cros: Add a policy for multiprofile user behavior.

- Add a user policy "ChromeOsMultiProfileUserBehavior" that binds to
  user pref "settings.multiprofile_user_behavior";
- Add a MultiProfileUserController that caches the pref value in local state
  to make decisions before user actually signs in and also observe the pref
  change to update the cache and check if the policy is broken;

BUG=288764
R=dpolukhin@chromium.org, joaodasilva@chromium.org, mnissler@chromium.org, sky@chromium.org

Review URL: https://codereview.chromium.org/23856014

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@225039 0039d316-1c4b-4281-b951-d872f2087c98

1 files changed, 51 insertions, 1 deletions

diff --git a/chrome/app/policy/policy_templates.json b/chrome/app/policy/policy_templates.json
index 59aa304..c65023a 100644
--- a/chrome/app/policy/policy_templates.json
+++ b/chrome/app/policy/policy_templates.json
@@ -118,7 +118,7 @@
 #   persistent IDs for all fields (but not for groups!) are needed. These are
 #   specified by the 'id' keys of each policy. NEVER CHANGE EXISTING IDs,
 #   because doing so would break the deployed wire format!
-#   For your editing convenience: highest ID currently used: 243
+#   For your editing convenience: highest ID currently used: 244
 #
 # Placeholders:
 #   The following placeholder strings are automatically substituted:
@@ -2747,6 +2747,56 @@
       If the policy is left not set the user can choose whether he wants to be asked for password to unlock the device or not.''',
     },
     {
+      'name': 'ChromeOsMultiProfileUserBehavior',
+      'type': 'string-enum',
+      'schema': {
+        'type': 'string',
+        'enum': [
+          'unrestricted',
+          'primary-only',
+          'not-allowed',
+        ],
+      },
+      'items': [
+        {
+          'name': 'MultiProfileUserBehaviorUnrestricted',
+          'value': 'unrestricted',
+          'caption': '''Allow enterprise user to be both primary and secondary  (Default behavior)''',
+        },
+        {
+          'name': 'MultiProfileUserBehaviorMustBePrimary',
+          'value': 'primary-only',
+          'caption': '''Allow enterprise user to be primary multiprofile user only''',
+        },
+        {
+          'name': 'MultiProfileUserBehaviorNotAllowed',
+          'value': 'not-allowed',
+          'caption': '''Do not allow enterprise user to be part of multiprofile (primary or secondary)''',
+        },
+      ],
+      'supported_on': ['chrome_os:31-'],
+      'features': {
+        'dynamic_refresh': True,
+        'per_profile': True,
+      },
+      'example_value': 'unrestricted',
+      'id': 244,
+      'caption': '''Control the user behavior in a multiprofile session''',
+      'desc': '''Control the user behavior in a multiprofile session on <ph name="PRODUCT_OS_NAME">$2<ex>Google Chrome OS</ex></ph> devices.
+
+      If this policy is set to 'MultiProfileUserBehaviorUnrestricted', the user can be either primary or secondary user in a multiprofile session.
+
+      If this policy is set to 'MultiProfileUserBehaviorMustBePrimary', the user can only be the primary user in a multiprofile session.
+
+      If this policy is set to 'MultiProfileUserBehaviorNotAllowed', the user cannot be part of a multiprofile session.
+
+      If you set this setting, users cannot change or override it.
+
+      If the setting is changed while the user is signed into a multiprofile session, all users in the session will be checked against their cooresponding settings. The session will be closed if any one of the users is no longer allowed to be in the session.
+
+      If the policy is left not set, the default value 'MultiProfileUserBehaviorUnrestricted' will be used.''',
+    },
+    {
       'name': 'InstantEnabled',
       'type': 'main',
       'schema': { 'type': 'boolean' },