chrome/browser/managed_mode/managed_user_service.cc

   1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "chrome/browser/managed_mode/managed_user_service.h"
   6
   7 #include "base/command_line.h"
   8 #include "base/memory/ref_counted.h"
   9 #include "base/prefs/pref_service.h"
  10 #include "base/strings/string_number_conversions.h"
  11 #include "base/strings/utf_string_conversions.h"
  12 #include "chrome/browser/chrome_notification_types.h"
  13 #include "chrome/browser/extensions/extension_service.h"
  14 #include "chrome/browser/extensions/extension_system.h"
  15 #include "chrome/browser/managed_mode/custodian_profile_downloader_service.h"
  16 #include "chrome/browser/managed_mode/custodian_profile_downloader_service_factory.h"
  17 #include "chrome/browser/managed_mode/managed_mode_site_list.h"
  18 #include "chrome/browser/managed_mode/managed_user_constants.h"
  19 #include "chrome/browser/managed_mode/managed_user_registration_utility.h"
  20 #include "chrome/browser/managed_mode/managed_user_settings_service.h"
  21 #include "chrome/browser/managed_mode/managed_user_settings_service_factory.h"
  22 #include "chrome/browser/managed_mode/managed_user_sync_service.h"
  23 #include "chrome/browser/managed_mode/managed_user_sync_service_factory.h"
  24 #include "chrome/browser/profiles/profile.h"
  25 #include "chrome/browser/signin/profile_oauth2_token_service.h"
  26 #include "chrome/browser/signin/profile_oauth2_token_service_factory.h"
  27 #include "chrome/browser/signin/signin_manager.h"
  28 #include "chrome/browser/signin/signin_manager_base.h"
  29 #include "chrome/browser/signin/signin_manager_factory.h"
  30 #include "chrome/browser/sync/profile_sync_service.h"
  31 #include "chrome/browser/sync/profile_sync_service_factory.h"
  32 #include "chrome/browser/ui/browser.h"
  33 #include "chrome/browser/ui/browser_list.h"
  34 #include "chrome/common/chrome_switches.h"
  35 #include "chrome/common/extensions/api/managed_mode_private/managed_mode_handler.h"
  36 #include "chrome/common/pref_names.h"
  37 #include "components/user_prefs/pref_registry_syncable.h"
  38 #include "content/public/browser/browser_thread.h"
  39 #include "content/public/browser/notification_details.h"
  40 #include "content/public/browser/notification_source.h"
  41 #include "extensions/common/extension_set.h"
  42 #include "google_apis/gaia/google_service_auth_error.h"
  43 #include "grit/generated_resources.h"
  44 #include "net/base/escape.h"
  45 #include "ui/base/l10n/l10n_util.h"
  46
  47 #if defined(OS_CHROMEOS)
  48 #include "chrome/browser/chromeos/login/supervised_user_manager.h"
  49 #include "chrome/browser/chromeos/login/user_manager.h"
  50 #endif
  51
  52 using base::DictionaryValue;
  53 using content::BrowserThread;
  54
  55 const char kManagedUserAccessRequestKeyPrefix[] =
  56     "X-ManagedUser-AccessRequests";
  57 const char kManagedUserAccessRequestTime[] = "timestamp";
  58 const char kManagedUserName[] = "name";
  59 const char kOpenManagedProfileKeyPrefix[] = "X-ManagedUser-Events-OpenProfile";
  60 const char kQuitBrowserKeyPrefix[] = "X-ManagedUser-Events-QuitBrowser";
  61 const char kSwitchFromManagedProfileKeyPrefix[] =
  62     "X-ManagedUser-Events-SwitchProfile";
  63 const char kEventTimestamp[] = "timestamp";
  64
  65 ManagedUserService::URLFilterContext::URLFilterContext()
  66     : ui_url_filter_(new ManagedModeURLFilter),
  67       io_url_filter_(new ManagedModeURLFilter) {}
  68 ManagedUserService::URLFilterContext::~URLFilterContext() {}
  69
  70 ManagedModeURLFilter*
  71 ManagedUserService::URLFilterContext::ui_url_filter() const {
  72   return ui_url_filter_.get();
  73 }
  74
  75 ManagedModeURLFilter*
  76 ManagedUserService::URLFilterContext::io_url_filter() const {
  77   return io_url_filter_.get();
  78 }
  79
  80 void ManagedUserService::URLFilterContext::SetDefaultFilteringBehavior(
  81     ManagedModeURLFilter::FilteringBehavior behavior) {
  82   ui_url_filter_->SetDefaultFilteringBehavior(behavior);
  83   BrowserThread::PostTask(
  84       BrowserThread::IO,
  85       FROM_HERE,
  86       base::Bind(&ManagedModeURLFilter::SetDefaultFilteringBehavior,
  87                  io_url_filter_.get(), behavior));
  88 }
  89
  90 void ManagedUserService::URLFilterContext::LoadWhitelists(
  91     ScopedVector<ManagedModeSiteList> site_lists) {
  92   // ManagedModeURLFilter::LoadWhitelists takes ownership of |site_lists|,
  93   // so we make an additional copy of it.
  94   /// TODO(bauerb): This is kinda ugly.
  95   ScopedVector<ManagedModeSiteList> site_lists_copy;
  96   for (ScopedVector<ManagedModeSiteList>::iterator it = site_lists.begin();
  97        it != site_lists.end(); ++it) {
  98     site_lists_copy.push_back((*it)->Clone());
  99   }
 100   ui_url_filter_->LoadWhitelists(site_lists.Pass());
 101   BrowserThread::PostTask(
 102       BrowserThread::IO,
 103       FROM_HERE,
 104       base::Bind(&ManagedModeURLFilter::LoadWhitelists,
 105                  io_url_filter_, base::Passed(&site_lists_copy)));
 106 }
 107
 108 void ManagedUserService::URLFilterContext::SetManualHosts(
 109     scoped_ptr<std::map<std::string, bool> > host_map) {
 110   ui_url_filter_->SetManualHosts(host_map.get());
 111   BrowserThread::PostTask(
 112       BrowserThread::IO,
 113       FROM_HERE,
 114       base::Bind(&ManagedModeURLFilter::SetManualHosts,
 115                  io_url_filter_, base::Owned(host_map.release())));
 116 }
 117
 118 void ManagedUserService::URLFilterContext::SetManualURLs(
 119     scoped_ptr<std::map<GURL, bool> > url_map) {
 120   ui_url_filter_->SetManualURLs(url_map.get());
 121   BrowserThread::PostTask(
 122       BrowserThread::IO,
 123       FROM_HERE,
 124       base::Bind(&ManagedModeURLFilter::SetManualURLs,
 125                  io_url_filter_, base::Owned(url_map.release())));
 126 }
 127
 128 ManagedUserService::ManagedUserService(Profile* profile)
 129     : profile_(profile),
 130       waiting_for_sync_initialization_(false),
 131       is_profile_active_(false),
 132       elevated_for_testing_(false),
 133       did_shutdown_(false),
 134       weak_ptr_factory_(this) {
 135 }
 136
 137 ManagedUserService::~ManagedUserService() {
 138   DCHECK(did_shutdown_);
 139 }
 140
 141 void ManagedUserService::Shutdown() {
 142   did_shutdown_ = true;
 143   if (ProfileIsManaged()) {
 144     RecordProfileAndBrowserEventsHelper(kQuitBrowserKeyPrefix);
 145 #if !defined(OS_ANDROID)
 146     // TODO(bauerb): Get rid of the platform-specific #ifdef here.
 147     // http://crbug.com/313377
 148     BrowserList::RemoveObserver(this);
 149 #endif
 150   }
 151
 152   if (!waiting_for_sync_initialization_)
 153     return;
 154
 155   ProfileSyncService* sync_service =
 156         ProfileSyncServiceFactory::GetForProfile(profile_);
 157   sync_service->RemoveObserver(this);
 158 }
 159
 160 bool ManagedUserService::ProfileIsManaged() const {
 161   return profile_->IsManaged();
 162 }
 163
 164 // static
 165 void ManagedUserService::RegisterProfilePrefs(
 166     user_prefs::PrefRegistrySyncable* registry) {
 167   registry->RegisterDictionaryPref(
 168       prefs::kManagedModeManualHosts,
 169       user_prefs::PrefRegistrySyncable::UNSYNCABLE_PREF);
 170   registry->RegisterDictionaryPref(
 171       prefs::kManagedModeManualURLs,
 172       user_prefs::PrefRegistrySyncable::UNSYNCABLE_PREF);
 173   registry->RegisterIntegerPref(
 174       prefs::kDefaultManagedModeFilteringBehavior, ManagedModeURLFilter::ALLOW,
 175       user_prefs::PrefRegistrySyncable::UNSYNCABLE_PREF);
 176   registry->RegisterStringPref(
 177       prefs::kManagedUserCustodianEmail, std::string(),
 178       user_prefs::PrefRegistrySyncable::UNSYNCABLE_PREF);
 179   registry->RegisterStringPref(
 180       prefs::kManagedUserCustodianName, std::string(),
 181       user_prefs::PrefRegistrySyncable::UNSYNCABLE_PREF);
 182   registry->RegisterBooleanPref(prefs::kManagedUserCreationAllowed, true,
 183       user_prefs::PrefRegistrySyncable::UNSYNCABLE_PREF);
 184 }
 185
 186 // static
 187 void ManagedUserService::MigrateUserPrefs(PrefService* prefs) {
 188   if (!prefs->HasPrefPath(prefs::kProfileIsManaged))
 189     return;
 190
 191   bool is_managed = prefs->GetBoolean(prefs::kProfileIsManaged);
 192   prefs->ClearPref(prefs::kProfileIsManaged);
 193
 194   if (!is_managed)
 195     return;
 196
 197   std::string managed_user_id = prefs->GetString(prefs::kManagedUserId);
 198   if (!managed_user_id.empty())
 199     return;
 200
 201   prefs->SetString(prefs::kManagedUserId, "Dummy ID");
 202 }
 203
 204 scoped_refptr<const ManagedModeURLFilter>
 205 ManagedUserService::GetURLFilterForIOThread() {
 206   return url_filter_context_.io_url_filter();
 207 }
 208
 209 ManagedModeURLFilter* ManagedUserService::GetURLFilterForUIThread() {
 210   return url_filter_context_.ui_url_filter();
 211 }
 212
 213 // Items not on any list must return -1 (CATEGORY_NOT_ON_LIST in history.js).
 214 // Items on a list, but with no category, must return 0 (CATEGORY_OTHER).
 215 #define CATEGORY_NOT_ON_LIST -1;
 216 #define CATEGORY_OTHER 0;
 217
 218 int ManagedUserService::GetCategory(const GURL& url) {
 219   std::vector<ManagedModeSiteList::Site*> sites;
 220   GetURLFilterForUIThread()->GetSites(url, &sites);
 221   if (sites.empty())
 222     return CATEGORY_NOT_ON_LIST;
 223
 224   return (*sites.begin())->category_id;
 225 }
 226
 227 // static
 228 void ManagedUserService::GetCategoryNames(CategoryList* list) {
 229   ManagedModeSiteList::GetCategoryNames(list);
 230 }
 231
 232 std::string ManagedUserService::GetCustodianEmailAddress() const {
 233 #if defined(OS_CHROMEOS)
 234   return chromeos::UserManager::Get()->GetSupervisedUserManager()->
 235       GetManagerDisplayEmail(
 236           chromeos::UserManager::Get()->GetActiveUser()->email());
 237 #else
 238   return profile_->GetPrefs()->GetString(prefs::kManagedUserCustodianEmail);
 239 #endif
 240 }
 241
 242 std::string ManagedUserService::GetCustodianName() const {
 243 #if defined(OS_CHROMEOS)
 244   return base::UTF16ToUTF8(chromeos::UserManager::Get()->
 245       GetSupervisedUserManager()->GetManagerDisplayName(
 246           chromeos::UserManager::Get()->GetActiveUser()->email()));
 247 #else
 248   std::string name = profile_->GetPrefs()->GetString(
 249       prefs::kManagedUserCustodianName);
 250   return name.empty() ? GetCustodianEmailAddress() : name;
 251 #endif
 252 }
 253
 254 void ManagedUserService::AddNavigationBlockedCallback(
 255     const NavigationBlockedCallback& callback) {
 256   navigation_blocked_callbacks_.push_back(callback);
 257 }
 258
 259 void ManagedUserService::DidBlockNavigation(
 260     content::WebContents* web_contents) {
 261   for (std::vector<NavigationBlockedCallback>::iterator it =
 262            navigation_blocked_callbacks_.begin();
 263        it != navigation_blocked_callbacks_.end(); ++it) {
 264     it->Run(web_contents);
 265   }
 266 }
 267
 268 std::string ManagedUserService::GetDebugPolicyProviderName() const {
 269   // Save the string space in official builds.
 270 #ifdef NDEBUG
 271   NOTREACHED();
 272   return std::string();
 273 #else
 274   return "Managed User Service";
 275 #endif
 276 }
 277
 278 bool ManagedUserService::UserMayLoad(const extensions::Extension* extension,
 279                                      base::string16* error) const {
 280   base::string16 tmp_error;
 281   if (ExtensionManagementPolicyImpl(extension, &tmp_error))
 282     return true;
 283
 284   // If the extension is already loaded, we allow it, otherwise we'd unload
 285   // all existing extensions.
 286   ExtensionService* extension_service =
 287       extensions::ExtensionSystem::Get(profile_)->extension_service();
 288
 289   // |extension_service| can be NULL in a unit test.
 290   if (extension_service &&
 291       extension_service->GetInstalledExtension(extension->id()))
 292     return true;
 293
 294   bool was_installed_by_default = extension->was_installed_by_default();
 295 #if defined(OS_CHROMEOS)
 296   // On Chrome OS all external sources are controlled by us so it means that
 297   // they are "default". Method was_installed_by_default returns false because
 298   // extensions creation flags are ignored in case of default extensions with
 299   // update URL(the flags aren't passed to OnExternalExtensionUpdateUrlFound).
 300   // TODO(dpolukhin): remove this Chrome OS specific code as soon as creation
 301   // flags are not ignored.
 302   was_installed_by_default =
 303       extensions::Manifest::IsExternalLocation(extension->location());
 304 #endif
 305   if (extension->location() == extensions::Manifest::COMPONENT ||
 306       was_installed_by_default) {
 307     return true;
 308   }
 309
 310   if (error)
 311     *error = tmp_error;
 312   return false;
 313 }
 314
 315 bool ManagedUserService::UserMayModifySettings(
 316     const extensions::Extension* extension,
 317     base::string16* error) const {
 318   return ExtensionManagementPolicyImpl(extension, error);
 319 }
 320
 321 void ManagedUserService::OnStateChanged() {
 322   ProfileSyncService* service =
 323       ProfileSyncServiceFactory::GetForProfile(profile_);
 324   if (waiting_for_sync_initialization_ && service->sync_initialized()) {
 325     waiting_for_sync_initialization_ = false;
 326     service->RemoveObserver(this);
 327     SetupSync();
 328     return;
 329   }
 330
 331   DLOG_IF(ERROR, service->GetAuthError().state() ==
 332                      GoogleServiceAuthError::INVALID_GAIA_CREDENTIALS)
 333       << "Credentials rejected";
 334 }
 335
 336 void ManagedUserService::Observe(int type,
 337                           const content::NotificationSource& source,
 338                           const content::NotificationDetails& details) {
 339   switch (type) {
 340     case chrome::NOTIFICATION_EXTENSION_LOADED: {
 341       const extensions::Extension* extension =
 342           content::Details<extensions::Extension>(details).ptr();
 343       if (!extensions::ManagedModeInfo::GetContentPackSiteList(
 344               extension).empty()) {
 345         UpdateSiteLists();
 346       }
 347       break;
 348     }
 349     case chrome::NOTIFICATION_EXTENSION_UNLOADED: {
 350       const extensions::UnloadedExtensionInfo* extension_info =
 351           content::Details<extensions::UnloadedExtensionInfo>(details).ptr();
 352       if (!extensions::ManagedModeInfo::GetContentPackSiteList(
 353               extension_info->extension).empty()) {
 354         UpdateSiteLists();
 355       }
 356       break;
 357     }
 358     default:
 359       NOTREACHED();
 360   }
 361 }
 362
 363 void ManagedUserService::SetupSync() {
 364   ProfileSyncService* service =
 365       ProfileSyncServiceFactory::GetForProfile(profile_);
 366   DCHECK(service->sync_initialized());
 367
 368   bool sync_everything = false;
 369   syncer::ModelTypeSet synced_datatypes;
 370   synced_datatypes.Put(syncer::MANAGED_USER_SETTINGS);
 371   service->OnUserChoseDatatypes(sync_everything, synced_datatypes);
 372
 373   // Notify ProfileSyncService that we are done with configuration.
 374   service->SetSetupInProgress(false);
 375   service->SetSyncSetupCompleted();
 376 }
 377
 378 bool ManagedUserService::ExtensionManagementPolicyImpl(
 379     const extensions::Extension* extension,
 380     base::string16* error) const {
 381   // |extension| can be NULL in unit_tests.
 382   if (!ProfileIsManaged() || (extension && extension->is_theme()))
 383     return true;
 384
 385   if (elevated_for_testing_)
 386     return true;
 387
 388   if (error)
 389     *error = l10n_util::GetStringUTF16(IDS_EXTENSIONS_LOCKED_MANAGED_USER);
 390   return false;
 391 }
 392
 393 ScopedVector<ManagedModeSiteList> ManagedUserService::GetActiveSiteLists() {
 394   ScopedVector<ManagedModeSiteList> site_lists;
 395   ExtensionService* extension_service =
 396       extensions::ExtensionSystem::Get(profile_)->extension_service();
 397   // Can be NULL in unit tests.
 398   if (!extension_service)
 399     return site_lists.Pass();
 400
 401   const extensions::ExtensionSet* extensions = extension_service->extensions();
 402   for (extensions::ExtensionSet::const_iterator it = extensions->begin();
 403        it != extensions->end(); ++it) {
 404     const extensions::Extension* extension = it->get();
 405     if (!extension_service->IsExtensionEnabled(extension->id()))
 406       continue;
 407
 408     extensions::ExtensionResource site_list =
 409         extensions::ManagedModeInfo::GetContentPackSiteList(extension);
 410     if (!site_list.empty()) {
 411       site_lists.push_back(new ManagedModeSiteList(extension->id(),
 412                                                    site_list.GetFilePath()));
 413     }
 414   }
 415
 416   return site_lists.Pass();
 417 }
 418
 419 ManagedUserSettingsService* ManagedUserService::GetSettingsService() {
 420   return ManagedUserSettingsServiceFactory::GetForProfile(profile_);
 421 }
 422
 423 void ManagedUserService::OnDefaultFilteringBehaviorChanged() {
 424   DCHECK(ProfileIsManaged());
 425
 426   int behavior_value = profile_->GetPrefs()->GetInteger(
 427       prefs::kDefaultManagedModeFilteringBehavior);
 428   ManagedModeURLFilter::FilteringBehavior behavior =
 429       ManagedModeURLFilter::BehaviorFromInt(behavior_value);
 430   url_filter_context_.SetDefaultFilteringBehavior(behavior);
 431 }
 432
 433 void ManagedUserService::UpdateSiteLists() {
 434   url_filter_context_.LoadWhitelists(GetActiveSiteLists());
 435 }
 436
 437 bool ManagedUserService::AccessRequestsEnabled() {
 438   ProfileSyncService* service =
 439       ProfileSyncServiceFactory::GetForProfile(profile_);
 440   GoogleServiceAuthError::State state = service->GetAuthError().state();
 441   // We allow requesting access if Sync is working or has a transient error.
 442   return (state == GoogleServiceAuthError::NONE ||
 443           state == GoogleServiceAuthError::CONNECTION_FAILED ||
 444           state == GoogleServiceAuthError::SERVICE_UNAVAILABLE);
 445 }
 446
 447 void ManagedUserService::AddAccessRequest(const GURL& url) {
 448   // Normalize the URL.
 449   GURL normalized_url = ManagedModeURLFilter::Normalize(url);
 450
 451   // Escape the URL.
 452   std::string output(net::EscapeQueryParamValue(normalized_url.spec(), true));
 453
 454   // Add the prefix.
 455   std::string key = ManagedUserSettingsService::MakeSplitSettingKey(
 456       kManagedUserAccessRequestKeyPrefix, output);
 457
 458   scoped_ptr<base::DictionaryValue> dict(new base::DictionaryValue);
 459
 460   // TODO(sergiu): Use sane time here when it's ready.
 461   dict->SetDouble(kManagedUserAccessRequestTime, base::Time::Now().ToJsTime());
 462
 463   dict->SetString(kManagedUserName, profile_->GetProfileName());
 464
 465   GetSettingsService()->UploadItem(key, dict.PassAs<base::Value>());
 466 }
 467
 468 ManagedUserService::ManualBehavior ManagedUserService::GetManualBehaviorForHost(
 469     const std::string& hostname) {
 470   const base::DictionaryValue* dict =
 471       profile_->GetPrefs()->GetDictionary(prefs::kManagedModeManualHosts);
 472   bool allow = false;
 473   if (!dict->GetBooleanWithoutPathExpansion(hostname, &allow))
 474     return MANUAL_NONE;
 475
 476   return allow ? MANUAL_ALLOW : MANUAL_BLOCK;
 477 }
 478
 479 ManagedUserService::ManualBehavior ManagedUserService::GetManualBehaviorForURL(
 480     const GURL& url) {
 481   const base::DictionaryValue* dict =
 482       profile_->GetPrefs()->GetDictionary(prefs::kManagedModeManualURLs);
 483   GURL normalized_url = ManagedModeURLFilter::Normalize(url);
 484   bool allow = false;
 485   if (!dict->GetBooleanWithoutPathExpansion(normalized_url.spec(), &allow))
 486     return MANUAL_NONE;
 487
 488   return allow ? MANUAL_ALLOW : MANUAL_BLOCK;
 489 }
 490
 491 void ManagedUserService::GetManualExceptionsForHost(const std::string& host,
 492                                                     std::vector<GURL>* urls) {
 493   const base::DictionaryValue* dict =
 494       profile_->GetPrefs()->GetDictionary(prefs::kManagedModeManualURLs);
 495   for (base::DictionaryValue::Iterator it(*dict); !it.IsAtEnd(); it.Advance()) {
 496     GURL url(it.key());
 497     if (url.host() == host)
 498       urls->push_back(url);
 499   }
 500 }
 501
 502 void ManagedUserService::InitSync(const std::string& refresh_token) {
 503   ProfileSyncService* service =
 504       ProfileSyncServiceFactory::GetForProfile(profile_);
 505   // Tell the sync service that setup is in progress so we don't start syncing
 506   // until we've finished configuration.
 507   service->SetSetupInProgress(true);
 508
 509   ProfileOAuth2TokenService* token_service =
 510       ProfileOAuth2TokenServiceFactory::GetForProfile(profile_);
 511   token_service->UpdateCredentials(managed_users::kManagedUserPseudoEmail,
 512                                    refresh_token);
 513
 514   // Continue in SetupSync() once the Sync backend has been initialized.
 515   if (service->sync_initialized()) {
 516     SetupSync();
 517   } else {
 518     ProfileSyncServiceFactory::GetForProfile(profile_)->AddObserver(this);
 519     waiting_for_sync_initialization_ = true;
 520   }
 521 }
 522
 523 void ManagedUserService::Init() {
 524   ManagedUserSettingsService* settings_service = GetSettingsService();
 525   DCHECK(settings_service->IsReady());
 526   if (!ProfileIsManaged()) {
 527     settings_service->Clear();
 528     return;
 529   }
 530
 531   settings_service->Activate();
 532
 533   CommandLine* command_line = CommandLine::ForCurrentProcess();
 534   if (command_line->HasSwitch(switches::kManagedUserSyncToken)) {
 535     InitSync(
 536         command_line->GetSwitchValueASCII(switches::kManagedUserSyncToken));
 537   }
 538
 539   // TODO(rogerta): Remove this once PO2TS has replaced TokenService.
 540   ProfileOAuth2TokenService* token_service =
 541       ProfileOAuth2TokenServiceFactory::GetForProfile(profile_);
 542   token_service->LoadCredentials();
 543
 544   extensions::ExtensionSystem* extension_system =
 545       extensions::ExtensionSystem::Get(profile_);
 546   extensions::ManagementPolicy* management_policy =
 547       extension_system->management_policy();
 548   if (management_policy)
 549     extension_system->management_policy()->RegisterProvider(this);
 550
 551   registrar_.Add(this, chrome::NOTIFICATION_EXTENSION_LOADED,
 552                  content::Source<Profile>(profile_));
 553   registrar_.Add(this, chrome::NOTIFICATION_EXTENSION_UNLOADED,
 554                  content::Source<Profile>(profile_));
 555
 556   pref_change_registrar_.Init(profile_->GetPrefs());
 557   pref_change_registrar_.Add(
 558       prefs::kDefaultManagedModeFilteringBehavior,
 559       base::Bind(&ManagedUserService::OnDefaultFilteringBehaviorChanged,
 560           base::Unretained(this)));
 561   pref_change_registrar_.Add(prefs::kManagedModeManualHosts,
 562       base::Bind(&ManagedUserService::UpdateManualHosts,
 563                  base::Unretained(this)));
 564   pref_change_registrar_.Add(prefs::kManagedModeManualURLs,
 565       base::Bind(&ManagedUserService::UpdateManualURLs,
 566                  base::Unretained(this)));
 567
 568 #if !defined(OS_ANDROID)
 569   // TODO(bauerb): Get rid of the platform-specific #ifdef here.
 570   // http://crbug.com/313377
 571   BrowserList::AddObserver(this);
 572 #endif
 573
 574   // Initialize the filter.
 575   OnDefaultFilteringBehaviorChanged();
 576   UpdateSiteLists();
 577   UpdateManualHosts();
 578   UpdateManualURLs();
 579 }
 580
 581 void ManagedUserService::RegisterAndInitSync(
 582     ManagedUserRegistrationUtility* registration_utility,
 583     Profile* custodian_profile,
 584     const std::string& managed_user_id,
 585     const AuthErrorCallback& callback) {
 586   DCHECK(ProfileIsManaged());
 587   DCHECK(!custodian_profile->IsManaged());
 588
 589   base::string16 name = base::UTF8ToUTF16(
 590       profile_->GetPrefs()->GetString(prefs::kProfileName));
 591   int avatar_index = profile_->GetPrefs()->GetInteger(
 592       prefs::kProfileAvatarIndex);
 593   ManagedUserRegistrationInfo info(name, avatar_index);
 594   registration_utility->Register(
 595       managed_user_id,
 596       info,
 597       base::Bind(&ManagedUserService::OnManagedUserRegistered,
 598                  weak_ptr_factory_.GetWeakPtr(), callback, custodian_profile));
 599
 600   // Fetch the custodian's profile information, to store the name.
 601   // TODO(pamg): If --google-profile-info (flag: switches::kGoogleProfileInfo)
 602   // is ever enabled, take the name from the ProfileInfoCache instead.
 603   CustodianProfileDownloaderService* profile_downloader_service =
 604       CustodianProfileDownloaderServiceFactory::GetForProfile(
 605           custodian_profile);
 606   profile_downloader_service->DownloadProfile(
 607       base::Bind(&ManagedUserService::OnCustodianProfileDownloaded,
 608                  weak_ptr_factory_.GetWeakPtr()));
 609 }
 610
 611 void ManagedUserService::OnCustodianProfileDownloaded(
 612     const base::string16& full_name) {
 613   profile_->GetPrefs()->SetString(prefs::kManagedUserCustodianName,
 614                                   base::UTF16ToUTF8(full_name));
 615 }
 616
 617 void ManagedUserService::OnManagedUserRegistered(
 618     const AuthErrorCallback& callback,
 619     Profile* custodian_profile,
 620     const GoogleServiceAuthError& auth_error,
 621     const std::string& token) {
 622   if (auth_error.state() == GoogleServiceAuthError::NONE) {
 623     InitSync(token);
 624     SigninManagerBase* signin =
 625         SigninManagerFactory::GetForProfile(custodian_profile);
 626     profile_->GetPrefs()->SetString(prefs::kManagedUserCustodianEmail,
 627                                     signin->GetAuthenticatedUsername());
 628   } else {
 629     DCHECK_EQ(std::string(), token);
 630   }
 631
 632   callback.Run(auth_error);
 633 }
 634
 635 void ManagedUserService::UpdateManualHosts() {
 636   const base::DictionaryValue* dict =
 637       profile_->GetPrefs()->GetDictionary(prefs::kManagedModeManualHosts);
 638   scoped_ptr<std::map<std::string, bool> > host_map(
 639       new std::map<std::string, bool>());
 640   for (base::DictionaryValue::Iterator it(*dict); !it.IsAtEnd(); it.Advance()) {
 641     bool allow = false;
 642     bool result = it.value().GetAsBoolean(&allow);
 643     DCHECK(result);
 644     (*host_map)[it.key()] = allow;
 645   }
 646   url_filter_context_.SetManualHosts(host_map.Pass());
 647 }
 648
 649 void ManagedUserService::UpdateManualURLs() {
 650   const base::DictionaryValue* dict =
 651       profile_->GetPrefs()->GetDictionary(prefs::kManagedModeManualURLs);
 652   scoped_ptr<std::map<GURL, bool> > url_map(new std::map<GURL, bool>());
 653   for (base::DictionaryValue::Iterator it(*dict); !it.IsAtEnd(); it.Advance()) {
 654     bool allow = false;
 655     bool result = it.value().GetAsBoolean(&allow);
 656     DCHECK(result);
 657     (*url_map)[GURL(it.key())] = allow;
 658   }
 659   url_filter_context_.SetManualURLs(url_map.Pass());
 660 }
 661
 662 void ManagedUserService::OnBrowserSetLastActive(Browser* browser) {
 663   bool profile_became_active = profile_->IsSameProfile(browser->profile());
 664   if (!is_profile_active_ && profile_became_active)
 665     RecordProfileAndBrowserEventsHelper(kOpenManagedProfileKeyPrefix);
 666   else if (is_profile_active_ && !profile_became_active)
 667     RecordProfileAndBrowserEventsHelper(kSwitchFromManagedProfileKeyPrefix);
 668
 669   is_profile_active_ = profile_became_active;
 670 }
 671
 672 void ManagedUserService::RecordProfileAndBrowserEventsHelper(
 673     const char* key_prefix) {
 674   std::string key = ManagedUserSettingsService::MakeSplitSettingKey(
 675       key_prefix,
 676       base::Int64ToString(base::TimeTicks::Now().ToInternalValue()));
 677
 678   scoped_ptr<base::DictionaryValue> dict(new base::DictionaryValue);
 679
 680   // TODO(bauerb): Use sane time when ready.
 681   dict->SetDouble(kEventTimestamp, base::Time::Now().ToJsTime());
 682
 683   GetSettingsService()->UploadItem(key, dict.PassAs<base::Value>());
 684 }