Add Mojo IPCs to to power JS API for sync encryption keys

A privileged Javascript API is exposed to allowed origins, which
requires analogous plumbing between the renderer process and the browser
process.

In this patch, the Mojo interface is introduced and basic
implementation of both ends, with a browser test that exercises the full
flow.

Design doc (Googlers only):
https://docs.google.com/document/d/1YNrBAzmHlhjEigpjcR_hm7yrvGIuJOZpXEhtqNloUec/edit#bookmark=id.bgwil9c791bc

Bug: 984940
Change-Id: Ic3c941b5209a03bc35dce44ecdd31a8e47af0b84
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1725913Reviewed-by: David Roger <droger@chromium.org>
Reviewed-by: Marc Treib <treib@chromium.org>
Reviewed-by: Nasko Oskov <nasko@chromium.org>
Commit-Queue: Mikel Astiz <mastiz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#707792}

chrome/browser/BUILD.gn

@@ -1744,6 +1744,8 @@ jumbo_static_library("browser") {
     "sync/sessions/sync_sessions_web_contents_router.h",
     "sync/sessions/sync_sessions_web_contents_router_factory.cc",
     "sync/sessions/sync_sessions_web_contents_router_factory.h",
+    "sync/sync_encryption_keys_tab_helper.cc",
+    "sync/sync_encryption_keys_tab_helper.h",
     "sync/sync_startup_tracker.cc",
     "sync/sync_startup_tracker.h",
     "sync/user_event_service_factory.cc",

chrome/browser/sync/sync_encryption_keys_tab_helper.cc

+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/sync/sync_encryption_keys_tab_helper.h"
+
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "base/no_destructor.h"
+#include "chrome/browser/profiles/profile.h"
+#include "chrome/browser/sync/profile_sync_service_factory.h"
+#include "chrome/common/sync_encryption_keys_extension.mojom.h"
+#include "components/sync/driver/sync_service.h"
+#include "components/sync/driver/sync_user_settings.h"
+#include "content/public/browser/navigation_handle.h"
+#include "content/public/browser/web_contents.h"
+#include "content/public/browser/web_contents_binding_set.h"
+#include "google_apis/gaia/core_account_id.h"
+#include "google_apis/gaia/gaia_urls.h"
+#include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
+#include "url/origin.h"
+
+namespace {
+
+const url::Origin& GetAllowedOrigin() {
+  static const base::NoDestructor<url::Origin> origin(
+      url::Origin::Create(GaiaUrls::GetInstance()->gaia_url()));
+  CHECK(!origin->opaque());
+  return *origin;
+}
+
+bool ShouldExposeMojoApi(content::NavigationHandle* navigation_handle) {
+  if (!navigation_handle->IsInMainFrame() ||
+      !navigation_handle->HasCommitted() || navigation_handle->IsErrorPage()) {
+    return false;
+  }
+  // Restrict to allowed origin only.
+  return url::Origin::Create(navigation_handle->GetURL()) == GetAllowedOrigin();
+}
+
+}  // namespace
+
+class SyncEncryptionKeysTabHelper::EncryptionKeyApi
+    : public chrome::mojom::SyncEncryptionKeysExtension {
+ public:
+  EncryptionKeyApi(content::WebContents* web_contents,
+                   syncer::SyncService* sync_service)
+      : sync_service_(sync_service), bindings_(web_contents, this) {
+    DCHECK(web_contents);
+    DCHECK(sync_service);
+  }
+
+  // chrome::mojom::SyncEncryptionKeysExtension:
+  void SetEncryptionKeys(const std::vector<std::string>& encryption_keys,
+                         const std::string& account_id,
+                         SetEncryptionKeysCallback callback) override {
+    CHECK_EQ(bindings_.GetCurrentTargetFrame()->GetLastCommittedOrigin(),
+             GetAllowedOrigin());
+
+    sync_service_->GetUserSettings()->AddTrustedVaultDecryptionKeys(
+        CoreAccountId(account_id), encryption_keys);
+    std::move(callback).Run();
+  }
+
+ private:
+  syncer::SyncService* const sync_service_;
+
+  content::WebContentsFrameBindingSet<
+      chrome::mojom::SyncEncryptionKeysExtension>
+      bindings_;
+
+  DISALLOW_COPY_AND_ASSIGN(EncryptionKeyApi);
+};
+
+// static
+void SyncEncryptionKeysTabHelper::CreateForWebContents(
+    content::WebContents* web_contents) {
+  DCHECK(web_contents);
+
+  if (FromWebContents(web_contents)) {
+    return;
+  }
+
+  if (web_contents->GetBrowserContext()->IsOffTheRecord()) {
+    return;
+  }
+
+  syncer::SyncService* sync_service = ProfileSyncServiceFactory::GetForProfile(
+      Profile::FromBrowserContext(web_contents->GetBrowserContext()));
+  if (!sync_service) {
+    return;
+  }
+
+  web_contents->SetUserData(UserDataKey(),
+                            base::WrapUnique(new SyncEncryptionKeysTabHelper(
+                                web_contents, sync_service)));
+}
+
+SyncEncryptionKeysTabHelper::SyncEncryptionKeysTabHelper(
+    content::WebContents* web_contents,
+    syncer::SyncService* sync_service)
+    : content::WebContentsObserver(web_contents), sync_service_(sync_service) {
+  DCHECK(web_contents);
+  DCHECK(sync_service);
+}
+
+SyncEncryptionKeysTabHelper::~SyncEncryptionKeysTabHelper() = default;
+
+void SyncEncryptionKeysTabHelper::DidFinishNavigation(
+    content::NavigationHandle* navigation_handle) {
+  if (navigation_handle->IsSameDocument()) {
+    return;
+  }
+
+  if (!ShouldExposeMojoApi(navigation_handle)) {
+    encryption_key_api_.reset();
+  } else if (!encryption_key_api_) {
+    encryption_key_api_ =
+        std::make_unique<EncryptionKeyApi>(web_contents(), sync_service_);
+  }
+}
+
+WEB_CONTENTS_USER_DATA_KEY_IMPL(SyncEncryptionKeysTabHelper)

chrome/browser/sync/sync_encryption_keys_tab_helper.h

+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_SYNC_SYNC_ENCRYPTION_KEYS_TAB_HELPER_H_
+#define CHROME_BROWSER_SYNC_SYNC_ENCRYPTION_KEYS_TAB_HELPER_H_
+
+#include <memory>
+
+#include "base/macros.h"
+#include "content/public/browser/web_contents_observer.h"
+#include "content/public/browser/web_contents_user_data.h"
+
+namespace content {
+class WebContents;
+}  // namespace content
+
+namespace syncer {
+class SyncService;
+}  // namespace syncer
+
+// SyncEncryptionKeysTabHelper is responsible for installing Mojo API in order
+// to receive sync encryption keys from the renderer process.
+class SyncEncryptionKeysTabHelper
+    : public content::WebContentsUserData<SyncEncryptionKeysTabHelper>,
+      public content::WebContentsObserver {
+ public:
+  static void CreateForWebContents(content::WebContents* web_contents);
+
+  ~SyncEncryptionKeysTabHelper() override;
+
+  // content::WebContentsObserver:
+  void DidFinishNavigation(
+      content::NavigationHandle* navigation_handle) override;
+
+ private:
+  friend class content::WebContentsUserData<SyncEncryptionKeysTabHelper>;
+
+  SyncEncryptionKeysTabHelper(content::WebContents* web_contents,
+                              syncer::SyncService* sync_service);
+
+  syncer::SyncService* const sync_service_;
+
+  // EncryptionKeyApi represent the actual exposure of the Mojo API (i.e.
+  // chrome::mojom::SyncEncryptionKeysExtension) to the renderer. Instantiated
+  // only for allowed origins.
+  class EncryptionKeyApi;
+  std::unique_ptr<EncryptionKeyApi> encryption_key_api_;
+
+  WEB_CONTENTS_USER_DATA_KEY_DECL();
+
+  DISALLOW_COPY_AND_ASSIGN(SyncEncryptionKeysTabHelper);
+};
+
+#endif  // CHROME_BROWSER_SYNC_SYNC_ENCRYPTION_KEYS_TAB_HELPER_H_

chrome/browser/sync/sync_encryption_keys_tab_helper_unittest.cc

+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/sync/sync_encryption_keys_tab_helper.h"
+
+#include "base/macros.h"
+#include "base/memory/scoped_refptr.h"
+#include "chrome/common/sync_encryption_keys_extension.mojom.h"
+#include "chrome/test/base/chrome_render_view_host_test_harness.h"
+#include "content/public/browser/web_contents_binding_set.h"
+#include "content/public/browser/web_contents_observer.h"
+#include "content/public/test/web_contents_tester.h"
+#include "google_apis/gaia/gaia_urls.h"
+#include "net/base/net_errors.h"
+#include "net/http/http_response_headers.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace {
+
+using testing::IsNull;
+using testing::NotNull;
+
+class SyncEncryptionKeysTabHelperTest : public ChromeRenderViewHostTestHarness {
+ protected:
+  SyncEncryptionKeysTabHelperTest() = default;
+
+  ~SyncEncryptionKeysTabHelperTest() override = default;
+
+  // content::RenderViewHostTestHarness:
+  void SetUp() override {
+    ChromeRenderViewHostTestHarness::SetUp();
+    SyncEncryptionKeysTabHelper::CreateForWebContents(web_contents());
+  }
+
+  content::WebContentsTester* web_contents_tester() {
+    return content::WebContentsTester::For(web_contents());
+  }
+
+  content::WebContentsBindingSet* frame_binding_set() {
+    return content::WebContentsBindingSet::GetForWebContents<
+        chrome::mojom::SyncEncryptionKeysExtension>(web_contents());
+  }
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(SyncEncryptionKeysTabHelperTest);
+};
+
+TEST_F(SyncEncryptionKeysTabHelperTest, ShouldExposeMojoApiToAllowedOrigin) {
+  ASSERT_THAT(frame_binding_set(), IsNull());
+  web_contents_tester()->NavigateAndCommit(GaiaUrls::GetInstance()->gaia_url());
+  EXPECT_THAT(frame_binding_set(), NotNull());
+}
+
+TEST_F(SyncEncryptionKeysTabHelperTest,
+       ShouldNotExposeMojoApiToUnallowedOrigin) {
+  web_contents_tester()->NavigateAndCommit(GURL("http://page.com"));
+  EXPECT_THAT(frame_binding_set(), IsNull());
+}
+
+TEST_F(SyncEncryptionKeysTabHelperTest, ShouldNotExposeMojoApiIfNavigatedAway) {
+  web_contents_tester()->NavigateAndCommit(GaiaUrls::GetInstance()->gaia_url());
+  ASSERT_THAT(frame_binding_set(), NotNull());
+  web_contents_tester()->NavigateAndCommit(GURL("http://page.com"));
+  EXPECT_THAT(frame_binding_set(), IsNull());
+}
+
+TEST_F(SyncEncryptionKeysTabHelperTest,
+       ShouldNotExposeMojoApiIfNavigationFailed) {
+  web_contents_tester()->NavigateAndFail(
+      GaiaUrls::GetInstance()->gaia_url(), net::ERR_ABORTED,
+      base::MakeRefCounted<net::HttpResponseHeaders>("some_headers"));
+  EXPECT_THAT(frame_binding_set(), IsNull());
+}
+
+TEST_F(SyncEncryptionKeysTabHelperTest,
+       ShouldNotExposeMojoApiIfNavigatedAwayToErrorPage) {
+  web_contents_tester()->NavigateAndCommit(GaiaUrls::GetInstance()->gaia_url());
+  ASSERT_THAT(frame_binding_set(), NotNull());
+  web_contents_tester()->NavigateAndFail(
+      GURL("http://page.com"), net::ERR_ABORTED,
+      base::MakeRefCounted<net::HttpResponseHeaders>("some_headers"));
+  EXPECT_THAT(frame_binding_set(), IsNull());
+}
+
+}  // namespace

chrome/browser/sync/test/integration/encryption_helper.cc

@@ -179,6 +179,23 @@ std::string PassphraseRequiredStateChecker::GetDebugMessage() const {
          std::string(desired_state_ ? "required" : "not required");
 }
 
+TrustedVaultKeyRequiredStateChecker::TrustedVaultKeyRequiredStateChecker(
+    syncer::ProfileSyncService* service,
+    bool desired_state)
+    : SingleClientStatusChangeChecker(service), desired_state_(desired_state) {}
+
+bool TrustedVaultKeyRequiredStateChecker::IsExitConditionSatisfied() {
+  return service()
+             ->GetUserSettings()
+             ->IsTrustedVaultKeyRequiredForPreferredDataTypes() ==
+         desired_state_;
+}
+
+std::string TrustedVaultKeyRequiredStateChecker::GetDebugMessage() const {
+  return "Waiting until trusted vault keys are " +
+         std::string(desired_state_ ? "required" : "not required");
+}
+
 ScopedScryptFeatureToggler::ScopedScryptFeatureToggler(
     bool force_disabled,
     bool use_for_new_passphrases) {

chrome/browser/sync/test/integration/encryption_helper.h

@@ -61,8 +61,8 @@ class ServerNigoriChecker : public SingleClientStatusChangeChecker {
   std::string GetDebugMessage() const override;
 
  private:
-  fake_server::FakeServer* fake_server_;
-  syncer::PassphraseType expected_passphrase_type_;
+  fake_server::FakeServer* const fake_server_;
+  const syncer::PassphraseType expected_passphrase_type_;
 };
 
 // Checker used to block until Sync requires or stops requiring a passphrase.
@@ -75,7 +75,22 @@ class PassphraseRequiredStateChecker : public SingleClientStatusChangeChecker {
   std::string GetDebugMessage() const override;
 
  private:
-  bool desired_state_;
+  const bool desired_state_;
+};
+
+// Checker used to block until Sync requires or stops requiring trusted vault
+// keys.
+class TrustedVaultKeyRequiredStateChecker
+    : public SingleClientStatusChangeChecker {
+ public:
+  TrustedVaultKeyRequiredStateChecker(syncer::ProfileSyncService* service,
+                                      bool desired_state);
+
+  bool IsExitConditionSatisfied() override;
+  std::string GetDebugMessage() const override;
+
+ private:
+  const bool desired_state_;
 };
 
 // Helper for setting scrypt-related feature flags.

chrome/browser/ui/tab_helpers.cc

@@ -58,6 +58,7 @@
 #include "chrome/browser/subresource_filter/chrome_subresource_filter_client.h"
 #include "chrome/browser/sync/sessions/sync_sessions_router_tab_helper.h"
 #include "chrome/browser/sync/sessions/sync_sessions_web_contents_router_factory.h"
+#include "chrome/browser/sync/sync_encryption_keys_tab_helper.h"
 #include "chrome/browser/tab_contents/navigation_metrics_recorder.h"
 #include "chrome/browser/tracing/navigation_tracing.h"
 #include "chrome/browser/translate/chrome_translate_client.h"
@@ -265,6 +266,7 @@ void TabHelpers::AttachTabHelpers(WebContents* web_contents) {
       web_contents,
       sync_sessions::SyncSessionsWebContentsRouterFactory::GetForProfile(
           profile));
+
   TabSpecificContentSettings::CreateForWebContents(web_contents);
   TabUIHelper::CreateForWebContents(web_contents);
   tasks::TaskTabHelper::CreateForWebContents(web_contents);
@@ -308,6 +310,9 @@ void TabHelpers::AttachTabHelpers(WebContents* web_contents) {
   SadTabHelper::CreateForWebContents(web_contents);
   safe_browsing::SafeBrowsingTabObserver::CreateForWebContents(web_contents);
   SearchTabHelper::CreateForWebContents(web_contents);
+  if (base::FeatureList::IsEnabled(features::kSyncEncryptionKeysWebApi)) {
+    SyncEncryptionKeysTabHelper::CreateForWebContents(web_contents);
+  }
   TabDialogs::CreateForWebContents(web_contents);
   if (base::FeatureList::IsEnabled(features::kTabHoverCardImages) ||
       base::FeatureList::IsEnabled(features::kWebUITabStrip))

chrome/common/BUILD.gn

@@ -747,6 +747,7 @@ mojom("mojo_bindings") {
     "plugin.mojom",
     "prerender.mojom",
     "renderer_configuration.mojom",
+    "sync_encryption_keys_extension.mojom",
   ]
 
   deps = []

chrome/common/sync_encryption_keys_extension.mojom

+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+module chrome.mojom;
+
+// API exposed by the browser process to the renderer process, such that the
+// renderer can interact with the encryption state of Sync. Exposed to allowed
+// origins only.
+interface SyncEncryptionKeysExtension {
+  // Provides sync encryption keys to the browser process. Returns true if no
+  // further encryption keys are needed (which includes the case, among others,
+  // of encryption keys not being needed even prior to this call).
+  SetEncryptionKeys(array<string> encryption_keys, string account_id) => ();
+};

chrome/renderer/sync_encryption_keys_extension.cc

@@ -10,11 +10,13 @@
 #include "base/bind.h"
 #include "base/logging.h"
 #include "base/no_destructor.h"
+#include "content/public/common/isolated_world_ids.h"
 #include "content/public/renderer/chrome_object_extensions_utils.h"
 #include "content/public/renderer/render_frame.h"
 #include "gin/arguments.h"
 #include "gin/function_template.h"
 #include "google_apis/gaia/gaia_urls.h"
+#include "third_party/blink/public/common/associated_interfaces/associated_interface_provider.h"
 #include "third_party/blink/public/web/blink.h"
 #include "third_party/blink/public/web/web_local_frame.h"
 #include "url/origin.h"
@@ -45,13 +47,17 @@ void SyncEncryptionKeysExtension::OnDestruct() {
   delete this;
 }
 
-void SyncEncryptionKeysExtension::DidClearWindowObject() {
+void SyncEncryptionKeysExtension::DidCreateScriptContext(
+    v8::Local<v8::Context> v8_context,
+    int32_t world_id) {
   if (!render_frame()) {
     return;
   }
 
   url::Origin origin = render_frame()->GetWebFrame()->GetSecurityOrigin();
-  if (origin == GetAllowedOrigin()) {
+  if (render_frame()->IsMainFrame() &&
+      world_id == content::ISOLATED_WORLD_ID_GLOBAL &&
+      origin == GetAllowedOrigin()) {
     Install();
   }
 }
@@ -63,8 +69,9 @@ void SyncEncryptionKeysExtension::Install() {
   v8::HandleScope handle_scope(isolate);
   v8::Local<v8::Context> context =
       render_frame()->GetWebFrame()->MainWorldScriptContext();
-  if (context.IsEmpty())
+  if (context.IsEmpty()) {
     return;
+  }
 
   v8::Context::Scope context_scope(context);
 
@@ -118,16 +125,22 @@ void SyncEncryptionKeysExtension::SetSyncEncryptionKeys(gin::Arguments* args) {
   auto global_callback =
       std::make_unique<v8::Global<v8::Function>>(args->isolate(), callback);
 
-  // TODO(crbug.com/1000146): Pass along the encryption keys to the browser
-  // process.
-  NOTIMPLEMENTED();
-  RunCompletionCallback(std::move(global_callback));
+  if (!remote_.is_bound()) {
+    render_frame()->GetRemoteAssociatedInterfaces()->GetInterface(&remote_);
+  }
+
+  remote_->SetEncryptionKeys(
+      encryption_keys, account_id,
+      base::BindOnce(&SyncEncryptionKeysExtension::RunCompletionCallback,
+                     weak_ptr_factory_.GetWeakPtr(),
+                     std::move(global_callback)));
 }
 
 void SyncEncryptionKeysExtension::RunCompletionCallback(
     std::unique_ptr<v8::Global<v8::Function>> callback) {
-  if (!render_frame())
+  if (!render_frame()) {
     return;
+  }
 
   v8::Isolate* isolate = blink::MainThreadIsolate();
   v8::HandleScope handle_scope(isolate);

chrome/renderer/sync_encryption_keys_extension.h

@@ -10,7 +10,9 @@
 
 #include "base/macros.h"
 #include "base/memory/weak_ptr.h"
+#include "chrome/common/sync_encryption_keys_extension.mojom.h"
 #include "content/public/renderer/render_frame_observer.h"
+#include "mojo/public/cpp/bindings/associated_remote.h"
 #include "v8/include/v8.h"
 
 namespace gin {
@@ -26,7 +28,8 @@ class SyncEncryptionKeysExtension : public content::RenderFrameObserver {
 
   // content::RenderFrameObserver:
   void OnDestruct() override;
-  void DidClearWindowObject() override;
+  void DidCreateScriptContext(v8::Local<v8::Context> v8_context,
+                              int32_t world_id) override;
 
  private:
   explicit SyncEncryptionKeysExtension(content::RenderFrame* frame);
@@ -36,6 +39,7 @@ class SyncEncryptionKeysExtension : public content::RenderFrameObserver {
   void RunCompletionCallback(
       std::unique_ptr<v8::Global<v8::Function>> callback);
 
+  mojo::AssociatedRemote<chrome::mojom::SyncEncryptionKeysExtension> remote_;
   base::WeakPtrFactory<SyncEncryptionKeysExtension> weak_ptr_factory_{this};
 
   DISALLOW_COPY_AND_ASSIGN(SyncEncryptionKeysExtension);

chrome/test/BUILD.gn

@@ -3268,6 +3268,7 @@ test("unit_tests") {
     "../browser/sync/profile_sync_service_factory_unittest.cc",
     "../browser/sync/session_sync_service_factory_unittest.cc",
     "../browser/sync/sessions/sync_sessions_web_contents_router_unittest.cc",
+    "../browser/sync/sync_encryption_keys_tab_helper_unittest.cc",
     "../browser/sync/sync_startup_tracker_unittest.cc",
     "../browser/tracing/background_tracing_field_trial_unittest.cc",
     "../browser/tracing/background_tracing_metrics_provider_unittest.cc",

chrome/test/data/sync/encryption_keys_retrieval.html

+<html>
+<head>
+<script>
+window.onload = function() {
+  if (typeof chrome.setSyncEncryptionKeys == "undefined") {
+    document.title = "UNDEFINED";
+  } else {
+    chrome.setSyncEncryptionKeys([location.hash.substring(1)],
+                                 location.search.substring(1),
+                                 () => { document.title = "OK"; });
+  }
+}
+</script>
+</head>
+</html>

content/browser/renderer_host/DEPS

@@ -33,6 +33,7 @@ specific_include_rules = {
   ],
   "render_process_host_impl\.cc": [
     "+content/browser/frame_host/render_frame_message_filter.h",
+    "+google_apis/gaia/gaia_switches.h",
     # TODO(crbug.com/734668): Dependencies on ozone should be removed, as content
     # embedded in mus won't be able to talk to the native ozone.
     "+ui/ozone/public/ozone_switches.h",

content/browser/renderer_host/render_process_host_impl.cc

@@ -179,6 +179,7 @@
 #include "content/public/common/url_constants.h"
 #include "content/public/common/web_preferences.h"
 #include "device/gamepad/gamepad_haptics_manager.h"
+#include "google_apis/gaia/gaia_switches.h"
 #include "gpu/GLES2/gl2extchromium.h"
 #include "gpu/command_buffer/client/gpu_switches.h"
 #include "gpu/command_buffer/common/context_creation_attribs.h"
@@ -3079,6 +3080,7 @@ void RenderProcessHostImpl::PropagateBrowserCommandLineToRenderer(
     switches::kForceOverlayFullscreenVideo,
     switches::kForceVideoOverlays,
     switches::kFullMemoryCrashReport,
+    switches::kGaiaUrl,
     switches::kIPCConnectionTimeout,
     switches::kJavaScriptFlags,
     switches::kLogBestEffortTasks,