Disable background Gaia ListAccounts by default (fixes #4276)

Skip ListAccounts when browser sign-in is disabled, default new
profiles to sign-in disabled, and disable the sign-in promo on the
avatar button by default. Embedders can still opt in via
OnRegisterCustomPreferences.

libcef/common/chrome/chrome_main_delegate_cef.cc

@@ -32,6 +32,7 @@
 #include "components/autofill/core/common/autofill_features.h"
 #include "components/embedder_support/switches.h"
 #include "components/lens/lens_features.h"
+#include "components/signin/public/base/signin_switches.h"
 #include "components/variations/service/buildflags.h"
 #include "content/common/features.h"
 #include "content/public/common/content_switches.h"
@@ -380,6 +381,12 @@ std::optional<int> ChromeMainDelegateCef::BasicStartupComplete() {
     // -- "Search with Google Lens" support.
     DisableFeatureByDefault(lens::features::kLensOverlay, disable_features);
 
+#if BUILDFLAG(ENABLE_DICE_SUPPORT)
+    // Disable the sign-in promo on the avatar button by default.
+    DisableFeatureByDefault(switches::kSigninPromoOnAvatarPill,
+                            disable_features);
+#endif  // BUILDFLAG(ENABLE_DICE_SUPPORT)
+
     // Disable features that break CEF APIs.
     // -- KillOnInvalidNavigationHeaders kills the renderer when a navigation
     //    request carries headers outside the browser allowlist (Origin,

patch/patch.cfg

@@ -906,5 +906,12 @@ patches = [
   {
     # Guard background extensions dependency on enable_background_mode.
     'name': 'chrome_browser_extensions_background',
+  },
+  {
+    # Disable background Gaia ListAccounts when browser sign-in is disabled and
+    # default new CEF profiles to sign-in disabled. Embedders can opt in per
+    # request context via CefPreferenceRegistrar::SetDefaultPreference.
+    # https://github.com/chromiumembedded/cef/issues/4276
+    'name': 'signin_allowed_4276',
   }
 ]

patch/patches/signin_allowed_4276.patch

@@ -0,0 +1,37 @@
+diff --git chrome/browser/signin/account_consistency_mode_manager.cc chrome/browser/signin/account_consistency_mode_manager.cc
+index 7d4c893cbcd995c48a00631f9cbfd736fb188e63..bfca8880151207480763f6a9d1f01bfb29864600 100644
+--- chrome/browser/signin/account_consistency_mode_manager.cc
++++ chrome/browser/signin/account_consistency_mode_manager.cc
+@@ -12,6 +12,7 @@
+ #include "base/metrics/histogram_macros.h"
+ #include "base/strings/string_util.h"
+ #include "build/build_config.h"
++#include "cef/libcef/features/features.h"
+ #include "chrome/browser/browser_process.h"
+ #include "chrome/browser/profiles/profile.h"
+ #include "chrome/browser/profiles/profile_attributes_storage.h"
+@@ -146,7 +147,8 @@ AccountConsistencyModeManager::~AccountConsistencyModeManager() = default;
+ // static
+ void AccountConsistencyModeManager::RegisterProfilePrefs(
+     user_prefs::PrefRegistrySyncable* registry) {
+-  registry->RegisterBooleanPref(prefs::kSigninAllowedOnNextStartup, true);
++  registry->RegisterBooleanPref(prefs::kSigninAllowedOnNextStartup,
++                                !BUILDFLAG(ENABLE_CEF));
+ }
+ 
+ // static
+diff --git components/signin/internal/identity_manager/gaia_cookie_manager_service.cc components/signin/internal/identity_manager/gaia_cookie_manager_service.cc
+index db2e0266aa2200f23d47eba563dac73e96fef1c7..cb8e446b47aa714914af2a1a195384a5b06163eb 100644
+--- components/signin/internal/identity_manager/gaia_cookie_manager_service.cc
++++ components/signin/internal/identity_manager/gaia_cookie_manager_service.cc
+@@ -525,6 +525,10 @@ GaiaCookieManagerService::GetCachedListAccounts() {
+ }
+ 
+ void GaiaCookieManagerService::TriggerListAccounts() {
++  if (!signin_client_->GetPrefs()->GetBoolean(prefs::kSigninAllowed)) {
++    return;
++  }
++
+   // Callers suspect that a check to Gaia needs to be done, don't rely on the
+   // in progress request, conditions might have changed while the request is
+   // in-flight.

tests/ceftests/preference_unittest.cc

@@ -24,6 +24,7 @@ const char kPrefTestDict[] = "test.dict";
 const char kPrefTestNoExist[] = "test.noexist";
 #if CEF_API_ADDED(CEF_NEXT)
 const char kPrefTestOverride[] = "test.override";
+const char kSigninAllowed[] = "signin.allowed";
 const char kSigninAllowedOnNextStartup[] = "signin.allowed_on_next_startup";
 #endif
 
@@ -134,9 +135,23 @@ class PreferenceBrowserTest : public client::ClientAppBrowser::Delegate {
       // Registered by a Chrome keyed service, after RegisterUserProfilePrefs.
       EXPECT_FALSE(registrar->AddPreference(kSigninAllowedOnNextStartup,
                                             CreateBoolValue(true)));
+      auto signin_default =
+          registrar->GetDefaultPreference(kSigninAllowedOnNextStartup);
+      ASSERT_TRUE(signin_default);
+      EXPECT_EQ(VTYPE_BOOL, signin_default->GetType());
+      EXPECT_FALSE(signin_default->GetBool());
+
+      // Applications can opt in before the profile is created.
       EXPECT_TRUE(registrar->SetDefaultPreference(
           kSigninAllowedOnNextStartup, CreateBoolValue(true), error));
       EXPECT_TRUE(error.empty());
+      EXPECT_TRUE(registrar->GetDefaultPreference(kSigninAllowedOnNextStartup)
+                      ->GetBool());
+      EXPECT_TRUE(registrar->SetDefaultPreference(
+          kSigninAllowedOnNextStartup, signin_default, error));
+      EXPECT_TRUE(error.empty());
+      EXPECT_FALSE(registrar->GetDefaultPreference(kSigninAllowedOnNextStartup)
+                       ->GetBool());
     }
 #endif
   }
@@ -744,6 +759,36 @@ TEST(PreferenceTest, OverriddenRequestContextDefault) {
   ValidateOverriddenDefault(context, event);
   event->Wait();
 }
+
+void ValidateSigninDisabled(CefRefPtr<CefRequestContext> context,
+                            CefRefPtr<CefWaitableEvent> event) {
+  if (!CefCurrentlyOn(TID_UI)) {
+    CefPostTask(TID_UI, base::BindOnce(ValidateSigninDisabled, context, event));
+    return;
+  }
+
+  // The registration default is applied before account consistency initializes.
+  auto next_startup = context->GetPreference(kSigninAllowedOnNextStartup);
+  EXPECT_TRUE(next_startup);
+  if (next_startup) {
+    EXPECT_EQ(VTYPE_BOOL, next_startup->GetType());
+    EXPECT_FALSE(next_startup->GetBool());
+  }
+
+  auto allowed = context->GetPreference(kSigninAllowed);
+  EXPECT_TRUE(allowed);
+  if (allowed) {
+    EXPECT_EQ(VTYPE_BOOL, allowed->GetType());
+    EXPECT_FALSE(allowed->GetBool());
+  }
+  event->Signal();
+}
+
+TEST(PreferenceTest, RequestContextSigninDisabledByDefault) {
+  auto event = CefWaitableEvent::CreateWaitableEvent(true, false);
+  ValidateSigninDisabled(CefRequestContext::GetGlobalContext(), event);
+  event->Wait();
+}
 #endif  // CEF_API_ADDED(CEF_NEXT)
 
 // Entry point for creating preference browser test objects.