app.app_url = GURL("chrome://os-settings/");
+
+    scoped_refptr<extensions::CrxInstaller> installer =
+        extensions::CrxInstaller::CreateSilent(extension_service());
+    installer->set_install_source(extensions::Manifest::EXTERNAL_COMPONENT);
+    installer->set_creation_flags(
+        extensions::Extension::WAS_INSTALLED_BY_DEFAULT);
+
+    content::WindowedNotificationObserver observer(
+        extensions::NOTIFICATION_CRX_INSTALLER_DONE,
+        content::NotificationService::AllSources());
+    installer->InstallWebApp(web_app);
+    observer.Wait();
+
+    web_app::ExternallyInstalledWebAppPrefs web_app_prefs(
+        browser()->profile()->GetPrefs());
+    web_app_prefs.Insert(GURL("chrome://os-settings/"),
+                         chromeos::default_web_apps::kOsSettingsAppId,
+                         web_app::ExternalInstallSource::kSystemInstalled);
+
+    content::Details<const extensions::Extension> details = observer.details();
+    return details.ptr();
+  }
+#endif
+
   void UninstallExtension(const std::string& id, bool expect_success) {
     if (expect_success) {
       extensions::TestExtensionRegistryObserver observer(extension_registry());
@@ -314,6 +345,34 @@ IN_PROC_BROWSER_TEST_F(ExtensionPolicyTest,
       registry->enabled_extensions().GetByID(extensions::kWebStoreAppId));
   EXPECT_EQ(enabled_count - 1, registry->enabled_extensions().size());
 }
+
+IN_PROC_BROWSER_TEST_F(ExtensionPolicyTest,
+                       ExtensionInstallBlacklistOsSettings) {
+  extensions::ExtensionPrefs* extension_prefs =
+      extensions::ExtensionPrefs::Get(browser()->profile());
+
+  extensions::ExtensionRegistry* registry = extension_registry();
+  const extensions::Extension* bookmark_app = InstallOSSettings();
+  ASSERT_TRUE(bookmark_app);
+  ASSERT_TRUE(registry->enabled_extensions().GetByID(
+      chromeos::default_web_apps::kOsSettingsAppId));
+
+  base::ListValue blacklist;
+  blacklist.AppendString(chromeos::default_web_apps::kOsSettingsAppId);
+  PolicyMap policies;
+  policies.Set(key::kExtensionInstallBlacklist, POLICY_LEVEL_MANDATORY,
+               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD,
+               blacklist.CreateDeepCopy(), nullptr);
+  UpdateProviderPolicy(policies);
+
+  EXPECT_EQ(1u, registry->disabled_extensions().size());
+  extensions::ExtensionService* service = extension_service();
+  EXPECT_FALSE(service->IsExtensionEnabled(
+      chromeos::default_web_apps::kOsSettingsAppId));
+  EXPECT_EQ(extensions::disable_reason::DISABLE_BLOCKED_BY_POLICY,
+            extension_prefs->GetDisableReasons(
+                chromeos::default_web_apps::kOsSettingsAppId));
+}
 #endif  // defined(OS_CHROMEOS)
 
 IN_PROC_BROWSER_TEST_F(ExtensionPolicyTest,