Enable TRUSTED_VAULT_PASSPHRASE behind feature toggle

This introduces basic functionality related to this passphrase type,
which behaves similarly to KEYSTORE_PASSPHRASE but is designed to
receive the encryption key by means other than the sync protocol.

Bug: 1000146
Change-Id: I0a3f093ae47a8efcb79794572c6e7ac30b335d95
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1806874Reviewed-by: Maksim Moskvitin <mmoskvitin@google.com>
Commit-Queue: Mikel Astiz <mastiz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#697203}

components/sync/engine/sync_engine_switches.cc

@@ -25,4 +25,7 @@ const base::Feature kSyncResetPollIntervalOnStart{
 const base::Feature kSyncUseScryptForNewCustomPassphrases{
     "SyncUseScryptForNewCustomPassphrases", base::FEATURE_ENABLED_BY_DEFAULT};
 
+const base::Feature kSyncSupportTrustedVaultPassphrase{
+    "SyncSupportTrustedVaultPassphrase", base::FEATURE_DISABLED_BY_DEFAULT};
+
 }  // namespace switches

components/sync/engine/sync_engine_switches.h

@@ -13,6 +13,7 @@ extern const char kSyncEnableGetUpdatesBeforeCommit[];
 
 extern const base::Feature kSyncResetPollIntervalOnStart;
 extern const base::Feature kSyncUseScryptForNewCustomPassphrases;
+extern const base::Feature kSyncSupportTrustedVaultPassphrase;
 
 }  // namespace switches
 

components/sync/nigori/nigori_sync_bridge_impl.cc

@@ -263,8 +263,8 @@ bool IsValidNigoriSpecifics(const NigoriSpecifics& specifics) {
       }
       break;
     case NigoriSpecifics::TRUSTED_VAULT_PASSPHRASE:
-      NOTIMPLEMENTED();
-      return false;
+      return base::FeatureList::IsEnabled(
+          switches::kSyncSupportTrustedVaultPassphrase);
   }
   return true;
 }
@@ -290,7 +290,8 @@ bool IsValidPassphraseTransition(
       NOTREACHED();
       return false;
     case NigoriSpecifics::KEYSTORE_PASSPHRASE:
-      return new_passphrase_type == NigoriSpecifics::CUSTOM_PASSPHRASE;
+      return new_passphrase_type == NigoriSpecifics::CUSTOM_PASSPHRASE ||
+             new_passphrase_type == NigoriSpecifics::TRUSTED_VAULT_PASSPHRASE;
     case NigoriSpecifics::FROZEN_IMPLICIT_PASSPHRASE:
       // There is no client side code which can cause such transition, but
       // technically it's a valid one and can be implemented in the future.
@@ -509,7 +510,11 @@ NigoriSyncBridgeImpl::NigoriSyncBridgeImpl(
   // verifications, taking into account sensitivity of this data.
   base::Optional<sync_pb::NigoriLocalData> deserialized_data =
       storage_->RestoreData();
-  if (!deserialized_data) {
+  if (!deserialized_data ||
+      (deserialized_data->nigori_model().passphrase_type() ==
+           NigoriSpecifics::TRUSTED_VAULT_PASSPHRASE &&
+       !base::FeatureList::IsEnabled(
+           switches::kSyncSupportTrustedVaultPassphrase))) {
     // We either have no Nigori node stored locally or it was corrupted.
     processor_->ModelReadyToSync(this, NigoriMetadataBatch());
     return;
@@ -1054,6 +1059,15 @@ const Cryptographer& NigoriSyncBridgeImpl::GetCryptographerForTesting() const {
   return cryptographer_;
 }
 
+sync_pb::NigoriSpecifics::PassphraseType
+NigoriSyncBridgeImpl::GetPassphraseTypeForTesting() const {
+  return passphrase_type_;
+}
+
+ModelTypeSet NigoriSyncBridgeImpl::GetEncryptedTypesForTesting() const {
+  return GetEncryptedTypes(encrypt_everything_);
+}
+
 std::string NigoriSyncBridgeImpl::PackExplicitPassphraseKeyForTesting(
     const Encryptor& encryptor,
     const Cryptographer& cryptographer) {
@@ -1108,6 +1122,9 @@ void NigoriSyncBridgeImpl::MaybeNotifyBootstrapTokenUpdated() const {
       NOTIMPLEMENTED();
       return;
     case NigoriSpecifics::TRUSTED_VAULT_PASSPHRASE:
+      // This may be problematic for the MIGRATION_DONE case because the local
+      // keybag will be cleared and it won't be automatically recovered from
+      // prefs.
       NOTIMPLEMENTED();
       return;
     case NigoriSpecifics::FROZEN_IMPLICIT_PASSPHRASE:

components/sync/nigori/nigori_sync_bridge_impl.h

@@ -82,6 +82,9 @@ class NigoriSyncBridgeImpl : public KeystoreKeysHandler,
   // tests and decide whether this method should be a part of
   // SyncEncryptionHandler interface.
   const Cryptographer& GetCryptographerForTesting() const;
+  sync_pb::NigoriSpecifics::PassphraseType GetPassphraseTypeForTesting() const;
+  ModelTypeSet GetEncryptedTypesForTesting() const;
+
   static std::string PackExplicitPassphraseKeyForTesting(
       const Encryptor& encryptor,
       const Cryptographer& cryptographer);