Testing managed storage on MacOS

[Hillel Solow]

Sorry if this is dumb, but I'm struggling to test an extension using Playwright/Chromium on MacOS and inject data that will show up as chrome.storage.managed. I've tries placing various json formats in various file locations. I've tried using defaults to set system wide values. I've tried loading a plist file. I'm kinda at my wits end. I'm sure it's something super simple, but it's eluding me.

I want the test scripts to be able to load different configurations into the managed storage data and launch chromium to test the extension in different configurations.

Thanks,

Hillel

[Oliver Dunk]

Hi Hillel,

Setting this up can be a bit tricky, since you need both the right schema in your manifest.json and a matching policy file. However, it's definitely possible to do.

Would you be comfortable sharing your manifest.json and policy file? Feel free to make a smaller hello world example if you can't share your real ones.

Oliver Dunk | DevRel, Chrome Extensions | https://developer.chrome.com/ | London, GB

--
You received this message because you are subscribed to the Google Groups "Chromium Extensions" group.
To unsubscribe from this group and stop receiving emails from it, send an email to chromium-extens...@chromium.org.
To view this discussion visit https://groups.google.com/a/chromium.org/d/msgid/chromium-extensions/4457b15c-6862-403a-8a93-f4c9182a1164n%40chromium.org.

[Hillel Solow]

Hi Oliver,

Thanks for the quick response! I'd be happy to share. Here's a simplified manifest.json and a sample policy schema I've been using. Let me know if you see anything obviously wrong.

Policy data I'm trying is something like:

{
  "3rdparty": {
    "extensions": {
      "iblnnhdjoilnigecdnnjlhnakihjopmb": {
        "authToken": "test-auth-token-123",
        "serverUrl": "https://api.example.com"
      }
    }
  }
}

For MacOS, what is the write way to set this?
I've seen:

• use defaults to set the policy. something like: execSync(`defaults write ${bundleId} policy -string '${policyJsonString}'`);
• use dscl to deploy some sort of plist file
• place a policy.json somewhere in the profile directory or in some other directory

Bear in mind that the first two options are less attractive to me, as I'm trying to run tests in sandboxed chromium environments with playwright and so it's kind of ugly to have to touch system level settings and then try to put them back after. It also makes it challenging to run tests in parallel. Is there some magical "--policy-file" options somewhere.

Thanks,
Hillel

[Oliver Dunk]

Hi Hillel,

The suggestions you have are along the right lines. Unfortunately, there isn't an easy way to set policy from a user profile directory (at least that I'm aware of).

If you really want to avoid system level changes, perhaps you could build a special testing mode into your extension? You could write a wrapper around storage, and then have special builds where this function returns predefined data. Alternatively, perhaps you could even add a way for Playwright to message your extension and set specific values in this fake storage.

It sounds like it isn't the path you want to go down, but I've been wanting to document the other ways of setting policy, so including that below in case it is helpful.

Using defaults

Run `defaults write com.google.Chrome.extensions.iblnnhdjoilnigecdnnjlhnakihjopmb serverUrl -string test`

Using `dscl`

Save the following as `test.plist`:

```

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>com.google.Chrome.extensions.iblnnhdjoilnigecdnnjlhnakihjopmb</key>
  <dict>
    <key>serverUrl</key>
    <dict>
      <key>state</key>
      <string>always</string>
      <key>value</key>
      <string>Hello World</string>
    </dict>
  </dict>
</dict>
</plist>

```

You would then be able to run:

1. `dscl /Local/Default -mcximport /Computers/local_computer test.plist` to import this
2. mcxrefresh -n <username> to refresh policies for a given macOS user
3. Click "Reload policies" on chrome://policy to detect the change

Note that this is an MCX file so does not identically follow the schema provided in your manifest.json file.

Using mobileconfig files

Save the following as `test.mobileconfig` file on your desktop:

```

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>PayloadContent</key>
  <array>
    <dict>
      <key>PayloadContent</key>
      <dict>
        <key>com.google.Chrome.extensions.iblnnhdjoilnigecdnnjlhnakihjopmb</key>
        <dict>
          <key>Forced</key>
          <array>
            <dict>
              <key>mcx_preference_settings</key>
              <dict>
                <key>serverUrl</key>
                <string>Hello World</string>
              </dict>
            </dict>
          </array>
        </dict>
      </dict>
      <key>PayloadEnabled</key>
      <true/>
      <key>PayloadIdentifier</key>
      <string>0a3dd694-2aa3-4cbc-a8da-38859c620b75</string>
      <key>PayloadType</key>
      <string>com.apple.ManagedClient.preferences</string>
      <key>PayloadUUID</key>
      <string>0a3dd694-2aa3-4cbc-a8da-38859c620b75</string>
      <key>PayloadVersion</key>
      <integer>1</integer>
    </dict>
  </array>
  <key>PayloadDescription</key>
  <string>Example policy for server.</string>
  <key>PayloadDisplayName</key>
  <string>Managed Storage Example</string>
  <key>PayloadIdentifier</key>
  <string>extensionupdateserver</string>
  <key>PayloadOrganization</key>
  <string></string>
  <key>PayloadRemovalDisallowed</key>
  <true/>
  <key>PayloadScope</key>
  <string>System</string>
  <key>PayloadType</key>
  <string>Configuration</string>
  <key>PayloadUUID</key>
  <string>71feadbc-6c9a-49e9-aa6f-d3625ce8639a</string>
  <key>PayloadVersion</key>
  <integer>1</integer>
</dict>
</plist>

```

To use this:

1. Double click the file to import the policy.
2. Open the "Device Management" tab in "System Settings" to approve it.
3. Click "Reload policies" on chrome://policy to detect the change.

This is my preferred approach as the schema more closely matches the manifest, and you can use the System Settings UI to easily remove the policy afterwards.

Oliver Dunk | DevRel, Chrome Extensions | https://developer.chrome.com/ | London, GB

[Hillel Solow]

Thanks so much! I'll give it a try and report back. 

Hillel

[Boris Figovsky]

Hi Oliver,

We are also testing managed storage in chrome extensions on macOS, and with macOS 15.6 we have noticed that:
Using defaults
The value is used in chrome://policy as Recommended and not Mandatory. However chrome.storage.managed.get(..) does not return it

Using `dscl`

mcxrefresh -n <username> fails with error code 9, and reload the policies in chrome://policy  has no affect.

(this happens only if you update from macOS <15.6 to macOS =15.6 or 26 beta)

Using mobileconfig
is not an option for automation (as it requires manual user interaction).

1. Is there any other automated method we can use?
2. What is the bundle id to be used for Chrome for Testing? (in place of com.google.Chrome)

Thank you in advance,

Boris.

[Oliver Dunk]

Hi Boris,

In testing we've seen that the public macOS 26.0 has a functional `mcxrefresh` command. Are you saying that it is still broken there for you?

The bundle ID for Chrome for Testing is com.google.chrome.for.testing :)

Oliver Dunk | DevRel, Chrome Extensions | https://developer.chrome.com/ | London, GB

[Boris Figovsky]

Hi Oliver,

Thank you for your response.

Regarding `mcxrefresh`, we've observed that it works on a fresh macOS installation. However, it appears to break when macOS is updated to versions 15.6 or 26.

Best regards,

Boris

--

Boris Figovsky Director of Browser Security Perception Point +972(54)4524788 boris.f...@perception-point.io https://perception-point.io/

[Oliver Dunk]

Hmm, I'm not sure in that case. It worked for us but of course we're not experts in macOS administration.

There isn't much precedence for automated testing of managed storage and so I think this is something that you would need to figure out on your end. Please do let us know if you find anything useful!

Oliver Dunk | DevRel, Chrome Extensions | https://developer.chrome.com/ | London, GB