Update Sync policy schema

1rneh · 1rneh · commit a7f58fcf681d · 2026-02-18T23:12:33.000+01:00
diff --git a/browser/components/enterprisepolicies/Policies.sys.mjs b/browser/components/enterprisepolicies/Policies.sys.mjs
@@ -33,7 +33,7 @@ ChromeUtils.defineESModuleGetters(lazy, {
   WebsiteFilter: "resource:///modules/policies/WebsiteFilter.sys.mjs",
 });
 
-const PREF_LOGLEVEL = "browser.policies.loglevel";
+export const PREF_LOGLEVEL = "browser.policies.loglevel";
 const BROWSER_DOCUMENT_URL = AppConstants.BROWSER_CHROME_URL;
 const ABOUT_CONTRACT = "@mozilla.org/network/protocol/about;1?what=";
 
diff --git a/browser/components/enterprisepolicies/helpers/SyncPolicy.sys.mjs b/browser/components/enterprisepolicies/helpers/SyncPolicy.sys.mjs
@@ -2,20 +2,27 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-const lazy = {};
+import {
+  PREF_LOGLEVEL,
+  setAndLockPref,
+  unsetAndUnlockPref,
+  PoliciesUtils,
+} from "resource:///modules/policies/Policies.sys.mjs";
+
+const SYNC_STATUS_OK = ChromeUtils.importESModule(
+  "resource://services-sync/constants.sys.mjs"
+).STATUS_OK
 
+
+const lazy = {};
 ChromeUtils.defineESModuleGetters(lazy, {
-  PREF_LOGLEVEL: "resource:///modules/policies/Policies.sys.mjs",
-  setAndLockPref: "resource:///modules/policies/Policies.sys.mjs",
-  STATUS_OK: "resource://services-sync/constants.sys.mjs",
-  unsetAndUnlockPref: "resource:///modules/policies/Policies.sys.mjs",
   Weave: "resource://services-sync/main.sys.mjs",
 });
 
 ChromeUtils.defineLazyGetter(lazy, "log", () => {
   return console.createInstance({
-    prefix: "SyncSettingsPolicy",
-    maxLogLevelPref: lazy.PREF_LOGLEVEL,
+    prefix: "SyncPolicy",
+    maxLogLevelPref: PREF_LOGLEVEL,
   });
 });
 
@@ -30,145 +37,130 @@ const ENGINE_PREFS = {
   settings: "services.sync.engine.prefs",
 };
 
-const STATE = {
-  DEFAULT: "default",
-  SYNC_ENABLED: "enabled",
-  SYNC_DISABLED: "disabled",
-  POLICY_NOT_APPLIED: "policy-not-applied",
-};
+const SYNC_FEATURE = "change-sync-state";
 
 /**
- * Policy to control the Sync state (force-enable or force-disable Sync)
- * and to control which data types are synced. The user is not able to
- * customize Sync settings when this policy is active.
+ * Customizes Sync settings (all settings are optional):
+ *    - Whether sync is enabled/disabled
+ *    - Which types of data to sync
+ *    - Whether to lock the sync customization
+ * See SyncPolicyParams for details.
  */
-export const SyncSettingsPolicy = {
-  _isSyncEnabledDefaultValue: null,
-  _currentPolicyState: null,
-
+export const SyncPolicy = {
   /**
    * Get current sync state.
    *
    * @returns {boolean} Whether sync is currently enabled.
    */
   isSyncEnabled() {
-    return lazy.Weave.Status.checkSetup() == lazy.STATUS_OK;
+    return lazy.Weave.Status.checkSetup() == SYNC_STATUS_OK;
   },
 
   /**
-   * @typedef {object} SyncSettings
-   * @property {boolean} SyncEnabled Whether Sync should be force-enabled or force-disabled.
-   * @property {Array<"addresses"|"bookmarks"|"history"|"openTabs"|"passwords"|"paymentMethods"|"addons"|"settings">} TypesEnabled
-   *   Which data types should be synced when Sync is force-enabled.
+   * @typedef {object} SyncPolicyParams
+   * @property {boolean} [Enabled] Whether Sync should be enabled
+   * @property {boolean} [addresses] Whether syncing addresses should be enabled
+   * @property {boolean} [bookmarks] Whether syncing bookmarks should be enabled
+   * @property {boolean} [history] Whether syncing history should be enabled
+   * @property {boolean} [openTabs] Whether syncing openTabs should be enabled
+   * @property {boolean} [passwords] Whether syncing passwords should be enabled
+   * @property {boolean} [paymentMethods] Whether syncing paymentMethods should be enabled
+   * @property {boolean} [addons] Whether syncing addons should be enabled
+   * @property {boolean} [settings] Whether syncing settings should be enabled
+   * @property {boolean} [Locked] Whether to lock the customized sync settings
    */
 
   /**
-   * Apply policy Sync settings to the current profile and prevent changes to
-   * the Sync state while the policy is active.
+   * Apply Sync settings
    *
    * @param {EnterprisePoliciesManager} manager
-   * @param {SyncSettings} param
+   * @param {SyncPolicyParams} params
    *
    * @returns {Promise<void>} Resolves once all Sync settings have been applied.
    */
-  async applySettings(manager, param) {
+  async applySettings(manager, params) {
     lazy.log.debug("Apply Sync Settings");
 
+    // This might be an update to the Sync policy
+    // so restore previous sync settings
+    this.restoreSettings(manager);
+
+    const {
+      Enabled: shouldEnableSync,
+      Locked: shouldLock,
+      ...typeSettings
+    } = params;
+
     const isSyncEnabled = this.isSyncEnabled();
-    if (this._isSyncEnabledDefaultValue === null) {
-      // Cache initial sync state
-      this._isSyncEnabledDefaultValue = isSyncEnabled;
-    }
 
-    if (!param.SyncEnabled) {
-      lazy.log.debug("Force-disable Sync");
+    if (shouldEnableSync === true) {
+      lazy.log.debug("Enable Sync");
+      if (!isSyncEnabled) {
+        await this.connectSync(manager);
+      }
+    } else if (shouldEnableSync === false) {
+      lazy.log.debug("Disable Sync");
       if (isSyncEnabled) {
         await this.disconnectSync(manager);
       }
-      return;
     }
 
-    lazy.log.debug("Force-enable Sync");
-
-    for (const [type, pref] of Object.entries(ENGINE_PREFS)) {
-      if (param.TypesEnabled.includes(type)) {
-        lazy.log.debug(`Enabling type: ${type}`);
-        lazy.setAndLockPref(pref, true);
-      } else {
-        lazy.log.debug(`Disabling type: ${type}`);
-        lazy.setAndLockPref(pref, false);
+    for (const [type, value] of Object.entries(typeSettings)) {
+      const pref = ENGINE_PREFS[type];
+      if (shouldLock) {
+        lazy.log.debug(`Setting and locking ${type}: ${pref} : ${value}`);
+        setAndLockPref(pref, value);
+        continue;
       }
+      lazy.log.debug(`Setting ${type}: ${pref} : ${value}`);
+      PoliciesUtils.setDefaultPref(pref, value, false);
     }
 
-    await this.connectSync(manager);
-
-    this._currentPolicyState = STATE.SYNC_ENABLED;
+    // Only lock the Sync feature if 'Enabled' is configured
+    if (shouldLock && shouldEnableSync !== undefined) {
+      manager.disallowFeature(SYNC_FEATURE);
+    }
   },
 
   /**
-   * Restore Sync preferences and state to what they were before policy enforcement,
-   * and re-allow changes to the Sync state.
+   * Restore initial sync state.
    *
    * @param {EnterprisePoliciesManager} manager
    */
   async restoreSettings(manager) {
-    lazy.log.debug("Restore Sync Settings");
-
-    if (this._currentPolicyState !== STATE.DEFAULT) {
-      // Only restore the default state if the current state
-      // isn't already the default state.
-      this.restoreDefault(manager);
+    if (!Services.policies.isAllowed(SYNC_FEATURE)) {
+      manager.allowFeature(SYNC_FEATURE);
     }
-
-    this._currentPolicyState = STATE.POLICY_NOT_APPLIED;
-  },
-
-  /**
-   * Restore default state
-   *
-   * @param {EnterprisePoliciesManager} manager
-   */
-  async restoreDefault(manager) {
     for (const pref of Object.values(ENGINE_PREFS)) {
-      lazy.unsetAndUnlockPref(pref);
+      lazy.log.debug(`Unsetting ${pref}`);
+      unsetAndUnlockPref(pref);
     }
 
-    const isSyncEnabled = this.isSyncEnabled();
-
-    if (this._isSyncEnabledDefaultValue) {
-      // Re-connecting to re-trigger a Sync action with the
-      // restored default enabled types.
-      lazy.log.debug("Restoring Sync state by enabling it.");
-      await this.connectSync(manager);
-    } else if (!this._isSyncEnabledDefaultValue && isSyncEnabled) {
-      lazy.log.debug("Restoring Sync state by disabling it.");
-      await this.disconnectSync(manager);
-    }
-
-    this._isSyncEnabledDefaultValue = null;
-    manager.allowFeature("change-sync-state");
+    // We don't have a way yet to restore the pre-policy sync 
+    // state (Bug 2017719). So for now we fallback to sync enabled.
+    this.connectSync()
   },
 
   /**
-   * Disconnect Sync and disallow any changes to the sync state.
-   *
-   * @param {EnterprisePoliciesManager} manager
+   * Disconnect sync
    */
-  async disconnectSync(manager) {
-    manager.allowFeature("change-sync-state");
-    await lazy.Weave.Service.promiseInitialized;
-    await lazy.Weave.Service.startOver();
-    manager.disallowFeature("change-sync-state");
+  async disconnectSync() {
+    try {
+      await lazy.Weave.Service.promiseInitialized;
+      await lazy.Weave.Service.startOver();
+    } catch (e) {
+      lazy.log.error(`Failed to disconnect sync: ${e}`)
+    }
   },
 
   /**
-   * Connect Sync and disallow any changes to the sync state.
-   *
-   * @param {EnterprisePoliciesManager} manager
+   * Connect sync
    */
-  async connectSync(manager) {
-    manager.allowFeature("change-sync-state");
-    await lazy.Weave.Service.configure();
-    manager.disallowFeature("change-sync-state");
+  async connectSync() {
+    try {
+      await lazy.Weave.Service.configure();
+    } catch (e) {
+      lazy.log.error(`Failed to connect sync: ${e}`)
+    }
   },
 };
diff --git a/browser/components/enterprisepolicies/schemas/policies-schema.json b/browser/components/enterprisepolicies/schemas/policies-schema.json
@@ -1700,27 +1700,36 @@
     "Sync": {
       "type": "object",
       "properties": {
-        "State": {
-          "type": "string",
-          "enum": ["enabled", "disabled", "default"]
+        "Enabled": {
+          "type": "boolean"
         },
-        "TypesEnabled": {
-          "type": "array",
-          "items": {
-            "type": "string",
-            "enum": [
-              "addresses",
-              "bookmarks",
-              "history",
-              "openTabs",
-              "passwords",
-              "paymentMethods",
-              "addons",
-              "settings"
-            ]
-          }
+        "addresses": {
+          "type": "boolean"
+        },
+        "bookmarks": {
+          "type": "boolean"
         },
-        "required": ["State"]
+        "history": {
+          "type": "boolean"
+        },
+        "openTabs": {
+          "type": "boolean"
+        },
+        "passwords": {
+          "type": "boolean"
+        },
+        "paymentMethods": {
+          "type": "boolean"
+        },
+        "addons": {
+          "type": "boolean"
+        },
+        "settings": {
+          "type": "boolean"
+        },
+        "Locked": {
+          "type": "boolean"
+        }
       }
     },
 
diff --git a/browser/components/preferences/dialogs/syncChooseWhatToSync.js b/browser/components/preferences/dialogs/syncChooseWhatToSync.js
@@ -28,7 +28,10 @@ let gSyncChooseWhatToSync = {
     this._setupEventListeners();
     this._adjustForPrefs();
     let options = window.arguments[0];
-    if (options.disconnectFun) {
+    if (
+      options.disconnectFun &&
+      Services.policies.isAllowed("change-sync-state")
+    ) {
       // Offer 'Disconnect' functionality if it was provided
       document.addEventListener("dialogextra2", function () {
         options.disconnectFun().then(disconnected => {
diff --git a/browser/components/preferences/sync.js b/browser/components/preferences/sync.js
@@ -911,12 +911,8 @@ var gSyncPane = {
     );
     connectAnotherDeviceLink.setAttribute("restricted-enterprise-view", true);
 
-    if ("SyncSettings" in (Services.policies.getActivePolicies() || {})) {
-      // Hide "Manage Sync" button (visible when Sync is enabled)
-      const manageSyncButton = document.getElementById("syncChangeOptions");
-      manageSyncButton.setAttribute("restricted-enterprise-view", true);
-
-      // Hide info box and "Turn on syncing..."" button (visible when Sync is disabled)
+    if (!Services.policies.isAllowed("change-sync-state")) {
+      // Hide info box and "Turn on syncing..." button (visible when Sync is disabled)
       const syncOffBox = document.getElementById("syncNotConfigured");
       syncOffBox.setAttribute("restricted-enterprise-view", true);
     }
diff --git a/browser/themes/shared/preferences/preferences.css b/browser/themes/shared/preferences/preferences.css
@@ -1607,7 +1607,6 @@ setting-group[groupid="aiStatesDescription"] {
 #fxaUnlinkButton[restricted-enterprise-view],
 #verifiedManage[restricted-enterprise-view],
 #connect-another-device[restricted-enterprise-view],
-#syncChangeOptions[restricted-enterprise-view],
 #syncNotConfigured[restricted-enterprise-view] {
   display: none;
 }
diff --git a/services/sync/modules/service.sys.mjs b/services/sync/modules/service.sys.mjs
@@ -971,7 +971,8 @@ Sync11Service.prototype = {
   // configures/enabled/turns-on sync. There must be an FxA user signed in.
   async configure() {
     if (AppConstants.MOZ_ENTERPRISE && !Services.policies.isAllowed("change-sync-state")) {
-      this._log.trace("Sync is force-disabled by the SyncSettings policy and can only be enabled by a policy update.");
+      // This should never hit. If the Sync policy locks the sync state all calls to this method are guarded.
+      this._log.error("Sync is disabled and locked by the Sync policy and can only be enabled by a policy update.");
       return;
     }
     // We don't, and must not, throw if sync is already configured, because we
@@ -995,11 +996,13 @@ Sync11Service.prototype = {
 
   // resets/turns-off sync.
   async startOver() {
+    this._log.trace("Invoking Service.startOver.");
+    
     if (AppConstants.MOZ_ENTERPRISE && !Services.policies.isAllowed("change-sync-state")) {
-      this._log.trace("Sync is force-enabled by the SyncSettings policy and can only be disabled by a policy update.");
+      // This should never hit. If the Sync policy locks the sync state all calls to this method are guarded.
+      this._log.error("Sync is enabled and locked by the Sync policy and can only be disabled by a policy update.");
       return;
     }
-    this._log.trace("Invoking Service.startOver.");
     await this._stopTracking();
     this.status.resetSync();
 

Original file line number	Diff line number	Diff line change
`@@ -1607,7 +1607,6 @@ setting-group[groupid="aiStatesDescription"] {`
`1607`	`1607`	`#fxaUnlinkButton[restricted-enterprise-view],`
`1608`	`1608`	`#verifiedManage[restricted-enterprise-view],`
`1609`	`1609`	`#connect-another-device[restricted-enterprise-view],`
`1610`		`-#syncChangeOptions[restricted-enterprise-view],`
`1611`	`1610`	`#syncNotConfigured[restricted-enterprise-view] {`
`1612`	`1611`	`display: none;`
`1613`	`1612`	`}`