Add enterprise policy to turn off Web Bluetooth.

Organizations will be able to set "DefaultWebBluetoothGuardSetting" to '2' to prevent their users from using Web Bluetooth at all, or '3' to explicitly leave the setting at the default "ask" value. There is no "allow" option, because it wouldn't specify which device to select from the chooser.

BUG=562592
TEST=On ChromeOS, Android, Mac, and Windows 8.1, run the following steps with 3 different enterprise policy settings. Note that the test machine needs Bluetooth 4 support, and Bluetooth has to be turned on. If it's not, you'll get a "Bluetooth adapter not available." error, and won't have tested this patch.
1) Run chrome with the --enable-web-bluetooth flag.
2) Visit https://googlechrome.github.io/samples/web-bluetooth/device-info.html
3) Type "Test" into the "Device Name Prefix" text box (the third).
4) Press the "Get Bluetooth Device Info" button.

Enterprise policy A: 'DefaultWebBluetoothGuardSetting' unset. A dialog saying "https://googlechrome.github.io wants to pair with" should appear. Click 'Cancel' or outside the dialog to close it.

Enterprise policy B: 'DefaultWebBluetoothGuardSetting' set to 2. No dialog appears, and the "Live Output" box says "Argh! NotFoundError: User or their enterprise policy has disabled Web Bluetooth globally."

Enterprise policy C: 'DefaultWebBluetoothGuardSetting' set to 3. A dialog saying "https://googlechrome.github.io wants to pair with" should appear. Click 'Cancel' or outside the dialog to close it.

Review URL: https://codereview.chromium.org/1706503002

Cr-Commit-Position: refs/heads/master@{#377959}

20 files changed, 200 insertions, 16 deletions

diff --git a/chrome/browser/chrome_content_browser_client.cc b/chrome/browser/chrome_content_browser_client.cc
index b85bffd..3e884bb 100644
--- a/chrome/browser/chrome_content_browser_client.cc
+++ b/chrome/browser/chrome_content_browser_client.cc
@@ -110,6 +110,7 @@
 #include "components/content_settings/core/browser/cookie_settings.h"
 #include "components/content_settings/core/browser/host_content_settings_map.h"
 #include "components/content_settings/core/common/content_settings.h"
+#include "components/content_settings/core/common/content_settings_types.h"
 #include "components/data_reduction_proxy/content/browser/data_reduction_proxy_message_filter.h"
 #include "components/dom_distiller/core/dom_distiller_switches.h"
 #include "components/dom_distiller/core/url_constants.h"
@@ -163,6 +164,8 @@
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/base/resource/resource_bundle.h"
 #include "ui/resources/grit/ui_resources.h"
+#include "url/gurl.h"
+#include "url/origin.h"
 
 #if defined(OS_WIN)
 #include "base/strings/string_tokenizer.h"
@@ -1988,6 +1991,21 @@ bool ChromeContentBrowserClient::AllowKeygen(
          CONTENT_SETTING_ALLOW;
 }
 
+bool ChromeContentBrowserClient::AllowWebBluetooth(
+    content::BrowserContext* browser_context,
+    const url::Origin& requesting_origin,
+    const url::Origin& embedding_origin) {
+  const HostContentSettingsMap* const content_settings =
+      HostContentSettingsMapFactory::GetForProfile(
+          Profile::FromBrowserContext(browser_context));
+
+  return content_settings->GetContentSetting(
+             GURL(requesting_origin.Serialize()),
+             GURL(embedding_origin.Serialize()),
+             CONTENT_SETTINGS_TYPE_BLUETOOTH_GUARD,
+             std::string()) != CONTENT_SETTING_BLOCK;
+}
+
 net::URLRequestContext*
 ChromeContentBrowserClient::OverrideRequestContextForURL(
     const GURL& url, content::ResourceContext* context) {
diff --git a/chrome/browser/chrome_content_browser_client.h b/chrome/browser/chrome_content_browser_client.h
index f969305..d8ccfa8 100644
--- a/chrome/browser/chrome_content_browser_client.h
+++ b/chrome/browser/chrome_content_browser_client.h
@@ -172,6 +172,9 @@ class ChromeContentBrowserClient : public content::ContentBrowserClient {
 #endif  // defined(ENABLE_WEBRTC)
 
   bool AllowKeygen(const GURL& url, content::ResourceContext* context) override;
+  bool AllowWebBluetooth(content::BrowserContext* browser_context,
+                         const url::Origin& requesting_origin,
+                         const url::Origin& embedding_origin) override;
 
   net::URLRequestContext* OverrideRequestContextForURL(
       const GURL& url,
diff --git a/chrome/browser/policy/configuration_policy_handler_list_factory.cc b/chrome/browser/policy/configuration_policy_handler_list_factory.cc
index c8bfa33..5ee927f 100644
--- a/chrome/browser/policy/configuration_policy_handler_list_factory.cc
+++ b/chrome/browser/policy/configuration_policy_handler_list_factory.cc
@@ -329,6 +329,9 @@ const PolicyToPreferenceMapEntry kSimplePolicyMap[] = {
   { key::kRestrictSigninToPattern,
     prefs::kGoogleServicesUsernamePattern,
     base::Value::TYPE_STRING },
+  { key::kDefaultWebBluetoothGuardSetting,
+    prefs::kManagedDefaultWebBluetoothGuardSetting,
+    base::Value::TYPE_INTEGER },
   { key::kDefaultMediaStreamSetting,
     prefs::kManagedDefaultMediaStreamSetting,
     base::Value::TYPE_INTEGER },
diff --git a/chrome/browser/policy/policy_browsertest.cc b/chrome/browser/policy/policy_browsertest.cc
index df2ca80..9a88dc6 100644
--- a/chrome/browser/policy/policy_browsertest.cc
+++ b/chrome/browser/policy/policy_browsertest.cc
@@ -141,6 +141,7 @@
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_constants.h"
 #include "content/public/common/content_paths.h"
+#include "content/public/common/content_switches.h"
 #include "content/public/common/process_type.h"
 #include "content/public/common/result_codes.h"
 #include "content/public/common/url_constants.h"
@@ -150,6 +151,8 @@
 #include "content/public/test/mock_notification_observer.h"
 #include "content/public/test/test_navigation_observer.h"
 #include "content/public/test/test_utils.h"
+#include "device/bluetooth/bluetooth_adapter_factory.h"
+#include "device/bluetooth/test/mock_bluetooth_adapter.h"
 #include "extensions/browser/extension_dialog_auto_confirm.h"
 #include "extensions/browser/extension_host.h"
 #include "extensions/browser/extension_prefs.h"
@@ -181,6 +184,7 @@
 #include "ui/base/page_transition_types.h"
 #include "ui/base/resource/resource_bundle.h"
 #include "url/gurl.h"
+#include "url/origin.h"
 
 #if defined(OS_CHROMEOS)
 #include "ash/accelerators/accelerator_controller.h"
@@ -3653,6 +3657,53 @@ INSTANTIATE_TEST_CASE_P(MediaStreamDevicesControllerBrowserTestInstance,
                         MediaStreamDevicesControllerBrowserTest,
                         testing::Bool());
 
+class WebBluetoothPolicyTest : public PolicyTest {
+  void SetUpCommandLine(base::CommandLine* command_line)override {
+    // This is needed while Web Bluetooth is an Origin Trial, but can go away
+    // once it ships globally.
+    command_line->AppendSwitch(switches::kEnableWebBluetooth);
+    PolicyTest::SetUpCommandLine(command_line);
+  }
+};
+
+IN_PROC_BROWSER_TEST_F(WebBluetoothPolicyTest, Block) {
+  // Fake the BluetoothAdapter to say it's present.
+  scoped_refptr<device::MockBluetoothAdapter> adapter =
+      new testing::NiceMock<device::MockBluetoothAdapter>;
+  EXPECT_CALL(*adapter, IsPresent()).WillRepeatedly(testing::Return(true));
+  device::BluetoothAdapterFactory::SetAdapterForTesting(adapter);
+
+  // Navigate to a secure context.
+  embedded_test_server()->ServeFilesFromSourceDirectory("content/test/data");
+  ASSERT_TRUE(embedded_test_server()->Start());
+  ui_test_utils::NavigateToURL(
+      browser(),
+      embedded_test_server()->GetURL("localhost", "/simple_page.html"));
+  content::WebContents* const web_contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+  EXPECT_THAT(
+      web_contents->GetMainFrame()->GetLastCommittedOrigin().Serialize(),
+      testing::StartsWith("http://localhost:"));
+
+  // Set the policy to block Web Bluetooth.
+  PolicyMap policies;
+  policies.Set(key::kDefaultWebBluetoothGuardSetting, POLICY_LEVEL_MANDATORY,
+               POLICY_SCOPE_USER, POLICY_SOURCE_CLOUD,
+               new base::FundamentalValue(2), nullptr);
+  UpdateProviderPolicy(policies);
+
+  std::string rejection;
+  EXPECT_TRUE(content::ExecuteScriptAndExtractString(
+      web_contents,
+      "navigator.bluetooth.requestDevice({filters: [{name: 'Hello'}]})"
+      "  .then(() => { domAutomationController.send('Success'); },"
+      "        reason => {"
+      "      domAutomationController.send(reason.name + ': ' + reason.message);"
+      "  });",
+      &rejection));
+  EXPECT_THAT(rejection, testing::MatchesRegex("NotFoundError: .*policy.*"));
+}
+
 // Test that when extended reporting opt-in is disabled by policy, the
 // opt-in checkbox does not appear on SSL blocking pages.
 IN_PROC_BROWSER_TEST_F(PolicyTest, SafeBrowsingExtendedReportingOptInAllowed) {
diff --git a/chrome/test/data/policy/policy_test_cases.json b/chrome/test/data/policy/policy_test_cases.json
index ea7e14c..211d843 100644
--- a/chrome/test/data/policy/policy_test_cases.json
+++ b/chrome/test/data/policy/policy_test_cases.json
@@ -1215,6 +1215,14 @@
     ]
   },
 
+  "DefaultWebBluetoothGuardSetting": {
+    "os": ["win", "linux", "mac", "chromeos"],
+    "test_policy": { "DefaultWebBluetoothGuardSetting": 2 },
+    "pref_mappings": [
+      { "pref": "profile.managed_default_content_settings.web_bluetooth_guard" }
+    ]
+  },
+
   "AutoSelectCertificateForUrls": {
     "os": ["win", "linux", "mac", "chromeos"],
     "test_policy": { "AutoSelectCertificateForUrls": ["{'pattern':'https://example.com','filter':{'ISSUER':{'CN': 'issuer-name'}}}"] },
diff --git a/components/content_settings/core/browser/content_settings_default_provider.cc b/components/content_settings/core/browser/content_settings_default_provider.cc
index 7d8d25b..e995c0a 100644
--- a/components/content_settings/core/browser/content_settings_default_provider.cc
+++ b/components/content_settings/core/browser/content_settings_default_provider.cc
@@ -180,6 +180,11 @@ DefaultProvider::DefaultProvider(PrefService* prefs, bool incognito)
       IntToContentSetting(prefs_->GetInteger(
           GetPrefName(CONTENT_SETTINGS_TYPE_KEYGEN))),
       CONTENT_SETTING_NUM_SETTINGS);
+  UMA_HISTOGRAM_ENUMERATION(
+      "ContentSettings.DefaultWebBluetoothGuardSetting",
+      IntToContentSetting(prefs_->GetInteger(
+          GetPrefName(CONTENT_SETTINGS_TYPE_BLUETOOTH_GUARD))),
+      CONTENT_SETTING_NUM_SETTINGS);
 
   pref_change_registrar_.Init(prefs_);
   PrefChangeRegistrar::NamedChangeCallback callback = base::Bind(
diff --git a/components/content_settings/core/browser/content_settings_policy_provider.cc b/components/content_settings/core/browser/content_settings_policy_provider.cc
index ef9643d..d8d1b83 100644
--- a/components/content_settings/core/browser/content_settings_policy_provider.cc
+++ b/components/content_settings/core/browser/content_settings_policy_provider.cc
@@ -89,6 +89,8 @@ const PolicyProvider::PrefsForManagedDefaultMapEntry
         {CONTENT_SETTINGS_TYPE_PLUGINS, prefs::kManagedDefaultPluginsSetting},
         {CONTENT_SETTINGS_TYPE_POPUPS, prefs::kManagedDefaultPopupsSetting},
         {CONTENT_SETTINGS_TYPE_KEYGEN, prefs::kManagedDefaultKeygenSetting},
+        {CONTENT_SETTINGS_TYPE_BLUETOOTH_GUARD,
+         prefs::kManagedDefaultWebBluetoothGuardSetting},
 };
 
 // static
@@ -130,6 +132,8 @@ void PolicyProvider::RegisterProfilePrefs(
                                 CONTENT_SETTING_DEFAULT);
   registry->RegisterIntegerPref(prefs::kManagedDefaultKeygenSetting,
                                 CONTENT_SETTING_DEFAULT);
+  registry->RegisterIntegerPref(prefs::kManagedDefaultWebBluetoothGuardSetting,
+                                CONTENT_SETTING_DEFAULT);
 }
 
 PolicyProvider::PolicyProvider(PrefService* prefs) : prefs_(prefs) {
@@ -178,6 +182,8 @@ PolicyProvider::PolicyProvider(PrefService* prefs) : prefs_(prefs) {
   pref_change_registrar_.Add(prefs::kManagedDefaultPluginsSetting, callback);
   pref_change_registrar_.Add(prefs::kManagedDefaultPopupsSetting, callback);
   pref_change_registrar_.Add(prefs::kManagedDefaultKeygenSetting, callback);
+  pref_change_registrar_.Add(prefs::kManagedDefaultWebBluetoothGuardSetting,
+                             callback);
 }
 
 PolicyProvider::~PolicyProvider() {
diff --git a/components/content_settings/core/browser/content_settings_registry.cc b/components/content_settings/core/browser/content_settings_registry.cc
index 890006d..ee738a6 100644
--- a/components/content_settings/core/browser/content_settings_registry.cc
+++ b/components/content_settings/core/browser/content_settings_registry.cc
@@ -279,6 +279,13 @@ void ContentSettingsRegistry::Init() {
            WhitelistedSchemes(), ValidSettings(),
            WebsiteSettingsInfo::TOP_LEVEL_DOMAIN_ONLY_SCOPE,
            ContentSettingsInfo::INHERIT_IN_INCOGNITO);
+
+  Register(CONTENT_SETTINGS_TYPE_BLUETOOTH_GUARD, "bluetooth-guard",
+           CONTENT_SETTING_ASK, WebsiteSettingsInfo::UNSYNCABLE,
+           WhitelistedSchemes(),
+           ValidSettings(CONTENT_SETTING_ASK, CONTENT_SETTING_BLOCK),
+           WebsiteSettingsInfo::REQUESTING_ORIGIN_AND_TOP_LEVEL_ORIGIN_SCOPE,
+           ContentSettingsInfo::INHERIT_IN_INCOGNITO);
 }
 
 void ContentSettingsRegistry::Register(
diff --git a/components/content_settings/core/common/content_settings.cc b/components/content_settings/core/common/content_settings.cc
index e37461d..5b0e36f 100644
--- a/components/content_settings/core/common/content_settings.cc
+++ b/components/content_settings/core/common/content_settings.cc
@@ -53,6 +53,7 @@ ContentSettingsType kHistogramOrder[] = {
     CONTENT_SETTINGS_TYPE_SITE_ENGAGEMENT,
     CONTENT_SETTINGS_TYPE_DURABLE_STORAGE,
     CONTENT_SETTINGS_TYPE_KEYGEN,
+    CONTENT_SETTINGS_TYPE_BLUETOOTH_GUARD,
 };
 
 int ContentSettingTypeToHistogramValue(ContentSettingsType content_setting,
diff --git a/components/content_settings/core/common/content_settings_types.h b/components/content_settings/core/common/content_settings_types.h
index 02c389e..0e91e3f1 100644
--- a/components/content_settings/core/common/content_settings_types.h
+++ b/components/content_settings/core/common/content_settings_types.h
@@ -44,6 +44,7 @@ enum ContentSettingsType {
   CONTENT_SETTINGS_TYPE_SITE_ENGAGEMENT,
   CONTENT_SETTINGS_TYPE_DURABLE_STORAGE,
   CONTENT_SETTINGS_TYPE_USB_CHOOSER_DATA,
+  CONTENT_SETTINGS_TYPE_BLUETOOTH_GUARD,
   CONTENT_SETTINGS_TYPE_KEYGEN,
 
   // WARNING: This enum is going to be removed soon. Do not depend on NUM_TYPES.
diff --git a/components/content_settings/core/common/pref_names.cc b/components/content_settings/core/common/pref_names.cc
index 90f1f84..ebcf7f0 100644
--- a/components/content_settings/core/common/pref_names.cc
+++ b/components/content_settings/core/common/pref_names.cc
@@ -38,6 +38,8 @@ const char kManagedDefaultPopupsSetting[] =
     "profile.managed_default_content_settings.popups";
 const char kManagedDefaultKeygenSetting[] =
     "profile.managed_default_content_settings.keygen";
+const char kManagedDefaultWebBluetoothGuardSetting[] =
+    "profile.managed_default_content_settings.web_bluetooth_guard";
 
 // Preferences that are exclusively used to store managed
 // content settings patterns.
diff --git a/components/content_settings/core/common/pref_names.h b/components/content_settings/core/common/pref_names.h
index da5fbe2..aa1af1c 100644
--- a/components/content_settings/core/common/pref_names.h
+++ b/components/content_settings/core/common/pref_names.h
@@ -26,6 +26,7 @@ extern const char kManagedDefaultGeolocationSetting[];
 extern const char kManagedDefaultNotificationsSetting[];
 extern const char kManagedDefaultMediaStreamSetting[];
 extern const char kManagedDefaultKeygenSetting[];
+extern const char kManagedDefaultWebBluetoothGuardSetting[];
 
 extern const char kManagedCookiesAllowedForUrls[];
 extern const char kManagedCookiesBlockedForUrls[];
diff --git a/components/policy/resources/policy_templates.json b/components/policy/resources/policy_templates.json
index b626efa..7bdc31e 100644
--- a/components/policy/resources/policy_templates.json
+++ b/components/policy/resources/policy_templates.json
@@ -137,7 +137,7 @@
 #   persistent IDs for all fields (but not for groups!) are needed. These are
 #   specified by the 'id' keys of each policy. NEVER CHANGE EXISTING IDs,
 #   because doing so would break the deployed wire format!
-#   For your editing convenience: highest ID currently used: 319
+#   For your editing convenience: highest ID currently used: 320
 #
 # Placeholders:
 #   The following placeholder strings are automatically substituted:
@@ -3076,6 +3076,38 @@
           If this policy is left not set, 'PromptOnAccess' will be used and the user will be able to change it.''',
         },
         {
+          'name': 'DefaultWebBluetoothGuardSetting',
+          'type': 'int-enum',
+          'schema': {
+            'type': 'integer',
+            'enum': [ 2, 3 ],
+          },
+          'items': [
+            {
+              'name': 'BlockWebBluetooth',
+              'value': 2,
+              'caption': '''Do not allow any site to request access to Bluetooth devices via the Web Bluetooth API''',
+            },
+            {
+              'name': 'AskWebBluetooth',
+              'value': 3,
+              'caption': '''Allow sites to ask the user to grant access to a nearby Bluetooth device''',
+            },
+          ],
+          'supported_on': ['chrome_os:50-', 'android:50-', 'chrome.*:50-'],
+          'features': {
+            'dynamic_refresh': True,
+            'per_profile': True,
+          },
+          'example_value': 2,
+          'id': 320,
+          'caption': '''Control use of the Web Bluetooth API''',
+          'tags': ['website-sharing'],
+          'desc': '''Allows you to set whether websites are allowed to get access to nearby Bluetooth devices. Access can be completely blocked, or the user can be asked every time a website wants to get access to nearby Bluetooth devices.
+
+          If this policy is left not set, '3' will be used, and the user will be able to change it.''',
+        },
+        {
           'name': 'DefaultKeygenSetting',
           'type': 'int-enum',
           'schema': {
diff --git a/content/browser/bluetooth/bluetooth_dispatcher_host.cc b/content/browser/bluetooth/bluetooth_dispatcher_host.cc
index f783d31..d25c368 100644
--- a/content/browser/bluetooth/bluetooth_dispatcher_host.cc
+++ b/content/browser/bluetooth/bluetooth_dispatcher_host.cc
@@ -25,6 +25,7 @@
 #include "content/browser/bluetooth/first_device_bluetooth_chooser.h"
 #include "content/browser/frame_host/render_frame_host_impl.h"
 #include "content/common/bluetooth/bluetooth_messages.h"
+#include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_contents_delegate.h"
 #include "device/bluetooth/bluetooth_adapter.h"
@@ -1081,18 +1082,25 @@ void BluetoothDispatcherHost::OnRequestDeviceImpl(
 
   RenderFrameHostImpl* render_frame_host =
       RenderFrameHostImpl::FromID(render_process_id_, frame_routing_id);
+  WebContents* web_contents =
+      WebContents::FromRenderFrameHost(render_frame_host);
 
-  if (!render_frame_host) {
-    DLOG(WARNING)
-        << "Got a requestDevice IPC without a matching RenderFrameHost: "
-        << render_process_id_ << ", " << frame_routing_id;
+  if (!render_frame_host || !web_contents) {
+    DLOG(WARNING) << "Got a requestDevice IPC without a matching "
+                  << "RenderFrameHost or WebContents: " << render_process_id_
+                  << ", " << frame_routing_id;
     RecordRequestDeviceOutcome(UMARequestDeviceOutcome::NO_RENDER_FRAME);
     Send(new BluetoothMsg_RequestDeviceError(
         thread_id, request_id, WebBluetoothError::RequestDeviceWithoutFrame));
     return;
   }
 
-  if (render_frame_host->GetLastCommittedOrigin().unique()) {
+  const url::Origin requesting_origin =
+      render_frame_host->GetLastCommittedOrigin();
+  const url::Origin embedding_origin =
+      web_contents->GetMainFrame()->GetLastCommittedOrigin();
+
+  if (requesting_origin.unique()) {
     VLOG(1) << "Request device with unique origin.";
     Send(new BluetoothMsg_RequestDeviceError(
         thread_id, request_id,
@@ -1118,23 +1126,29 @@ void BluetoothDispatcherHost::OnRequestDeviceImpl(
     return;
   }
 
+  if (!GetContentClient()->browser()->AllowWebBluetooth(
+          web_contents->GetBrowserContext(), requesting_origin,
+          embedding_origin)) {
+    RecordRequestDeviceOutcome(
+        UMARequestDeviceOutcome::BLUETOOTH_CHOOSER_GLOBALLY_DISABLED);
+    Send(new BluetoothMsg_RequestDeviceError(
+        thread_id, request_id, WebBluetoothError::ChooserDisabled));
+    return;
+  }
+
   // Create storage for the information that backs the chooser, and show the
   // chooser.
-  RequestDeviceSession* const session =
-      new RequestDeviceSession(thread_id, request_id, frame_routing_id,
-                               render_frame_host->GetLastCommittedOrigin(),
-                               filters, optional_services_blacklist_filtered);
+  RequestDeviceSession* const session = new RequestDeviceSession(
+      thread_id, request_id, frame_routing_id, requesting_origin, filters,
+      optional_services_blacklist_filtered);
   int chooser_id = request_device_sessions_.Add(session);
 
   BluetoothChooser::EventHandler chooser_event_handler =
       base::Bind(&BluetoothDispatcherHost::OnBluetoothChooserEvent,
                  weak_ptr_on_ui_thread_, chooser_id);
-  if (WebContents* web_contents =
-          WebContents::FromRenderFrameHost(render_frame_host)) {
-    if (WebContentsDelegate* delegate = web_contents->GetDelegate()) {
-      session->chooser = delegate->RunBluetoothChooser(render_frame_host,
-                                                       chooser_event_handler);
-    }
+  if (WebContentsDelegate* delegate = web_contents->GetDelegate()) {
+    session->chooser =
+        delegate->RunBluetoothChooser(render_frame_host, chooser_event_handler);
   }
   if (!session->chooser) {
     LOG(WARNING)
diff --git a/content/browser/bluetooth/bluetooth_metrics.h b/content/browser/bluetooth/bluetooth_metrics.h
index fe89e6a..d50e699 100644
--- a/content/browser/bluetooth/bluetooth_metrics.h
+++ b/content/browser/bluetooth/bluetooth_metrics.h
@@ -67,6 +67,7 @@ enum class UMARequestDeviceOutcome {
   BLUETOOTH_OVERVIEW_HELP_LINK_PRESSED = 12,
   ADAPTER_OFF_HELP_LINK_PRESSED = 13,
   NEED_LOCATION_HELP_LINK_PRESSED = 14,
+  BLUETOOTH_CHOOSER_GLOBALLY_DISABLED = 15,
   // NOTE: Add new requestDevice() outcomes immediately above this line. Make
   // sure to update the enum list in
   // tools/metrics/histograms/histograms.xml accordingly.
diff --git a/content/public/browser/content_browser_client.cc b/content/public/browser/content_browser_client.cc
index 269aaee..be79b6b 100644
--- a/content/public/browser/content_browser_client.cc
+++ b/content/public/browser/content_browser_client.cc
@@ -222,6 +222,13 @@ bool ContentBrowserClient::AllowKeygen(const GURL& url,
   return true;
 }
 
+bool ContentBrowserClient::AllowWebBluetooth(
+    content::BrowserContext* browser_context,
+    const url::Origin& requesting_origin,
+    const url::Origin& embedding_origin) {
+  return true;
+}
+
 QuotaPermissionContext* ContentBrowserClient::CreateQuotaPermissionContext() {
   return nullptr;
 }
diff --git a/content/public/browser/content_browser_client.h b/content/public/browser/content_browser_client.h
index 9e6c174..00bae9f 100644
--- a/content/public/browser/content_browser_client.h
+++ b/content/public/browser/content_browser_client.h
@@ -84,6 +84,10 @@ namespace ui {
 class SelectFilePolicy;
 }
 
+namespace url {
+class Origin;
+}
+
 namespace storage {
 class ExternalMountPoints;
 class FileSystemBackend;
@@ -410,6 +414,12 @@ class CONTENT_EXPORT ContentBrowserClient {
   // Allow the embedder to control whether we can use <keygen>.
   virtual bool AllowKeygen(const GURL& url, content::ResourceContext* context);
 
+  // Allow the embedder to control whether we can use Web Bluetooth.
+  // TODO(crbug.com/589228): Replace this with a use of the permission system.
+  virtual bool AllowWebBluetooth(content::BrowserContext* browser_context,
+                                 const url::Origin& requesting_origin,
+                                 const url::Origin& embedding_origin);
+
   // Allow the embedder to override the request context based on the URL for
   // certain operations, like cookie access. Returns nullptr to indicate the
   // regular request context should be used.
diff --git a/third_party/WebKit/Source/modules/bluetooth/BluetoothError.cpp b/third_party/WebKit/Source/modules/bluetooth/BluetoothError.cpp
index 5070f4b..a60ad7c 100644
--- a/third_party/WebKit/Source/modules/bluetooth/BluetoothError.cpp
+++ b/third_party/WebKit/Source/modules/bluetooth/BluetoothError.cpp
@@ -48,6 +48,7 @@ DOMException* BluetoothError::take(ScriptPromiseResolver*, const WebBluetoothErr
         MAP_ERROR(NoBluetoothAdapter, NotFoundError, "Bluetooth adapter not available.");
         MAP_ERROR(ChosenDeviceVanished, NotFoundError, "User selected a device that doesn't exist anymore.");
         MAP_ERROR(ChooserCancelled, NotFoundError, "User cancelled the requestDevice() chooser.");
+        MAP_ERROR(ChooserDisabled, NotFoundError, "User or their enterprise policy has disabled Web Bluetooth globally.");
         MAP_ERROR(ChooserDeniedPermission, NotFoundError, "User denied the browser permission to scan for Bluetooth devices.");
         MAP_ERROR(ServiceNotFound, NotFoundError, "Service not found in device.");
         MAP_ERROR(CharacteristicNotFound, NotFoundError, "Characteristic not found in device.");
diff --git a/third_party/WebKit/public/platform/modules/bluetooth/WebBluetoothError.h b/third_party/WebKit/public/platform/modules/bluetooth/WebBluetoothError.h
index b9aef69..de5b55d 100644
--- a/third_party/WebKit/public/platform/modules/bluetooth/WebBluetoothError.h
+++ b/third_party/WebKit/public/platform/modules/bluetooth/WebBluetoothError.h
@@ -44,6 +44,7 @@ enum class WebBluetoothError {
     NoBluetoothAdapter,
     ChosenDeviceVanished,
     ChooserCancelled,
+    ChooserDisabled,
     ChooserDeniedPermission,
     ServiceNotFound,
     CharacteristicNotFound,
diff --git a/tools/metrics/histograms/histograms.xml b/tools/metrics/histograms/histograms.xml
index 5f5a88e..78870aa 100644
--- a/tools/metrics/histograms/histograms.xml
+++ b/tools/metrics/histograms/histograms.xml
@@ -5592,6 +5592,14 @@ http://cs/file:chrome/histograms.xml - but prefer this file for new entries.
   </summary>
 </histogram>
 
+<histogram name="ContentSettings.DefaultWebBluetoothGuardSetting"
+    enum="ContentSetting">
+  <owner>jyasskin@chromium.org</owner>
+  <summary>
+    The default permission setting for Web Bluetooth at profile open.
+  </summary>
+</histogram>
+
 <histogram name="ContentSettings.LastSettingParsed" enum="LastSettingParsed">
   <obsolete>
     Deprecated 2015-10-05 in Issue 433475. Histogram was used temorarily for
@@ -63712,6 +63720,7 @@ http://cs/file:chrome/histograms.xml - but prefer this file for new entries.
   <int value="319"
       label="Allow the auto launched with zero delay kiosk app to control
              ChromeOS version"/>
+  <int value="320" label="Control use of the Web Bluetooth API"/>
 </enum>
 
 <enum name="EnterprisePolicyInvalidations" type="int">
@@ -82935,6 +82944,9 @@ To add a new entry, add it with any value and run test to compute valid value.
   <int value="12" label="Bluetooth Overview Help link pressed."/>
   <int value="13" label="Adapter Off Help link pressed."/>
   <int value="14" label="Need Location Help link pressed."/>
+  <int value="15"
+      label="Chooser insta-closed because user or enterprise policy has
+             disabled it"/>
 </enum>
 
 <enum name="WebCertVerifyAgreement" type="int">