1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
|
// Copyright 2019 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include "chrome/browser/ash/child_accounts/parent_access_code/parent_access_service.h"
#include <string>
#include <utility>
#include "ash/public/cpp/child_accounts/parent_access_controller.h"
#include "base/check.h"
#include "base/containers/contains.h"
#include "base/logging.h"
#include "base/no_destructor.h"
#include "base/timer/timer.h"
#include "base/values.h"
#include "chrome/browser/browser_process.h"
#include "chrome/common/chrome_features.h"
#include "chrome/common/pref_names.h"
#include "components/prefs/pref_registry_simple.h"
#include "components/user_manager/user.h"
#include "components/user_manager/user_manager.h"
namespace ash {
namespace parent_access {
namespace {
// Returns true when the device owner is a child.
bool IsDeviceOwnedByChild() {
AccountId owner_account_id =
user_manager::UserManager::Get()->GetOwnerAccountId();
if (owner_account_id.empty()) {
LOG(ERROR) << "Device owner could not be determined - will skip parent "
"code validation";
return false;
}
const user_manager::User* device_owner =
user_manager::UserManager::Get()->FindUser(owner_account_id);
// It looks like reading users from Local State might be failing sometimes.
// Default to false if ownership is not known to avoid crash.
// TODO(agawronska): Investigate if it can be improved. Defaulting to false
// could sometimes lead to skipping parent code validation when child is the
// device owner.
if (!device_owner) {
LOG(ERROR) << "Device owner could not be determined - will skip parent "
"code validation";
return false;
}
return device_owner->IsChild();
}
} // namespace
// static
void ParentAccessService::RegisterProfilePrefs(PrefRegistrySimple* registry) {
registry->RegisterDictionaryPref(prefs::kParentAccessCodeConfig);
}
// static
ParentAccessService& ParentAccessService::Get() {
static base::NoDestructor<ParentAccessService> instance;
return *instance;
}
// static
bool ParentAccessService::IsApprovalRequired(SupervisedAction action) {
switch (action) {
case SupervisedAction::kUpdateClock:
case SupervisedAction::kUpdateTimezone:
if (user_manager::UserManager::Get()->IsUserLoggedIn()) {
return user_manager::UserManager::Get()->GetActiveUser()->IsChild();
}
return IsDeviceOwnedByChild();
case SupervisedAction::kAddUser:
return IsDeviceOwnedByChild();
case SupervisedAction::kReauth:
return false;
case SupervisedAction::kUnlockTimeLimits:
DCHECK(user_manager::UserManager::Get()->IsUserLoggedIn());
return true;
}
}
ParentAccessService::ParentAccessService() = default;
ParentAccessService::~ParentAccessService() = default;
ParentCodeValidationResult ParentAccessService::ValidateParentAccessCode(
const AccountId& account_id,
const std::string& access_code,
base::Time validation_time) {
ParentCodeValidationResult result = ParentCodeValidationResult::kInvalid;
if (config_source_.config_map().empty() ||
(account_id.is_valid() &&
!base::Contains(config_source_.config_map(), account_id))) {
result = ParentCodeValidationResult::kNoConfig;
NotifyObservers(result, account_id);
return result;
}
for (const auto& map_entry : config_source_.config_map()) {
if (!account_id.is_valid() || account_id == map_entry.first) {
for (const auto& validator : map_entry.second) {
if (validator->Validate(access_code, validation_time)) {
result = ParentCodeValidationResult::kValid;
NotifyObservers(result, account_id);
return result;
}
}
}
}
NotifyObservers(result, account_id);
return result;
}
void ParentAccessService::LoadConfigForUser(const user_manager::User* user) {
config_source_.LoadConfigForUser(user);
}
void ParentAccessService::AddObserver(Observer* observer) {
observers_.AddObserver(observer);
}
void ParentAccessService::RemoveObserver(Observer* observer) {
observers_.RemoveObserver(observer);
}
void ParentAccessService::NotifyObservers(
ParentCodeValidationResult validation_result,
const AccountId& account_id) {
for (auto& observer : observers_)
observer.OnAccessCodeValidation(validation_result, account_id);
}
} // namespace parent_access
} // namespace ash
|
