text: // Copyright 2015 The Chromium Authors. All rights reserved.
  // Use of this source code is governed by a BSD-style license that can be
  // found in the LICENSE file.
  #include "chrome/browser/chromeos/policy/affiliation/affiliation_test_helper.h"
  
  #include <stdint.h>
  
  #include <memory>
  #include <string>
  
  #include "ash/constants/ash_switches.h"
  #include "base/command_line.h"
  #include "base/containers/contains.h"
  #include "base/files/file_path.h"
  #include "base/files/file_util.h"
  #include "base/numerics/safe_conversions.h"
  #include "base/path_service.h"
  #include "chrome/browser/ash/login/existing_user_controller.h"
  #include "chrome/browser/ash/login/session/user_session_manager_test_api.h"
  #include "chrome/browser/ash/login/startup_utils.h"
  #include "chrome/browser/ash/login/test/session_manager_state_waiter.h"
  #include "chrome/browser/browser_process.h"
  #include "chrome/browser/chromeos/policy/core/device_cloud_policy_store_chromeos.h"
  #include "chrome/browser/chromeos/policy/core/device_policy_builder.h"
  #include "chrome/browser/chromeos/policy/core/device_policy_cros_browser_test.h"
  #include "chrome/common/chrome_paths.h"
  #include "chromeos/cryptohome/cryptohome_parameters.h"
  #include "chromeos/dbus/authpolicy/fake_authpolicy_client.h"
  #include "chromeos/dbus/constants/dbus_paths.h"
  #include "chromeos/dbus/session_manager/fake_session_manager_client.h"
  #include "chromeos/dbus/session_manager/session_manager_client.h"
  #include "chromeos/dbus/userdataauth/userdataauth_client.h"
  #include "chromeos/login/auth/key.h"
  #include "chromeos/login/auth/user_context.h"
  #include "components/account_id/account_id.h"
  #include "components/policy/core/common/cloud/cloud_policy_core.h"
  #include "components/policy/core/common/cloud/cloud_policy_store.h"
  #include "components/policy/core/common/cloud/test/policy_builder.h"
  #include "components/prefs/pref_service.h"
  #include "components/prefs/scoped_user_pref_update.h"
  #include "components/user_manager/known_user.h"
  #include "components/user_manager/user_manager.h"
  #include "crypto/rsa_private_key.h"
  #include "testing/gtest/include/gtest/gtest.h"
  
  namespace policy {
  
  namespace {
  
  // Creates policy key file for the user specified in |user_policy|.
  void SetUserKeys(const policy::UserPolicyBuilder& user_policy) {
    base::FilePath user_data_dir;
    if (base::PathService::Get(chrome::DIR_USER_DATA, &user_data_dir))
      chromeos::dbus_paths::RegisterStubPathOverrides(user_data_dir);
  
    const AccountId account_id =
        AccountId::FromUserEmail(user_policy.policy_data().username());
    base::FilePath user_keys_dir;
    ASSERT_TRUE(base::PathService::Get(chromeos::dbus_paths::DIR_USER_POLICY_KEYS,
                                       &user_keys_dir));
    const std::string sanitized_username =
        chromeos::UserDataAuthClient::GetStubSanitizedUsername(
            cryptohome::CreateAccountIdentifierFromAccountId(account_id));
    const base::FilePath user_key_file =
        user_keys_dir.AppendASCII(sanitized_username).AppendASCII("policy.pub");
    std::string user_key_bits = user_policy.GetPublicSigningKeyAsString();
    ASSERT_FALSE(user_key_bits.empty());
    ASSERT_TRUE(base::CreateDirectory(user_key_file.DirName()));
    ASSERT_EQ(base::WriteFile(user_key_file, user_key_bits.data(),
                              user_key_bits.length()),
              base::checked_cast<int>(user_key_bits.length()));
  }
  
  }  // namespace
  
  constexpr char AffiliationTestHelper::kFakeRefreshToken[] =
      "fake-refresh-token";
  constexpr char AffiliationTestHelper::kEnterpriseUserEmail[] =
      "testuser@example.com";
  constexpr char AffiliationTestHelper::kEnterpriseUserGaiaId[] = "01234567890";
  
  // static
  AffiliationTestHelper AffiliationTestHelper::CreateForCloud(
      chromeos::FakeSessionManagerClient* fake_session_manager_client) {
    return AffiliationTestHelper(ManagementType::kCloud,
                                 fake_session_manager_client,
                                 nullptr /* fake_authpolicy_client */);
  }
  
  // static
  AffiliationTestHelper AffiliationTestHelper::CreateForActiveDirectory(
      chromeos::FakeSessionManagerClient* fake_session_manager_client,
      chromeos::FakeAuthPolicyClient* fake_authpolicy_client) {
    return AffiliationTestHelper(ManagementType::kActiveDirectory,
                                 fake_session_manager_client,
                                 fake_authpolicy_client);
  }
  
  AffiliationTestHelper::AffiliationTestHelper(AffiliationTestHelper&& other) =
      default;
  
  AffiliationTestHelper::AffiliationTestHelper(
      ManagementType management_type,
      chromeos::FakeSessionManagerClient* fake_session_manager_client,
      chromeos::FakeAuthPolicyClient* fake_authpolicy_client)
      : management_type_(management_type),
        fake_session_manager_client_(fake_session_manager_client),
        fake_authpolicy_client_(fake_authpolicy_client) {
    DCHECK(fake_session_manager_client);
  }
  
  void AffiliationTestHelper::CheckPreconditions() {
    ASSERT_TRUE(fake_session_manager_client_);
    ASSERT_TRUE(management_type_ != ManagementType::kActiveDirectory ||
                fake_authpolicy_client_);
  }
  
  void AffiliationTestHelper::SetDeviceAffiliationIDs(
      policy::DevicePolicyCrosTestHelper* test_helper,
      const std::set<std::string>& device_affiliation_ids) {
    ASSERT_NO_FATAL_FAILURE(CheckPreconditions());
  
    policy::DevicePolicyBuilder* device_policy = test_helper->device_policy();
    for (const auto& device_affiliation_id : device_affiliation_ids) {
      device_policy->policy_data().add_device_affiliation_ids(
          device_affiliation_id);
    }
    if (management_type_ != ManagementType::kActiveDirectory) {
      // Create keys and sign policy. Note that Active Directory policy is
      // unsigned.
      device_policy->SetDefaultSigningKey();
    }
    device_policy->Build();
  
    fake_session_manager_client_->set_device_policy(device_policy->GetBlob());
    fake_session_manager_client_->OnPropertyChangeComplete(true);
  
    if (management_type_ == ManagementType::kActiveDirectory)
      fake_authpolicy_client_->set_device_affiliation_ids(device_affiliation_ids);
  }
  
  void AffiliationTestHelper::SetUserAffiliationIDs(
      policy::UserPolicyBuilder* user_policy,
      const AccountId& user_account_id,
      const std::set<std::string>& user_affiliation_ids) {
    ASSERT_NO_FATAL_FAILURE(CheckPreconditions());
    ASSERT_TRUE(management_type_ != ManagementType::kActiveDirectory ||
                user_account_id.GetAccountType() ==
                    AccountType::ACTIVE_DIRECTORY);
  
    user_policy->policy_data().set_username(user_account_id.GetUserEmail());
    if (management_type_ != ManagementType::kActiveDirectory) {
      user_policy->policy_data().set_gaia_id(user_account_id.GetGaiaId());
      ASSERT_NO_FATAL_FAILURE(SetUserKeys(*user_policy));
    }
    for (const auto& user_affiliation_id : user_affiliation_ids) {
      user_policy->policy_data().add_user_affiliation_ids(user_affiliation_id);
    }
    user_policy->Build();
  
    fake_session_manager_client_->set_user_policy(
        cryptohome::CreateAccountIdentifierFromAccountId(user_account_id),
        user_policy->GetBlob());
  
    if (management_type_ == ManagementType::kActiveDirectory)
      fake_authpolicy_client_->set_user_affiliation_ids(user_affiliation_ids);
  }
  
  // static
  void AffiliationTestHelper::PreLoginUser(const AccountId& account_id) {
    ListPrefUpdate users_pref(g_browser_process->local_state(), "LoggedInUsers");
    base::Value email_value(account_id.GetUserEmail());
    if (!base::Contains(users_pref->GetList(), email_value))
      users_pref->Append(std::move(email_value));
  
    if (user_manager::UserManager::IsInitialized())
      user_manager::known_user::SaveKnownUser(account_id);
  
    chromeos::StartupUtils::MarkOobeCompleted();
  }
  
  // static
  void AffiliationTestHelper::LoginUser(const AccountId& account_id) {
    ash::test::UserSessionManagerTestApi session_manager_test_api(
        ash::UserSessionManager::GetInstance());
    session_manager_test_api.SetShouldObtainTokenHandleInTests(false);
  
    const bool is_active_directory =
        account_id.GetAccountType() == AccountType::ACTIVE_DIRECTORY;
    const user_manager::UserType user_type =
        is_active_directory ? user_manager::UserType::USER_TYPE_ACTIVE_DIRECTORY
                            : user_manager::UserType::USER_TYPE_REGULAR;
    chromeos::UserContext user_context(user_type, account_id);
    user_context.SetKey(chromeos::Key("password"));
    if (account_id.GetUserEmail() == kEnterpriseUserEmail) {
      user_context.SetRefreshToken(kFakeRefreshToken);
    }
    chromeos::ExistingUserController* controller =
        chromeos::ExistingUserController::current_controller();
    CHECK(controller);
    controller->Login(user_context, chromeos::SigninSpecifics());
    chromeos::test::WaitForPrimaryUserSessionStart();
  
    const user_manager::UserList& logged_users =
        user_manager::UserManager::Get()->GetLoggedInUsers();
    for (user_manager::UserList::const_iterator it = logged_users.begin();
         it != logged_users.end(); ++it) {
      if ((*it)->GetAccountId() == user_context.GetAccountId())
        return;
    }
    ADD_FAILURE() << account_id.Serialize()
                  << " was not added via PreLoginUser()";
  }
  
  // static
  void AffiliationTestHelper::AppendCommandLineSwitchesForLoginManager(
      base::CommandLine* command_line) {
    command_line->AppendSwitch(chromeos::switches::kLoginManager);
    command_line->AppendSwitch(chromeos::switches::kForceLoginManagerInTests);
    // LoginManager tests typically don't stand up a policy test server but
    // instead inject policies directly through a SessionManagerClient. So allow
    // policy fetches to fail - this is expected.
    command_line->AppendSwitch(
        chromeos::switches::kAllowFailedPolicyFetchForTest);
  }
  
  }  // namespace policy
  