From c05f05808366c9177ee955528791c442d328cb71 Mon Sep 17 00:00:00 2001
From: Nikhil Kumar <nykkumar@google.com>
Date: Tue, 6 Aug 2024 14:15:40 +0100
Subject: [PATCH] SettingsApp Implement DISALLOW_GRANT_ADMIN in user creation
 flow

In the process of creating a user through the Settings app, if the current user has the DISALLOW_GRANT_ADMIN restriction, the dialogue for granting ADMIN privileges will be hidden after this implementation. This action ensures that even if child users can create SECONDARY users, they cannot create ADMIN users.

Design doc: go/unicorn-hsum

Bug: 357819541
Test: manually verified the user is not allowed to create ADMIN user when DISALLOW_GRANT_ADMIN restriction is applied.
Flag: android.multiuser.unicorn_mode_refactoring_for_hsum_read_only
Change-Id: I4b40f83b50d4de0af103d4f5ca400e42345144e0
---
 src/com/android/settings/users/UserSettings.java | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/src/com/android/settings/users/UserSettings.java b/src/com/android/settings/users/UserSettings.java
index 0cf01e311e1..c387d9e461d 100644
--- a/src/com/android/settings/users/UserSettings.java
+++ b/src/com/android/settings/users/UserSettings.java
@@ -919,7 +919,7 @@ public class UserSettings extends SettingsPreferenceFragment
             d = mCreateUserDialogController.createDialog(
                     getActivity(),
                     this::startActivityForResult,
-                    UserManager.isMultipleAdminEnabled(),
+                    canCreateAdminUser(),
                     (userName, userIcon, isAdmin) -> {
                         mPendingUserIcon = userIcon;
                         mPendingUserName = userName;
@@ -937,6 +937,19 @@ public class UserSettings extends SettingsPreferenceFragment
         return d;
     }
 
+    /**
+     * Checks if the creation of a new admin user is allowed.
+     * @return {@code true} if creating a new admin is allowed, {@code false} otherwise.
+     */
+    private boolean canCreateAdminUser() {
+        if (Flags.unicornModeRefactoringForHsumReadOnly()) {
+            return UserManager.isMultipleAdminEnabled()
+                    && !mUserManager.hasUserRestriction(UserManager.DISALLOW_GRANT_ADMIN);
+        } else {
+            return UserManager.isMultipleAdminEnabled();
+        }
+    }
+
     @Override
     public int getDialogMetricsCategory(int dialogId) {
         switch (dialogId) {