// Copyright 2017 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "chrome/browser/ash/policy/handlers/minimum_version_policy_handler.h"

#include <algorithm>
#include <string>
#include <utility>

#include "ash/constants/ash_features.h"
#include "ash/constants/ash_switches.h"
#include "ash/public/cpp/system_tray.h"
#include "base/functional/bind.h"
#include "base/logging.h"
#include "base/memory/ref_counted.h"
#include "base/numerics/safe_conversions.h"
#include "base/time/default_clock.h"
#include "base/time/time.h"
#include "base/values.h"
#include "chrome/browser/ash/app_mode/app_launch_utils.h"
#include "chrome/browser/ash/notifications/update_required_notification.h"
#include "chrome/browser/ash/policy/core/browser_policy_connector_ash.h"
#include "chrome/browser/ash/policy/handlers/minimum_version_policy_handler_delegate_impl.h"
#include "chrome/browser/browser_process.h"
#include "chrome/browser/browser_process_platform_part.h"
#include "chrome/browser/ui/ash/system/system_tray_client_impl.h"
#include "chrome/browser/upgrade_detector/build_state.h"
#include "chrome/browser/upgrade_detector/upgrade_detector.h"
#include "chrome/common/pref_names.h"
#include "chromeos/ash/components/dbus/update_engine/update_engine_client.h"
#include "chromeos/ash/components/network/network_handler.h"
#include "chromeos/ash/components/network/network_state_handler.h"
#include "chromeos/ash/components/settings/cros_settings_names.h"
#include "chromeos/ash/components/settings/cros_settings_provider.h"
#include "components/prefs/pref_registry_simple.h"
#include "components/prefs/pref_service.h"
#include "ui/chromeos/devicetype_utils.h"

namespace policy {

namespace {

using ::ash::UpdateEngineClient;
using MinimumVersionRequirement =
    MinimumVersionPolicyHandler::MinimumVersionRequirement;

const int kOneWeekEolNotificationInDays = 7;

PrefService* local_state() {
  return g_browser_process->local_state();
}

MinimumVersionPolicyHandler::NetworkStatus GetCurrentNetworkStatus() {
  ash::NetworkStateHandler* network_state_handler =
      ash::NetworkHandler::Get()->network_state_handler();
  const ash::NetworkState* current_network =
      network_state_handler->DefaultNetwork();
  if (!current_network || !current_network->IsConnectedState())
    return MinimumVersionPolicyHandler::NetworkStatus::kOffline;
  if (network_state_handler->default_network_is_metered())
    return MinimumVersionPolicyHandler::NetworkStatus::kMetered;
  return MinimumVersionPolicyHandler::NetworkStatus::kAllowed;
}

void OpenNetworkSettings() {
  ash::SystemTray::Get()->ShowNetworkDetailedViewBubble();
}

void OpenEnterpriseInfoPage() {
  SystemTrayClientImpl::Get()->ShowEnterpriseInfo();
}

std::string GetEnterpriseManager() {
  return g_browser_process->platform_part()
      ->browser_policy_connector_ash()
      ->GetEnterpriseDomainManager();
}

BuildState* GetBuildState() {
  return g_browser_process->GetBuildState();
}

int GetDaysRounded(base::TimeDelta time) {
  return base::ClampRound(time / base::Days(1));
}

// Overrides the relaunch notification style to required and configures the
// relaunch deadline according to the deadline.
void OverrideRelaunchNotification(base::Time deadline) {
  UpgradeDetector* upgrade_detector = UpgradeDetector::GetInstance();
  upgrade_detector->OverrideRelaunchNotificationToRequired(true);
  upgrade_detector->OverrideHighAnnoyanceDeadline(deadline);
}

// Resets the overridden relaunch notification style and deadline.
void ResetRelaunchNotification() {
  UpgradeDetector* upgrade_detector = UpgradeDetector::GetInstance();
  upgrade_detector->ResetOverriddenDeadline();
  upgrade_detector->OverrideRelaunchNotificationToRequired(false);
}

}  // namespace

const char MinimumVersionPolicyHandler::kRequirements[] = "requirements";
const char MinimumVersionPolicyHandler::kChromeOsVersion[] = "chromeos_version";
const char MinimumVersionPolicyHandler::kWarningPeriod[] = "warning_period";
const char MinimumVersionPolicyHandler::kEolWarningPeriod[] =
    "aue_warning_period";
const char MinimumVersionPolicyHandler::kUnmanagedUserRestricted[] =
    "unmanaged_user_restricted";

MinimumVersionRequirement::MinimumVersionRequirement(
    const base::Version version,
    const base::TimeDelta warning,
    const base::TimeDelta eol_warning)
    : minimum_version_(version),
      warning_time_(warning),
      eol_warning_time_(eol_warning) {}

std::unique_ptr<MinimumVersionRequirement>
MinimumVersionRequirement::CreateInstanceIfValid(
    const base::Value::Dict& dict) {
  const std::string* version = dict.FindString(kChromeOsVersion);
  if (!version)
    return nullptr;
  base::Version minimum_version(*version);
  if (!minimum_version.IsValid())
    return nullptr;
  auto warning = dict.FindInt(kWarningPeriod);
  base::TimeDelta warning_time =
      base::Days(warning.has_value() ? warning.value() : 0);
  auto eol_warning = dict.FindInt(kEolWarningPeriod);
  base::TimeDelta eol_warning_time =
      base::Days(eol_warning.has_value() ? eol_warning.value() : 0);
  return std::make_unique<MinimumVersionRequirement>(
      minimum_version, warning_time, eol_warning_time);
}

int MinimumVersionRequirement::Compare(
    const MinimumVersionRequirement* other) const {
  const int version_compare = version().CompareTo(other->version());
  if (version_compare != 0)
    return version_compare;
  if (warning() != other->warning())
    return (warning() > other->warning() ? 1 : -1);
  if (eol_warning() != other->eol_warning())
    return (eol_warning() > other->eol_warning() ? 1 : -1);
  return 0;
}

MinimumVersionPolicyHandler::MinimumVersionPolicyHandler(
    Delegate* delegate,
    ash::CrosSettings* cros_settings)
    : delegate_(delegate),
      cros_settings_(cros_settings),
      clock_(base::DefaultClock::GetInstance()) {
  policy_subscription_ = cros_settings_->AddSettingsObserver(
      ash::kDeviceMinimumVersion,
      base::BindRepeating(&MinimumVersionPolicyHandler::OnPolicyChanged,
                          weak_factory_.GetWeakPtr()));

  // Fire it once so we're sure we get an invocation on startup.
  OnPolicyChanged();
}

MinimumVersionPolicyHandler::~MinimumVersionPolicyHandler() {
  GetBuildState()->RemoveObserver(this);
  StopObservingNetwork();
  UpdateEngineClient::Get()->RemoveObserver(this);
}

void MinimumVersionPolicyHandler::AddObserver(Observer* observer) {
  observers_.AddObserver(observer);
}

void MinimumVersionPolicyHandler::RemoveObserver(Observer* observer) {
  observers_.RemoveObserver(observer);
}

bool MinimumVersionPolicyHandler::CurrentVersionSatisfies(
    const MinimumVersionRequirement& requirement) const {
  base::Version platform_version(delegate_->GetCurrentVersion());
  if (platform_version.IsValid())
    return delegate_->GetCurrentVersion().CompareTo(requirement.version()) >= 0;
  return true;
}

bool MinimumVersionPolicyHandler::IsPolicyRestrictionAppliedForUser() const {
  return delegate_->IsUserEnterpriseManaged() || unmanaged_user_restricted_;
}

//  static
void MinimumVersionPolicyHandler::RegisterPrefs(PrefRegistrySimple* registry) {
  registry->RegisterTimePref(prefs::kUpdateRequiredTimerStartTime,
                             base::Time());
  registry->RegisterTimeDeltaPref(prefs::kUpdateRequiredWarningPeriod,
                                  base::TimeDelta());
}

bool MinimumVersionPolicyHandler::ShouldShowUpdateRequiredEolBanner() const {
  return !RequirementsAreSatisfied() && IsPolicyRestrictionAppliedForUser() &&
         eol_reached_;
}

bool MinimumVersionPolicyHandler::IsDeadlineTimerRunningForTesting() const {
  return update_required_deadline_timer_.IsRunning();
}

bool MinimumVersionPolicyHandler::IsPolicyApplicable() {
  bool device_managed = delegate_->IsDeviceEnterpriseManaged();
  bool is_kiosk = delegate_->IsKioskMode();
  return device_managed && !is_kiosk;
}

void MinimumVersionPolicyHandler::OnPolicyChanged() {
  ash::CrosSettingsProvider::TrustedStatus status =
      cros_settings_->PrepareTrustedValues(
          base::BindOnce(&MinimumVersionPolicyHandler::OnPolicyChanged,
                         weak_factory_.GetWeakPtr()));
  if (status != ash::CrosSettingsProvider::TRUSTED || !IsPolicyApplicable() ||
      !ash::features::IsMinimumChromeVersionEnabled()) {
    VLOG(1) << "Ignore policy change - policy is not applicable or settings "
               "are not trusted.";
    return;
  }

  const base::Value::Dict* policy_value;
  if (!cros_settings_->GetDictionary(ash::kDeviceMinimumVersion,
                                     &policy_value)) {
    VLOG(1) << "Revoke policy - policy is unset or value is incorrect.";
    HandleUpdateNotRequired();
    return;
  }
  const base::Value::List* entries = policy_value->FindList(kRequirements);
  if (!entries || entries->empty()) {
    VLOG(1) << "Revoke policy - empty policy requirements.";
    HandleUpdateNotRequired();
    return;
  }
  auto restricted = policy_value->FindBool(kUnmanagedUserRestricted);
  unmanaged_user_restricted_ = restricted.value_or(false);

  std::vector<std::unique_ptr<MinimumVersionRequirement>> configs;
  for (const auto& item : *entries) {
    if (!item.is_dict())
      continue;
    std::unique_ptr<MinimumVersionRequirement> instance =
        MinimumVersionRequirement::CreateInstanceIfValid(item.GetDict());
    if (instance)
      configs.push_back(std::move(instance));
  }

  // Select the strongest config whose requirements are not satisfied by the
  // current version. The strongest config is chosen as the one whose minimum
  // required version is greater and closest to the current version. In case of
  // conflict. preference is given to the one with lesser warning time or eol
  // warning time.
  int strongest_config_idx = -1;
  std::vector<std::unique_ptr<MinimumVersionRequirement>>
      update_required_configs;
  for (unsigned int i = 0; i < configs.size(); i++) {
    MinimumVersionRequirement* item = configs[i].get();
    if (!CurrentVersionSatisfies(*item) &&
        (strongest_config_idx == -1 ||
         item->Compare(configs[strongest_config_idx].get()) < 0))
      strongest_config_idx = i;
  }

  if (strongest_config_idx != -1) {
    // Update is required if at least one config exists whose requirements are
    // not satisfied by the current version.
    std::unique_ptr<MinimumVersionRequirement> strongest_config =
        std::move(configs[strongest_config_idx]);
    if (!state_ || state_->Compare(strongest_config.get()) != 0) {
      state_ = std::move(strongest_config);
      FetchEolInfo();
    }
  } else {
    // Update is not required as the requirements of all of the configs in the
    // policy are satisfied by the current Chrome OS version. We could also
    // reach here at the time of login if the device was rebooted to apply the
    // downloaded update, in which case it is needed to reset the local state.
    HandleUpdateNotRequired();
  }
}

void MinimumVersionPolicyHandler::HandleUpdateNotRequired() {
  VLOG(2) << "Update is not required.";
  // Reset the state including any running timers.
  Reset();
  // Hide update required screen if it is visible and switch back to the login
  // screen.
  if (delegate_->IsLoginSessionState())
    delegate_->HideUpdateRequiredScreenIfShown();
  ResetRelaunchNotification();
}

void MinimumVersionPolicyHandler::Reset() {
  deadline_reached_ = false;
  eol_reached_ = false;
  update_required_deadline_ = base::Time();
  update_required_time_ = base::Time();
  update_required_deadline_timer_.Stop();
  notification_timer_.Stop();
  GetBuildState()->RemoveObserver(this);
  state_.reset();
  HideNotification();
  notification_handler_.reset();
  ResetLocalState();
  StopObservingNetwork();
}

void MinimumVersionPolicyHandler::ResetOnUpdateCompleted() {
  update_required_deadline_timer_.Stop();
  notification_timer_.Stop();
  GetBuildState()->RemoveObserver(this);
  HideNotification();
  notification_handler_.reset();
}

void MinimumVersionPolicyHandler::FetchEolInfo() {
  // Return if update required state is null meaning all requirements are
  // satisfied.
  if (!state_)
    return;

  update_required_time_ = clock_->Now();
  // Request the End of Life (Auto Update Expiration) status.
  UpdateEngineClient::Get()->GetEolInfo(
      base::BindOnce(&MinimumVersionPolicyHandler::OnFetchEolInfo,
                     weak_factory_.GetWeakPtr()));
}

void MinimumVersionPolicyHandler::OnFetchEolInfo(
    const UpdateEngineClient::EolInfo info) {
  if (!ash::switches::IsAueReachedForUpdateRequiredForTest() &&
      (info.eol_date.is_null() || info.eol_date > update_required_time_)) {
    // End of life is not reached. Start update with |warning_time_|.
    eol_reached_ = false;
    HandleUpdateRequired(state_->warning());
  } else {
    // End of life is reached. Start update with |eol_warning_time_|.
    eol_reached_ = true;
    HandleUpdateRequired(state_->eol_warning());
  }
  if (!fetch_eol_callback_.is_null())
    std::move(fetch_eol_callback_).Run();
}

void MinimumVersionPolicyHandler::HandleUpdateRequired(
    base::TimeDelta warning_time) {
  const base::Time stored_timer_start_time =
      local_state()->GetTime(prefs::kUpdateRequiredTimerStartTime);
  const base::TimeDelta stored_warning_time =
      local_state()->GetTimeDelta(prefs::kUpdateRequiredWarningPeriod);
  base::Time previous_deadline = stored_timer_start_time + stored_warning_time;

  // If update is already required, use the existing timer start time to
  // calculate the new deadline. Else use |update_required_time_|. Do not reduce
  // the warning time if policy is already applied.
  if (stored_timer_start_time.is_null()) {
    update_required_deadline_ = update_required_time_ + warning_time;
  } else {
    update_required_deadline_ =
        stored_timer_start_time + std::max(stored_warning_time, warning_time);
  }
  VLOG(1) << "Update is required with "
          << "update required time " << update_required_time_
          << " warning time " << warning_time
          << " and update required deadline " << update_required_deadline_;

  const bool deadline_reached =
      update_required_deadline_ <= update_required_time_;
  if (deadline_reached) {
    // As per the policy, the deadline for the user cannot reduce.
    // This case can be encountered when :-
    // a) Update was not required before and now critical update is required.
    // b) Update was required and warning time has expired when device is
    // rebooted.
    // Update the local state with the current policy values.
    if (update_required_deadline_ > previous_deadline)
      UpdateLocalState(warning_time);
    OnDeadlineReached();
    return;
  }

  // Need to start the timer even if the deadline is same as the previous one to
  // handle the case of Chrome reboot.
  if (update_required_deadline_timer_.IsRunning() &&
      update_required_deadline_timer_.desired_run_time() ==
          update_required_deadline_) {
    DLOG(WARNING) << "Deadline is same as previous and timer is running.";
    return;
  }

  // This case can be encountered when :-
  // a) Update was not required before and now update is required with a
  // warning time. b) Policy has been updated with new values and update is
  // still required.

  // Hide update required screen if it is shown on the login screen.
  if (delegate_->IsLoginSessionState())
    delegate_->HideUpdateRequiredScreenIfShown();

  // The |deadline| can only be equal to or greater than the
  // |previous_deadline|. No need to update the local state if the deadline has
  // not been extended.
  if (update_required_deadline_ > previous_deadline)
    UpdateLocalState(warning_time);

  // The device has already downloaded the update in-session and waiting for
  // reboot to apply it.
  if (GetBuildState()->update_type() == BuildState::UpdateType::kNormalUpdate) {
    OverrideRelaunchNotification(update_required_deadline_);
    DLOG(WARNING) << "Update is already installed.";
    return;
  }

  StartDeadlineTimer(update_required_deadline_);
  if (!eol_reached_)
    StartObservingUpdate();
  ShowAndScheduleNotification(update_required_deadline_);
}

void MinimumVersionPolicyHandler::ResetLocalState() {
  local_state()->ClearPref(prefs::kUpdateRequiredTimerStartTime);
  local_state()->ClearPref(prefs::kUpdateRequiredWarningPeriod);
}

void MinimumVersionPolicyHandler::UpdateLocalState(
    base::TimeDelta warning_time) {
  base::Time timer_start_time =
      local_state()->GetTime(prefs::kUpdateRequiredTimerStartTime);
  if (timer_start_time.is_null()) {
    local_state()->SetTime(prefs::kUpdateRequiredTimerStartTime,
                           update_required_time_);
  }
  local_state()->SetTimeDelta(prefs::kUpdateRequiredWarningPeriod,
                              warning_time);
  local_state()->CommitPendingWrite();
}

void MinimumVersionPolicyHandler::StartDeadlineTimer(base::Time deadline) {
  // Start the timer to expire when deadline is reached and the device is not
  // updated to meet the policy requirements.
  update_required_deadline_timer_.Start(
      FROM_HERE, deadline,
      base::BindOnce(&MinimumVersionPolicyHandler::OnDeadlineReached,
                     weak_factory_.GetWeakPtr()));
}

void MinimumVersionPolicyHandler::StartObservingUpdate() {
  auto* build_state = GetBuildState();
  if (!build_state->HasObserver(this))
    build_state->AddObserver(this);
}

std::optional<int> MinimumVersionPolicyHandler::GetTimeRemainingInDays() {
  const base::Time now = clock_->Now();
  if (!state_ || update_required_deadline_ <= now)
    return std::nullopt;
  base::TimeDelta time_remaining = update_required_deadline_ - now;
  return GetDaysRounded(time_remaining);
}

void MinimumVersionPolicyHandler::MaybeShowNotificationOnLogin() {
  // |days| could be null if |update_required_deadline_timer_| expired while
  // login was in progress, else we would have shown the update required screen
  // at startup.
  std::optional<int> days = GetTimeRemainingInDays();
  if (days && days.value() <= 1)
    MaybeShowNotification(base::Days(days.value()));
}

void MinimumVersionPolicyHandler::MaybeShowNotification(
    base::TimeDelta warning) {
  const NetworkStatus status = GetCurrentNetworkStatus();
  if ((!eol_reached_ && status == NetworkStatus::kAllowed) ||
      !delegate_->IsUserLoggedIn() || !IsPolicyRestrictionAppliedForUser()) {
    return;
  }

  if (!notification_handler_) {
    notification_handler_ = std::make_unique<ash::UpdateRequiredNotification>();
  }

  NotificationType type = NotificationType::kNoConnection;
  base::OnceClosure button_click_callback;
  std::string manager = GetEnterpriseManager();
  std::u16string device_type = ui::GetChromeOSDeviceName();
  auto close_callback =
      base::BindOnce(&MinimumVersionPolicyHandler::StopObservingNetwork,
                     weak_factory_.GetWeakPtr());
  if (eol_reached_) {
    VLOG(2) << "Showing end of life notification.";
    type = NotificationType::kEolReached;
    button_click_callback = base::BindOnce(&OpenEnterpriseInfoPage);
  } else if (status == NetworkStatus::kMetered) {
    VLOG(2) << "Showing metered network notification.";
    type = NotificationType::kMeteredConnection;
    button_click_callback = base::BindOnce(
        &MinimumVersionPolicyHandler::UpdateOverMeteredPermssionGranted,
        weak_factory_.GetWeakPtr());
  } else if (status == NetworkStatus::kOffline) {
    VLOG(2) << "Showing no network notification.";
    button_click_callback = base::BindOnce(&OpenNetworkSettings);
  } else {
    NOTREACHED();
  }
  notification_handler_->Show(type, warning, manager, device_type,
                              std::move(button_click_callback),
                              std::move(close_callback));

  if (!eol_reached_) {
    ash::NetworkStateHandler* network_state_handler =
        ash::NetworkHandler::Get()->network_state_handler();
    if (!network_state_handler->HasObserver(this))
      network_state_handler_observer_.Observe(network_state_handler);
  }
}

void MinimumVersionPolicyHandler::ShowAndScheduleNotification(
    base::Time deadline) {
  const base::Time now = clock_->Now();
  if (deadline <= now)
    return;

  base::Time expiry;
  base::TimeDelta time_remaining = deadline - now;
  int days_remaining = GetDaysRounded(time_remaining);

  // Network limitation notifications are shown when policy is received and on
  // the last day. End of life notifications are shown when policy is received,
  // one week before EOL and on the last day. No need to schedule a notification
  // if it is already the last day.
  if (eol_reached_ && days_remaining > kOneWeekEolNotificationInDays) {
    expiry = deadline - base::Days(kOneWeekEolNotificationInDays);
  } else if (days_remaining > 1) {
    expiry = deadline - base::Days(1);
  }

  VLOG(2) << "Next notification scheduled for " << expiry;
  MaybeShowNotification(base::Days(days_remaining));
  if (!expiry.is_null()) {
    notification_timer_.Start(
        FROM_HERE, expiry,
        base::BindOnce(
            &MinimumVersionPolicyHandler::ShowAndScheduleNotification,
            weak_factory_.GetWeakPtr(), deadline));
  }
}

void MinimumVersionPolicyHandler::OnUpdate(const BuildState* build_state) {
  // If the device has been successfully updated, the relaunch notifications
  // will reboot it for applying the updates.
  VLOG(1) << "Update installed successfully at " << clock_->Now()
          << " with deadline " << update_required_deadline_;
  UpdateEngineClient::Get()->RemoveObserver(this);
  if (build_state->update_type() == BuildState::UpdateType::kNormalUpdate) {
    ResetOnUpdateCompleted();
    OverrideRelaunchNotification(update_required_deadline_);
  }
}

void MinimumVersionPolicyHandler::HideNotification() const {
  if (notification_handler_)
    notification_handler_->Hide();
}

void MinimumVersionPolicyHandler::DefaultNetworkChanged(
    const ash::NetworkState* network) {
  // Close notification if network has switched to one that allows updates.
  const NetworkStatus status = GetCurrentNetworkStatus();
  if (status == NetworkStatus::kAllowed && notification_handler_) {
    HideNotification();
  }
}

void MinimumVersionPolicyHandler::OnShuttingDown() {
  network_state_handler_observer_.Reset();
}

void MinimumVersionPolicyHandler::StopObservingNetwork() {
  network_state_handler_observer_.Reset();
}

void MinimumVersionPolicyHandler::UpdateOverMeteredPermssionGranted() {
  VLOG(1) << "Permission for update over metered network granted.";
  UpdateEngineClient* const update_engine_client = UpdateEngineClient::Get();
  if (!update_engine_client->HasObserver(this))
    update_engine_client->AddObserver(this);
  update_engine_client->RequestUpdateCheck(
      base::BindOnce(&MinimumVersionPolicyHandler::OnUpdateCheckStarted,
                     weak_factory_.GetWeakPtr()));
}

void MinimumVersionPolicyHandler::OnUpdateCheckStarted(
    UpdateEngineClient::UpdateCheckResult result) {
  VLOG(1) << "Update check started.";
  if (result != UpdateEngineClient::UPDATE_RESULT_SUCCESS)
    UpdateEngineClient::Get()->RemoveObserver(this);
}

void MinimumVersionPolicyHandler::UpdateStatusChanged(
    const update_engine::StatusResult& status) {
  if (status.current_operation() ==
      update_engine::Operation::NEED_PERMISSION_TO_UPDATE) {
    UpdateEngineClient::Get()->SetUpdateOverCellularOneTimePermission(
        status.new_version(), status.new_size(),
        base::BindOnce(&MinimumVersionPolicyHandler::
                           OnSetUpdateOverCellularOneTimePermission,
                       weak_factory_.GetWeakPtr()));
  }
}

void MinimumVersionPolicyHandler::OnSetUpdateOverCellularOneTimePermission(
    bool success) {
  if (success)
    UpdateOverMeteredPermssionGranted();
  else
    UpdateEngineClient::Get()->RemoveObserver(this);
}

void MinimumVersionPolicyHandler::OnDeadlineReached() {
  deadline_reached_ = true;
  if (delegate_->IsLoginSessionState() && !delegate_->IsLoginInProgress()) {
    // Show update required screen over the login screen.
    delegate_->ShowUpdateRequiredScreen();
  } else if (delegate_->IsUserLoggedIn() &&
             IsPolicyRestrictionAppliedForUser()) {
    // Terminate the current user session to show update required
    // screen on the login screen if the user is managed or
    // |unmanaged_user_restricted_| is set to true.
    delegate_->RestartToLoginScreen();
  }
  // No action is required if -
  // 1) The user signed in is not managed. Once the un-managed user signs out or
  // the device is rebooted, the policy handler will be called again to show the
  // update required screen if required.
  // 2) Login is in progress. This would be handled in-session once user logs
  // in, the user would be logged out and update required screen is shown.
  // 3) Device has just been enrolled. The login screen would check and show the
  // update required screen.
}

}  // namespace policy