From dd1747011af674d0ff3f1cc7e65e08b58aff1696 Mon Sep 17 00:00:00 2001
From: Alex Johnston <acjohnston@google.com>
Date: Thu, 5 Mar 2020 17:51:38 +0000
Subject: [PATCH] Add policy transparency dialog to 'Remove work profile'

* For a work profile on an organization-owned device,
  no explanation was being shown to the user as to
  why the work profile cannot be removed.
* This CL adds a policy transparency dialog when the
  'Remove work profile' option is selected in the
  'Device Admin' Settings screen.

Bug: 149391073
Test: Manual testing
      atest com.android.settings.applications.specialaccess.deviceadmin.DeviceAdminAddTest
Change-Id: I8221973ed16fcc7c79f5897c3bea063050ae00a6
---
 .../deviceadmin/DeviceAdminAdd.java           | 21 +++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/src/com/android/settings/applications/specialaccess/deviceadmin/DeviceAdminAdd.java b/src/com/android/settings/applications/specialaccess/deviceadmin/DeviceAdminAdd.java
index 3e534b30b25..9afb2b4f2c1 100644
--- a/src/com/android/settings/applications/specialaccess/deviceadmin/DeviceAdminAdd.java
+++ b/src/com/android/settings/applications/specialaccess/deviceadmin/DeviceAdminAdd.java
@@ -457,12 +457,20 @@ public class DeviceAdminAdd extends Activity {
     private void showPolicyTransparencyDialogIfRequired() {
         if (isManagedProfile(mDeviceAdmin)
                 && mDeviceAdmin.getComponent().equals(mDPM.getProfileOwner())) {
-            if (hasBaseCantRemoveProfileRestriction()) {
-                // If DISALLOW_REMOVE_MANAGED_PROFILE is set by the system, there's no
-                // point showing a dialog saying it's disabled by an admin.
-                return;
+            EnforcedAdmin enforcedAdmin;
+            ComponentName adminComponent = mDPM.getProfileOwnerAsUser(getUserId());
+            if (adminComponent != null && mDPM.isOrganizationOwnedDeviceWithManagedProfile()) {
+                enforcedAdmin = new EnforcedAdmin(adminComponent,
+                        UserManager.DISALLOW_REMOVE_MANAGED_PROFILE, UserHandle.of(getUserId()));
+            } else {
+                // Todo (b/151061366): Investigate this case to check if it is still viable.
+                if (hasBaseCantRemoveProfileRestriction()) {
+                    // If DISALLOW_REMOVE_MANAGED_PROFILE is set by the system, there's no
+                    // point showing a dialog saying it's disabled by an admin.
+                    return;
+                }
+                enforcedAdmin = getAdminEnforcingCantRemoveProfile();
             }
-            EnforcedAdmin enforcedAdmin = getAdminEnforcingCantRemoveProfile();
             if (enforcedAdmin != null) {
                 RestrictedLockUtils.sendShowAdminSupportDetailsIntent(
                         DeviceAdminAdd.this,
@@ -640,7 +648,8 @@ public class DeviceAdminAdd extends Activity {
 
                 final EnforcedAdmin admin = getAdminEnforcingCantRemoveProfile();
                 final boolean hasBaseRestriction = hasBaseCantRemoveProfileRestriction();
-                if (admin != null && !hasBaseRestriction) {
+                if ((hasBaseRestriction && mDPM.isOrganizationOwnedDeviceWithManagedProfile())
+                        || (admin != null && !hasBaseRestriction)) {
                     findViewById(R.id.restricted_icon).setVisibility(View.VISIBLE);
                 }
                 mActionButton.setEnabled(admin == null && !hasBaseRestriction);