• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Copyright (C) 2021 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 package android.devicepolicy.cts;
17 
18 import static android.content.Context.RECEIVER_EXPORTED;
19 import static android.content.Intent.ACTION_APPLICATION_RESTRICTIONS_CHANGED;
20 
21 import static com.android.bedstead.harrier.UserType.INITIAL_USER;
22 import static com.android.bedstead.harrier.UserType.PRIVATE_PROFILE;
23 import static com.android.bedstead.harrier.UserType.WORK_PROFILE;
24 import static com.android.bedstead.metricsrecorder.truth.MetricQueryBuilderSubject.assertThat;
25 import static com.android.eventlib.truth.EventLogsSubject.assertThat;
26 
27 import static com.google.common.truth.Truth.assertThat;
28 
29 import static org.junit.Assume.assumeTrue;
30 import static org.testng.Assert.assertThrows;
31 
32 import android.app.admin.flags.Flags;
33 import android.content.ComponentName;
34 import android.content.IntentFilter;
35 import android.content.pm.PackageManager;
36 import android.devicepolicy.cts.utils.BundleUtils;
37 import android.os.Bundle;
38 import android.stats.devicepolicy.EventId;
39 
40 import com.android.bedstead.enterprise.annotations.CanSetPolicyTest;
41 import com.android.bedstead.enterprise.annotations.CannotSetPolicyTest;
42 import com.android.bedstead.enterprise.annotations.EnsureHasDevicePolicyManagerRoleHolder;
43 import com.android.bedstead.enterprise.annotations.EnsureHasProfileOwner;
44 import com.android.bedstead.enterprise.annotations.EnsureHasWorkProfile;
45 import com.android.bedstead.enterprise.annotations.PolicyAppliesTest;
46 import com.android.bedstead.enterprise.annotations.PolicyDoesNotApplyTest;
47 import com.android.bedstead.flags.annotations.RequireFlagsEnabled;
48 import com.android.bedstead.harrier.BedsteadJUnit4;
49 import com.android.bedstead.harrier.DeviceState;
50 import com.android.bedstead.harrier.annotations.Postsubmit;
51 import com.android.bedstead.harrier.annotations.RequireRunOnInitialUser;
52 import com.android.bedstead.harrier.annotations.UserTest;
53 import com.android.bedstead.harrier.policies.ApplicationRestrictions;
54 import com.android.bedstead.harrier.policies.ApplicationRestrictionsManagingPackage;
55 import com.android.bedstead.harrier.policies.DmrhOnlyApplicationRestrictions;
56 import com.android.bedstead.harrier.policies.DpcOnlyApplicationRestrictions;
57 import com.android.bedstead.metricsrecorder.EnterpriseMetricsRecorder;
58 import com.android.bedstead.testapp.TestApp;
59 import com.android.bedstead.testapp.TestAppInstance;
60 
61 import org.junit.ClassRule;
62 import org.junit.Ignore;
63 import org.junit.Rule;
64 import org.junit.Test;
65 import org.junit.runner.RunWith;
66 
67 import java.util.List;
68 
69 @RunWith(BedsteadJUnit4.class)
70 public final class ApplicationRestrictionsTest {
71 
72     @ClassRule
73     @Rule
74     public static final DeviceState sDeviceState = new DeviceState();
75 
76     private static final String TAG = ApplicationRestrictionsTest.class.getSimpleName();
77 
78     private static final TestApp sTestApp = sDeviceState.testApps().any();
79 
80     private static final TestApp sDifferentTestApp = sDeviceState.testApps().any();
81 
82     @Postsubmit(reason = "New test")
83     @PolicyAppliesTest(policy = DpcOnlyApplicationRestrictions.class)
setApplicationRestrictions_applicationRestrictionsAreSet()84     public void setApplicationRestrictions_applicationRestrictionsAreSet() {
85         Bundle originalApplicationRestrictions =
86                 sDeviceState.dpc().devicePolicyManager()
87                         .getApplicationRestrictions(
88                                 sDeviceState.dpc().componentName(), sTestApp.packageName());
89         Bundle bundle = BundleUtils.createBundle(
90                 "setApplicationRestrictions_applicationRestrictionsAreSet");
91 
92         try (TestAppInstance testApp = sTestApp.install()) {
93             sDeviceState.dpc().devicePolicyManager()
94                     .setApplicationRestrictions(
95                             sDeviceState.dpc().componentName(), sTestApp.packageName(),
96                             bundle);
97 
98             BundleUtils.assertEqualToBundle(
99                     "setApplicationRestrictions_applicationRestrictionsAreSet",
100                     testApp.userManager().getApplicationRestrictions(sTestApp.packageName()));
101         } finally {
102             sDeviceState.dpc().devicePolicyManager().setApplicationRestrictions(
103                     sDeviceState.dpc().componentName(),
104                     sTestApp.packageName(), originalApplicationRestrictions);
105         }
106     }
107 
108   @Postsubmit(reason = "New test")
109   @PolicyAppliesTest(policy = DpcOnlyApplicationRestrictions.class)
110   @Ignore("b/290932414")
setApplicationRestrictions_applicationRestrictionsAlreadySet_setsNewRestrictions()111   public void setApplicationRestrictions_applicationRestrictionsAlreadySet_setsNewRestrictions() {
112         Bundle originalApplicationRestrictions =
113                 sDeviceState.dpc().devicePolicyManager()
114                         .getApplicationRestrictions(
115                                 sDeviceState.dpc().componentName(), sTestApp.packageName());
116         Bundle bundle = BundleUtils.createBundle(
117                 "setApplicationRestrictions_applicationRestrictionsAlreadySet_setsNewRestrictions");
118 
119         try (TestAppInstance testApp = sTestApp.install()) {
120             sDeviceState.dpc().devicePolicyManager()
121                     .setApplicationRestrictions(
122                             sDeviceState.dpc().componentName(), sTestApp.packageName(),
123                             new Bundle());
124             sDeviceState.dpc().devicePolicyManager()
125                     .setApplicationRestrictions(
126                             sDeviceState.dpc().componentName(), sTestApp.packageName(),
127                             bundle);
128 
129       BundleUtils.assertEqualToBundle(
130           "setApplicationRestrictions_applicationRestrictionsAlreadySet_setsNewRestrictions",
131           testApp.userManager().getApplicationRestrictions(sTestApp.packageName()));
132         } finally {
133             sDeviceState.dpc().devicePolicyManager().setApplicationRestrictions(
134                     sDeviceState.dpc().componentName(),
135                     sTestApp.packageName(), originalApplicationRestrictions);
136         }
137     }
138 
139     @Postsubmit(reason = "New test")
140     @CanSetPolicyTest(policy = {
141             ApplicationRestrictions.class, DmrhOnlyApplicationRestrictions.class})
142     //TODO: wait for b/332662548 so we can test DMRH calling
143     // dpm.getParentInstance().getApplicationRestrictions()
getApplicationRestrictions_applicationRestrictionsAreSet_returnsApplicationRestrictions()144     public void getApplicationRestrictions_applicationRestrictionsAreSet_returnsApplicationRestrictions() {
145         skipRoleHolderTestIfFlagNotEnabled();
146         Bundle originalApplicationRestrictions =
147                 sDeviceState.dpc().devicePolicyManager()
148                         .getApplicationRestrictions(
149                                 sDeviceState.dpc().componentName(), sTestApp.packageName());
150     Bundle bundle =
151         BundleUtils.createBundle(
152             "getApplicationRestrictions_applicationRestrictionsAreSet_returnsApplicationRestrictions");
153 
154         try {
155             sDeviceState.dpc().devicePolicyManager()
156                     .setApplicationRestrictions(
157                             sDeviceState.dpc().componentName(), sTestApp.packageName(),
158                             bundle);
159 
160       BundleUtils.assertEqualToBundle(
161           "getApplicationRestrictions_applicationRestrictionsAreSet_returnsApplicationRestrictions",
162           sDeviceState
163               .dpc()
164               .devicePolicyManager()
165               .getApplicationRestrictions(
166                   sDeviceState.dpc().componentName(), sTestApp.packageName()));
167         } finally {
168             sDeviceState.dpc().devicePolicyManager().setApplicationRestrictions(
169                     sDeviceState.dpc().componentName(),
170                     sTestApp.packageName(), originalApplicationRestrictions);
171         }
172     }
173 
174     @Postsubmit(reason = "New test")
175     @CanSetPolicyTest(policy = ApplicationRestrictions.class)
getApplicationRestrictions_differentPackage_throwsException()176     public void getApplicationRestrictions_differentPackage_throwsException() {
177         Bundle originalApplicationRestrictions =
178                 sDeviceState.dpc().devicePolicyManager()
179                         .getApplicationRestrictions(
180                                 sDeviceState.dpc().componentName(), sTestApp.packageName());
181         Bundle bundle = BundleUtils.createBundle(
182                 "getApplicationRestrictions_differentPackage_throwsException");
183 
184         try (TestAppInstance differentTestApp = sDifferentTestApp.install()) {
185             sDeviceState.dpc().devicePolicyManager()
186                     .setApplicationRestrictions(
187                             sDeviceState.dpc().componentName(), sTestApp.packageName(),
188                             bundle);
189 
190             assertThrows(SecurityException.class,
191                     () -> differentTestApp.userManager().getApplicationRestrictions(
192                             sTestApp.packageName()));
193         } finally {
194             sDeviceState.dpc().devicePolicyManager().setApplicationRestrictions(
195                     sDeviceState.dpc().componentName(),
196                     sTestApp.packageName(), originalApplicationRestrictions);
197         }
198     }
199 
200     @Postsubmit(reason = "New test")
201     @CanSetPolicyTest(policy = ApplicationRestrictions.class)
getApplicationRestrictions_setForOtherPackage_returnsNull()202     public void getApplicationRestrictions_setForOtherPackage_returnsNull() {
203         Bundle originalApplicationRestrictions =
204                 sDeviceState.dpc().devicePolicyManager()
205                         .getApplicationRestrictions(
206                                 sDeviceState.dpc().componentName(), sTestApp.packageName());
207         Bundle bundle = BundleUtils.createBundle(
208                 "getApplicationRestrictions_setForOtherPackage_returnsNull");
209 
210         try (TestAppInstance differentTestApp = sDifferentTestApp.install()) {
211             sDeviceState.dpc().devicePolicyManager()
212                     .setApplicationRestrictions(
213                             sDeviceState.dpc().componentName(), sTestApp.packageName(),
214                             bundle);
215 
216             BundleUtils.assertNotEqualToBundle(
217                     "getApplicationRestrictions_setForOtherPackage_returnsNull",
218                     differentTestApp.userManager().getApplicationRestrictions(
219                     sDifferentTestApp.packageName()));
220         } finally {
221             sDeviceState.dpc().devicePolicyManager().setApplicationRestrictions(
222                     sDeviceState.dpc().componentName(),
223                     sTestApp.packageName(), originalApplicationRestrictions);
224         }
225     }
226 
227     @Postsubmit(reason = "New test")
228     @PolicyDoesNotApplyTest(policy = ApplicationRestrictions.class)
setApplicationRestrictions_policyDoesNotApply_applicationRestrictionsAreNotSet()229     public void setApplicationRestrictions_policyDoesNotApply_applicationRestrictionsAreNotSet() {
230         Bundle originalApplicationRestrictions =
231                 sDeviceState.dpc().devicePolicyManager().getApplicationRestrictions(
232                         sDeviceState.dpc().componentName(), sTestApp.packageName());
233         Bundle bundle = BundleUtils.createBundle(
234                 "setApplicationRestrictions_policyDoesNotApply_applicationRestrictionsAreNotSet");
235 
236         try (TestAppInstance testApp = sTestApp.install()) {
237             sDeviceState.dpc().devicePolicyManager()
238                     .setApplicationRestrictions(
239                             sDeviceState.dpc().componentName(), sTestApp.packageName(),
240                             bundle);
241 
242       BundleUtils.assertNotEqualToBundle(
243           "setApplicationRestrictions_policyDoesNotApply_applicationRestrictionsAreNotSet",
244           testApp.userManager().getApplicationRestrictions(sTestApp.packageName()));
245         } finally {
246             sDeviceState.dpc().devicePolicyManager().setApplicationRestrictions(
247                     sDeviceState.dpc().componentName(),
248                     sTestApp.packageName(), originalApplicationRestrictions);
249         }
250     }
251 
252     @Postsubmit(reason = "New test")
253     @CannotSetPolicyTest(policy = ApplicationRestrictions.class)
setApplicationRestrictions_cannotSetPolicy_throwsException()254     public void setApplicationRestrictions_cannotSetPolicy_throwsException() {
255         Bundle bundle = BundleUtils.createBundle(
256                 "setApplicationRestrictions_cannotSetPolicy_throwsException");
257         assertThrows(SecurityException.class, () -> {
258             sDeviceState.dpc().devicePolicyManager()
259                     .setApplicationRestrictions(
260                             sDeviceState.dpc().componentName(), sTestApp.packageName(),
261                             bundle);
262         });
263     }
264 
265     @Postsubmit(reason = "New test")
266     @CannotSetPolicyTest(policy = ApplicationRestrictions.class)
getApplicationRestrictions_cannotSetPolicy_throwsException()267     public void getApplicationRestrictions_cannotSetPolicy_throwsException() {
268         assertThrows(SecurityException.class, () -> {
269             sDeviceState.dpc().devicePolicyManager()
270                     .getApplicationRestrictions(
271                             sDeviceState.dpc().componentName(), sTestApp.packageName());
272         });
273     }
274 
275     @Postsubmit(reason = "New test")
276     @CanSetPolicyTest(policy = ApplicationRestrictions.class, singleTestOnly = true)
setApplicationRestrictions_nullComponent_throwsException()277     public void setApplicationRestrictions_nullComponent_throwsException() {
278         Bundle bundle = BundleUtils.createBundle(
279                 "setApplicationRestrictions_nullComponent_throwsException");
280         assertThrows(SecurityException.class,
281                 () -> sDeviceState.dpc().devicePolicyManager().setApplicationRestrictions(null,
282                         sTestApp.packageName(), bundle));
283     }
284 
285     @Postsubmit(reason = "New test")
286     @PolicyAppliesTest(policy = {
287             ApplicationRestrictions.class, DmrhOnlyApplicationRestrictions.class})
setApplicationRestrictions_restrictionsChangedBroadcastIsReceived()288     public void setApplicationRestrictions_restrictionsChangedBroadcastIsReceived() {
289         skipRoleHolderTestIfFlagNotEnabled();
290         Bundle originalApplicationRestrictions =
291                 sDeviceState.dpc().devicePolicyManager()
292                         .getApplicationRestrictions(
293                                 sDeviceState.dpc().componentName(), sTestApp.packageName());
294         Bundle bundle = BundleUtils.createBundle(
295                 "setApplicationRestrictions_restrictionsChangedBroadcastIsReceived");
296 
297         try (TestAppInstance testApp = sTestApp.install()) {
298             testApp.registerReceiver(new IntentFilter(ACTION_APPLICATION_RESTRICTIONS_CHANGED),
299                     RECEIVER_EXPORTED);
300 
301             sDeviceState.dpc().devicePolicyManager()
302                     .setApplicationRestrictions(
303                             sDeviceState.dpc().componentName(), sTestApp.packageName(),
304                             bundle);
305 
306             assertThat(testApp.events().broadcastReceived().whereIntent().action().isEqualTo(
307                     ACTION_APPLICATION_RESTRICTIONS_CHANGED)).eventOccurred();
308         } finally {
309             sDeviceState.dpc().devicePolicyManager().setApplicationRestrictions(
310                     sDeviceState.dpc().componentName(),
311                     sTestApp.packageName(), originalApplicationRestrictions);
312         }
313     }
314 
315     @Postsubmit(reason = "New test")
316     @CanSetPolicyTest(policy = ApplicationRestrictionsManagingPackage.class)
setApplicationRestrictionsManagingPackage_applicationRestrictionsManagingPackageIsSet()317     public void setApplicationRestrictionsManagingPackage_applicationRestrictionsManagingPackageIsSet()
318             throws Exception {
319         final String originalApplicationRestrictionsManagingPackage =
320                 sDeviceState.dpc().devicePolicyManager().getApplicationRestrictionsManagingPackage(
321                         sDeviceState.dpc().componentName());
322         try (TestAppInstance testApp = sTestApp.install()) {
323             sDeviceState.dpc().devicePolicyManager().setApplicationRestrictionsManagingPackage(
324                     sDeviceState.dpc().componentName(), sTestApp.packageName());
325 
326             assertThat(sDeviceState.dpc().devicePolicyManager()
327                     .getApplicationRestrictionsManagingPackage(sDeviceState.dpc().componentName()))
328                     .isEqualTo(sTestApp.packageName());
329         } finally {
330             try {
331                 sDeviceState.dpc().devicePolicyManager().setApplicationRestrictionsManagingPackage(
332                         sDeviceState.dpc().componentName(),
333                         originalApplicationRestrictionsManagingPackage);
334             } catch (Throwable expected) {
335                 // If the original has been removed this can throw
336             }
337         }
338     }
339 
340     @Postsubmit(reason = "New test")
341     @CanSetPolicyTest(policy = ApplicationRestrictionsManagingPackage.class)
setApplicationRestrictionsManagingPackage_appNotInstalled_throwsException()342     public void setApplicationRestrictionsManagingPackage_appNotInstalled_throwsException() {
343         sDifferentTestApp.uninstall();
344 
345         assertThrows(PackageManager.NameNotFoundException.class,
346                 () -> sDeviceState.dpc().devicePolicyManager()
347                         .setApplicationRestrictionsManagingPackage(
348                                 sDeviceState.dpc().componentName(),
349                                 sDifferentTestApp.packageName()));
350     }
351 
352     @Postsubmit(reason = "New test")
353     @PolicyAppliesTest(policy = {
354             ApplicationRestrictions.class, DmrhOnlyApplicationRestrictions.class})
setApplicationRestrictions_logged()355     public void setApplicationRestrictions_logged() {
356         skipRoleHolderTestIfFlagNotEnabled();
357         Bundle originalApplicationRestrictions =
358                 sDeviceState.dpc().devicePolicyManager()
359                         .getApplicationRestrictions(
360                                 sDeviceState.dpc().componentName(), sTestApp.packageName());
361         Bundle bundle = BundleUtils.createBundle("setApplicationRestrictions_logged");
362 
363         try (EnterpriseMetricsRecorder metrics = EnterpriseMetricsRecorder.create();
364              TestAppInstance testApp = sTestApp.install()) {
365             sDeviceState.dpc().devicePolicyManager()
366                     .setApplicationRestrictions(
367                             sDeviceState.dpc().componentName(), sTestApp.packageName(),
368                             bundle);
369 
370             assertThat(metrics.query()
371                     .whereType().isEqualTo(EventId.SET_APPLICATION_RESTRICTIONS_VALUE)
372                     .whereAdminPackageName().isEqualTo(
373                             sDeviceState.dpc().packageName())
374                     .whereStrings().contains(sTestApp.packageName())
375                     .whereStrings().size().isEqualTo(1))
376                     .wasLogged();
377         } finally {
378             sDeviceState.dpc().devicePolicyManager().setApplicationRestrictions(
379                     sDeviceState.dpc().componentName(),
380                     sTestApp.packageName(), originalApplicationRestrictions);
381         }
382     }
383 
384     @Postsubmit(reason = "New test")
385     @CanSetPolicyTest(policy = {
386             ApplicationRestrictions.class, DmrhOnlyApplicationRestrictions.class})
setApplicationRestrictions_invalidPackageName_throwsException()387     public void setApplicationRestrictions_invalidPackageName_throwsException() {
388         Bundle bundle = BundleUtils.createBundle(
389                 "setApplicationRestrictions_invalidPackageName_throwsException");
390         assertThrows(IllegalArgumentException.class,
391                 () -> sDeviceState.dpc().devicePolicyManager().setApplicationRestrictions(
392                         sDeviceState.dpc().componentName(), "/../blah", bundle));
393     }
394 
395     @Postsubmit(reason = "New test")
396     @CanSetPolicyTest(policy = {
397             ApplicationRestrictions.class, DmrhOnlyApplicationRestrictions.class})
getApplicationRestrictionsPerAdmin_restrictionsSetForOneAdmin_returnsApplicationRestrictions()398     public void getApplicationRestrictionsPerAdmin_restrictionsSetForOneAdmin_returnsApplicationRestrictions() {
399         skipRoleHolderTestIfFlagNotEnabled();
400         Bundle originalApplicationRestrictions =
401                 sDeviceState.dpc().devicePolicyManager()
402                         .getApplicationRestrictions(
403                                 sDeviceState.dpc().componentName(), sTestApp.packageName());
404         Bundle bundle = BundleUtils.createBundle(
405                 "getApplicationRestrictionsPerAdmin_applicationRestrictionsAreSetForOneAdmin"
406                         + "_returnsApplicationRestrictions");
407 
408         try (TestAppInstance testApp = sTestApp.install()) {
409             sDeviceState.dpc().devicePolicyManager()
410                     .setApplicationRestrictions(
411                             sDeviceState.dpc().componentName(), sTestApp.packageName(),
412                             bundle);
413 
414             List<Bundle> restrictions = testApp.restrictionsManager()
415                     .getApplicationRestrictionsPerAdmin();
416             assertThat(restrictions.size()).isEqualTo(1);
417             BundleUtils.assertEqualToBundle("getApplicationRestrictionsPerAdmin"
418                             + "_applicationRestrictionsAreSetForOneAdmin"
419                             + "_returnsApplicationRestrictions",
420                     restrictions.get(0));
421         } finally {
422             sDeviceState.dpc().devicePolicyManager().setApplicationRestrictions(
423                     sDeviceState.dpc().componentName(),
424                     sTestApp.packageName(), originalApplicationRestrictions);
425         }
426     }
427 
428     @Postsubmit(reason = "New test")
429     @CanSetPolicyTest(policy = DmrhOnlyApplicationRestrictions.class)
430     @RequireFlagsEnabled(Flags.FLAG_DMRH_SET_APP_RESTRICTIONS)
roleHolderSetApplicationRestrictions_UserManagerReturnsNull()431     public void roleHolderSetApplicationRestrictions_UserManagerReturnsNull() {
432         Bundle originalApplicationRestrictions =
433                 sDeviceState.dpc().devicePolicyManager()
434                         .getApplicationRestrictions(
435                                 sDeviceState.dpc().componentName(), sTestApp.packageName());
436         Bundle bundle = BundleUtils.createBundle(
437                 "roleHolderSetApplicationRestrictions_UserManagerReturnsNull");
438 
439         try (TestAppInstance testApp = sTestApp.install()) {
440             sDeviceState.dpc().devicePolicyManager()
441                     .setApplicationRestrictions(
442                             sDeviceState.dpc().componentName(), sTestApp.packageName(),
443                             bundle);
444 
445             assertThat(testApp.userManager()
446                     .getApplicationRestrictions(testApp.packageName()).isEmpty()).isTrue();
447         } finally {
448             sDeviceState.dpc().devicePolicyManager().setApplicationRestrictions(
449                     sDeviceState.dpc().componentName(),
450                     sTestApp.packageName(), originalApplicationRestrictions);
451         }
452     }
453 
454     @EnsureHasDevicePolicyManagerRoleHolder(isPrimary = true, onUser = WORK_PROFILE)
455     @EnsureHasWorkProfile(isOrganizationOwned = true)
456     @RequireFlagsEnabled(Flags.FLAG_DMRH_SET_APP_RESTRICTIONS)
457     @UserTest({INITIAL_USER, PRIVATE_PROFILE})
458     @Test
roleHolderSetApplicationRestrictionsOnParent_successWithBroadcastSent()459     public void roleHolderSetApplicationRestrictionsOnParent_successWithBroadcastSent() {
460         ComponentName admin = sDeviceState.dpc().componentName();
461         Bundle originalApplicationRestrictions = sDeviceState.dpc().devicePolicyManager()
462                         .getApplicationRestrictions(admin, sTestApp.packageName());
463 
464         String bundleName = "parentUserBundle";
465 
466         try (TestAppInstance testApp = sTestApp.install()) {
467             testApp.registerReceiver(new IntentFilter(ACTION_APPLICATION_RESTRICTIONS_CHANGED),
468                     RECEIVER_EXPORTED);
469 
470             sDeviceState.dpc().devicePolicyManager()
471                     .getParentProfileInstance(admin)
472                     .setApplicationRestrictions(
473                     admin, sTestApp.packageName(), BundleUtils.createBundle(bundleName));
474 
475             List<Bundle> restrictions = testApp.restrictionsManager()
476                     .getApplicationRestrictionsPerAdmin();
477             assertThat(restrictions.size()).isEqualTo(1);
478             BundleUtils.assertEqualToBundle(bundleName, restrictions.get(0));
479 
480             assertThat(testApp.events().broadcastReceived().whereIntent().action().isEqualTo(
481                     ACTION_APPLICATION_RESTRICTIONS_CHANGED)).eventOccurred();
482         } finally {
483             sDeviceState.dpc().devicePolicyManager().setApplicationRestrictions(
484                     admin, sTestApp.packageName(), originalApplicationRestrictions);
485         }
486     }
487 
488     @EnsureHasDevicePolicyManagerRoleHolder(isPrimary = true, onUser = WORK_PROFILE)
489     @EnsureHasWorkProfile(isOrganizationOwned = false)
490     @RequireFlagsEnabled(Flags.FLAG_DMRH_SET_APP_RESTRICTIONS)
491     @RequireRunOnInitialUser
492     @Test
roleHolderSetApplicationRestrictionsOnParent_throwExceptionIfNotCope()493     public void roleHolderSetApplicationRestrictionsOnParent_throwExceptionIfNotCope() {
494         assertThrows(IllegalStateException.class, () -> {
495             sDeviceState.dpc().devicePolicyManager().getParentProfileInstance(null)
496                     .setApplicationRestrictions(
497                             sDeviceState.dpc().componentName(), sTestApp.packageName(),
498                             new Bundle());
499         });
500     }
501 
502     /**
503      * Verifies that DMRH and DPC can both set application restrictions without overwriting each
504      * other.
505      *
506      * To ensure this works correctly on HSUM, make sure DMRH, DPC and the TestApp all run on the
507      * instrumented user, using test annotations.
508      */
509     @Postsubmit(reason = "New test")
510     @EnsureHasDevicePolicyManagerRoleHolder
511     @EnsureHasProfileOwner(isPrimary = true)
512     @RequireFlagsEnabled(Flags.FLAG_DMRH_SET_APP_RESTRICTIONS)
513     @RequireRunOnInitialUser
514     @Test
dpcAndRoleHolderSetApplicationRestrictions_doesNotOverlap()515     public void dpcAndRoleHolderSetApplicationRestrictions_doesNotOverlap() {
516         skipRoleHolderTestIfFlagNotEnabled();
517         ComponentName dpcAdmin = sDeviceState.dpc().componentName();
518         ComponentName dmrhAdmin = sDeviceState.dpmRoleHolder().componentName();
519         Bundle originalDpcAppRestrictions = sDeviceState.dpc().devicePolicyManager()
520                 .getApplicationRestrictions(dpcAdmin, sTestApp.packageName());
521         Bundle originalRoleHolderAppRestrictions = sDeviceState.dpmRoleHolder()
522                 .devicePolicyManager()
523                 .getApplicationRestrictions(dmrhAdmin, sTestApp.packageName());
524 
525         try (TestAppInstance testApp = sTestApp.install()) {
526             sDeviceState.dpc().devicePolicyManager().setApplicationRestrictions(
527                     dpcAdmin, sTestApp.packageName(), BundleUtils.createBundle("dpcBundle"));
528             sDeviceState.dpmRoleHolder().devicePolicyManager().setApplicationRestrictions(
529                     null, sTestApp.packageName(), BundleUtils.createBundle("dmrhBundle"));
530 
531             BundleUtils.assertEqualToBundle("dpcBundle",
532                     testApp.userManager().getApplicationRestrictions(sTestApp.packageName()));
533 
534             List<Bundle> restrictions = testApp.restrictionsManager()
535                     .getApplicationRestrictionsPerAdmin();
536             BundleUtils.assertEqualToBundleList(restrictions, "dpcBundle", "dmrhBundle");
537         } finally {
538             sDeviceState.dpc().devicePolicyManager().setApplicationRestrictions(
539                     dpcAdmin, sTestApp.packageName(), originalDpcAppRestrictions);
540             sDeviceState.dpmRoleHolder().devicePolicyManager().setApplicationRestrictions(
541                     dmrhAdmin, sTestApp.packageName(), originalRoleHolderAppRestrictions);
542         }
543     }
544 
skipRoleHolderTestIfFlagNotEnabled()545     private void skipRoleHolderTestIfFlagNotEnabled() {
546         try {
547             if (sDeviceState.dpc() == sDeviceState.dpmRoleHolder()) {
548                 assumeTrue("This test only runs with flag "
549                         + Flags.FLAG_DMRH_SET_APP_RESTRICTIONS
550                         + " is enabled", Flags.dmrhSetAppRestrictions());
551             }
552         } catch (IllegalStateException e) {
553             // Fine - DMRH is not set
554         }
555     }
556 }
557