Enterprise policy for DevTools AI features

Adds an enterprise policy to disable/allow DevTools AI features
(only Console Insights for now). Using an int instead of a boolean,
because we might add a third option (allow, but don't allow data to
be used for model training) later.

Bug: b/299423255
Change-Id: I9fa054a12bc524ff86967207e04c3254dfd7a756
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5244671
Reviewed-by: Anqing Zhao <anqing@chromium.org>
Reviewed-by: Cris Guerrero Romero <crisguerrero@chromium.org>
Commit-Queue: Wolfgang Beyer <wolfi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1259712}

chrome/browser/BUILD.gn

@@ -1908,6 +1908,8 @@ static_library("browser") {
       "picture_in_picture/auto_pip_setting_overlay_view.h",
       "picture_in_picture/auto_pip_setting_view.cc",
       "picture_in_picture/auto_pip_setting_view.h",
+      "policy/devtools_gen_ai_policy_handler.cc",
+      "policy/devtools_gen_ai_policy_handler.h",
       "preloading/preview/preview_manager.cc",
       "preloading/preview/preview_manager.h",
       "preloading/preview/preview_navigation_throttle.cc",

chrome/browser/devtools/devtools_browsertest.cc

@@ -37,6 +37,7 @@
 #include "chrome/browser/browser_features.h"
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/devtools/device/tcp_device_provider.h"
+#include "chrome/browser/devtools/devtools_window.h"
 #include "chrome/browser/devtools/devtools_window_testing.h"
 #include "chrome/browser/devtools/protocol/browser_handler.h"
 #include "chrome/browser/extensions/api/developer_private/developer_private_api.h"
@@ -3742,3 +3743,86 @@ IN_PROC_BROWSER_TEST_F(DevToolsProcessPerSiteUpToMainFrameThresholdTest,
   ASSERT_NE(webcontents->GetPrimaryMainFrame()->GetProcess(),
             webcontents2->GetPrimaryMainFrame()->GetProcess());
 }
+
+class DevToolsConsoleInsightsTest : public DevToolsTest {
+ public:
+  DevToolsConsoleInsightsTest() {
+    scoped_feature_list_.InitAndEnableFeature(
+        features::kDevToolsConsoleInsights);
+    policy_provider_.SetDefaultReturns(
+        /*is_initialization_complete_return=*/true,
+        /*is_first_policy_load_complete_return=*/true);
+    policy::BrowserPolicyConnector::SetPolicyProviderForTesting(
+        &policy_provider_);
+  }
+
+  ~DevToolsConsoleInsightsTest() override = default;
+
+ private:
+  base::test::ScopedFeatureList scoped_feature_list_;
+
+ protected:
+  testing::NiceMock<policy::MockConfigurationPolicyProvider> policy_provider_;
+};
+
+IN_PROC_BROWSER_TEST_F(DevToolsConsoleInsightsTest,
+                       CanBeDisabledByEnterprisePolicy) {
+  OpenDevToolsWindow(kDebuggerTestPage, false);
+  WebContents* wc = DevToolsWindowTesting::Get(window_)->main_web_contents();
+#if BUILDFLAG(GOOGLE_CHROME_BRANDING)
+  EXPECT_NE(std::string::npos,
+            wc->GetLastCommittedURL().query().find("&enableAida=true"));
+#else
+  EXPECT_EQ(std::string::npos,
+            wc->GetLastCommittedURL().query().find("&enableAida=true"));
+#endif
+  CloseDevToolsWindow();
+
+  // Disable via enterprise policy.
+  policy::PolicyMap policies;
+  policies.Set(policy::key::kDevToolsGenAiSettings,
+               policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_USER,
+               policy::POLICY_SOURCE_CLOUD, base::Value(/* disable */ 2),
+               nullptr);
+  policy_provider_.UpdateChromePolicy(policies);
+  base::RunLoop().RunUntilIdle();
+
+  OpenDevToolsWindow(kDebuggerTestPage, false);
+  wc = DevToolsWindowTesting::Get(window_)->main_web_contents();
+  EXPECT_EQ(std::string::npos,
+            wc->GetLastCommittedURL().query().find("&enableAida=true"));
+  CloseDevToolsWindow();
+
+  // Enable via enterprise policy.
+  policies.Set(policy::key::kDevToolsGenAiSettings,
+               policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_USER,
+               policy::POLICY_SOURCE_CLOUD, base::Value(/* allow */ 0),
+               nullptr);
+  policy_provider_.UpdateChromePolicy(policies);
+  base::RunLoop().RunUntilIdle();
+
+  OpenDevToolsWindow(kDebuggerTestPage, false);
+  wc = DevToolsWindowTesting::Get(window_)->main_web_contents();
+#if BUILDFLAG(GOOGLE_CHROME_BRANDING)
+  EXPECT_NE(std::string::npos,
+            wc->GetLastCommittedURL().query().find("&enableAida=true"));
+#else
+  EXPECT_EQ(std::string::npos,
+            wc->GetLastCommittedURL().query().find("&enableAida=true"));
+#endif
+  CloseDevToolsWindow();
+
+  // Use value for a potential future "enable and don't store data for model
+  // training" policy to disable via enterprise policy.
+  policies.Set(policy::key::kDevToolsGenAiSettings,
+               policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_USER,
+               policy::POLICY_SOURCE_CLOUD, base::Value(1), nullptr);
+  policy_provider_.UpdateChromePolicy(policies);
+  base::RunLoop().RunUntilIdle();
+
+  OpenDevToolsWindow(kDebuggerTestPage, false);
+  wc = DevToolsWindowTesting::Get(window_)->main_web_contents();
+  EXPECT_EQ(std::string::npos,
+            wc->GetLastCommittedURL().query().find("&enableAida=true"));
+  CloseDevToolsWindow();
+}

chrome/browser/devtools/devtools_window.cc

@@ -117,6 +117,12 @@ static const char kJSFrontendURL[] = "devtools://devtools/bundled/js_app.html";
 static const char kFallbackFrontendURL[] =
     "devtools://devtools/bundled/inspector.html";
 
+// The possible values for the DevTools GenAI enterprise policy.
+enum class DevToolsGenAiEnterprisePolicyValue {
+  kAllow = 0,
+  kDisable = 2,
+};
+
 bool FindInspectedBrowserAndTabIndex(
     WebContents* inspected_web_contents, Browser** browser, int* tab) {
   if (!inspected_web_contents)
@@ -512,6 +518,9 @@ void DevToolsWindow::RegisterProfilePrefs(
       user_prefs::PrefRegistrySyncable::SYNCABLE_PREF);
   registry->RegisterDictionaryPref(
       prefs::kDevToolsSyncedPreferencesSyncDisabled);
+  registry->RegisterIntegerPref(
+      prefs::kDevToolsGenAiSettings,
+      static_cast<int>(DevToolsGenAiEnterprisePolicyValue::kAllow));
 }
 
 // static
@@ -1250,7 +1259,9 @@ GURL DevToolsWindow::GetDevToolsURL(Profile* profile,
         url += "&veLogging=true";
       }
 #if BUILDFLAG(GOOGLE_CHROME_BRANDING)
-      if (base::FeatureList::IsEnabled(::features::kDevToolsConsoleInsights)) {
+      if (base::FeatureList::IsEnabled(::features::kDevToolsConsoleInsights) &&
+          profile->GetPrefs()->GetInteger(prefs::kDevToolsGenAiSettings) ==
+              static_cast<int>(DevToolsGenAiEnterprisePolicyValue::kAllow)) {
         url += "&enableAida=true&aidaModelId=" +
                features::kDevToolsConsoleInsightsModelId.Get() +
                "&aidaTemperature=" +

chrome/browser/policy/configuration_policy_handler_list_factory.cc

@@ -143,6 +143,7 @@
 #include "chrome/browser/enterprise/connectors/enterprise_connectors_policy_handler.h"
 #include "chrome/browser/enterprise/reporting/extension_request/extension_request_policy_handler.h"
 #include "chrome/browser/media/router/discovery/access_code/access_code_cast_feature.h"
+#include "chrome/browser/policy/devtools_gen_ai_policy_handler.h"
 #include "chrome/browser/policy/local_sync_policy_handler.h"
 #include "chrome/browser/policy/managed_account_policy_handler.h"
 #include "chrome/browser/web_applications/policy/web_app_settings_policy_handler.h"
@@ -2407,6 +2408,7 @@ std::unique_ptr<ConfigurationPolicyHandlerList> BuildHandlerList(
           key::kWindowManagementBlockedForUrls,
           prefs::kManagedWindowManagementBlockedForUrls,
           base::Value::Type::LIST)));
+  handlers->AddHandler(std::make_unique<DevtoolsGenAiPolicyHandler>());
 #endif  // BUILDFLAG(IS_ANDROID)
 
 #if BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC) || BUILDFLAG(IS_LINUX) || \

chrome/browser/policy/devtools_gen_ai_policy_handler.cc

@@ -0,0 +1,34 @@
+// Copyright 2024 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/policy/devtools_gen_ai_policy_handler.h"
+
+#include "base/values.h"
+#include "chrome/common/pref_names.h"
+#include "components/policy/core/common/policy_map.h"
+#include "components/policy/policy_constants.h"
+#include "components/prefs/pref_value_map.h"
+
+namespace policy {
+
+DevtoolsGenAiPolicyHandler::DevtoolsGenAiPolicyHandler()
+    : IntRangePolicyHandlerBase(key::kDevToolsGenAiSettings, 0, 2, false) {}
+
+DevtoolsGenAiPolicyHandler::~DevtoolsGenAiPolicyHandler() {}
+
+void DevtoolsGenAiPolicyHandler::ApplyPolicySettings(const PolicyMap& policies,
+                                                     PrefValueMap* prefs) {
+  const base::Value* const value =
+      policies.GetValue(policy_name(), base::Value::Type::INTEGER);
+  int value_in_range;
+  if (value && EnsureInRange(value, &value_in_range, nullptr)) {
+    // Map unimplemented value 1 (enable, but don't use data) to 2 (disable)
+    if (value_in_range == 1) {
+      value_in_range = 2;
+    }
+    prefs->SetInteger(prefs::kDevToolsGenAiSettings, value_in_range);
+  }
+}
+
+}  // namespace policy

chrome/browser/policy/devtools_gen_ai_policy_handler.h

@@ -0,0 +1,31 @@
+// Copyright 2024 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_POLICY_DEVTOOLS_GEN_AI_POLICY_HANDLER_H_
+#define CHROME_BROWSER_POLICY_DEVTOOLS_GEN_AI_POLICY_HANDLER_H_
+
+#include "components/policy/core/browser/configuration_policy_handler.h"
+
+class PrefValueMap;
+
+namespace policy {
+
+class PolicyMap;
+
+class DevtoolsGenAiPolicyHandler : public IntRangePolicyHandlerBase {
+ public:
+  DevtoolsGenAiPolicyHandler();
+  DevtoolsGenAiPolicyHandler(const DevtoolsGenAiPolicyHandler&) = delete;
+  DevtoolsGenAiPolicyHandler& operator=(const DevtoolsGenAiPolicyHandler&) =
+      delete;
+  ~DevtoolsGenAiPolicyHandler() override;
+
+  // IntRangePolicyHandlerBase:
+  void ApplyPolicySettings(const PolicyMap& policies,
+                           PrefValueMap* prefs) override;
+};
+
+}  // namespace policy
+
+#endif  // CHROME_BROWSER_POLICY_DEVTOOLS_GEN_AI_POLICY_HANDLER_H_

chrome/common/pref_names.h

@@ -2316,6 +2316,8 @@ inline constexpr char kDevToolsSyncedPreferencesSyncEnabled[] =
 inline constexpr char kDevToolsSyncedPreferencesSyncDisabled[] =
     "devtools.synced_preferences_sync_disabled";
 
+inline constexpr char kDevToolsGenAiSettings[] = "devtools.gen_ai_settings";
+
 #if !BUILDFLAG(IS_ANDROID)
 // Tracks the number of times the dice signin promo has been shown in the user
 // menu.

components/policy/resources/templates/policies.yaml

@@ -1215,6 +1215,7 @@ policies:
   1214: GoogleLocationServicesEnabled
   1215: ProvisionManagedClientCertificateForUser
   1216: LocalUserFilesAllowed
+  1217: DevToolsGenAiSettings
 atomic_groups:
   1: Homepage
   2: RemoteAccess

components/policy/resources/templates/policy_definitions/GenerativeAI/DevToolsGenAiSettings.yaml

@@ -0,0 +1,38 @@
+caption: Settings for DevTools Generative AI Features
+
+desc: |-
+  These features in <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph>'s DevTools employ generative AI models to provide additional debugging information. To use these features, <ph name="PRODUCT_NAME">$1<ex>Google Chrome</ex></ph> has to collect data such as error messages, stack traces, code snippets, and network requests and send them to a server owned by Google, which runs a generative AI model. Response body or authentication and cookie headers in network requests are not included in the data sent to the server.
+
+  0 = Enable the feature for users, and send relevant data to Google to help train or improve AI models. 0 is the default value.
+
+  2 = Disable the feature.
+
+  DevTools Generative AI features include:
+
+  - Console Insights: explains console messages and offers suggestions on how to fix console errors.
+default: 0
+example_value: 0
+features:
+  dynamic_refresh: true
+  per_profile: true
+items:
+- caption: Enable the features and send data to help train AI models
+  name: Allowed
+  value: 0
+# Potential future value 1: Enable the feature but don't send data to help train AI models
+- caption: Disable the features
+  name: Disabled
+  value: 2
+owners:
+- wolfi@chromium.org
+- devtools-console-insights@google.com
+schema:
+  enum:
+  - 0
+  - 2
+  type: integer
+supported_on:
+- chrome.*:123-
+- chrome_os:123-
+tags: []
+type: int-enum

components/policy/test/data/pref_mapping/DevToolsGenAiSettings.json

@@ -0,0 +1,51 @@
+[
+    {
+      "os": [
+        "win",
+        "linux",
+        "mac",
+        "chromeos_lacros",
+        "chromeos_ash"
+      ],
+      "policy_pref_mapping_tests": [
+        {
+          "policies": {},
+          "prefs": {
+            "devtools.gen_ai_settings": {
+              "default_value": 0
+            }
+          }
+        },
+        {
+          "policies": {
+            "DevToolsGenAiSettings": 0
+          },
+          "prefs": {
+            "devtools.gen_ai_settings": {
+              "value": 0
+            }
+          }
+        },
+        {
+          "policies": {
+            "DevToolsGenAiSettings": 1
+          },
+          "prefs": {
+            "devtools.gen_ai_settings": {
+              "value": 2
+            }
+          }
+        },
+        {
+          "policies": {
+            "DevToolsGenAiSettings": 2
+          },
+          "prefs": {
+            "devtools.gen_ai_settings": {
+              "value": 2
+            }
+          }
+        }
+      ]
+    }
+  ]

tools/metrics/histograms/metadata/enterprise/enums.xml

@@ -2030,6 +2030,7 @@ chromium-metrics-reviews@google.com.
   <int value="1214" label="GoogleLocationServicesEnabled"/>
   <int value="1215" label="ProvisionManagedClientCertificateForUser"/>
   <int value="1216" label="LocalUserFilesAllowed"/>
+  <int value="1217" label="DevToolsGenAiSettings"/>
 </enum>
 
 <enum name="EnterprisePoliciesSources">