Hide plugin vm from non-primary users' settings page

If plugin vm is installed, we show it in settings page even if policy
does not allow it so that the user can still uninstall it. But we should
not show it if the user logs in as a non-primary user because they can
still uninstall it when re-login as a primary user.

Bug: b/155954630
Test: manually
Change-Id: I34ca261c929f5d3e1d3c2b1dc145e679fd6d30f7
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2275978
Commit-Queue: Jason Lin <lxj@google.com>
Reviewed-by: Timothy Loh <timloh@chromium.org>
Reviewed-by: Nancy Wang <nancylingwang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#785303}

chrome/browser/apps/app_service/plugin_vm_apps.cc

@@ -18,6 +18,7 @@
 #include "chrome/browser/chromeos/plugin_vm/plugin_vm_manager_factory.h"
 #include "chrome/browser/chromeos/plugin_vm/plugin_vm_pref_names.h"
 #include "chrome/browser/chromeos/plugin_vm/plugin_vm_util.h"
+#include "chrome/browser/chromeos/profiles/profile_helper.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ui/webui/app_management/app_management.mojom.h"
 #include "chrome/grit/chrome_unscaled_resources.h"
@@ -138,6 +139,14 @@ PluginVmApps::PluginVmApps(
     const mojo::Remote<apps::mojom::AppService>& app_service,
     Profile* profile)
     : profile_(profile), permissions_observer_(this) {
+  // Don't show anything for non-primary profiles. We can't use
+  // `IsPluginVmAllowedForProfile()` here because we still let the user
+  // uninstall Plugin VM when it isn't allowed for some other reasons (e.g.
+  // policy).
+  if (!chromeos::ProfileHelper::IsPrimaryProfile(profile)) {
+    return;
+  }
+
   PublisherBase::Initialize(app_service, apps::mojom::AppType::kPluginVm);
 
   // Register for Plugin VM changes to policy and installed state, so that we

chrome/browser/ui/app_list/app_service/app_service_app_model_builder_unittest.cc

@@ -741,6 +741,10 @@ class PluginVmAppTest : public ::testing::TestWithParam<ProviderType> {
     testing_profile_ = std::make_unique<TestingProfile>();
     web_app::TestWebAppProvider::Get(testing_profile_.get())->Start();
     test_helper_ = std::make_unique<PluginVmTestHelper>(testing_profile_.get());
+    // We need to call this before creating the builder, otherwise
+    // |PluginVmApps| is disabled forever.
+    test_helper_->SetUserRequirementsToAllowPluginVm();
+
     CreateBuilder();
   }
 
@@ -777,6 +781,14 @@ class PluginVmAppTest : public ::testing::TestWithParam<ProviderType> {
                model_updater_.get());
   }
 
+  void AllowPluginVm() {
+    // We cannot call test_helper_.AllowPluginVm() because we have called
+    // SetUserRequirementsToAllowPluginVm()
+    test_helper_->EnablePluginVmFeature();
+    test_helper_->EnterpriseEnrollDevice();
+    test_helper_->SetPolicyRequirementsToAllowPluginVm();
+  }
+
   base::test::ScopedFeatureList scoped_feature_list_;
   content::BrowserTaskEnvironment task_environment_;
   std::unique_ptr<TestingProfile> testing_profile_;
@@ -797,7 +809,7 @@ TEST_P(PluginVmAppTest, EnableAndDisablePluginVm) {
   app_service_test_.FlushMojoCalls();
   EXPECT_THAT(GetModelContent(model_updater_.get()), testing::IsEmpty());
 
-  test_helper_->AllowPluginVm();
+  AllowPluginVm();
 
   app_service_test_.FlushMojoCalls();
   EXPECT_EQ(std::vector<std::string>{l10n_util::GetStringUTF8(
@@ -812,7 +824,7 @@ TEST_P(PluginVmAppTest, EnableAndDisablePluginVm) {
 }
 
 TEST_P(PluginVmAppTest, PluginVmEnabled) {
-  test_helper_->AllowPluginVm();
+  AllowPluginVm();
 
   // Reset the AppModelBuilder, so that it is created in a state where
   // Plugin VM was enabled.