Switch Android ProfileSyncService to OAuth2

BUG=226469

Review URL: https://chromiumcodereview.appspot.com/17628003

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@210669 0039d316-1c4b-4281-b951-d872f2087c98

13 files changed, 213 insertions, 267 deletions

diff --git a/chrome/android/java/src/org/chromium/chrome/browser/signin/AndroidProfileOAuth2TokenServiceHelper.java b/chrome/android/java/src/org/chromium/chrome/browser/signin/AndroidProfileOAuth2TokenServiceHelper.java
new file mode 100644
index 0000000..b64f2a2
--- /dev/null
+++ b/chrome/android/java/src/org/chromium/chrome/browser/signin/AndroidProfileOAuth2TokenServiceHelper.java
@@ -0,0 +1,87 @@
+// Copyright 2013 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+package org.chromium.chrome.browser.signin;
+
+import android.accounts.Account;
+import android.content.Context;
+import android.util.Log;
+
+import com.google.common.annotations.VisibleForTesting;
+
+import org.chromium.base.CalledByNative;
+import org.chromium.base.NativeClassQualifiedName;
+import org.chromium.base.ThreadUtils;
+import org.chromium.sync.signin.AccountManagerHelper;
+
+/**
+ * Helper class for working with access tokens from native code.
+ * <p/>
+ * This class forwards calls to request or invalidate access tokens made by native code to
+ * AccountManagerHelper and forwards callbacks to native code.
+ * <p/>
+ */
+public class AndroidProfileOAuth2TokenServiceHelper {
+
+    private static final String TAG = "AndroidProfileOAuth2TokenServiceHelper";
+
+    private static final String OAUTH2_SCOPE_PREFIX = "oauth2:";
+
+    private static Account getAccountOrNullFromUsername(Context context, String username) {
+        if (username == null) {
+            Log.e(TAG, "Username is null");
+            return null;
+        }
+
+        AccountManagerHelper accountManagerHelper = AccountManagerHelper.get(context);
+        Account account = accountManagerHelper.getAccountFromName(username);
+        if (account == null) {
+            Log.e(TAG, "Account not found for provided username.");
+            return null;
+        }
+        return account;
+    }
+
+    /**
+     * Called by native to retrieve OAuth2 tokens.
+     *
+     * @param username The native username (full address).
+     * @param scope The scope to get an auth token for (without Android-style 'oauth2:' prefix).
+     * @param oldAuthToken If provided, the token will be invalidated before getting a new token.
+     * @param nativeCallback The pointer to the native callback that should be run upon completion.
+     */
+    @CalledByNative
+    public static void getOAuth2AuthToken(
+            Context context, String username, String scope, final int nativeCallback) {
+        Account account = getAccountOrNullFromUsername(context, username);
+        if (account == null) {
+            nativeOAuth2TokenFetched(null, false, nativeCallback);
+            return;
+        }
+        String oauth2Scope = OAUTH2_SCOPE_PREFIX + scope;
+
+        AccountManagerHelper accountManagerHelper = AccountManagerHelper.get(context);
+        accountManagerHelper.getAuthTokenFromForeground(
+            null, account, oauth2Scope, new AccountManagerHelper.GetAuthTokenCallback() {
+                @Override
+                public void tokenAvailable(String token) {
+                    nativeOAuth2TokenFetched(
+                        token, token != null, nativeCallback);
+                }
+            });
+    }
+
+   /**
+    * Called by native to invalidate an OAuth2 token.
+    */
+    @CalledByNative
+    public static void invalidateOAuth2AuthToken(
+            Context context, String accessToken) {
+        AccountManagerHelper.get(context).invalidateAuthToken(accessToken);
+    }
+
+    private static native void nativeOAuth2TokenFetched(
+            String authToken, boolean result, int nativeCallback);
+
+}
diff --git a/chrome/android/java/src/org/chromium/chrome/browser/sync/ProfileSyncService.java b/chrome/android/java/src/org/chromium/chrome/browser/sync/ProfileSyncService.java
index ee7c8a8..6d6890a 100644
--- a/chrome/android/java/src/org/chromium/chrome/browser/sync/ProfileSyncService.java
+++ b/chrome/android/java/src/org/chromium/chrome/browser/sync/ProfileSyncService.java
@@ -16,7 +16,6 @@ import org.chromium.chrome.browser.identity.UniqueIdentificationGenerator;
 import org.chromium.sync.internal_api.pub.SyncDecryptionPassphraseType;
 import org.chromium.sync.internal_api.pub.base.ModelType;
 import org.chromium.sync.notifier.SyncStatusHelper;
-import org.chromium.sync.signin.AccountManagerHelper;
 
 import java.util.HashSet;
 import java.util.List;
@@ -113,21 +112,22 @@ public class ProfileSyncService {
      * Signs in to sync, using the existing auth token.
      */
     public void syncSignIn(String account) {
-        syncSignInWithAuthToken(account, "");
+        nativeSignInSync(mNativeProfileSyncServiceAndroid, account);
+        // Notify listeners right away that the sync state has changed (native side does not do
+        // this)
+        syncStateChanged();
     }
 
     /**
      * Signs in to sync.
      *
      * @param account   The username of the account that is signing in.
-     * @param authToken A chromiumsync auth token for sync to use, or empty if
-     *                  sync should use its existing auth token if available.
+     * @param authToken Not used. ProfileSyncService switched to OAuth2 tokens.
+     * Deprecated. Use syncSignIn instead.
      */
+    @Deprecated
     public void syncSignInWithAuthToken(String account, String authToken) {
-        nativeSignInSync(mNativeProfileSyncServiceAndroid, account, authToken);
-        // Notify listeners right away that the sync state has changed (native side does not do
-        // this)
-        syncStateChanged();
+        syncSignIn(account);
     }
 
     public void requestSyncFromNativeChrome(String objectId, long version, String payload) {
@@ -167,84 +167,6 @@ public class ProfileSyncService {
         }
     }
 
-    private Account getAccountOrNullFromUsername(String username) {
-        if (username == null) {
-            Log.e(TAG, "username is null");
-            return null;
-        }
-
-        final AccountManagerHelper accountManagerHelper = AccountManagerHelper.get(mContext);
-        final Account account = accountManagerHelper.getAccountFromName(username);
-        if (account == null) {
-            Log.e(TAG, "Account not found for provided username.");
-            return null;
-        }
-        return account;
-    }
-
-    /**
-     * Requests a new auth token from the AccountManager. Invalidates the old token
-     * if |invalidAuthToken| is not empty.
-     */
-    @CalledByNative
-    public void getNewAuthToken(final String username, final String invalidAuthToken) {
-        final Account account = getAccountOrNullFromUsername(username);
-        if (account == null) return;
-
-        AccountManagerHelper accountManagerHelper = AccountManagerHelper.get(mContext);
-        // Invalidate our old auth token and fetch a new one.
-        accountManagerHelper.getNewAuthTokenFromForeground(
-                account, invalidAuthToken, SyncStatusHelper.AUTH_TOKEN_TYPE_SYNC,
-                new AccountManagerHelper.GetAuthTokenCallback() {
-                    @Override
-                    public void tokenAvailable(String token) {
-                        if (token == null) {
-                            Log.d(TAG, "Auth token for sync was null.");
-                        } else {
-                            Log.d(TAG, "Successfully retrieved sync auth token.");
-                            nativeTokenAvailable(mNativeProfileSyncServiceAndroid, username, token);
-                        }
-                    }
-                });
-    }
-
-   /**
-    * Called by native to invalidate an OAuth2 token.
-    */
-    @CalledByNative
-    public void invalidateOAuth2AuthToken(String scope, String accessToken) {
-        AccountManagerHelper.get(mContext).invalidateAuthToken(scope, accessToken);
-    }
-
-    /**
-     * Called by native to retrieve OAuth2 tokens.
-     *
-     * @param username the native username (full address)
-     * @param scope the scope to get an auth token for (without Android-style 'oauth2:' prefix).
-     * @param oldAuthToken if provided, the token will be invalidated before getting a new token.
-     * @param nativeCallback the pointer to the native callback that should be run upon completion.
-     */
-    @CalledByNative
-    public void getOAuth2AuthToken(String username, String scope, final int nativeCallback) {
-        final Account account = getAccountOrNullFromUsername(username);
-        if (account == null) {
-            nativeOAuth2TokenFetched(
-                mNativeProfileSyncServiceAndroid, nativeCallback, null, false);
-            return;
-        }
-        final String oauth2Scope = "oauth2:" + scope;
-
-        AccountManagerHelper accountManagerHelper = AccountManagerHelper.get(mContext);
-        accountManagerHelper.getAuthTokenFromForeground(
-                null, account, oauth2Scope, new AccountManagerHelper.GetAuthTokenCallback() {
-                    @Override
-                    public void tokenAvailable(String token) {
-                        nativeOAuth2TokenFetched(
-                            mNativeProfileSyncServiceAndroid, nativeCallback, token, token != null);
-                    }
-                });
-    }
-
     /**
      * Checks if a password or a passphrase is required for decryption of sync data.
      * <p/>
@@ -563,7 +485,7 @@ public class ProfileSyncService {
     private native void nativeEnableSync(int nativeProfileSyncServiceAndroid);
     private native void nativeDisableSync(int nativeProfileSyncServiceAndroid);
     private native void nativeSignInSync(
-            int nativeProfileSyncServiceAndroid, String username, String authToken);
+            int nativeProfileSyncServiceAndroid, String username);
     private native void nativeSignOutSync(int nativeProfileSyncServiceAndroid);
     private native void nativeTokenAvailable(
             int nativeProfileSyncServiceAndroid, String username, String authToken);
@@ -606,7 +528,4 @@ public class ProfileSyncService {
     private native boolean nativeHasKeepEverythingSynced(int nativeProfileSyncServiceAndroid);
     private native boolean nativeHasUnrecoverableError(int nativeProfileSyncServiceAndroid);
     private native String nativeGetAboutInfoForTest(int nativeProfileSyncServiceAndroid);
-    private native void nativeOAuth2TokenFetched(
-            int nativeProfileSyncServiceAndroid, int nativeCallback, String authToken,
-            boolean result);
 }
diff --git a/chrome/browser/android/chrome_jni_registrar.cc b/chrome/browser/android/chrome_jni_registrar.cc
index 379c23d..022485e 100644
--- a/chrome/browser/android/chrome_jni_registrar.cc
+++ b/chrome/browser/android/chrome_jni_registrar.cc
@@ -20,6 +20,7 @@
 #include "chrome/browser/lifetime/application_lifetime_android.h"
 #include "chrome/browser/profiles/profile_android.h"
 #include "chrome/browser/search_engines/template_url_service_android.h"
+#include "chrome/browser/signin/android_profile_oauth2_token_service.h"
 #include "chrome/browser/speech/tts_android.h"
 #include "chrome/browser/sync/profile_sync_service_android.h"
 #include "chrome/browser/ui/android/autofill/autofill_dialog_view_android.h"
@@ -47,6 +48,8 @@ static base::android::RegistrationMethod kChromeRegisteredMethods[] = {
     web_contents_delegate_android::RegisterWebContentsDelegateAndroidJni },
   { "RegisterAuxiliaryProfileLoader", autofill::RegisterAutofillAndroidJni },
   // Register JNI for chrome classes.
+  { "AndroidProfileOAuth2TokenService",
+    AndroidProfileOAuth2TokenService::Register },
   { "ApplicationLifetime", RegisterApplicationLifetimeAndroid },
   { "AutofillDialog",
     autofill::AutofillDialogViewAndroid::RegisterAutofillDialogViewAndroid },
diff --git a/chrome/browser/android/chrome_startup_flags.cc b/chrome/browser/android/chrome_startup_flags.cc
index 8d0b2fe..b789424 100644
--- a/chrome/browser/android/chrome_startup_flags.cc
+++ b/chrome/browser/android/chrome_startup_flags.cc
@@ -36,10 +36,6 @@ void SetChromeSpecificCommandLineFlags() {
   // Turn on autologin.
   SetCommandLineSwitch(switches::kEnableAutologin);
 
-  // Use ClientLogin token on android.
-  // TODO(pavely): Remove once sync on android uses oauth2 tokens.
-  SetCommandLineSwitch(switches::kSyncDisableOAuth2Token);
-
   // Enable prerender for the omnibox.
   SetCommandLineSwitchASCII(
       switches::kPrerenderMode, switches::kPrerenderModeSwitchValueEnabled);
diff --git a/chrome/browser/signin/android_profile_oauth2_token_service.cc b/chrome/browser/signin/android_profile_oauth2_token_service.cc
index c013185..cb225bf 100644
--- a/chrome/browser/signin/android_profile_oauth2_token_service.cc
+++ b/chrome/browser/signin/android_profile_oauth2_token_service.cc
@@ -4,11 +4,23 @@
 
 #include "chrome/browser/signin/android_profile_oauth2_token_service.h"
 
+#include "base/android/jni_android.h"
+#include "base/android/jni_string.h"
 #include "base/bind.h"
+#include "chrome/browser/signin/signin_manager.h"
+#include "chrome/browser/signin/signin_manager_factory.h"
 #include "chrome/browser/sync/profile_sync_service_android.h"
 #include "content/public/browser/browser_thread.h"
+#include "jni/AndroidProfileOAuth2TokenServiceHelper_jni.h"
 #include "net/url_request/url_request_context_getter.h"
 
+using base::android::AttachCurrentThread;
+using base::android::CheckException;
+using base::android::ConvertJavaStringToUTF8;
+using base::android::ConvertUTF8ToJavaString;
+using base::android::ScopedJavaLocalRef;
+using content::BrowserThread;
+
 AndroidProfileOAuth2TokenService::AndroidProfileOAuth2TokenService(
     net::URLRequestContextGetter* getter)
     : ProfileOAuth2TokenService(getter) {
@@ -29,27 +41,31 @@ scoped_ptr<OAuth2TokenService::Request>
   scoped_ptr<RequestImpl> request(new RequestImpl(consumer));
   DCHECK_EQ(scopes.size(), 1U);
   std::vector<std::string> scope_list(scopes.begin(), scopes.end());
-  ProfileSyncServiceAndroid* sync_service =
-      ProfileSyncServiceAndroid::GetProfileSyncServiceAndroid();
-  sync_service->FetchOAuth2Token(
+  FetchOAuth2Token(
       scope_list.front(),
-      base::Bind(&RequestImpl::InformConsumer,
-                 request->AsWeakPtr()));
+      base::Bind(&RequestImpl::InformConsumer, request->AsWeakPtr()));
   return request.PassAs<Request>();
 }
 
+bool AndroidProfileOAuth2TokenService::RefreshTokenIsAvailable() {
+  SigninManagerBase* signin_manager =
+      SigninManagerFactory::GetForProfile(profile());
+  return !signin_manager->GetAuthenticatedUsername().empty();
+}
+
 void AndroidProfileOAuth2TokenService::InvalidateToken(
     const ScopeSet& scopes,
     const std::string& invalid_token) {
   OAuth2TokenService::InvalidateToken(scopes, invalid_token);
 
   DCHECK_EQ(scopes.size(), 1U);
-  std::vector<std::string> scope_list(scopes.begin(), scopes.end());
-  ProfileSyncServiceAndroid* sync_service =
-      ProfileSyncServiceAndroid::GetProfileSyncServiceAndroid();
-  sync_service->InvalidateOAuth2Token(
-      scope_list.front(),
-      invalid_token);
+
+  JNIEnv* env = AttachCurrentThread();
+  ScopedJavaLocalRef<jstring> j_invalid_token =
+      ConvertUTF8ToJavaString(env, invalid_token);
+  Java_AndroidProfileOAuth2TokenServiceHelper_invalidateOAuth2AuthToken(
+      env, base::android::GetApplicationContext(),
+      j_invalid_token.obj());
 }
 
 bool AndroidProfileOAuth2TokenService::ShouldCacheForRefreshToken(
@@ -60,3 +76,52 @@ bool AndroidProfileOAuth2TokenService::ShouldCacheForRefreshToken(
   // this concept doesn't exist and we can simply always cache.
   return true;
 }
+
+void AndroidProfileOAuth2TokenService::FetchOAuth2Token(
+    const std::string& scope, const FetchOAuth2TokenCallback& callback) {
+  const std::string& sync_username =
+      SigninManagerFactory::GetForProfile(profile())->
+          GetAuthenticatedUsername();
+
+  JNIEnv* env = AttachCurrentThread();
+  ScopedJavaLocalRef<jstring> j_sync_username =
+      ConvertUTF8ToJavaString(env, sync_username);
+  ScopedJavaLocalRef<jstring> j_scope =
+      ConvertUTF8ToJavaString(env, scope);
+
+  // Allocate a copy of the callback on the heap, because the callback
+  // needs to be passed through JNI as an int.
+  // It will be passed back to OAuth2TokenFetched(), where it will be freed.
+  scoped_ptr<FetchOAuth2TokenCallback> heap_callback(
+      new FetchOAuth2TokenCallback(callback));
+
+  // Call into Java to get a new token.
+  Java_AndroidProfileOAuth2TokenServiceHelper_getOAuth2AuthToken(
+      env, base::android::GetApplicationContext(),
+      j_sync_username.obj(),
+      j_scope.obj(),
+      reinterpret_cast<int>(heap_callback.release()));
+}
+
+// Called from Java when fetching of an OAuth2 token is finished. The
+// |authToken| param is only valid when |result| is true.
+void OAuth2TokenFetched(JNIEnv* env, jclass clazz,
+    jstring authToken,
+    jboolean result,
+    jint nativeCallback) {
+  std::string token = ConvertJavaStringToUTF8(env, authToken);
+  scoped_ptr<AndroidProfileOAuth2TokenService::FetchOAuth2TokenCallback>
+      heap_callback(
+          reinterpret_cast<
+              AndroidProfileOAuth2TokenService::FetchOAuth2TokenCallback*>(
+                  nativeCallback));
+  GoogleServiceAuthError err(result ?
+                             GoogleServiceAuthError::NONE :
+                             GoogleServiceAuthError::INVALID_GAIA_CREDENTIALS);
+  heap_callback->Run(err, token, base::Time());
+}
+
+// static
+bool AndroidProfileOAuth2TokenService::Register(JNIEnv* env) {
+  return RegisterNativesImpl(env);
+}
diff --git a/chrome/browser/signin/android_profile_oauth2_token_service.h b/chrome/browser/signin/android_profile_oauth2_token_service.h
index 14556c03..e792eeb 100644
--- a/chrome/browser/signin/android_profile_oauth2_token_service.h
+++ b/chrome/browser/signin/android_profile_oauth2_token_service.h
@@ -5,9 +5,14 @@
 #ifndef CHROME_BROWSER_SIGNIN_ANDROID_PROFILE_OAUTH2_TOKEN_SERVICE_H_
 #define CHROME_BROWSER_SIGNIN_ANDROID_PROFILE_OAUTH2_TOKEN_SERVICE_H_
 
+#include <jni.h>
 #include <string>
 
+#include "base/android/jni_helper.h"
+#include "base/callback.h"
+#include "base/time/time.h"
 #include "chrome/browser/signin/profile_oauth2_token_service.h"
+#include "google_apis/gaia/google_service_auth_error.h"
 
 namespace net {
 class URLRequestContextGetter;
@@ -15,6 +20,7 @@ class URLRequestContextGetter;
 
 class TokenService;
 
+
 // A specialization of ProfileOAuth2TokenService that will be returned by
 // ProfileOAuth2TokenServiceFactory for OS_ANDROID.  This instance uses
 // native Android features to lookup OAuth2 tokens.
@@ -25,15 +31,31 @@ class TokenService;
 // request from other thread, please use ProfileOAuth2TokenServiceRequest.
 class AndroidProfileOAuth2TokenService : public ProfileOAuth2TokenService {
  public:
+
+  // Callback from FetchOAuth2Token.
+  // Arguments:
+  // - the error, or NONE if the token fetch was successful.
+  // - the OAuth2 access token.
+  // - the expiry time of the token (may be null, indicating that the expiry
+  //   time is unknown.
+  typedef base::Callback<void(
+      const GoogleServiceAuthError&, const std::string&, const base::Time&)>
+          FetchOAuth2TokenCallback;
+
   // Start the OAuth2 access token for the given scopes using
   // ProfileSyncServiceAndroid.
   virtual scoped_ptr<OAuth2TokenService::Request> StartRequest(
       const OAuth2TokenService::ScopeSet& scopes,
       OAuth2TokenService::Consumer* consumer) OVERRIDE;
 
+  virtual bool RefreshTokenIsAvailable() OVERRIDE;
   virtual void InvalidateToken(const ScopeSet& scopes,
                                const std::string& invalid_token) OVERRIDE;
 
+  // Registers the AndroidProfileOAuth2TokenService's native methods through
+  // JNI.
+  static bool Register(JNIEnv* env);
+
  protected:
   friend class ProfileOAuth2TokenServiceFactory;
   explicit AndroidProfileOAuth2TokenService(
@@ -44,6 +66,9 @@ class AndroidProfileOAuth2TokenService : public ProfileOAuth2TokenService {
   bool ShouldCacheForRefreshToken(TokenService *token_service,
                                   const std::string& refresh_token);
 
+  void FetchOAuth2Token(const std::string& scope,
+                        const FetchOAuth2TokenCallback& callback);
+
  private:
   DISALLOW_COPY_AND_ASSIGN(AndroidProfileOAuth2TokenService);
 };
diff --git a/chrome/browser/signin/oauth2_token_service.h b/chrome/browser/signin/oauth2_token_service.h
index 7f04269..f961505 100644
--- a/chrome/browser/signin/oauth2_token_service.h
+++ b/chrome/browser/signin/oauth2_token_service.h
@@ -119,7 +119,7 @@ class OAuth2TokenService {
 
   // Returns true if a refresh token exists. If false, calls to
   // |StartRequest| will result in a Consumer::OnGetTokenFailure callback.
-  bool RefreshTokenIsAvailable();
+  virtual bool RefreshTokenIsAvailable();
 
   // Mark an OAuth2 access token as invalid. This should be done if the token
   // was received from this class, but was not accepted by the server (e.g.,
diff --git a/chrome/browser/signin/profile_oauth2_token_service.h b/chrome/browser/signin/profile_oauth2_token_service.h
index 8e541dc..d5cbe9f 100644
--- a/chrome/browser/signin/profile_oauth2_token_service.h
+++ b/chrome/browser/signin/profile_oauth2_token_service.h
@@ -68,6 +68,8 @@ class ProfileOAuth2TokenService : public OAuth2TokenService,
     return signin_global_error_.get();
   }
 
+  Profile* profile() const { return profile_; }
+
  protected:
   friend class ProfileOAuth2TokenServiceFactory;
   explicit ProfileOAuth2TokenService(net::URLRequestContextGetter* getter);
diff --git a/chrome/browser/sync/profile_sync_service.cc b/chrome/browser/sync/profile_sync_service.cc
index 1d5adc1..49cac84 100644
--- a/chrome/browser/sync/profile_sync_service.cc
+++ b/chrome/browser/sync/profile_sync_service.cc
@@ -111,14 +111,6 @@ const char* ProfileSyncService::kDevServerUrl =
 
 static const int kSyncClearDataTimeoutInSeconds = 60;  // 1 minute.
 
-static const char* kOAuth2Scopes[] = {
-  GaiaConstants::kChromeSyncOAuth2Scope,
-};
-
-static const char* kManagedOAuth2Scopes[] = {
-  GaiaConstants::kChromeSyncManagedOAuth2Scope
-};
-
 static const char* kSyncUnrecoverableErrorHistogram =
     "Sync.UnrecoverableErrors";
 
@@ -1815,18 +1807,17 @@ void ProfileSyncService::RequestAccessToken() {
   is_managed = ManagedUserService::ProfileIsManaged(profile_);
 #endif
   if (is_managed) {
-    for (size_t i = 0; i < arraysize(kManagedOAuth2Scopes); i++)
-      oauth2_scopes.insert(kManagedOAuth2Scopes[i]);
+    oauth2_scopes.insert(GaiaConstants::kChromeSyncManagedOAuth2Scope);
   } else {
-    for (size_t i = 0; i < arraysize(kOAuth2Scopes); i++)
-      oauth2_scopes.insert(kOAuth2Scopes[i]);
+    oauth2_scopes.insert(GaiaConstants::kChromeSyncOAuth2Scope);
   }
 
   OAuth2TokenService* token_service =
       ProfileOAuth2TokenServiceFactory::GetForProfile(profile_);
   // Invalidate previous token, otherwise token service will return the same
   // token again.
-  token_service->InvalidateToken(oauth2_scopes, access_token_);
+  if (!access_token_.empty())
+    token_service->InvalidateToken(oauth2_scopes, access_token_);
   access_token_.clear();
   access_token_request_ = token_service->StartRequest(oauth2_scopes, this);
 }
diff --git a/chrome/browser/sync/profile_sync_service_android.cc b/chrome/browser/sync/profile_sync_service_android.cc
index 7886477..62eb01f 100644
--- a/chrome/browser/sync/profile_sync_service_android.cc
+++ b/chrome/browser/sync/profile_sync_service_android.cc
@@ -82,20 +82,6 @@ ProfileSyncServiceAndroid::ProfileSyncServiceAndroid(JNIEnv* env, jobject obj)
 
 void ProfileSyncServiceAndroid::Init() {
   sync_service_->AddObserver(this);
-
-  std::string signed_in_username =
-      SigninManagerFactory::GetForProfile(profile_)->GetAuthenticatedUsername();
-  if (!signed_in_username.empty()) {
-    // If the user is logged in, see if he has a valid token - if not, fetch
-    // a new one.
-    TokenService* token_service = TokenServiceFactory::GetForProfile(profile_);
-    if (!token_service->HasTokenForService(GaiaConstants::kSyncService) ||
-        (sync_service_->GetAuthError().state() ==
-         GoogleServiceAuthError::INVALID_GAIA_CREDENTIALS)) {
-      DVLOG(2) << "Trying to update token for user " << signed_in_username;
-      InvalidateAuthToken();
-    }
-  }
 }
 
 void ProfileSyncServiceAndroid::RemoveObserver() {
@@ -152,15 +138,7 @@ void ProfileSyncServiceAndroid::SendNudgeNotification(
           &model_types_with_states));
 }
 
-
 void ProfileSyncServiceAndroid::OnStateChanged() {
-  // Check for auth errors.
-  const GoogleServiceAuthError& auth_error = sync_service_->GetAuthError();
-  if (auth_error.state() == GoogleServiceAuthError::INVALID_GAIA_CREDENTIALS) {
-      DVLOG(2) << "Updating auth token.";
-      InvalidateAuthToken();
-  }
-
   // Notify the java world that our sync state has changed.
   JNIEnv* env = AttachCurrentThread();
   Java_ProfileSyncService_syncStateChanged(
@@ -174,55 +152,6 @@ void ProfileSyncServiceAndroid::TokenAvailable(
       GaiaConstants::kSyncService, token);
 }
 
-void ProfileSyncServiceAndroid::InvalidateOAuth2Token(
-    const std::string& scope, const std::string& invalid_token) {
-  JNIEnv* env = AttachCurrentThread();
-  ScopedJavaLocalRef<jstring> j_scope =
-      ConvertUTF8ToJavaString(env, scope);
-  ScopedJavaLocalRef<jstring> j_invalid_token =
-      ConvertUTF8ToJavaString(env, invalid_token);
-  Java_ProfileSyncService_invalidateOAuth2AuthToken(
-      env, weak_java_profile_sync_service_.get(env).obj(),
-      j_scope.obj(),
-      j_invalid_token.obj());
-}
-
-void ProfileSyncServiceAndroid::FetchOAuth2Token(
-    const std::string& scope, const FetchOAuth2TokenCallback& callback) {
-  const std::string& sync_username =
-      SigninManagerFactory::GetForProfile(profile_)->GetAuthenticatedUsername();
-
-  JNIEnv* env = AttachCurrentThread();
-  ScopedJavaLocalRef<jstring> j_sync_username =
-      ConvertUTF8ToJavaString(env, sync_username);
-  ScopedJavaLocalRef<jstring> j_scope =
-      ConvertUTF8ToJavaString(env, scope);
-
-  // Allocate a copy of the callback on the heap, because the callback
-  // needs to be passed through JNI as an int.
-  // It will be passed back to OAuth2TokenFetched(), where it will be freed.
-  scoped_ptr<FetchOAuth2TokenCallback> heap_callback(
-      new FetchOAuth2TokenCallback(callback));
-
-  // Call into Java to get a new token.
-  Java_ProfileSyncService_getOAuth2AuthToken(
-      env, weak_java_profile_sync_service_.get(env).obj(),
-      j_sync_username.obj(),
-      j_scope.obj(),
-      reinterpret_cast<int>(heap_callback.release()));
-}
-
-void ProfileSyncServiceAndroid::OAuth2TokenFetched(
-    JNIEnv* env, jobject, int callback, jstring auth_token, jboolean result) {
-  std::string token = ConvertJavaStringToUTF8(env, auth_token);
-  scoped_ptr<FetchOAuth2TokenCallback> heap_callback(
-      reinterpret_cast<FetchOAuth2TokenCallback*>(callback));
-  GoogleServiceAuthError err(result ?
-                             GoogleServiceAuthError::NONE :
-                             GoogleServiceAuthError::INVALID_GAIA_CREDENTIALS);
-  heap_callback->Run(err, token, base::Time());
-}
-
 void ProfileSyncServiceAndroid::EnableSync(JNIEnv* env, jobject) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   // Don't need to do anything if we're already enabled.
@@ -244,7 +173,7 @@ void ProfileSyncServiceAndroid::DisableSync(JNIEnv* env, jobject) {
 }
 
 void ProfileSyncServiceAndroid::SignInSync(
-    JNIEnv* env, jobject, jstring username, jstring auth_token) {
+    JNIEnv* env, jobject, jstring username) {
   DCHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
   // Just return if sync already has everything it needs to start up (sync
   // should start up automatically as long as it has credentials). This can
@@ -267,22 +196,6 @@ void ProfileSyncServiceAndroid::SignInSync(
     profile_->GetPrefs()->SetString(prefs::kGoogleServicesUsername, name);
     SigninManagerFactory::GetForProfile(profile_)->
         SetAuthenticatedUsername(name);
-    std::string token = ConvertJavaStringToUTF8(env, auth_token);
-    if (token.empty()) {
-      // No credentials passed in - request an auth token.
-      // If fetching the auth token is successful, this will cause
-      // ProfileSyncService to start sync when it receives
-      // NOTIFICATION_TOKEN_AVAILABLE.
-      DVLOG(2) << "Fetching auth token for " << name;
-      InvalidateAuthToken();
-    } else {
-      // OnIssueAuthTokenSuccess will send out a notification to the sync
-      // service that will cause the sync backend to initialize.
-      TokenService* token_service =
-          TokenServiceFactory::GetForProfile(profile_);
-      token_service->OnIssueAuthTokenSuccess(GaiaConstants::kSyncService,
-                                             token);
-    }
 
     GoogleServiceSigninSuccessDetails details(name, std::string());
     content::NotificationService::current()->Notify(
@@ -592,29 +505,6 @@ ScopedJavaLocalRef<jstring> ProfileSyncServiceAndroid::GetAboutInfoForTest(
   return ConvertUTF8ToJavaString(env, about_info_json);
 }
 
-void ProfileSyncServiceAndroid::InvalidateAuthToken() {
-  // Get the token from token-db. If there's no token yet, this must be the
-  // the first time the user is signing in so we don't need to invalidate
-  // anything.
-  TokenService* token_service = TokenServiceFactory::GetForProfile(profile_);
-  std::string invalid_token;
-  if (token_service->HasTokenForService(GaiaConstants::kSyncService)) {
-    invalid_token = token_service->GetTokenForService(
-        GaiaConstants::kSyncService);
-  }
-  const std::string& sync_username =
-      SigninManagerFactory::GetForProfile(profile_)->GetAuthenticatedUsername();
-  // Call into java to invalidate the current token and get a new one.
-  JNIEnv* env = AttachCurrentThread();
-  ScopedJavaLocalRef<jstring> j_sync_username =
-      ConvertUTF8ToJavaString(env, sync_username);
-  ScopedJavaLocalRef<jstring> j_invalid_token =
-      ConvertUTF8ToJavaString(env, invalid_token);
-  Java_ProfileSyncService_getNewAuthToken(
-      env, weak_java_profile_sync_service_.get(env).obj(),
-      j_sync_username.obj(), j_invalid_token.obj());
-}
-
 void ProfileSyncServiceAndroid::NudgeSyncer(JNIEnv* env,
                                             jobject obj,
                                             jstring objectId,
diff --git a/chrome/browser/sync/profile_sync_service_android.h b/chrome/browser/sync/profile_sync_service_android.h
index b8027b4..c364061 100644
--- a/chrome/browser/sync/profile_sync_service_android.h
+++ b/chrome/browser/sync/profile_sync_service_android.h
@@ -27,15 +27,6 @@ class ProfileSyncService;
 // This class should only be accessed from the UI thread.
 class ProfileSyncServiceAndroid : public ProfileSyncServiceObserver {
  public:
-  // Callback from FetchOAuth2Token.
-  // Arguments:
-  // - the error, or NONE if the token fetch was successful.
-  // - the OAuth2 access token.
-  // - the expiry time of the token (may be null, indicating that the expiry
-  //   time is unknown.
-  typedef base::Callback<void(
-      const GoogleServiceAuthError&,const std::string&,const base::Time&)>
-          FetchOAuth2TokenCallback;
 
   ProfileSyncServiceAndroid(JNIEnv* env, jobject obj);
 
@@ -58,12 +49,8 @@ class ProfileSyncServiceAndroid : public ProfileSyncServiceObserver {
   // Called from Java when the user manually disables sync
   void DisableSync(JNIEnv* env, jobject obj);
 
-  // Called from Java when the user signs in to Chrome. Starts up sync, and
-  // if auth credentials are required, uses the passed |auth_token|. If
-  // |auth_token| is empty, a new |auth_token| is requested from the UI thread
-  // via a call to InvalidateAuthToken().
-  void SignInSync(JNIEnv* env, jobject obj, jstring username,
-                  jstring auth_token);
+  // Called from Java when the user signs in to Chrome. Starts up sync.
+  void SignInSync(JNIEnv* env, jobject obj, jstring username);
 
   // Called from Java when the user signs out of Chrome
   void SignOutSync(JNIEnv* env, jobject obj);
@@ -199,25 +186,6 @@ class ProfileSyncServiceAndroid : public ProfileSyncServiceObserver {
   // (GoogleServiceAuthError.State).
   jint GetAuthError(JNIEnv* env, jobject obj);
 
-  // Called by native to invalidate an OAuth2 token, e.g. after a 401 response
-  // from the server. This should be done before fetching a new token.
-  void InvalidateOAuth2Token(const std::string& scope,
-                             const std::string& invalid_auth_token);
-
-  // Called by native when an OAuth2 token is required. |invalid_auth_token|
-  // is an old auth token to be invalidated (may be empty). |callback| will be
-  // invoked asynchronously after a new token has been fetched.
-  void FetchOAuth2Token(const std::string& scope,
-                        const FetchOAuth2TokenCallback& callback);
-
-  // Called from Java when fetching of an OAuth2 token is finished. The
-  // |authToken| param is only valid when |result| is true.
-  void OAuth2TokenFetched(JNIEnv* env,
-                          jobject obj,
-                          int callback,
-                          jstring auth_token,
-                          jboolean result);
-
   // ProfileSyncServiceObserver:
   virtual void OnStateChanged() OVERRIDE;
 
@@ -230,7 +198,6 @@ class ProfileSyncServiceAndroid : public ProfileSyncServiceObserver {
   virtual ~ProfileSyncServiceAndroid();
   // Remove observers to profile sync service.
   void RemoveObserver();
-  void InvalidateAuthToken();
   // Called from Java when we need to nudge native syncer. The |objectId|,
   // |version| and |payload| values should come from an invalidation.
   void SendNudgeNotification(const std::string& str_object_id,
diff --git a/chrome/chrome_browser.gypi b/chrome/chrome_browser.gypi
index f456632..4b434cf 100644
--- a/chrome/chrome_browser.gypi
+++ b/chrome/chrome_browser.gypi
@@ -3330,6 +3330,7 @@
             'android/java/src/org/chromium/chrome/browser/profiles/Profile.java',
             'android/java/src/org/chromium/chrome/browser/SSLClientCertificateRequest.java',
             'android/java/src/org/chromium/chrome/browser/search_engines/TemplateUrlService.java',
+            'android/java/src/org/chromium/chrome/browser/signin/AndroidProfileOAuth2TokenServiceHelper.java',
             'android/java/src/org/chromium/chrome/browser/sync/ProfileSyncService.java',
             'android/java/src/org/chromium/chrome/browser/TabBase.java',
             'android/java/src/org/chromium/chrome/browser/TtsPlatformImpl.java',
diff --git a/sync/android/java/src/org/chromium/sync/signin/AccountManagerHelper.java b/sync/android/java/src/org/chromium/sync/signin/AccountManagerHelper.java
index ce3e171..3ed9a22 100644
--- a/sync/android/java/src/org/chromium/sync/signin/AccountManagerHelper.java
+++ b/sync/android/java/src/org/chromium/sync/signin/AccountManagerHelper.java
@@ -323,7 +323,7 @@ public class AccountManagerHelper {
     /**
      * Removes an auth token from the AccountManager's cache.
      */
-    public void invalidateAuthToken(String accountType, String authToken) {
-        mAccountManager.invalidateAuthToken(accountType, authToken);
+    public void invalidateAuthToken(String authToken) {
+        mAccountManager.invalidateAuthToken(GOOGLE_ACCOUNT_TYPE, authToken);
     }
 }