Bug 2001734 - Add a policy for launch on login. r=tgiles,iholmes,fluent-reviewers,bolsson

Differential Revision: https://phabricator.services.mozilla.com/D313712

Author: mkaply

browser/components/enterprisepolicies/Policies.sys.mjs

@@ -29,6 +29,7 @@ ChromeUtils.defineESModuleGetters(lazy, {
   SearchService: "moz-src:///toolkit/components/search/SearchService.sys.mjs",
   QuickSuggest: "moz-src:///browser/components/urlbar/QuickSuggest.sys.mjs",
   WebsiteFilter: "resource:///modules/policies/WebsiteFilter.sys.mjs",
+  WindowsLaunchOnLogin: "resource://gre/modules/WindowsLaunchOnLogin.sys.mjs",
 
   PoliciesUtils: "resource://gre/modules/PoliciesHelpers.sys.mjs",
   addAllowDenyPermissions: "resource://gre/modules/PoliciesHelpers.sys.mjs",
@@ -1220,6 +1221,20 @@ export var Policies = {
     },
   },
 
+  DisableLaunchOnLogin: {
+    onBeforeAddons(manager, param) {
+      if (!param || AppConstants.platform !== "win") {
+        return;
+      }
+      manager.disallowFeature("launchOnLogin");
+      lazy.PoliciesUtils.setAndLockPref(
+        "browser.startup.windowsLaunchOnLogin.enabled",
+        false
+      );
+      lazy.WindowsLaunchOnLogin.removeLaunchOnLogin();
+    },
+  },
+
   DisableMasterPasswordCreation: {
     onBeforeUIStartup(manager, param) {
       if (param) {

browser/components/enterprisepolicies/schemas/policies-schema.json

@@ -897,6 +897,13 @@
       "examples": [true, false]
     },
 
+    "DisableLaunchOnLogin": {
+      "type": "boolean",
+      "x-category": "Startup",
+      "description": "Prevent Firefox from launching automatically when the user logs in, and prevent the user from enabling this setting. This policy currently only has an effect on Windows.",
+      "examples": [true]
+    },
+
     "DisableMasterPasswordCreation": {
       "type": "boolean",
       "x-category": "Password manager",

browser/components/enterprisepolicies/tests/browser/browser.toml

@@ -61,6 +61,11 @@ https_first_disabled = true
 
 ["browser_policy_disable_fxaccounts.js"]
 
+["browser_policy_disable_launch_on_login.js"]
+run-if = [
+  "os == 'win'",
+]
+
 ["browser_policy_disable_masterpassword.js"]
 
 ["browser_policy_disable_password_reveal.js"]

browser/components/enterprisepolicies/tests/browser/browser_policy_disable_launch_on_login.js

@@ -0,0 +1,104 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+"use strict";
+
+ChromeUtils.defineESModuleGetters(this, {
+  WindowsLaunchOnLogin: "resource://gre/modules/WindowsLaunchOnLogin.sys.mjs",
+});
+
+const { MockRegistry } = ChromeUtils.importESModule(
+  "resource://testing-common/MockRegistry.sys.mjs"
+);
+
+const ENABLED_PREF = "browser.startup.windowsLaunchOnLogin.enabled";
+const isMSIX = Services.sysinfo.getProperty("hasWinPackageId");
+
+let registry = null;
+
+add_setup(async function () {
+  registry = new MockRegistry();
+  registry.setValue(
+    Ci.nsIWindowsRegKey.ROOT_KEY_CURRENT_USER,
+    "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run",
+    "",
+    ""
+  );
+  registry.setValue(
+    Ci.nsIWindowsRegKey.ROOT_KEY_CURRENT_USER,
+    "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run",
+    "",
+    ""
+  );
+  registerCleanupFunction(async () => {
+    registry.shutdown();
+    await setupPolicyEngineWithJson("");
+  });
+});
+
+async function hasRegistryKey() {
+  let exists = false;
+  await WindowsLaunchOnLogin.withLaunchOnLoginRegistryKey(wrk => {
+    exists = wrk.hasValue(WindowsLaunchOnLogin.getLaunchOnLoginRegistryName());
+  });
+  return exists;
+}
+
+add_task(async function test_disable_launch_on_login() {
+  // Simulate the user having previously enabled launch on login.
+  if (!isMSIX) {
+    await WindowsLaunchOnLogin.createLaunchOnLogin();
+    ok(await hasRegistryKey(), "Registry key exists before the policy applies");
+  }
+
+  await setupPolicyEngineWithJson({
+    policies: {
+      DisableLaunchOnLogin: true,
+    },
+  });
+
+  is(
+    Services.prefs.getBoolPref(ENABLED_PREF),
+    false,
+    "Launch on login enabled pref is forced to false"
+  );
+  ok(Services.prefs.prefIsLocked(ENABLED_PREF), "Enabled pref is locked");
+
+  if (!isMSIX) {
+    await TestUtils.waitForCondition(
+      async () => !(await hasRegistryKey()),
+      "Waiting for the launch on login registry key to be removed"
+    );
+
+    await WindowsLaunchOnLogin.createLaunchOnLogin();
+    ok(
+      !(await hasRegistryKey()),
+      "createLaunchOnLogin is blocked while the policy is active"
+    );
+  }
+
+  await BrowserTestUtils.withNewTab("about:preferences", async browser => {
+    let doc = browser.contentDocument;
+    await TestUtils.waitForCondition(
+      () => doc.getElementById("windowsLaunchOnLogin"),
+      "windowsLaunchOnLogin checkbox rendered"
+    );
+    ok(
+      doc.getElementById("windowsLaunchOnLogin").parentElement.hidden,
+      "Checkbox is hidden by policy"
+    );
+  });
+});
+
+add_task(async function test_policy_false_is_noop() {
+  await setupPolicyEngineWithJson({
+    policies: {
+      DisableLaunchOnLogin: false,
+    },
+  });
+
+  ok(
+    !Services.prefs.prefIsLocked(ENABLED_PREF),
+    "Enabled pref is not locked when the policy is false"
+  );
+});

browser/locales/en-US/browser/policies/policies-descriptions.ftl

@@ -95,6 +95,8 @@ policy-DisableForgetButton = Prevent access to the Forget button.
 
 policy-DisableFormHistory = Don’t remember search and form history.
 
+policy-DisableLaunchOnLogin = Prevent { -brand-short-name } from launching automatically when the user logs in.
+
 policy-DisablePrimaryPasswordCreation = If true, a Primary Password can’t be created.
 
 policy-DisablePasswordReveal = Do not allow passwords to be revealed in saved logins.

toolkit/modules/WindowsLaunchOnLogin.sys.mjs

@@ -76,6 +76,9 @@ export var WindowsLaunchOnLogin = {
    * restrictions on writing to the registry in MSIX.
    */
   async createLaunchOnLogin() {
+    if (Services.policies && !Services.policies.isAllowed("launchOnLogin")) {
+      return;
+    }
     if (Services.sysinfo.getProperty("hasWinPackageId")) {
       await this.enableLaunchOnLoginMSIX();
     } else {