Add new certificateProvider extension API.
[chromium-blink-merge.git] / chrome / browser / extensions / api / permissions / permissions_api.cc
blob6a0ee31799d1e0368c999f8f78d7d363a3666f3f
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 #include "chrome/browser/extensions/api/permissions/permissions_api.h"
7 #include "base/memory/scoped_ptr.h"
8 #include "chrome/browser/chrome_notification_types.h"
9 #include "chrome/browser/extensions/api/permissions/permissions_api_helpers.h"
10 #include "chrome/browser/extensions/extension_management.h"
11 #include "chrome/browser/extensions/permissions_updater.h"
12 #include "chrome/browser/profiles/profile.h"
13 #include "chrome/common/extensions/api/permissions.h"
14 #include "extensions/browser/extension_prefs.h"
15 #include "extensions/common/error_utils.h"
16 #include "extensions/common/extension.h"
17 #include "extensions/common/manifest_handlers/permissions_parser.h"
18 #include "extensions/common/permissions/permission_message_provider.h"
19 #include "extensions/common/permissions/permissions_data.h"
20 #include "extensions/common/permissions/permissions_info.h"
22 namespace extensions {
24 using api::permissions::Permissions;
26 namespace Contains = api::permissions::Contains;
27 namespace GetAll = api::permissions::GetAll;
28 namespace Remove = api::permissions::Remove;
29 namespace Request = api::permissions::Request;
30 namespace helpers = permissions_api_helpers;
32 namespace {
34 const char kBlockedByEnterprisePolicy[] =
35 "Permissions are blocked by enterprise policy.";
36 const char kCantRemoveRequiredPermissionsError[] =
37 "You cannot remove required permissions.";
38 const char kNotInOptionalPermissionsError[] =
39 "Optional permissions must be listed in extension manifest.";
40 const char kNotWhitelistedError[] =
41 "The optional permissions API does not support '*'.";
42 const char kUserGestureRequiredError[] =
43 "This function must be called during a user gesture";
45 enum AutoConfirmForTest {
46 DO_NOT_SKIP = 0,
47 PROCEED,
48 ABORT
50 AutoConfirmForTest auto_confirm_for_tests = DO_NOT_SKIP;
51 bool ignore_user_gesture_for_tests = false;
53 } // namespace
55 bool PermissionsContainsFunction::RunSync() {
56 scoped_ptr<Contains::Params> params(Contains::Params::Create(*args_));
57 EXTENSION_FUNCTION_VALIDATE(params);
59 scoped_refptr<PermissionSet> permissions = helpers::UnpackPermissionSet(
60 params->permissions,
61 ExtensionPrefs::Get(GetProfile())->AllowFileAccess(extension_->id()),
62 &error_);
63 if (!permissions.get())
64 return false;
66 results_ = Contains::Results::Create(
67 extension()->permissions_data()->active_permissions()->Contains(
68 *permissions.get()));
69 return true;
72 bool PermissionsGetAllFunction::RunSync() {
73 scoped_ptr<Permissions> permissions = helpers::PackPermissionSet(
74 extension()->permissions_data()->active_permissions().get());
75 results_ = GetAll::Results::Create(*permissions);
76 return true;
79 bool PermissionsRemoveFunction::RunSync() {
80 scoped_ptr<Remove::Params> params(Remove::Params::Create(*args_));
81 EXTENSION_FUNCTION_VALIDATE(params);
83 scoped_refptr<PermissionSet> permissions = helpers::UnpackPermissionSet(
84 params->permissions,
85 ExtensionPrefs::Get(GetProfile())->AllowFileAccess(extension_->id()),
86 &error_);
87 if (!permissions.get())
88 return false;
90 // Make sure they're only trying to remove permissions supported by this API.
91 APIPermissionSet apis = permissions->apis();
92 for (APIPermissionSet::const_iterator i = apis.begin();
93 i != apis.end(); ++i) {
94 if (!i->info()->supports_optional()) {
95 error_ = ErrorUtils::FormatErrorMessage(
96 kNotWhitelistedError, i->name());
97 return false;
101 // Make sure we don't remove any required pemissions.
102 scoped_refptr<const PermissionSet> required =
103 PermissionsParser::GetRequiredPermissions(extension());
104 scoped_refptr<PermissionSet> intersection(
105 PermissionSet::CreateIntersection(permissions.get(), required.get()));
106 if (!intersection->IsEmpty()) {
107 error_ = kCantRemoveRequiredPermissionsError;
108 return false;
111 PermissionsUpdater(GetProfile())
112 .RemovePermissions(extension(), permissions.get());
113 results_ = Remove::Results::Create(true);
114 return true;
117 // static
118 void PermissionsRequestFunction::SetAutoConfirmForTests(bool should_proceed) {
119 auto_confirm_for_tests = should_proceed ? PROCEED : ABORT;
122 // static
123 void PermissionsRequestFunction::SetIgnoreUserGestureForTests(
124 bool ignore) {
125 ignore_user_gesture_for_tests = ignore;
128 PermissionsRequestFunction::PermissionsRequestFunction() {}
130 void PermissionsRequestFunction::InstallUIProceed() {
131 PermissionsUpdater perms_updater(GetProfile());
132 perms_updater.AddPermissions(extension(), requested_permissions_.get());
134 results_ = Request::Results::Create(true);
135 SendResponse(true);
137 Release(); // Balanced in RunAsync().
140 void PermissionsRequestFunction::InstallUIAbort(bool user_initiated) {
141 SendResponse(true);
143 Release(); // Balanced in RunAsync().
146 PermissionsRequestFunction::~PermissionsRequestFunction() {}
148 bool PermissionsRequestFunction::RunAsync() {
149 results_ = Request::Results::Create(false);
151 if (!user_gesture() &&
152 !ignore_user_gesture_for_tests &&
153 extension_->location() != Manifest::COMPONENT) {
154 error_ = kUserGestureRequiredError;
155 return false;
158 scoped_ptr<Request::Params> params(Request::Params::Create(*args_));
159 EXTENSION_FUNCTION_VALIDATE(params);
161 requested_permissions_ = helpers::UnpackPermissionSet(
162 params->permissions,
163 ExtensionPrefs::Get(GetProfile())->AllowFileAccess(extension_->id()),
164 &error_);
165 if (!requested_permissions_.get())
166 return false;
168 // Make sure they're only requesting permissions supported by this API.
169 APIPermissionSet apis = requested_permissions_->apis();
170 for (APIPermissionSet::const_iterator i = apis.begin();
171 i != apis.end(); ++i) {
172 if (!i->info()->supports_optional()) {
173 error_ = ErrorUtils::FormatErrorMessage(
174 kNotWhitelistedError, i->name());
175 return false;
179 // The requested permissions must be defined as optional in the manifest.
180 if (!PermissionsParser::GetOptionalPermissions(extension())
181 ->Contains(*requested_permissions_.get())) {
182 error_ = kNotInOptionalPermissionsError;
183 return false;
186 // Automatically declines api permissions requests, which are blocked by
187 // enterprise policy.
188 if (!ExtensionManagementFactory::GetForBrowserContext(GetProfile())
189 ->IsPermissionSetAllowed(extension(), requested_permissions_)) {
190 error_ = kBlockedByEnterprisePolicy;
191 return false;
194 // We don't need to prompt the user if the requested permissions are a subset
195 // of the granted permissions set.
196 scoped_refptr<const PermissionSet> granted =
197 ExtensionPrefs::Get(GetProfile())
198 ->GetGrantedPermissions(extension()->id());
199 if (granted.get() && granted->Contains(*requested_permissions_.get())) {
200 PermissionsUpdater perms_updater(GetProfile());
201 perms_updater.AddPermissions(extension(), requested_permissions_.get());
202 results_ = Request::Results::Create(true);
203 SendResponse(true);
204 return true;
207 // Filter out the granted permissions so we only prompt for new ones.
208 requested_permissions_ = PermissionSet::CreateDifference(
209 requested_permissions_.get(), granted.get());
211 // Filter out the active permissions.
212 requested_permissions_ = PermissionSet::CreateDifference(
213 requested_permissions_.get(),
214 extension()->permissions_data()->active_permissions().get());
216 AddRef(); // Balanced in InstallUIProceed() / InstallUIAbort().
218 // We don't need to show the prompt if there are no new warnings, or if
219 // we're skipping the confirmation UI. All extension types but INTERNAL
220 // are allowed to silently increase their permission level.
221 const PermissionMessageProvider* message_provider =
222 PermissionMessageProvider::Get();
223 bool has_no_warnings =
224 message_provider->GetPermissionMessages(
225 message_provider->GetAllPermissionIDs(
226 requested_permissions_.get(),
227 extension()->GetType())).empty();
228 if (auto_confirm_for_tests == PROCEED || has_no_warnings ||
229 extension_->location() == Manifest::COMPONENT) {
230 InstallUIProceed();
231 } else if (auto_confirm_for_tests == ABORT) {
232 // Pretend the user clicked cancel.
233 InstallUIAbort(true);
234 } else {
235 CHECK_EQ(DO_NOT_SKIP, auto_confirm_for_tests);
236 install_ui_.reset(new ExtensionInstallPrompt(GetAssociatedWebContents()));
237 install_ui_->ConfirmPermissions(
238 this, extension(), requested_permissions_.get());
241 return true;
244 } // namespace extensions