BASELINE: Update Chromium to 100.0.4896.167

Change-Id: I98cbeb5d7543d966ffe04d8cefded0c493a11333
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>

84 files changed, 1234 insertions, 647 deletions

diff --git a/chromium/components/signin/core/browser/BUILD.gn b/chromium/components/signin/core/browser/BUILD.gn
index d577cf2baf7..64c2d2bf6f1 100644
--- a/chromium/components/signin/core/browser/BUILD.gn
+++ b/chromium/components/signin/core/browser/BUILD.gn
@@ -98,6 +98,12 @@ static_library("browser") {
       "//chromeos/crosapi/mojom",
       "//chromeos/lacros",
     ]
+    sources += [
+      "consistency_cookie_manager.cc",
+      "consistency_cookie_manager.h",
+      "mirror_landing_account_reconcilor_delegate.cc",
+      "mirror_landing_account_reconcilor_delegate.h",
+    ]
   }
 
   if (!enable_dice_support) {
@@ -162,6 +168,10 @@ source_set("unit_tests") {
       "//chromeos/lacros",
       "//chromeos/lacros:test_support",
     ]
+    sources += [
+      "consistency_cookie_manager_unittest.cc",
+      "mirror_landing_account_reconcilor_delegate_unittest.cc",
+    ]
   }
 
   if (!enable_dice_support) {
diff --git a/chromium/components/signin/core/browser/account_investigator_unittest.cc b/chromium/components/signin/core/browser/account_investigator_unittest.cc
index d6b28c25d49..a43cd77de5e 100644
--- a/chromium/components/signin/core/browser/account_investigator_unittest.cc
+++ b/chromium/components/signin/core/browser/account_investigator_unittest.cc
@@ -393,7 +393,7 @@ TEST_F(AccountInvestigatorTest, TryPeriodicReportWithPrimary) {
 }
 
 // Neither iOS nor Android support unconsented primary accounts.
-#if !defined(OS_IOS) && !defined(OS_ANDROID)
+#if !BUILDFLAG(IS_IOS) && !BUILDFLAG(IS_ANDROID)
 TEST_F(AccountInvestigatorTest, TryPeriodicReportWithUnconsentedPrimary) {
   investigator()->Initialize();
 
@@ -413,7 +413,7 @@ TEST_F(AccountInvestigatorTest, TryPeriodicReportWithUnconsentedPrimary) {
       "Signin.CookieJar.SignedInCountWithPrimary.SyncConsumer",
       /*count=*/0);
 }
-#endif  // !defined(OS_IOS) && !defined(OS_ANDROID)
+#endif  // !BUILDFLAG(IS_IOS) && !BUILDFLAG(IS_ANDROID)
 
 TEST_F(AccountInvestigatorTest, TryPeriodicReportWithEnterprisePrimary) {
   investigator()->Initialize();
diff --git a/chromium/components/signin/core/browser/account_reconcilor.cc b/chromium/components/signin/core/browser/account_reconcilor.cc
index 2319062bb55..cf5b71c5079 100644
--- a/chromium/components/signin/core/browser/account_reconcilor.cc
+++ b/chromium/components/signin/core/browser/account_reconcilor.cc
@@ -22,7 +22,6 @@
 #include "base/strings/string_util.h"
 #include "base/task/single_thread_task_runner.h"
 #include "base/threading/thread_task_runner_handle.h"
-#include "build/build_config.h"
 #include "components/content_settings/core/browser/content_settings_observer.h"
 #include "components/signin/core/browser/account_reconcilor_delegate.h"
 #include "components/signin/public/base/account_consistency_method.h"
@@ -225,7 +224,7 @@ void AccountReconcilor::EnableReconcile() {
 
 void AccountReconcilor::DisableReconcile(bool logout_all_accounts) {
   AbortReconcile();
-  SetState(AccountReconcilorState::ACCOUNT_RECONCILOR_OK);
+  SetState(AccountReconcilorState::ACCOUNT_RECONCILOR_INACTIVE);
   UnregisterWithAllDependencies();
 
   if (logout_all_accounts)
@@ -284,7 +283,7 @@ void AccountReconcilor::UnregisterWithIdentityManager() {
   registered_with_identity_manager_ = false;
 }
 
-AccountReconcilorState AccountReconcilor::GetState() {
+AccountReconcilorState AccountReconcilor::GetState() const {
   return state_;
 }
 
@@ -389,7 +388,7 @@ void AccountReconcilor::StartReconcile(Trigger trigger) {
   CHECK(client_);
   if (!delegate_->IsReconcileEnabled() || !client_->AreSigninCookiesAllowed()) {
     VLOG(1) << "AccountReconcilor::StartReconcile: !enabled or no cookies";
-    SetState(AccountReconcilorState::ACCOUNT_RECONCILOR_OK);
+    SetState(AccountReconcilorState::ACCOUNT_RECONCILOR_INACTIVE);
     return;
   }
 
@@ -663,13 +662,13 @@ AccountReconcilor::LoadValidAccountsFromTokenService() const {
 
 void AccountReconcilor::OnReceivedManageAccountsResponse(
     signin::GAIAServiceType service_type) {
-#if !defined(OS_CHROMEOS)
+#if !BUILDFLAG(IS_CHROMEOS)
   // TODO(https://crbug.com/1224872): check if it's still required on Android
   // and iOS.
   if (service_type == signin::GAIA_SERVICE_TYPE_ADDSESSION) {
     identity_manager_->GetAccountsCookieMutator()->TriggerCookieJarUpdate();
   }
-#endif  // !defined(OS_CHROMEOS)
+#endif  // !BUILDFLAG(IS_CHROMEOS)
 }
 
 void AccountReconcilor::AbortReconcile() {
diff --git a/chromium/components/signin/core/browser/account_reconcilor.h b/chromium/components/signin/core/browser/account_reconcilor.h
index 3a0b0974fcc..ac10b0d4c74 100644
--- a/chromium/components/signin/core/browser/account_reconcilor.h
+++ b/chromium/components/signin/core/browser/account_reconcilor.h
@@ -16,6 +16,8 @@
 #include "base/time/time.h"
 #include "base/timer/timer.h"
 #include "build/build_config.h"
+#include "build/buildflag.h"
+#include "build/chromeos_buildflags.h"
 #include "components/content_settings/core/browser/content_settings_observer.h"
 #include "components/content_settings/core/common/content_settings_pattern.h"
 #include "components/keyed_service/core/keyed_service.h"
@@ -30,6 +32,10 @@
 namespace signin {
 class AccountReconcilorDelegate;
 enum class SetAccountsInCookieResult;
+
+#if BUILDFLAG(IS_CHROMEOS_LACROS)
+class ConsistencyCookieManagerTest;
+#endif
 }
 
 class SigninClient;
@@ -121,7 +127,7 @@ class AccountReconcilor : public KeyedService,
   void Shutdown() override;
 
   // Determine what the reconcilor is currently doing.
-  signin_metrics::AccountReconcilorState GetState();
+  signin_metrics::AccountReconcilorState GetState() const;
 
   // Adds ands removes observers.
   void AddObserver(Observer* observer);
@@ -141,10 +147,15 @@ class AccountReconcilor : public KeyedService,
 
  private:
   friend class AccountReconcilorTest;
-  friend class DiceBrowserTest;
-  friend class BaseAccountReconcilorTestTable;
-  friend class AccountReconcilorThrottlerTest;
   friend class AccountReconcilorTestForceDiceMigration;
+  friend class AccountReconcilorThrottlerTest;
+  friend class BaseAccountReconcilorTestTable;
+  friend class DiceBrowserTest;
+
+#if BUILDFLAG(IS_CHROMEOS_LACROS)
+  friend class signin::ConsistencyCookieManagerTest;
+#endif
+
   FRIEND_TEST_ALL_PREFIXES(AccountReconcilorTestForceDiceMigration,
                            TableRowTestCheckNoOp);
   FRIEND_TEST_ALL_PREFIXES(AccountReconcilorMirrorTest,
@@ -422,8 +433,11 @@ class AccountReconcilor : public KeyedService,
   // not invalidate the primary token while this is happening.
   int synced_data_deletion_in_progress_count_ = 0;
 
+  // Note: when the reconcilor is blocked with `BlockReconcile()` the state is
+  // set to ACCOUNT_RECONCILOR_SCHEDULED rather than ACCOUNT_RECONCILOR_INACTIVE
+  // as this is only used to temporarily suspend the reconcilor.
   signin_metrics::AccountReconcilorState state_ =
-      signin_metrics::ACCOUNT_RECONCILOR_OK;
+      signin_metrics::ACCOUNT_RECONCILOR_INACTIVE;
 
   // Set to true when Shutdown() is called.
   bool was_shut_down_ = false;
diff --git a/chromium/components/signin/core/browser/chrome_connected_header_helper.cc b/chromium/components/signin/core/browser/chrome_connected_header_helper.cc
index e252a6805ee..78876a115e0 100644
--- a/chromium/components/signin/core/browser/chrome_connected_header_helper.cc
+++ b/chromium/components/signin/core/browser/chrome_connected_header_helper.cc
@@ -15,6 +15,7 @@
 #include "build/chromeos_buildflags.h"
 #include "components/google/core/common/google_util.h"
 #include "components/signin/core/browser/cookie_settings_util.h"
+#include "components/signin/public/base/signin_switches.h"
 #include "components/signin/public/identity_manager/tribool.h"
 #include "google_apis/gaia/gaia_auth_util.h"
 #include "net/base/registry_controlled_domains/registry_controlled_domain.h"
@@ -41,7 +42,7 @@ const char kProfileModeAttrName[] = "mode";
 const char kServiceTypeAttrName[] = "action";
 const char kSupervisedAttrName[] = "supervised";
 const char kSourceAttrName[] = "source";
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 const char kEligibleForConsistency[] = "eligible_for_consistency";
 const char kShowConsistencyPromo[] = "show_consistency_promo";
 #endif
@@ -110,7 +111,7 @@ ManageAccountsParams ChromeConnectedHeaderHelper::BuildManageAccountsParams(
       params.continue_url = value;
     } else if (key_name == kIsSameTabAttrName) {
       params.is_same_tab = value == "true";
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
     } else if (key_name == kShowConsistencyPromo) {
       params.show_consistency_promo = value == "true";
 #endif
@@ -211,13 +212,13 @@ std::string ChromeConnectedHeaderHelper::BuildRequestHeader(
 #endif
 
   if (!force_account_consistency && gaia_id.empty()) {
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
     if (gaia::IsGaiaSignonRealm(url.DeprecatedGetOriginAsURL())) {
       parts.push_back(
           base::StringPrintf("%s=%s", kEligibleForConsistency, "true"));
       return base::JoinString(parts, is_header_request ? "," : ":");
     }
-#endif  // defined(OS_ANDROID) || defined(OS_IOS)
+#endif  // BUILDFLAG(IS_ANDROID) || BUILDFLAG(IS_IOS)
     return std::string();
   }
 
@@ -246,8 +247,19 @@ std::string ChromeConnectedHeaderHelper::BuildRequestHeader(
       // Do not add the supervised parameter.
       break;
   }
-  parts.push_back(base::StringPrintf(
-      "%s=%s", kConsistencyEnabledByDefaultAttrName, "false"));
+
+#if BUILDFLAG(IS_CHROMEOS_LACROS)
+  std::string consistency_enabled_by_default =
+      base::FeatureList::IsEnabled(switches::kLacrosNonSyncingProfiles)
+          ? "true"
+          : "false";
+#else
+  std::string consistency_enabled_by_default = "false";
+#endif
+
+  parts.push_back(base::StringPrintf("%s=%s",
+                                     kConsistencyEnabledByDefaultAttrName,
+                                     consistency_enabled_by_default.c_str()));
 
   return base::JoinString(parts, is_header_request ? "," : ":");
 }
diff --git a/chromium/components/signin/core/browser/consistency_cookie_manager.cc b/chromium/components/signin/core/browser/consistency_cookie_manager.cc
new file mode 100644
index 00000000000..29a36d582e8
--- /dev/null
+++ b/chromium/components/signin/core/browser/consistency_cookie_manager.cc
@@ -0,0 +1,106 @@
+// Copyright 2022 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/signin/core/browser/consistency_cookie_manager.h"
+
+#include "base/check.h"
+#include "base/time/time.h"
+#include "components/signin/public/base/signin_client.h"
+#include "google_apis/gaia/gaia_urls.h"
+#include "net/cookies/canonical_cookie.h"
+#include "net/cookies/cookie_options.h"
+#include "net/cookies/cookie_util.h"
+#include "services/network/public/mojom/cookie_manager.mojom.h"
+#include "url/gurl.h"
+
+namespace signin {
+
+const char ConsistencyCookieManager::kCookieName[] =
+    "CHROME_ID_CONSISTENCY_STATE";
+const char ConsistencyCookieManager::kCookieValueStringConsistent[] =
+    "Consistent";
+const char ConsistencyCookieManager::kCookieValueStringInconsistent[] =
+    "Inconsistent";
+const char ConsistencyCookieManager::kCookieValueStringUpdating[] = "Updating";
+
+ConsistencyCookieManager::ConsistencyCookieManager(
+    SigninClient* signin_client,
+    AccountReconcilor* reconcilor)
+    : signin_client_(signin_client), account_reconcilor_(reconcilor) {
+  DCHECK(signin_client_);
+  DCHECK(account_reconcilor_);
+  account_reconcilor_observation_.Observe(account_reconcilor_);
+  UpdateCookieIfNeeded();
+}
+
+ConsistencyCookieManager::~ConsistencyCookieManager() = default;
+
+// static
+void ConsistencyCookieManager::UpdateCookie(
+    network::mojom::CookieManager* cookie_manager,
+    CookieValue value) {
+  std::string cookie_value_string;
+  switch (value) {
+    case CookieValue::kConsistent:
+      cookie_value_string = kCookieValueStringConsistent;
+      break;
+    case CookieValue::kInconsistent:
+      cookie_value_string = kCookieValueStringInconsistent;
+      break;
+    case CookieValue::kUpdating:
+      cookie_value_string = kCookieValueStringUpdating;
+      break;
+  }
+  DCHECK(!cookie_value_string.empty());
+
+  // Update the cookie with the new value.
+  base::Time now = base::Time::Now();
+  base::Time expiry = now + base::Days(2 * 365);  // Two years.
+  std::unique_ptr<net::CanonicalCookie> cookie =
+      net::CanonicalCookie::CreateSanitizedCookie(
+          GaiaUrls::GetInstance()->gaia_url(), kCookieName, cookie_value_string,
+          GaiaUrls::GetInstance()->gaia_url().host(),
+          /*path=*/"/", /*creation=*/now, /*expiration=*/expiry,
+          /*last_access=*/now, /*secure=*/true, /*httponly=*/false,
+          net::CookieSameSite::LAX_MODE, net::COOKIE_PRIORITY_DEFAULT,
+          /*same_party=*/false, /*partition_key=*/absl::nullopt);
+  net::CookieOptions cookie_options;
+  // Permit to set SameSite cookies.
+  cookie_options.set_same_site_cookie_context(
+      net::CookieOptions::SameSiteCookieContext::MakeInclusive());
+  cookie_manager->SetCanonicalCookie(
+      *cookie, net::cookie_util::SimulatedCookieSource(*cookie, "https"),
+      cookie_options,
+      network::mojom::CookieManager::SetCanonicalCookieCallback());
+}
+
+void ConsistencyCookieManager::OnStateChanged(
+    signin_metrics::AccountReconcilorState state) {
+  UpdateCookieIfNeeded();
+}
+
+absl::optional<ConsistencyCookieManager::CookieValue>
+ConsistencyCookieManager::CalculateCookieValue() const {
+  switch (account_reconcilor_->GetState()) {
+    case signin_metrics::ACCOUNT_RECONCILOR_OK:
+      return CookieValue::kConsistent;
+    case signin_metrics::ACCOUNT_RECONCILOR_RUNNING:
+    case signin_metrics::ACCOUNT_RECONCILOR_SCHEDULED:
+      return CookieValue::kUpdating;
+    case signin_metrics::ACCOUNT_RECONCILOR_ERROR:
+      return CookieValue::kInconsistent;
+    case signin_metrics::ACCOUNT_RECONCILOR_INACTIVE:
+      return absl::nullopt;
+  }
+}
+
+void ConsistencyCookieManager::UpdateCookieIfNeeded() {
+  absl::optional<CookieValue> cookie_value = CalculateCookieValue();
+  if (!cookie_value.has_value() || cookie_value == cookie_value_)
+    return;
+  cookie_value_ = cookie_value;
+  UpdateCookie(signin_client_->GetCookieManager(), cookie_value_.value());
+}
+
+}  // namespace signin
diff --git a/chromium/components/signin/core/browser/consistency_cookie_manager.h b/chromium/components/signin/core/browser/consistency_cookie_manager.h
new file mode 100644
index 00000000000..45255ee8791
--- /dev/null
+++ b/chromium/components/signin/core/browser/consistency_cookie_manager.h
@@ -0,0 +1,77 @@
+// Copyright 2022 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef COMPONENTS_SIGNIN_CORE_BROWSER_CONSISTENCY_COOKIE_MANAGER_H_
+#define COMPONENTS_SIGNIN_CORE_BROWSER_CONSISTENCY_COOKIE_MANAGER_H_
+
+#include "base/gtest_prod_util.h"
+#include "base/scoped_observation.h"
+#include "components/signin/core/browser/account_reconcilor.h"
+#include "third_party/abseil-cpp/absl/types/optional.h"
+
+namespace network::mojom {
+class CookieManager;
+}
+
+class SigninClient;
+
+namespace signin {
+
+// The `ConsistencyCookieManager` manages the CHROME_ID_CONSISTENCY_STATE
+// cookie, which is used to display an interstitial page (a.k.a. "Mirror
+// Landing") while account additions are in progress. This avoids issues where
+// the user has to manually reload the page or retry their navigation after
+// adding an account to the OS account manager.
+// The value of the cookie depends on the state of the `AccountReconcilor` and
+// whether there is a native account addition flow in progress.
+//
+// TODO(https://crbug.com/1260291): The `ConsistencyCookieManager` only
+// listens to the `AccountReconcilor` for now, it is not updated by UI flows
+// yet.
+class ConsistencyCookieManager : public AccountReconcilor::Observer {
+ public:
+  explicit ConsistencyCookieManager(SigninClient* signin_client,
+                                    AccountReconcilor* reconcilor);
+  ~ConsistencyCookieManager() override;
+
+  ConsistencyCookieManager& operator=(const ConsistencyCookieManager&) = delete;
+  ConsistencyCookieManager(const ConsistencyCookieManager&) = delete;
+
+ private:
+  friend class ConsistencyCookieManagerTest;
+  FRIEND_TEST_ALL_PREFIXES(ConsistencyCookieManagerTest, ReconcilorState);
+
+  enum class CookieValue { kConsistent, kInconsistent, kUpdating };
+
+  // Cookie name and values.
+  static const char kCookieName[];
+  static const char kCookieValueStringConsistent[];
+  static const char kCookieValueStringInconsistent[];
+  static const char kCookieValueStringUpdating[];
+
+  // Sets the cookie to match `value`.
+  static void UpdateCookie(network::mojom::CookieManager* cookie_manager,
+                           CookieValue value);
+
+  // AccountReconcilor::Observer:
+  void OnStateChanged(signin_metrics::AccountReconcilorState state) override;
+
+  // Calculates the cookie value based on the reconcilor state.
+  absl::optional<CookieValue> CalculateCookieValue() const;
+
+  // Gets the new value using `CalculateCookieValue()` and sets the cookie if it
+  // changed.
+  void UpdateCookieIfNeeded();
+
+  SigninClient* const signin_client_;
+  AccountReconcilor* const account_reconcilor_;
+  absl::optional<CookieValue> cookie_value_ = absl::nullopt;
+
+  base::ScopedObservation<AccountReconcilor, AccountReconcilor::Observer>
+      account_reconcilor_observation_{this};
+};
+
+}  // namespace signin
+
+#endif  // COMPONENTS_SIGNIN_CORE_BROWSER_CONSISTENCY_COOKIE_MANAGER_H_
diff --git a/chromium/components/signin/core/browser/consistency_cookie_manager_unittest.cc b/chromium/components/signin/core/browser/consistency_cookie_manager_unittest.cc
new file mode 100644
index 00000000000..2bfef6e0f8d
--- /dev/null
+++ b/chromium/components/signin/core/browser/consistency_cookie_manager_unittest.cc
@@ -0,0 +1,133 @@
+// Copyright 2022 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/signin/core/browser/consistency_cookie_manager.h"
+
+#include "components/signin/core/browser/account_reconcilor.h"
+#include "components/signin/core/browser/account_reconcilor_delegate.h"
+#include "components/signin/public/base/signin_metrics.h"
+#include "components/signin/public/base/test_signin_client.h"
+#include "google_apis/gaia/gaia_urls.h"
+#include "net/cookies/canonical_cookie.h"
+#include "services/network/test/test_cookie_manager.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
+#include "third_party/abseil-cpp/absl/types/optional.h"
+
+namespace signin {
+
+namespace {
+
+class MockCookieManager
+    : public testing::StrictMock<network::TestCookieManager> {
+ public:
+  MOCK_METHOD4(SetCanonicalCookie,
+               void(const net::CanonicalCookie& cookie,
+                    const GURL& source_url,
+                    const net::CookieOptions& cookie_options,
+                    SetCanonicalCookieCallback callback));
+};
+
+}  // namespace
+
+class ConsistencyCookieManagerTest : public testing::Test {
+ public:
+  ConsistencyCookieManagerTest() {
+    std::unique_ptr<MockCookieManager> mock_cookie_manager =
+        std::make_unique<MockCookieManager>();
+    cookie_manager_ = mock_cookie_manager.get();
+    signin_client_.set_cookie_manager(std::move(mock_cookie_manager));
+  }
+
+  ~ConsistencyCookieManagerTest() override { reconcilor_.Shutdown(); }
+
+  void ExpectCookieSet(const std::string& value) {
+    const std::string expected_domain =
+        std::string(".") + GaiaUrls::GetInstance()->gaia_url().host();
+    EXPECT_CALL(
+        *cookie_manager_,
+        SetCanonicalCookie(
+            testing::AllOf(
+                testing::Property(&net::CanonicalCookie::Name,
+                                  ConsistencyCookieManager::kCookieName),
+                testing::Property(&net::CanonicalCookie::Value, value),
+                testing::Property(&net::CanonicalCookie::Domain,
+                                  expected_domain),
+                testing::Property(&net::CanonicalCookie::Path, "/"),
+                testing::Property(&net::CanonicalCookie::IsSecure, true),
+                testing::Property(&net::CanonicalCookie::IsHttpOnly, false)),
+            GaiaUrls::GetInstance()->gaia_url(), testing::_, testing::_));
+  }
+
+  void SetReconcilorState(signin_metrics::AccountReconcilorState state) {
+    account_reconcilor()->SetState(state);
+  }
+
+  AccountReconcilor* account_reconcilor() { return &reconcilor_; }
+  SigninClient* signin_client() { return &signin_client_; }
+  MockCookieManager* cookie_manager() { return cookie_manager_; }
+
+ private:
+  TestSigninClient signin_client_{/*prefs=*/nullptr};
+  MockCookieManager* cookie_manager_ = nullptr;  // Owned by `signin_client_`.
+  AccountReconcilor reconcilor_{/*identity_manager=*/nullptr, &signin_client_,
+                                std::make_unique<AccountReconcilorDelegate>()};
+};
+
+TEST_F(ConsistencyCookieManagerTest, ReconcilorState) {
+  // Initial state.
+  EXPECT_EQ(account_reconcilor()->GetState(),
+            signin_metrics::ACCOUNT_RECONCILOR_INACTIVE);
+  ConsistencyCookieManager cookie_consistency_manager(signin_client(),
+                                                      account_reconcilor());
+  // Cookie has not been set.
+  testing::Mock::VerifyAndClearExpectations(cookie_manager());
+
+  struct AccountReconcilorStateTestCase {
+    signin_metrics::AccountReconcilorState state;
+    absl::optional<std::string> cookie_value;
+  };
+
+  // Iterate over all reconcilor state and check that they map to the right
+  // cookie value.
+  // Notes about the order:
+  // - Don't start with OK, as this is the current state.
+  // - Always change the reconcilor state to something that results in a
+  //   different cookie value (otherwise the cookie is not updated).
+  AccountReconcilorStateTestCase cases[] = {
+      {signin_metrics::ACCOUNT_RECONCILOR_RUNNING,
+       ConsistencyCookieManager::kCookieValueStringUpdating},
+      {signin_metrics::ACCOUNT_RECONCILOR_OK,
+       ConsistencyCookieManager::kCookieValueStringConsistent},
+      {signin_metrics::ACCOUNT_RECONCILOR_ERROR,
+       ConsistencyCookieManager::kCookieValueStringInconsistent},
+      {signin_metrics::ACCOUNT_RECONCILOR_SCHEDULED,
+       ConsistencyCookieManager::kCookieValueStringUpdating},
+      {signin_metrics::ACCOUNT_RECONCILOR_INACTIVE, absl::nullopt},
+  };
+
+  for (const AccountReconcilorStateTestCase& test_case : cases) {
+    if (test_case.cookie_value.has_value())
+      ExpectCookieSet(test_case.cookie_value.value());
+    SetReconcilorState(test_case.state);
+    testing::Mock::VerifyAndClearExpectations(cookie_manager());
+  }
+
+  // Check that the cookie is not updated needlessly.
+  EXPECT_EQ(account_reconcilor()->GetState(),
+            signin_metrics::ACCOUNT_RECONCILOR_INACTIVE);
+  // Set again the state that was used before INACTIVE.
+  SetReconcilorState(signin_metrics::ACCOUNT_RECONCILOR_SCHEDULED);
+  testing::Mock::VerifyAndClearExpectations(cookie_manager());
+  // Setting the same state again does not update the cookie.
+  SetReconcilorState(signin_metrics::ACCOUNT_RECONCILOR_SCHEDULED);
+  testing::Mock::VerifyAndClearExpectations(cookie_manager());
+  // Setting a state that maps to the same value does not update the cookie.
+  EXPECT_EQ(account_reconcilor()->GetState(),
+            signin_metrics::ACCOUNT_RECONCILOR_SCHEDULED);
+  SetReconcilorState(signin_metrics::ACCOUNT_RECONCILOR_RUNNING);
+  testing::Mock::VerifyAndClearExpectations(cookie_manager());
+}
+
+}  // namespace signin
diff --git a/chromium/components/signin/core/browser/mirror_account_reconcilor_delegate.cc b/chromium/components/signin/core/browser/mirror_account_reconcilor_delegate.cc
index b1ec78b2b6b..b83cc8b7b86 100644
--- a/chromium/components/signin/core/browser/mirror_account_reconcilor_delegate.cc
+++ b/chromium/components/signin/core/browser/mirror_account_reconcilor_delegate.cc
@@ -40,7 +40,7 @@ bool MirrorAccountReconcilorDelegate::ShouldAbortReconcileIfPrimaryHasError()
 
 ConsentLevel MirrorAccountReconcilorDelegate::GetConsentLevelForPrimaryAccount()
     const {
-#if defined(OS_ANDROID) || defined(OS_IOS)
+#if BUILDFLAG(IS_ANDROID) || BUILDFLAG(IS_IOS)
   return ConsentLevel::kSignin;
 #elif BUILDFLAG(IS_CHROMEOS_LACROS)
   // Whenever Mirror is enabled on a Lacros Profile, the Primary Account may or
diff --git a/chromium/components/signin/core/browser/mirror_account_reconcilor_delegate.h b/chromium/components/signin/core/browser/mirror_account_reconcilor_delegate.h
index 5d986ceaa8f..6e0de8ba33c 100644
--- a/chromium/components/signin/core/browser/mirror_account_reconcilor_delegate.h
+++ b/chromium/components/signin/core/browser/mirror_account_reconcilor_delegate.h
@@ -56,8 +56,6 @@ class MirrorAccountReconcilorDelegate : public AccountReconcilorDelegate,
   // IdentityManager::Observer:
   void OnPrimaryAccountChanged(const PrimaryAccountChangeEvent& event) override;
 
-  void UpdateReconcilorStatus();
-
   raw_ptr<IdentityManager> identity_manager_;
   bool reconcile_enabled_;
 };
diff --git a/chromium/components/signin/core/browser/mirror_landing_account_reconcilor_delegate.cc b/chromium/components/signin/core/browser/mirror_landing_account_reconcilor_delegate.cc
new file mode 100644
index 00000000000..b62569359f5
--- /dev/null
+++ b/chromium/components/signin/core/browser/mirror_landing_account_reconcilor_delegate.cc
@@ -0,0 +1,74 @@
+// Copyright 2022 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/signin/core/browser/mirror_landing_account_reconcilor_delegate.h"
+
+#include "base/containers/contains.h"
+#include "base/logging.h"
+#include "google_apis/gaia/core_account_id.h"
+#include "google_apis/gaia/gaia_auth_fetcher.h"
+#include "google_apis/gaia/gaia_auth_util.h"
+
+namespace signin {
+
+MirrorLandingAccountReconcilorDelegate::
+    MirrorLandingAccountReconcilorDelegate() = default;
+
+MirrorLandingAccountReconcilorDelegate::
+    ~MirrorLandingAccountReconcilorDelegate() = default;
+
+bool MirrorLandingAccountReconcilorDelegate::IsReconcileEnabled() const {
+  return true;
+}
+
+gaia::GaiaSource MirrorLandingAccountReconcilorDelegate::GetGaiaApiSource()
+    const {
+  return gaia::GaiaSource::kAccountReconcilorMirror;
+}
+
+bool MirrorLandingAccountReconcilorDelegate::
+    ShouldAbortReconcileIfPrimaryHasError() const {
+  return true;
+}
+
+ConsentLevel
+MirrorLandingAccountReconcilorDelegate::GetConsentLevelForPrimaryAccount()
+    const {
+  return ConsentLevel::kSignin;
+}
+
+CoreAccountId
+MirrorLandingAccountReconcilorDelegate::GetFirstGaiaAccountForReconcile(
+    const std::vector<CoreAccountId>& chrome_accounts,
+    const std::vector<gaia::ListedAccount>& gaia_accounts,
+    const CoreAccountId& primary_account,
+    bool first_execution,
+    bool will_logout) const {
+  if (!primary_account.empty()) {
+    // `ShouldAbortReconcileIfPrimaryHasError()` returns true.
+    DCHECK(base::Contains(chrome_accounts, primary_account));
+    return primary_account;
+  }
+
+  // If there is no primary account, there should be no account at all.
+  DCHECK(chrome_accounts.empty());
+  return CoreAccountId();
+}
+
+std::vector<CoreAccountId>
+MirrorLandingAccountReconcilorDelegate::GetChromeAccountsForReconcile(
+    const std::vector<CoreAccountId>& chrome_accounts,
+    const CoreAccountId& primary_account,
+    const std::vector<gaia::ListedAccount>& gaia_accounts,
+    bool first_execution,
+    bool primary_has_error,
+    const gaia::MultiloginMode mode) const {
+  DCHECK(!primary_has_error);
+  DCHECK_EQ(mode,
+            gaia::MultiloginMode::MULTILOGIN_UPDATE_COOKIE_ACCOUNTS_ORDER);
+  return ReorderChromeAccountsForReconcile(chrome_accounts, primary_account,
+                                           gaia_accounts);
+}
+
+}  // namespace signin
diff --git a/chromium/components/signin/core/browser/mirror_landing_account_reconcilor_delegate.h b/chromium/components/signin/core/browser/mirror_landing_account_reconcilor_delegate.h
new file mode 100644
index 00000000000..ae252c016af
--- /dev/null
+++ b/chromium/components/signin/core/browser/mirror_landing_account_reconcilor_delegate.h
@@ -0,0 +1,47 @@
+// Copyright 2022 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef COMPONENTS_SIGNIN_CORE_BROWSER_MIRROR_LANDING_ACCOUNT_RECONCILOR_DELEGATE_H_
+#define COMPONENTS_SIGNIN_CORE_BROWSER_MIRROR_LANDING_ACCOUNT_RECONCILOR_DELEGATE_H_
+
+#include "components/signin/core/browser/account_reconcilor_delegate.h"
+
+namespace signin {
+
+// AccountReconcilorDelegate specialized for Mirror, using the "Mirror landing"
+// variant. Mirror is always enabled, even when there is no primary account.
+class MirrorLandingAccountReconcilorDelegate
+    : public AccountReconcilorDelegate {
+ public:
+  MirrorLandingAccountReconcilorDelegate();
+  ~MirrorLandingAccountReconcilorDelegate() override;
+
+  MirrorLandingAccountReconcilorDelegate(
+      const MirrorLandingAccountReconcilorDelegate&) = delete;
+  MirrorLandingAccountReconcilorDelegate& operator=(
+      const MirrorLandingAccountReconcilorDelegate&) = delete;
+
+  // AccountReconcilorDelegate:
+  bool IsReconcileEnabled() const override;
+  gaia::GaiaSource GetGaiaApiSource() const override;
+  bool ShouldAbortReconcileIfPrimaryHasError() const override;
+  ConsentLevel GetConsentLevelForPrimaryAccount() const override;
+  CoreAccountId GetFirstGaiaAccountForReconcile(
+      const std::vector<CoreAccountId>& chrome_accounts,
+      const std::vector<gaia::ListedAccount>& gaia_accounts,
+      const CoreAccountId& primary_account,
+      bool first_execution,
+      bool will_logout) const override;
+  std::vector<CoreAccountId> GetChromeAccountsForReconcile(
+      const std::vector<CoreAccountId>& chrome_accounts,
+      const CoreAccountId& primary_account,
+      const std::vector<gaia::ListedAccount>& gaia_accounts,
+      bool first_execution,
+      bool primary_has_error,
+      const gaia::MultiloginMode mode) const override;
+};
+
+}  // namespace signin
+
+#endif  // COMPONENTS_SIGNIN_CORE_BROWSER_MIRROR_LANDING_ACCOUNT_RECONCILOR_DELEGATE_H_
diff --git a/chromium/components/signin/core/browser/mirror_landing_account_reconcilor_delegate_unittest.cc b/chromium/components/signin/core/browser/mirror_landing_account_reconcilor_delegate_unittest.cc
new file mode 100644
index 00000000000..94cc99bdc1d
--- /dev/null
+++ b/chromium/components/signin/core/browser/mirror_landing_account_reconcilor_delegate_unittest.cc
@@ -0,0 +1,90 @@
+// Copyright 2022 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "components/signin/core/browser/mirror_landing_account_reconcilor_delegate.h"
+
+#include <string>
+
+#include "google_apis/gaia/core_account_id.h"
+#include "google_apis/gaia/gaia_auth_util.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace signin {
+
+namespace {
+
+gaia::ListedAccount BuildListedAccount(const std::string& gaia_id) {
+  CoreAccountId account_id = CoreAccountId::FromGaiaId(gaia_id);
+  gaia::ListedAccount gaia_account;
+  gaia_account.id = account_id;
+  gaia_account.email = gaia_id + std::string("@gmail.com");
+  gaia_account.gaia_id = gaia_id;
+  gaia_account.raw_email = gaia_account.email;
+  return gaia_account;
+}
+
+}  // namespace
+
+TEST(MirrorLandingAccountReconcilorDelegateTest,
+     GetFirstGaiaAccountForReconcile) {
+  gaia::ListedAccount gaia_account = BuildListedAccount("gaia");
+  CoreAccountId kPrimaryAccountId = CoreAccountId::FromGaiaId("primary");
+  CoreAccountId kOtherAccountId = CoreAccountId::FromGaiaId("other");
+  MirrorLandingAccountReconcilorDelegate delegate;
+  // No primary account.
+  EXPECT_TRUE(delegate
+                  .GetFirstGaiaAccountForReconcile(
+                      /*chrome_accounts=*/{},
+                      /*gaia_accounts=*/{gaia_account},
+                      /*primary_account=*/CoreAccountId(),
+                      /*first_execution=*/true,
+                      /*will_logout=*/false)
+                  .empty());
+  // With primary account.
+  EXPECT_EQ(delegate.GetFirstGaiaAccountForReconcile(
+                /*chrome_accounts=*/{{kOtherAccountId, kPrimaryAccountId}},
+                /*gaia_accounts=*/{gaia_account},
+                /*primary_account=*/kPrimaryAccountId,
+                /*first_execution=*/true,
+                /*will_logout=*/false),
+            kPrimaryAccountId);
+}
+
+TEST(MirrorLandingAccountReconcilorDelegateTest,
+     GetChromeAccountsForReconcile) {
+  CoreAccountId kPrimaryAccountId = CoreAccountId::FromGaiaId("primary");
+  CoreAccountId kOtherAccountId1 = CoreAccountId::FromGaiaId("1");
+  CoreAccountId kOtherAccountId2 = CoreAccountId::FromGaiaId("2");
+  gaia::ListedAccount gaia_account_primary = BuildListedAccount("primary");
+  gaia::ListedAccount gaia_account_1 = BuildListedAccount("1");
+  gaia::ListedAccount gaia_account_2 = BuildListedAccount("2");
+  gaia::ListedAccount gaia_account_3 = BuildListedAccount("3");
+  MirrorLandingAccountReconcilorDelegate delegate;
+  // No primary account. Gaia accounts are removed.
+  EXPECT_TRUE(
+      delegate
+          .GetChromeAccountsForReconcile(
+              /*chrome_accounts=*/{},
+              /*primary_account=*/CoreAccountId(),
+              /*gaia_accounts=*/{gaia_account_1, gaia_account_2},
+              /*first_execution=*/true,
+              /*primary_has_error=*/false,
+              gaia::MultiloginMode::MULTILOGIN_UPDATE_COOKIE_ACCOUNTS_ORDER)
+          .empty());
+  // With primary account. Primary is moved in front, account 1 is kept in the
+  // same slot, account 2 is added, account 3 is removed.
+  EXPECT_EQ(delegate.GetChromeAccountsForReconcile(
+                /*chrome_accounts=*/{kOtherAccountId1, kOtherAccountId2,
+                                     kPrimaryAccountId},
+                /*primary_account=*/kPrimaryAccountId,
+                /*gaia_accounts=*/
+                {gaia_account_3, gaia_account_primary, gaia_account_1},
+                /*first_execution=*/true,
+                /*primary_has_error=*/false,
+                gaia::MultiloginMode::MULTILOGIN_UPDATE_COOKIE_ACCOUNTS_ORDER),
+            (std::vector<CoreAccountId>{kPrimaryAccountId, kOtherAccountId2,
+                                        kOtherAccountId1}));
+}
+
+}  // namespace signin
diff --git a/chromium/components/signin/core/browser/signin_header_helper.h b/chromium/components/signin/core/browser/signin_header_helper.h
index 47853fc055f..f6e601fcc0a 100644
--- a/chromium/components/signin/core/browser/signin_header_helper.h
+++ b/chromium/components/signin/core/browser/signin_header_helper.h
@@ -87,7 +87,7 @@ struct ManageAccountsParams {
   std::string continue_url;
   // Whether the continue URL should be loaded in the same tab.
   bool is_same_tab = false;
-#if defined(OS_ANDROID) || defined(OS_IOS)
+#if BUILDFLAG(IS_ANDROID) || BUILDFLAG(IS_IOS)
   // Whether to show consistency promo.
   bool show_consistency_promo = false;
 #endif
diff --git a/chromium/components/signin/core/browser/signin_header_helper_unittest.cc b/chromium/components/signin/core/browser/signin_header_helper_unittest.cc
index 52df4a179aa..3884e498914 100644
--- a/chromium/components/signin/core/browser/signin_header_helper_unittest.cc
+++ b/chromium/components/signin/core/browser/signin_header_helper_unittest.cc
@@ -19,6 +19,7 @@
 #include "components/signin/core/browser/chrome_connected_header_helper.h"
 #include "components/signin/public/base/account_consistency_method.h"
 #include "components/signin/public/base/signin_buildflags.h"
+#include "components/signin/public/base/signin_switches.h"
 #include "components/signin/public/identity_manager/tribool.h"
 #include "components/sync_preferences/testing_pref_service_syncable.h"
 #include "google_apis/gaia/gaia_urls.h"
@@ -153,6 +154,14 @@ class SigninHeaderHelperTest : public testing::Test {
   }
 #endif
 
+  std::string consistency_enabled_by_default_value() const {
+#if BUILDFLAG(IS_CHROMEOS_LACROS)
+    return "true";
+#else
+    return "false";
+#endif
+  }
+
   base::test::TaskEnvironment task_environment_;
 
   bool sync_enabled_ = false;
@@ -164,6 +173,8 @@ class SigninHeaderHelperTest : public testing::Test {
   sync_preferences::TestingPrefServiceSyncable prefs_;
 
 #if BUILDFLAG(IS_CHROMEOS_LACROS)
+  base::test::ScopedFeatureList scoped_feature_list_{
+      switches::kLacrosNonSyncingProfiles};
   std::unique_ptr<chromeos::ScopedLacrosServiceTestHelper>
       scoped_lacros_test_helper_;
 #endif  // BUILDFLAG(IS_CHROMEOS_LACROS)
@@ -180,13 +191,15 @@ TEST_F(SigninHeaderHelperTest, TestMirrorRequestNoAccountIdChromeOS) {
       GURL("https://docs.google.com"), /*gaia_id=*/"",
       /*is_child_account=*/Tribool::kUnknown,
       "source=TestSource,mode=0,enable_account_consistency=true,"
-      "consistency_enabled_by_default=false");
+      "consistency_enabled_by_default=" +
+          consistency_enabled_by_default_value());
   CheckMirrorCookieRequest(GURL("https://docs.google.com"), /*gaia_id=*/"",
                            "mode=0:enable_account_consistency=true:"
-                           "consistency_enabled_by_default=false");
+                           "consistency_enabled_by_default=" +
+                               consistency_enabled_by_default_value());
 }
 #else  // BUILDFLAG(IS_CHROMEOS_ASH) || BUILDFLAG(IS_CHROMEOS_LACROS)
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 // Tests that eligible_for_consistency request is returned on Android
 // when reaching to Gaia origin and there's no primary account.
 TEST_F(SigninHeaderHelperTest, TestEligibleForConsistencyRequestGaiaOrigin) {
@@ -219,7 +232,7 @@ TEST_F(SigninHeaderHelperTest, TestForceAccountConsistencyMobile) {
       "source=TestSource,mode=0,enable_account_consistency=true,"
       "consistency_enabled_by_default=false");
 }
-#endif  // defined(OS_ANDROID)
+#endif  // BUILDFLAG(IS_ANDROID)
 
 // Tests that no Mirror request is returned when the user is not signed in (no
 // account id), for non Chrome OS platforms.
@@ -257,10 +270,12 @@ TEST_F(SigninHeaderHelperTest, TestMirrorRequestGoogleTLD) {
       GURL("https://google.fr"), "0123456789",
       /*is_child_account=*/Tribool::kUnknown,
       "source=TestSource,mode=0,enable_account_consistency=true,"
-      "consistency_enabled_by_default=false");
+      "consistency_enabled_by_default=" +
+          consistency_enabled_by_default_value());
   CheckMirrorCookieRequest(GURL("https://google.de"), "0123456789",
                            "mode=0:enable_account_consistency=true:"
-                           "consistency_enabled_by_default=false");
+                           "consistency_enabled_by_default=" +
+                               consistency_enabled_by_default_value());
 }
 
 // Tests that the Mirror request is returned when the target is the domain
@@ -271,10 +286,12 @@ TEST_F(SigninHeaderHelperTest, TestMirrorRequestGoogleCom) {
       GURL("https://www.google.com"), "0123456789",
       /*is_child_account=*/Tribool::kUnknown,
       "source=TestSource,mode=0,enable_account_consistency=true,"
-      "consistency_enabled_by_default=false");
+      "consistency_enabled_by_default=" +
+          consistency_enabled_by_default_value());
   CheckMirrorCookieRequest(GURL("https://www.google.com"), "0123456789",
                            "mode=0:enable_account_consistency=true:"
-                           "consistency_enabled_by_default=false");
+                           "consistency_enabled_by_default=" +
+                               consistency_enabled_by_default_value());
 }
 
 // Tests that no header sent when mirror account consistency is nor requested.
@@ -305,7 +322,8 @@ TEST_F(SigninHeaderHelperTest, TestMirrorRequestGoogleComProfileConsistency) {
   CheckAccountConsistencyHeaderRequest(
       request_adapter.GetFinalHeaders(), kChromeConnectedHeader,
       "source=TestSource,mode=0,enable_account_consistency=true,"
-      "consistency_enabled_by_default=false");
+      "consistency_enabled_by_default=" +
+          consistency_enabled_by_default_value());
 }
 
 TEST_F(SigninHeaderHelperTest, TestMirrorRequestGoogleComSupervised) {
@@ -314,17 +332,20 @@ TEST_F(SigninHeaderHelperTest, TestMirrorRequestGoogleComSupervised) {
       GURL("https://www.google.com"), "0123456789",
       /*is_child_account=*/Tribool::kUnknown,
       "source=TestSource,mode=0,enable_account_consistency=true,"
-      "consistency_enabled_by_default=false");
+      "consistency_enabled_by_default=" +
+          consistency_enabled_by_default_value());
   CheckMirrorHeaderRequest(
       GURL("https://www.google.com"), "0123456789",
       /*is_child_account=*/Tribool::kTrue,
       "source=TestSource,mode=0,enable_account_consistency=true,"
-      "supervised=true,consistency_enabled_by_default=false");
+      "supervised=true,consistency_enabled_by_default=" +
+          consistency_enabled_by_default_value());
   CheckMirrorHeaderRequest(
       GURL("https://www.google.com"), "0123456789",
       /*is_child_account=*/Tribool::kFalse,
       "source=TestSource,mode=0,enable_account_consistency=true,"
-      "supervised=false,consistency_enabled_by_default=false");
+      "supervised=false,consistency_enabled_by_default=" +
+          consistency_enabled_by_default_value());
 }
 
 // Mirror is always enabled on Android and iOS, so these tests are only relevant
@@ -711,7 +732,7 @@ TEST_F(SigninHeaderHelperTest, TestBuildManageAccountsParams) {
       "action=ADDSESSION,email=%s,is_saml=true,"
       "is_same_tab=true,continue_url=%s",
       kEmail, kContinueURL);
-#if defined(OS_ANDROID) || defined(OS_IOS)
+#if BUILDFLAG(IS_ANDROID) || BUILDFLAG(IS_IOS)
   header += ",show_consistency_promo=true";
 #endif
 
@@ -721,7 +742,7 @@ TEST_F(SigninHeaderHelperTest, TestBuildManageAccountsParams) {
   EXPECT_EQ(true, params.is_saml);
   EXPECT_EQ(true, params.is_same_tab);
   EXPECT_EQ(GURL(kContinueURL), params.continue_url);
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   EXPECT_EQ(true, params.show_consistency_promo);
 #endif
 }
diff --git a/chromium/components/signin/internal/identity_manager/account_capabilities_constants.cc b/chromium/components/signin/internal/identity_manager/account_capabilities_constants.cc
index 44fe564401d..78be14efdb2 100644
--- a/chromium/components/signin/internal/identity_manager/account_capabilities_constants.cc
+++ b/chromium/components/signin/internal/identity_manager/account_capabilities_constants.cc
@@ -4,6 +4,9 @@
 
 #include "components/signin/internal/identity_manager/account_capabilities_constants.h"
 
+const char kIsSubjectToParentalControlsCapabilityName[] =
+    "accountcapabilities/guydolldmfya";
+
 const char kCanOfferExtendedChromeSyncPromosCapabilityName[] =
     "accountcapabilities/gi2tklldmfya";
 
diff --git a/chromium/components/signin/internal/identity_manager/account_capabilities_constants.h b/chromium/components/signin/internal/identity_manager/account_capabilities_constants.h
index df8cb64191d..0e638dc6c1f 100644
--- a/chromium/components/signin/internal/identity_manager/account_capabilities_constants.h
+++ b/chromium/components/signin/internal/identity_manager/account_capabilities_constants.h
@@ -7,5 +7,6 @@
 
 extern const char kCanOfferExtendedChromeSyncPromosCapabilityName[];
 extern const char kCanOfferExtendedChromeSyncPromosCapabilityPrefsPath[];
+extern const char kIsSubjectToParentalControlsCapabilityName[];
 
 #endif  // COMPONENTS_SIGNIN_INTERNAL_IDENTITY_MANAGER_ACCOUNT_CAPABILITIES_CONSTANTS_H_
diff --git a/chromium/components/signin/internal/identity_manager/account_fetcher_service.cc b/chromium/components/signin/internal/identity_manager/account_fetcher_service.cc
index 60ce8066134..748b82f641a 100644
--- a/chromium/components/signin/internal/identity_manager/account_fetcher_service.cc
+++ b/chromium/components/signin/internal/identity_manager/account_fetcher_service.cc
@@ -34,7 +34,7 @@
 #include "ash/constants/ash_features.h"
 #endif
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 #include "components/signin/internal/identity_manager/child_account_info_fetcher_android.h"
 #include "components/signin/public/identity_manager/tribool.h"
 #endif
@@ -57,7 +57,7 @@ AccountFetcherService::AccountFetcherService() = default;
 AccountFetcherService::~AccountFetcherService() {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   token_service_->RemoveObserver(this);
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   // child_info_request_ is an invalidation handler and needs to be
   // unregistered during the lifetime of the invalidation service.
   child_info_request_.reset();
@@ -113,7 +113,7 @@ bool AccountFetcherService::AreAllAccountCapabilitiesFetched() const {
 void AccountFetcherService::OnNetworkInitialized() {
   DCHECK(!network_initialized_);
   DCHECK(!network_fetches_enabled_);
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   DCHECK(!child_info_request_);
 #endif
   network_initialized_ = true;
@@ -148,7 +148,7 @@ void AccountFetcherService::RefreshAllAccountInfo(bool only_fetch_if_invalid) {
 // dependency on PrimaryAccountManager which we get around by only allowing a
 // single account. This is possible since we only support a single account to be
 // a child anyway.
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 void AccountFetcherService::RefreshAccountInfoIfStale(
     const CoreAccountId& account_id) {
   DCHECK(network_fetches_enabled_);
@@ -185,7 +185,7 @@ void AccountFetcherService::MaybeEnableNetworkFetches() {
     repeating_timer_->Start();
   }
   RefreshAllAccountInfo(/*only_fetch_if_invalid=*/true);
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   UpdateChildInfo();
 #endif
 }
@@ -210,7 +210,7 @@ void AccountFetcherService::StartFetchingUserInfo(
   }
 }
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 // Starts fetching whether this is a child account. Handles refresh internally.
 void AccountFetcherService::StartFetchingChildInfo(
     const CoreAccountId& account_id) {
@@ -243,7 +243,7 @@ bool AccountFetcherService::IsAccountCapabilitiesFetcherEnabled() {
     return true;
 
 #if BUILDFLAG(IS_CHROMEOS_ASH)
-  return ash::features::IsMinorModeRestrictionEnabled();
+  return true;
 #else
   return false;
 #endif
@@ -411,7 +411,7 @@ void AccountFetcherService::OnRefreshTokenAvailable(
   if (!network_fetches_enabled_)
     return;
   RefreshAccountInfo(account_id, /*only_fetch_if_invalid=*/true);
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   UpdateChildInfo();
 #endif
 }
@@ -433,7 +433,7 @@ void AccountFetcherService::OnRefreshTokenRevoked(
 
   user_info_requests_.erase(account_id);
   account_capabilities_requests_.erase(account_id);
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   UpdateChildInfo();
 #endif
   account_tracker_service_->StopTrackingAccount(account_id);
diff --git a/chromium/components/signin/internal/identity_manager/account_fetcher_service.h b/chromium/components/signin/internal/identity_manager/account_fetcher_service.h
index 10dd7063b89..6e579a3f287 100644
--- a/chromium/components/signin/internal/identity_manager/account_fetcher_service.h
+++ b/chromium/components/signin/internal/identity_manager/account_fetcher_service.h
@@ -29,7 +29,7 @@ class ProfileOAuth2TokenService;
 class PrefRegistrySimple;
 class SigninClient;
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 class ChildAccountInfoFetcherAndroid;
 #endif
 
@@ -101,7 +101,7 @@ class AccountFetcherService : public ProfileOAuth2TokenServiceObserver {
   // force-enable off.
   void EnableAccountCapabilitiesFetcherForTest(bool enabled);
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   // Refresh the AccountInfo if the existing one is stale
   void RefreshAccountInfoIfStale(const CoreAccountId& account_id);
 
@@ -121,7 +121,7 @@ class AccountFetcherService : public ProfileOAuth2TokenServiceObserver {
 
   void RefreshAllAccountInfo(bool only_fetch_if_invalid);
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   // Called on all account state changes. Decides whether to fetch new child
   // status information or reset old values that aren't valid now.
   void UpdateChildInfo();
@@ -133,7 +133,7 @@ class AccountFetcherService : public ProfileOAuth2TokenServiceObserver {
   // Further the two fetches are managed by a different refresh logic and
   // thus, can not be combined.
   void StartFetchingUserInfo(const CoreAccountId& account_id);
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   void StartFetchingChildInfo(const CoreAccountId& account_id);
 
   // Resets the child status to false if it is true. If there is more than one
@@ -180,7 +180,7 @@ class AccountFetcherService : public ProfileOAuth2TokenServiceObserver {
   bool enable_account_capabilities_fetcher_for_test_ = false;
   std::unique_ptr<signin::PersistentRepeatingTimer> repeating_timer_;
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   CoreAccountId child_request_account_id_;
   std::unique_ptr<ChildAccountInfoFetcherAndroid> child_info_request_;
 #endif
diff --git a/chromium/components/signin/internal/identity_manager/account_info_util.cc b/chromium/components/signin/internal/identity_manager/account_info_util.cc
index f9f9f45c4c3..07e2c382712 100644
--- a/chromium/components/signin/internal/identity_manager/account_info_util.cc
+++ b/chromium/components/signin/internal/identity_manager/account_info_util.cc
@@ -94,7 +94,7 @@ absl::optional<AccountCapabilities> AccountCapabilitiesFromValue(
 
   // 1. Create "capability name" -> "boolean value" mapping.
   std::map<std::string, bool> boolean_capabilities;
-  for (const auto& capability_value : list->GetList()) {
+  for (const auto& capability_value : list->GetListDeprecated()) {
     const std::string* name =
         capability_value.FindStringKey(kAccountCapabilityNameKey);
     if (!name)
diff --git a/chromium/components/signin/internal/identity_manager/account_tracker_service.cc b/chromium/components/signin/internal/identity_manager/account_tracker_service.cc
index 56c45d33dcd..c48334c0389 100644
--- a/chromium/components/signin/internal/identity_manager/account_tracker_service.cc
+++ b/chromium/components/signin/internal/identity_manager/account_tracker_service.cc
@@ -35,7 +35,7 @@
 #include "components/signin/public/identity_manager/tribool.h"
 #include "ui/gfx/image/image.h"
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 #include "base/android/jni_array.h"
 #include "components/signin/public/android/jni_headers/AccountTrackerService_jni.h"
 #endif
@@ -132,10 +132,18 @@ signin::Tribool FindAccountCapabilityPath(const base::Value& value,
   }
 }
 
+void GetString(const base::Value& dict,
+               base::StringPiece key,
+               std::string& result) {
+  if (const std::string* value = dict.FindStringKey(key)) {
+    result = *value;
+  }
+}
+
 }  // namespace
 
 AccountTrackerService::AccountTrackerService() {
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   JNIEnv* env = base::android::AttachCurrentThread();
   base::android::ScopedJavaLocalRef<jobject> java_ref =
       signin::Java_AccountTrackerService_Constructor(
@@ -524,13 +532,13 @@ void AccountTrackerService::OnAccountImageUpdated(
 
   base::DictionaryValue* dict = nullptr;
   ListPrefUpdate update(pref_service_, prefs::kAccountInfo);
-  for (size_t i = 0; i < update->GetList().size(); ++i, dict = nullptr) {
-    base::Value& dict_value = update->GetList()[i];
+  for (size_t i = 0; i < update->GetListDeprecated().size();
+       ++i, dict = nullptr) {
+    base::Value& dict_value = update->GetListDeprecated()[i];
     if (dict_value.is_dict()) {
       dict = static_cast<base::DictionaryValue*>(&dict_value);
-      std::string value;
-      if (dict->GetString(kAccountKeyPath, &value) &&
-          value == account_id.ToString()) {
+      const std::string* account_key = dict->FindStringKey(kAccountKeyPath);
+      if (account_key && *account_key == account_id.ToString()) {
         break;
       }
     }
@@ -551,42 +559,35 @@ void AccountTrackerService::RemoveAccountImageFromDisk(
 }
 
 void AccountTrackerService::LoadFromPrefs() {
-  const base::ListValue* list = pref_service_->GetList(prefs::kAccountInfo);
+  const base::Value* list = pref_service_->GetList(prefs::kAccountInfo);
   std::set<CoreAccountId> to_remove;
-  for (size_t i = 0; i < list->GetList().size(); ++i) {
-    const base::Value& dict_value = list->GetList()[i];
+  for (size_t i = 0; i < list->GetListDeprecated().size(); ++i) {
+    const base::Value& dict_value = list->GetListDeprecated()[i];
     if (dict_value.is_dict()) {
       const base::DictionaryValue& dict =
           base::Value::AsDictionaryValue(dict_value);
-      std::string value;
-      if (dict.GetString(kAccountKeyPath, &value)) {
+      if (const std::string* account_key =
+              dict.FindStringKey(kAccountKeyPath)) {
         // Ignore incorrectly persisted non-canonical account ids.
-        if (value.find('@') != std::string::npos &&
-            value != gaia::CanonicalizeEmail(value)) {
-          to_remove.insert(CoreAccountId::FromString(value));
+        if (account_key->find('@') != std::string::npos &&
+            *account_key != gaia::CanonicalizeEmail(*account_key)) {
+          to_remove.insert(CoreAccountId::FromString(*account_key));
           continue;
         }
 
-        CoreAccountId account_id = CoreAccountId::FromString(value);
+        CoreAccountId account_id = CoreAccountId::FromString(*account_key);
         StartTrackingAccount(account_id);
         AccountInfo& account_info = accounts_[account_id];
 
-        if (dict.GetString(kAccountGaiaPath, &value))
-          account_info.gaia = value;
-        if (dict.GetString(kAccountEmailPath, &value))
-          account_info.email = value;
-        if (dict.GetString(kAccountHostedDomainPath, &value))
-          account_info.hosted_domain = value;
-        if (dict.GetString(kAccountFullNamePath, &value))
-          account_info.full_name = value;
-        if (dict.GetString(kAccountGivenNamePath, &value))
-          account_info.given_name = value;
-        if (dict.GetString(kAccountLocalePath, &value))
-          account_info.locale = value;
-        if (dict.GetString(kAccountPictureURLPath, &value))
-          account_info.picture_url = value;
-        if (dict.GetString(kLastDownloadedImageURLWithSizePath, &value))
-          account_info.last_downloaded_image_url_with_size = value;
+        GetString(dict, kAccountGaiaPath, account_info.gaia);
+        GetString(dict, kAccountEmailPath, account_info.email);
+        GetString(dict, kAccountHostedDomainPath, account_info.hosted_domain);
+        GetString(dict, kAccountFullNamePath, account_info.full_name);
+        GetString(dict, kAccountGivenNamePath, account_info.given_name);
+        GetString(dict, kAccountLocalePath, account_info.locale);
+        GetString(dict, kAccountPictureURLPath, account_info.picture_url);
+        GetString(dict, kLastDownloadedImageURLWithSizePath,
+                  account_info.last_downloaded_image_url_with_size);
 
         if (absl::optional<bool> is_child_status =
                 dict.FindBoolKey(kDeprecatedChildStatusPath)) {
@@ -595,7 +596,7 @@ void AccountTrackerService::LoadFromPrefs() {
                                               : signin::Tribool::kFalse;
           // Migrate to kAccountChildAttributePath.
           ListPrefUpdate update(pref_service_, prefs::kAccountInfo);
-          base::Value* update_dict = &update->GetList()[i];
+          base::Value* update_dict = &update->GetListDeprecated()[i];
           DCHECK(update_dict->is_dict());
           SetAccountCapabilityPath(update_dict, kAccountChildAttributePath,
                                    account_info.is_child_account);
@@ -663,23 +664,21 @@ void AccountTrackerService::SaveToPrefs(const AccountInfo& account_info) {
 
   base::DictionaryValue* dict = nullptr;
   ListPrefUpdate update(pref_service_, prefs::kAccountInfo);
-  for (size_t i = 0; i < update->GetList().size(); ++i, dict = nullptr) {
-    base::Value& dict_value = update->GetList()[i];
+  for (size_t i = 0; i < update->GetListDeprecated().size();
+       ++i, dict = nullptr) {
+    base::Value& dict_value = update->GetListDeprecated()[i];
     if (dict_value.is_dict()) {
       dict = static_cast<base::DictionaryValue*>(&dict_value);
-      std::string value;
-      if (dict->GetString(kAccountKeyPath, &value) &&
-          value == account_info.account_id.ToString()) {
+      const std::string* account_key = dict->FindStringKey(kAccountKeyPath);
+      if (account_key && *account_key == account_info.account_id.ToString()) {
         break;
       }
     }
   }
 
   if (!dict) {
-    dict = new base::DictionaryValue();
-    update->Append(base::WrapUnique(dict));
-    // |dict| is invalidated at this point, so it needs to be reset.
-    base::Value& dict_value = update->GetList().back();
+    update->Append(base::Value(base::Value::Type::DICTIONARY));
+    base::Value& dict_value = update->GetListDeprecated().back();
     DCHECK(dict_value.is_dict());
     dict = static_cast<base::DictionaryValue*>(&dict_value);
     dict->SetString(kAccountKeyPath, account_info.account_id.ToString());
@@ -788,7 +787,7 @@ void AccountTrackerService::RemoveAccount(const CoreAccountId& account_id) {
   StopTrackingAccount(account_id);
 }
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 base::android::ScopedJavaLocalRef<jobject>
 AccountTrackerService::GetJavaObject() {
   return base::android::ScopedJavaLocalRef<jobject>(java_ref_);
diff --git a/chromium/components/signin/internal/identity_manager/account_tracker_service.h b/chromium/components/signin/internal/identity_manager/account_tracker_service.h
index 63dcaa0fcec..bf4650caa40 100644
--- a/chromium/components/signin/internal/identity_manager/account_tracker_service.h
+++ b/chromium/components/signin/internal/identity_manager/account_tracker_service.h
@@ -5,7 +5,6 @@
 #ifndef COMPONENTS_SIGNIN_INTERNAL_IDENTITY_MANAGER_ACCOUNT_TRACKER_SERVICE_H_
 #define COMPONENTS_SIGNIN_INTERNAL_IDENTITY_MANAGER_ACCOUNT_TRACKER_SERVICE_H_
 
-#include <list>
 #include <map>
 #include <string>
 #include <vector>
@@ -22,7 +21,7 @@
 #include "google_apis/gaia/core_account_id.h"
 #include "google_apis/gaia/gaia_auth_util.h"
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 #include "base/android/scoped_java_ref.h"
 #endif
 
@@ -126,7 +125,7 @@ class AccountTrackerService {
   AccountIdMigrationState GetMigrationState() const;
   void SetMigrationDone();
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   // Returns a reference to the corresponding Java AccountTrackerService object.
   base::android::ScopedJavaLocalRef<jobject> GetJavaObject();
 
@@ -239,7 +238,7 @@ class AccountTrackerService {
   // Task runner used for file operations on avatar images.
   scoped_refptr<base::SequencedTaskRunner> image_storage_task_runner_;
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   // A reference to the Java counterpart of this object.
   base::android::ScopedJavaGlobalRef<jobject> java_ref_;
 #endif
diff --git a/chromium/components/signin/internal/identity_manager/account_tracker_service_unittest.cc b/chromium/components/signin/internal/identity_manager/account_tracker_service_unittest.cc
index 037837a07ce..c1bf49a8a4d 100644
--- a/chromium/components/signin/internal/identity_manager/account_tracker_service_unittest.cc
+++ b/chromium/components/signin/internal/identity_manager/account_tracker_service_unittest.cc
@@ -45,7 +45,7 @@
 #include "ash/constants/ash_features.h"
 #endif
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 #include "components/signin/public/identity_manager/identity_test_utils.h"
 #endif
 
@@ -70,7 +70,7 @@ const AccountKey kAccountKeyIncomplete = {"incomplete"};
 const AccountKey kAccountKeyFooBar = {"foobar"};
 const AccountKey kAccountKeyFooDotBar = {"foo.bar"};
 
-#if !defined(OS_ANDROID) && !BUILDFLAG(IS_CHROMEOS_ASH) && !defined(OS_IOS)
+#if !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_CHROMEOS_ASH) && !BUILDFLAG(IS_IOS)
 const AccountKey kAccountKeyAdvancedProtection = {"advanced_protection"};
 #endif
 
@@ -202,7 +202,7 @@ class AccountTrackerServiceTest : public testing::Test {
   AccountTrackerServiceTest()
       : signin_client_(&pref_service_),
         fake_oauth2_token_service_(&pref_service_) {
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
     // Mock AccountManagerFacade in java code for tests that require its
     // initialization.
     signin::SetUpMockAccountManagerFacade();
@@ -707,14 +707,9 @@ TEST_F(AccountTrackerServiceTest,
   CheckAccountCapabilities(kAccountKeyAlpha, account_info);
 }
 
+#if !BUILDFLAG(IS_CHROMEOS_ASH)
 TEST_F(AccountTrackerServiceTest,
        TokenAvailable_AccountCapabilitiesFetcherDisabled) {
-#if BUILDFLAG(IS_CHROMEOS_ASH)
-  base::test::ScopedFeatureList scoped_feature_list;
-  scoped_feature_list.InitAndDisableFeature(
-      ash::features::kMinorModeRestriction);
-#endif
-
   account_fetcher()->EnableAccountCapabilitiesFetcherForTest(false);
   SimulateTokenAvailable(kAccountKeyAlpha);
   EXPECT_TRUE(account_fetcher()->AreAllAccountCapabilitiesFetched());
@@ -723,6 +718,7 @@ TEST_F(AccountTrackerServiceTest,
       AccountKeyToAccountId(kAccountKeyAlpha));
   EXPECT_FALSE(account_info.capabilities.AreAllCapabilitiesKnown());
 }
+#endif
 
 TEST_F(AccountTrackerServiceTest, TokenAvailableTwice_UserInfoOnce) {
   SimulateTokenAvailable(kAccountKeyAlpha);
@@ -972,7 +968,7 @@ TEST_F(AccountTrackerServiceTest, Persistence) {
   // This will allow testing removal as well as child accounts which is only
   // allowed for a single account.
   SimulateTokenRevoked(kAccountKeyAlpha);
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   account_fetcher()->SetIsChildAccount(AccountKeyToAccountId(kAccountKeyBeta),
                                        true);
 #else
@@ -980,7 +976,7 @@ TEST_F(AccountTrackerServiceTest, Persistence) {
                                        true);
 #endif
 
-#if !BUILDFLAG(IS_CHROMEOS_ASH) && !defined(OS_ANDROID) && !defined(OS_IOS)
+#if !BUILDFLAG(IS_CHROMEOS_ASH) && !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_IOS)
   account_tracker()->SetIsAdvancedProtectionAccount(
       AccountKeyToAccountId(kAccountKeyBeta), true);
 #endif
@@ -994,7 +990,7 @@ TEST_F(AccountTrackerServiceTest, Persistence) {
   CheckAccountDetails(kAccountKeyBeta, infos[0]);
   CheckAccountCapabilities(kAccountKeyBeta, infos[0]);
   EXPECT_EQ(signin::Tribool::kTrue, infos[0].is_child_account);
-#if !BUILDFLAG(IS_CHROMEOS_ASH) && !defined(OS_ANDROID) && !defined(OS_IOS)
+#if !BUILDFLAG(IS_CHROMEOS_ASH) && !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_IOS)
   EXPECT_TRUE(infos[0].is_under_advanced_protection);
 #else
   EXPECT_FALSE(infos[0].is_under_advanced_protection);
@@ -1028,17 +1024,17 @@ TEST_F(AccountTrackerServiceTest, ChildStatusMigration) {
                 ->GetAccountInfo(AccountKeyToAccountId(kAccountKeyAlpha))
                 .is_child_account);
   ListPrefUpdate update(prefs(), prefs::kAccountInfo);
-  base::Value* dict = nullptr;
-  update->Get(0, &dict);
-  ASSERT_TRUE(dict && dict->is_dict());
+  ASSERT_FALSE(update->GetListDeprecated().empty());
+  base::Value& dict = update->GetListDeprecated()[0];
+  ASSERT_TRUE(dict.is_dict());
   const char kDeprecatedChildKey[] = "is_child_account";
   const char kNewChildKey[] = "is_supervised_child";
   // The deprecated key is not set.
-  EXPECT_FALSE(dict->FindBoolKey(kDeprecatedChildKey));
+  EXPECT_FALSE(dict.FindBoolKey(kDeprecatedChildKey));
 
   // Set the child status using the deprecated key, and reload the account.
-  dict->SetBoolKey(kDeprecatedChildKey, true);
-  dict->RemoveKey(kNewChildKey);
+  dict.SetBoolKey(kDeprecatedChildKey, true);
+  dict.RemoveKey(kNewChildKey);
   ClearAccountTrackerEvents();
   ResetAccountTrackerWithPersistence(scoped_user_data_dir.GetPath());
   EXPECT_TRUE(CheckAccountTrackerEvents(
@@ -1053,9 +1049,9 @@ TEST_F(AccountTrackerServiceTest, ChildStatusMigration) {
   // The deprecated key has been read.
   EXPECT_EQ(signin::Tribool::kTrue, infos[0].is_child_account);
   // The deprecated key has been removed.
-  EXPECT_FALSE(dict->FindBoolKey(kDeprecatedChildKey));
+  EXPECT_FALSE(dict.FindBoolKey(kDeprecatedChildKey));
   // The new key has been written.
-  absl::optional<int> new_key = dict->FindIntKey(kNewChildKey);
+  absl::optional<int> new_key = dict.FindIntKey(kNewChildKey);
   ASSERT_TRUE(new_key.has_value());
   EXPECT_EQ(static_cast<int>(signin::Tribool::kTrue), new_key.value());
 }
@@ -1449,7 +1445,7 @@ TEST_F(AccountTrackerServiceTest, GaiaIdMigrationCrashInTheMiddle) {
 TEST_F(AccountTrackerServiceTest, ChildAccountBasic) {
   SimulateTokenAvailable(kAccountKeyChild);
   IssueAccessToken(kAccountKeyChild);
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   account_fetcher()->SetIsChildAccount(AccountKeyToAccountId(kAccountKeyChild),
                                        true);
 #else
@@ -1468,7 +1464,7 @@ TEST_F(AccountTrackerServiceTest, ChildAccountBasic) {
 TEST_F(AccountTrackerServiceTest, ChildAccountWithSecondaryEdu) {
   SimulateTokenAvailable(kAccountKeyChild);
   IssueAccessToken(kAccountKeyChild);
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   account_fetcher()->SetIsChildAccount(AccountKeyToAccountId(kAccountKeyChild),
                                        true);
 #else
@@ -1478,7 +1474,7 @@ TEST_F(AccountTrackerServiceTest, ChildAccountWithSecondaryEdu) {
 
   SimulateTokenAvailable(kAccountKeyEdu);
   IssueAccessToken(kAccountKeyEdu);
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   account_fetcher()->SetIsChildAccount(AccountKeyToAccountId(kAccountKeyEdu),
                                        false);
 #else
@@ -1502,7 +1498,7 @@ TEST_F(AccountTrackerServiceTest, ChildAccountWithSecondaryEdu) {
 TEST_F(AccountTrackerServiceTest, ChildAccountUpdatedAndRevoked) {
   SimulateTokenAvailable(kAccountKeyChild);
   IssueAccessToken(kAccountKeyChild);
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   account_fetcher()->SetIsChildAccount(AccountKeyToAccountId(kAccountKeyChild),
                                        false);
 #else
@@ -1531,7 +1527,7 @@ TEST_F(AccountTrackerServiceTest, ChildAccountUpdatedAndRevoked) {
 TEST_F(AccountTrackerServiceTest, ChildAccountUpdatedAndRevokedWithUpdate) {
   SimulateTokenAvailable(kAccountKeyChild);
   IssueAccessToken(kAccountKeyChild);
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   account_fetcher()->SetIsChildAccount(AccountKeyToAccountId(kAccountKeyChild),
                                        true);
 #else
@@ -1550,7 +1546,7 @@ TEST_F(AccountTrackerServiceTest, ChildAccountUpdatedAndRevokedWithUpdate) {
       AccountKeyToAccountId(kAccountKeyChild));
   EXPECT_EQ(signin::Tribool::kTrue, info.is_child_account);
   SimulateTokenRevoked(kAccountKeyChild);
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   // On Android, is_child_account is set to false before removing it.
   EXPECT_TRUE(CheckAccountTrackerEvents({
       TrackingEvent(UPDATED, AccountKeyToAccountId(kAccountKeyChild),
@@ -1575,7 +1571,7 @@ TEST_F(AccountTrackerServiceTest, ChildAccountUpdatedTwiceThenRevoked) {
 
   // Since the account state is already valid, this will notify the
   // observers for the second time.
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   account_fetcher()->SetIsChildAccount(AccountKeyToAccountId(kAccountKeyChild),
                                        true);
 #else
@@ -1591,7 +1587,7 @@ TEST_F(AccountTrackerServiceTest, ChildAccountUpdatedTwiceThenRevoked) {
                     AccountKeyToEmail(kAccountKeyChild)),
   }));
   SimulateTokenRevoked(kAccountKeyChild);
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   // On Android, is_child_account is set to false before removing it.
   EXPECT_TRUE(CheckAccountTrackerEvents({
       TrackingEvent(UPDATED, AccountKeyToAccountId(kAccountKeyChild),
@@ -1615,7 +1611,7 @@ TEST_F(AccountTrackerServiceTest, ChildAccountGraduation) {
   IssueAccessToken(kAccountKeyChild);
 
   // Set and verify this is a child account.
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   account_fetcher()->SetIsChildAccount(AccountKeyToAccountId(kAccountKeyChild),
                                        true);
 #else
@@ -1635,7 +1631,7 @@ TEST_F(AccountTrackerServiceTest, ChildAccountGraduation) {
   }));
 
   // Now simulate child account graduation.
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   account_fetcher()->SetIsChildAccount(AccountKeyToAccountId(kAccountKeyChild),
                                        false);
 #else
@@ -1678,7 +1674,7 @@ TEST_F(AccountTrackerServiceTest, RemoveAccountBeforeImageFetchDone) {
   }));
 }
 
-#if !defined(OS_ANDROID) && !BUILDFLAG(IS_CHROMEOS_ASH) && !defined(OS_IOS)
+#if !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_CHROMEOS_ASH) && !BUILDFLAG(IS_IOS)
 TEST_F(AccountTrackerServiceTest, AdvancedProtectionAccountBasic) {
   SimulateTokenAvailable(kAccountKeyAdvancedProtection);
   IssueAccessToken(kAccountKeyAdvancedProtection);
diff --git a/chromium/components/signin/internal/identity_manager/accounts_cookie_mutator_impl.cc b/chromium/components/signin/internal/identity_manager/accounts_cookie_mutator_impl.cc
index 12a0aa80973..e55e14a903f 100644
--- a/chromium/components/signin/internal/identity_manager/accounts_cookie_mutator_impl.cc
+++ b/chromium/components/signin/internal/identity_manager/accounts_cookie_mutator_impl.cc
@@ -104,7 +104,7 @@ void AccountsCookieMutatorImpl::TriggerCookieJarUpdate() {
   gaia_cookie_manager_service_->TriggerListAccounts();
 }
 
-#if defined(OS_IOS)
+#if BUILDFLAG(IS_IOS)
 void AccountsCookieMutatorImpl::ForceTriggerOnCookieChange() {
   gaia_cookie_manager_service_->ForceOnCookieChangeProcessing();
 }
diff --git a/chromium/components/signin/internal/identity_manager/accounts_cookie_mutator_impl.h b/chromium/components/signin/internal/identity_manager/accounts_cookie_mutator_impl.h
index a7d661eac8d..2032b2df59d 100644
--- a/chromium/components/signin/internal/identity_manager/accounts_cookie_mutator_impl.h
+++ b/chromium/components/signin/internal/identity_manager/accounts_cookie_mutator_impl.h
@@ -65,7 +65,7 @@ class AccountsCookieMutatorImpl : public AccountsCookieMutator {
 
   void TriggerCookieJarUpdate() override;
 
-#if defined(OS_IOS)
+#if BUILDFLAG(IS_IOS)
   void ForceTriggerOnCookieChange() override;
 #endif
 
diff --git a/chromium/components/signin/internal/identity_manager/device_accounts_synchronizer_impl.cc b/chromium/components/signin/internal/identity_manager/device_accounts_synchronizer_impl.cc
index f284e6a8ca0..9f140374d66 100644
--- a/chromium/components/signin/internal/identity_manager/device_accounts_synchronizer_impl.cc
+++ b/chromium/components/signin/internal/identity_manager/device_accounts_synchronizer_impl.cc
@@ -5,6 +5,7 @@
 #include "components/signin/internal/identity_manager/device_accounts_synchronizer_impl.h"
 
 #include "base/check.h"
+#include "build/build_config.h"
 #include "components/signin/internal/identity_manager/profile_oauth2_token_service_delegate.h"
 
 namespace signin {
@@ -24,7 +25,7 @@ void DeviceAccountsSynchronizerImpl::
       primary_account_id);
 }
 
-#if defined(OS_IOS)
+#if BUILDFLAG(IS_IOS)
 void DeviceAccountsSynchronizerImpl::ReloadAccountFromSystem(
     const CoreAccountId& account_id) {
   token_service_delegate_->ReloadAccountFromSystem(account_id);
diff --git a/chromium/components/signin/internal/identity_manager/device_accounts_synchronizer_impl.h b/chromium/components/signin/internal/identity_manager/device_accounts_synchronizer_impl.h
index 5b0e341da11..08a8aee7443 100644
--- a/chromium/components/signin/internal/identity_manager/device_accounts_synchronizer_impl.h
+++ b/chromium/components/signin/internal/identity_manager/device_accounts_synchronizer_impl.h
@@ -24,7 +24,7 @@ class DeviceAccountsSynchronizerImpl : public DeviceAccountsSynchronizer {
   void ReloadAllAccountsFromSystemWithPrimaryAccount(
       const absl::optional<CoreAccountId>& primary_account_id) override;
 
-#if defined(OS_IOS)
+#if BUILDFLAG(IS_IOS)
   void ReloadAccountFromSystem(const CoreAccountId& account_id) override;
 #endif
 
diff --git a/chromium/components/signin/internal/identity_manager/fake_profile_oauth2_token_service_delegate.cc b/chromium/components/signin/internal/identity_manager/fake_profile_oauth2_token_service_delegate.cc
index 0bff65ff384..255d8e5abd9 100644
--- a/chromium/components/signin/internal/identity_manager/fake_profile_oauth2_token_service_delegate.cc
+++ b/chromium/components/signin/internal/identity_manager/fake_profile_oauth2_token_service_delegate.cc
@@ -8,6 +8,7 @@
 
 #include "base/containers/cxx20_erase.h"
 #include "base/ranges/algorithm.h"
+#include "build/build_config.h"
 #include "components/signin/internal/identity_manager/profile_oauth2_token_service.h"
 #include "google_apis/gaia/gaia_access_token_fetcher.h"
 #include "google_apis/gaia/gaia_constants.h"
@@ -179,7 +180,7 @@ void FakeProfileOAuth2TokenServiceDelegate::UpdateAuthError(
   FireAuthErrorChanged(account_id, error);
 }
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 base::android::ScopedJavaLocalRef<jobject>
 FakeProfileOAuth2TokenServiceDelegate::GetJavaObject() {
   return base::android::ScopedJavaLocalRef<jobject>();
diff --git a/chromium/components/signin/internal/identity_manager/fake_profile_oauth2_token_service_delegate.h b/chromium/components/signin/internal/identity_manager/fake_profile_oauth2_token_service_delegate.h
index 2b54a9a3177..8cc9a884060 100644
--- a/chromium/components/signin/internal/identity_manager/fake_profile_oauth2_token_service_delegate.h
+++ b/chromium/components/signin/internal/identity_manager/fake_profile_oauth2_token_service_delegate.h
@@ -80,7 +80,7 @@ class FakeProfileOAuth2TokenServiceDelegate
   void IssueRefreshTokenForUser(const CoreAccountId& account_id,
                                 const std::string& token);
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   base::android::ScopedJavaLocalRef<jobject> GetJavaObject() override;
 #endif
 
diff --git a/chromium/components/signin/internal/identity_manager/gaia_cookie_manager_service.cc b/chromium/components/signin/internal/identity_manager/gaia_cookie_manager_service.cc
index 0a840ec20c6..5e1934169ac 100644
--- a/chromium/components/signin/internal/identity_manager/gaia_cookie_manager_service.cc
+++ b/chromium/components/signin/internal/identity_manager/gaia_cookie_manager_service.cc
@@ -275,14 +275,14 @@ void GaiaCookieManagerService::ExternalCcResultFetcher::
   }
 
   // If there is nothing to check, terminate immediately.
-  if (value->GetList().size() == 0) {
+  if (value->GetListDeprecated().size() == 0) {
     CleanupTransientState();
     GetCheckConnectionInfoCompleted(true);
     return;
   }
 
   // Start a fetcher for each connection URL that needs to be checked.
-  for (const base::Value& elem : value->GetList()) {
+  for (const base::Value& elem : value->GetListDeprecated()) {
     if (!elem.is_dict())
       continue;
 
@@ -715,12 +715,12 @@ GaiaCookieManagerService::GetURLLoaderFactory() {
 
 void GaiaCookieManagerService::MarkListAccountsStale() {
   list_accounts_stale_ = true;
-#if defined(OS_IOS)
+#if BUILDFLAG(IS_IOS)
   base::ThreadTaskRunnerHandle::Get()->PostTask(
       FROM_HERE,
       base::BindOnce(&GaiaCookieManagerService::ForceOnCookieChangeProcessing,
                      weak_ptr_factory_.GetWeakPtr()));
-#endif  // defined(OS_IOS)
+#endif  // BUILDFLAG(IS_IOS)
 }
 
 void GaiaCookieManagerService::OnCookieChange(
diff --git a/chromium/components/signin/internal/identity_manager/mutable_profile_oauth2_token_service_delegate_unittest.cc b/chromium/components/signin/internal/identity_manager/mutable_profile_oauth2_token_service_delegate_unittest.cc
index 6791237e16b..794ebcc79ae 100644
--- a/chromium/components/signin/internal/identity_manager/mutable_profile_oauth2_token_service_delegate_unittest.cc
+++ b/chromium/components/signin/internal/identity_manager/mutable_profile_oauth2_token_service_delegate_unittest.cc
@@ -1102,10 +1102,10 @@ TEST_F(MutableProfileOAuth2TokenServiceDelegateTest, GaiaIdMigration) {
 
     ListPrefUpdate update(&pref_service_, prefs::kAccountInfo);
     update->ClearList();
-    auto dict = std::make_unique<base::DictionaryValue>();
-    dict->SetString("account_id", email);
-    dict->SetString("email", email);
-    dict->SetString("gaia", gaia_id);
+    base::Value dict(base::Value::Type::DICTIONARY);
+    dict.SetStringKey("account_id", email);
+    dict.SetStringKey("email", email);
+    dict.SetStringKey("gaia", gaia_id);
     update->Append(std::move(dict));
     account_tracker_service_.ResetForTesting();
 
@@ -1165,16 +1165,16 @@ TEST_F(MutableProfileOAuth2TokenServiceDelegateTest,
 
     ListPrefUpdate update(&pref_service_, prefs::kAccountInfo);
     update->ClearList();
-    auto dict = std::make_unique<base::DictionaryValue>();
-    dict->SetString("account_id", email1);
-    dict->SetString("email", email1);
-    dict->SetString("gaia", gaia_id1);
-    update->Append(std::move(dict));
-    dict = std::make_unique<base::DictionaryValue>();
-    dict->SetString("account_id", email2);
-    dict->SetString("email", email2);
-    dict->SetString("gaia", gaia_id2);
-    update->Append(std::move(dict));
+    base::Value account1(base::Value::Type::DICTIONARY);
+    account1.SetStringKey("account_id", email1);
+    account1.SetStringKey("email", email1);
+    account1.SetStringKey("gaia", gaia_id1);
+    update->Append(std::move(account1));
+    base::Value account2(base::Value::Type::DICTIONARY);
+    account2.SetStringKey("account_id", email2);
+    account2.SetStringKey("email", email2);
+    account2.SetStringKey("gaia", gaia_id2);
+    update->Append(std::move(account2));
     account_tracker_service_.ResetForTesting();
 
     AddAuthTokenManually("AccountId-" + email1, "refresh_token");
diff --git a/chromium/components/signin/internal/identity_manager/primary_account_manager.cc b/chromium/components/signin/internal/identity_manager/primary_account_manager.cc
index 51ca2abc2b1..741a2b973ef 100644
--- a/chromium/components/signin/internal/identity_manager/primary_account_manager.cc
+++ b/chromium/components/signin/internal/identity_manager/primary_account_manager.cc
@@ -145,18 +145,34 @@ CoreAccountId PrimaryAccountManager::GetPrimaryAccountId(
   return GetPrimaryAccountInfo(consent_level).account_id;
 }
 
-void PrimaryAccountManager::SetUnconsentedPrimaryAccountInfo(
-    const CoreAccountInfo& account_info) {
+void PrimaryAccountManager::SetPrimaryAccountInfo(
+    const CoreAccountInfo& account_info,
+    signin::ConsentLevel consent_level) {
   if (HasPrimaryAccount(signin::ConsentLevel::kSync)) {
-    DCHECK_EQ(account_info, GetPrimaryAccountInfo(signin::ConsentLevel::kSync));
+    DCHECK_EQ(account_info, GetPrimaryAccountInfo(signin::ConsentLevel::kSync))
+        << "Changing the primary sync account is not allowed.";
     return;
   }
+  DCHECK(!account_info.account_id.empty());
+  DCHECK(!account_info.gaia.empty());
+  DCHECK(!account_info.email.empty());
+  DCHECK(!account_tracker_service_->GetAccountInfo(account_info.account_id)
+              .IsEmpty())
+      << "Account must be seeded before being set as primary account";
 
-  bool account_changed = account_info != primary_account_info();
   PrimaryAccountChangeEvent::State previous_state = GetPrimaryAccountState();
-  SetPrimaryAccountInternal(account_info, /*consented_to_sync=*/false);
-  if (account_changed)
-    FirePrimaryAccountChanged(previous_state);
+  switch (consent_level) {
+    case signin::ConsentLevel::kSync:
+      SetSyncPrimaryAccountInternal(account_info);
+      FirePrimaryAccountChanged(previous_state);
+      return;
+    case signin::ConsentLevel::kSignin:
+      bool account_changed = account_info != primary_account_info();
+      SetPrimaryAccountInternal(account_info, /*consented_to_sync=*/false);
+      if (account_changed)
+        FirePrimaryAccountChanged(previous_state);
+      return;
+  }
 }
 
 void PrimaryAccountManager::SetSyncPrimaryAccountInternal(
@@ -226,28 +242,6 @@ bool PrimaryAccountManager::HasPrimaryAccount(
   }
 }
 
-void PrimaryAccountManager::SetSyncPrimaryAccountInfo(
-    const CoreAccountInfo& account_info) {
-#if DCHECK_IS_ON()
-  DCHECK(!account_info.account_id.empty());
-  DCHECK(!account_info.gaia.empty());
-  DCHECK(!account_info.email.empty());
-  DCHECK(!account_tracker_service_->GetAccountInfo(account_info.account_id)
-              .IsEmpty())
-      << "Account should have been seeded before being set as primary account";
-#endif
-  if (HasPrimaryAccount(signin::ConsentLevel::kSync)) {
-    DCHECK_EQ(account_info.account_id,
-              GetPrimaryAccountId(signin::ConsentLevel::kSync))
-        << "Changing the primary sync account is not allowed.";
-    return;
-  }
-
-  PrimaryAccountChangeEvent::State previous_state = GetPrimaryAccountState();
-  SetSyncPrimaryAccountInternal(account_info);
-  FirePrimaryAccountChanged(previous_state);
-}
-
 void PrimaryAccountManager::UpdatePrimaryAccountInfo() {
   const CoreAccountId primary_account_id = primary_account_info().account_id;
   DCHECK(!primary_account_id.empty());
diff --git a/chromium/components/signin/internal/identity_manager/primary_account_manager.h b/chromium/components/signin/internal/identity_manager/primary_account_manager.h
index c4de592916e..04671a78c3c 100644
--- a/chromium/components/signin/internal/identity_manager/primary_account_manager.h
+++ b/chromium/components/signin/internal/identity_manager/primary_account_manager.h
@@ -99,15 +99,12 @@ class PrimaryAccountManager : public ProfileOAuth2TokenServiceObserver {
   // convenience wrapper over GetPrimaryAccountInfo().account_id.
   CoreAccountId GetPrimaryAccountId(signin::ConsentLevel consent_level) const;
 
-  // Signs a user in. PrimaryAccountManager assumes that |username| can be used
-  // to look up the corresponding account_id and gaia_id for this email.
-  void SetSyncPrimaryAccountInfo(const CoreAccountInfo& account_info);
-
-  // Sets the unconsented primary account. The unconsented primary account can
-  // only be changed if the user has not consented for sync If the user has
-  // consented for sync already, then use ClearPrimaryAccount() or RevokeSync()
-  // instead.
-  void SetUnconsentedPrimaryAccountInfo(const CoreAccountInfo& account_info);
+  // Sets the primary account with the required consent level. The primary
+  // account can only be changed if the user has not consented for sync. If the
+  // user has consented for sync already, then use ClearPrimaryAccount() or
+  // RevokeSync() instead.
+  void SetPrimaryAccountInfo(const CoreAccountInfo& account_info,
+                             signin::ConsentLevel consent_level);
 
   // Updates the primary account information from AccountTrackerService.
   void UpdatePrimaryAccountInfo();
diff --git a/chromium/components/signin/internal/identity_manager/primary_account_manager_unittest.cc b/chromium/components/signin/internal/identity_manager/primary_account_manager_unittest.cc
index 1140a44a215..1ea83d7b7c6 100644
--- a/chromium/components/signin/internal/identity_manager/primary_account_manager_unittest.cc
+++ b/chromium/components/signin/internal/identity_manager/primary_account_manager_unittest.cc
@@ -155,8 +155,8 @@ TEST_F(PrimaryAccountManagerTest, SignOut) {
   CreatePrimaryAccountManager();
   CoreAccountId main_account_id =
       AddToAccountTracker("account_id", "user@gmail.com");
-  manager_->SetSyncPrimaryAccountInfo(
-      account_tracker()->GetAccountInfo(main_account_id));
+  manager_->SetPrimaryAccountInfo(
+      account_tracker()->GetAccountInfo(main_account_id), ConsentLevel::kSync);
   manager_->ClearPrimaryAccount(signin_metrics::SIGNOUT_TEST,
                                 signin_metrics::SignoutDelete::kIgnoreMetric);
   EXPECT_EQ(1, num_successful_signouts_);
@@ -183,8 +183,8 @@ TEST_F(PrimaryAccountManagerTest, SignOutRevoke) {
       AddToAccountTracker("other_id", "other@gmail.com");
   token_service_.UpdateCredentials(main_account_id, "token");
   token_service_.UpdateCredentials(other_account_id, "token");
-  manager_->SetSyncPrimaryAccountInfo(
-      account_tracker()->GetAccountInfo(main_account_id));
+  manager_->SetPrimaryAccountInfo(
+      account_tracker()->GetAccountInfo(main_account_id), ConsentLevel::kSync);
   EXPECT_TRUE(manager_->HasPrimaryAccount(ConsentLevel::kSync));
   EXPECT_EQ(main_account_id,
             manager_->GetPrimaryAccountId(ConsentLevel::kSync));
@@ -207,8 +207,8 @@ TEST_F(PrimaryAccountManagerTest, SignOutWhileProhibited) {
 
   CoreAccountId main_account_id =
       AddToAccountTracker("gaia_id", "user@gmail.com");
-  manager_->SetSyncPrimaryAccountInfo(
-      account_tracker()->GetAccountInfo(main_account_id));
+  manager_->SetPrimaryAccountInfo(
+      account_tracker()->GetAccountInfo(main_account_id), ConsentLevel::kSync);
   signin_client()->set_is_signout_allowed(false);
   manager_->ClearPrimaryAccount(signin_metrics::SIGNOUT_TEST,
                                 signin_metrics::SignoutDelete::kIgnoreMetric);
@@ -230,7 +230,7 @@ TEST_F(PrimaryAccountManagerTest, UnconsentedSignOutWhileProhibited) {
 
   CoreAccountId account_id = AddToAccountTracker("gaia_id", "user@gmail.com");
   CoreAccountInfo account_info = account_tracker()->GetAccountInfo(account_id);
-  manager_->SetUnconsentedPrimaryAccountInfo(account_info);
+  manager_->SetPrimaryAccountInfo(account_info, ConsentLevel::kSignin);
   EXPECT_TRUE(manager_->HasPrimaryAccount(ConsentLevel::kSignin));
   EXPECT_FALSE(manager_->HasPrimaryAccount(ConsentLevel::kSync));
   signin_client()->set_is_signout_allowed(false);
@@ -278,7 +278,7 @@ TEST_F(PrimaryAccountManagerTest, NoopSignOutDoesNotNotifyObservers) {
 
   CoreAccountId account_id = AddToAccountTracker("gaia_id", "user@gmail.com");
   CoreAccountInfo account_info = account_tracker()->GetAccountInfo(account_id);
-  manager_->SetUnconsentedPrimaryAccountInfo(account_info);
+  manager_->SetPrimaryAccountInfo(account_info, ConsentLevel::kSignin);
   EXPECT_EQ(1, num_unconsented_account_changed_);
   EXPECT_TRUE(manager_->HasPrimaryAccount(ConsentLevel::kSignin));
   EXPECT_FALSE(manager_->HasPrimaryAccount(ConsentLevel::kSync));
@@ -300,8 +300,8 @@ TEST_F(PrimaryAccountManagerTest, SignIn) {
   EXPECT_EQ(0, num_unconsented_account_changed_);
 
   CoreAccountId account_id = AddToAccountTracker("gaia_id", "user@gmail.com");
-  manager_->SetSyncPrimaryAccountInfo(
-      account_tracker()->GetAccountInfo(account_id));
+  manager_->SetPrimaryAccountInfo(account_tracker()->GetAccountInfo(account_id),
+                                  ConsentLevel::kSync);
   EXPECT_EQ(1, num_successful_signins_);
   EXPECT_EQ(1, num_unconsented_account_changed_);
   EXPECT_EQ("user@gmail.com",
@@ -321,16 +321,16 @@ TEST_F(PrimaryAccountManagerTest,
   EXPECT_EQ(0, num_unconsented_account_changed_);
 
   CoreAccountId account_id = AddToAccountTracker("gaia_id", "user@gmail.com");
-  manager_->SetSyncPrimaryAccountInfo(
-      account_tracker()->GetAccountInfo(account_id));
+  manager_->SetPrimaryAccountInfo(account_tracker()->GetAccountInfo(account_id),
+                                  ConsentLevel::kSync);
   EXPECT_EQ(1, num_successful_signins_);
   EXPECT_EQ(1, num_unconsented_account_changed_);
   EXPECT_EQ("user@gmail.com",
             manager_->GetPrimaryAccountInfo(ConsentLevel::kSync).email);
   EXPECT_EQ(account_id, manager_->GetPrimaryAccountId(ConsentLevel::kSync));
 
-  manager_->SetSyncPrimaryAccountInfo(
-      account_tracker()->GetAccountInfo(account_id));
+  manager_->SetPrimaryAccountInfo(account_tracker()->GetAccountInfo(account_id),
+                                  ConsentLevel::kSync);
   EXPECT_EQ(1, num_successful_signins_);
   EXPECT_EQ(1, num_unconsented_account_changed_);
   EXPECT_EQ("user@gmail.com",
@@ -367,10 +367,10 @@ TEST_F(PrimaryAccountManagerTest, GaiaIdMigration) {
                            AccountTrackerService::MIGRATION_NOT_STARTED);
   ListPrefUpdate update(client_prefs, prefs::kAccountInfo);
   update->ClearList();
-  auto dict = std::make_unique<base::DictionaryValue>();
-  dict->SetString("account_id", email);
-  dict->SetString("email", email);
-  dict->SetString("gaia", gaia_id);
+  base::Value dict(base::Value::Type::DICTIONARY);
+  dict.SetStringKey("account_id", email);
+  dict.SetStringKey("email", email);
+  dict.SetStringKey("gaia", gaia_id);
   update->Append(std::move(dict));
 
   account_tracker()->ResetForTesting();
@@ -400,10 +400,10 @@ TEST_F(PrimaryAccountManagerTest, GaiaIdMigrationCrashInTheMiddle) {
                            AccountTrackerService::MIGRATION_NOT_STARTED);
   ListPrefUpdate update(client_prefs, prefs::kAccountInfo);
   update->ClearList();
-  auto dict = std::make_unique<base::DictionaryValue>();
-  dict->SetString("account_id", email);
-  dict->SetString("email", email);
-  dict->SetString("gaia", gaia_id);
+  base::Value dict(base::Value::Type::DICTIONARY);
+  dict.SetStringKey("account_id", email);
+  dict.SetStringKey("email", email);
+  dict.SetStringKey("gaia", gaia_id);
   update->Append(std::move(dict));
 
   account_tracker()->ResetForTesting();
@@ -433,9 +433,9 @@ TEST_F(PrimaryAccountManagerTest, GaiaIdMigration_ForceAllAccounts) {
                            AccountTrackerService::MIGRATION_NOT_STARTED);
   ListPrefUpdate update(client_prefs, prefs::kAccountInfo);
   update->ClearList();
-  auto dict = std::make_unique<base::DictionaryValue>();
-  dict->SetString("account_id", email);
-  dict->SetString("email", email);
+  base::Value dict(base::Value::Type::DICTIONARY);
+  dict.SetStringKey("account_id", email);
+  dict.SetStringKey("email", email);
   update->Append(std::move(dict));
 
   account_tracker()->ResetForTesting();
@@ -505,11 +505,9 @@ TEST_F(PrimaryAccountManagerTest, SetUnconsentedPrimaryAccountInfo) {
   EXPECT_EQ(0, num_successful_signins_);
 
   // Set the unconsented primary account.
-  CoreAccountInfo account_info;
-  account_info.account_id = CoreAccountId("gaia_id");
-  account_info.gaia = "gaia_id";
-  account_info.email = "user@gmail.com";
-  manager_->SetUnconsentedPrimaryAccountInfo(account_info);
+  CoreAccountId account_id = AddToAccountTracker("gaia_id", "user@gmail.com");
+  CoreAccountInfo account_info = account_tracker()->GetAccountInfo(account_id);
+  manager_->SetPrimaryAccountInfo(account_info, ConsentLevel::kSignin);
   EXPECT_EQ(0, num_successful_signins_);
   EXPECT_EQ(0, num_successful_signouts_);
   EXPECT_EQ(1, num_unconsented_account_changed_);
@@ -519,7 +517,7 @@ TEST_F(PrimaryAccountManagerTest, SetUnconsentedPrimaryAccountInfo) {
             manager_->GetPrimaryAccountInfo(ConsentLevel::kSync));
 
   // Set the same account again.
-  manager_->SetUnconsentedPrimaryAccountInfo(account_info);
+  manager_->SetPrimaryAccountInfo(account_info, ConsentLevel::kSignin);
   EXPECT_EQ(0, num_successful_signins_);
   EXPECT_EQ(0, num_successful_signouts_);
   EXPECT_EQ(1, num_unconsented_account_changed_);
@@ -531,7 +529,7 @@ TEST_F(PrimaryAccountManagerTest, SetUnconsentedPrimaryAccountInfo) {
   // Change the email to another equivalent email. The account is updated but
   // observers are not notified.
   account_info.email = "us.er@gmail.com";
-  manager_->SetUnconsentedPrimaryAccountInfo(account_info);
+  manager_->SetPrimaryAccountInfo(account_info, ConsentLevel::kSignin);
   EXPECT_EQ(0, num_successful_signins_);
   EXPECT_EQ(0, num_successful_signouts_);
   EXPECT_EQ(1, num_unconsented_account_changed_);
@@ -539,23 +537,13 @@ TEST_F(PrimaryAccountManagerTest, SetUnconsentedPrimaryAccountInfo) {
             manager_->GetPrimaryAccountInfo(ConsentLevel::kSignin));
   EXPECT_EQ(CoreAccountInfo(),
             manager_->GetPrimaryAccountInfo(ConsentLevel::kSync));
-
-  // Clear it.
-  manager_->SetUnconsentedPrimaryAccountInfo(CoreAccountInfo());
-  EXPECT_EQ(0, num_successful_signins_);
-  EXPECT_EQ(0, num_successful_signouts_);
-  EXPECT_EQ(2, num_unconsented_account_changed_);
-  EXPECT_EQ(CoreAccountInfo(),
-            manager_->GetPrimaryAccountInfo(ConsentLevel::kSignin));
-  EXPECT_EQ(CoreAccountInfo(),
-            manager_->GetPrimaryAccountInfo(ConsentLevel::kSync));
 }
 
 TEST_F(PrimaryAccountManagerTest, RevokeSyncConsent) {
   CreatePrimaryAccountManager();
   CoreAccountId account_id = AddToAccountTracker("gaia_id", "user@gmail.com");
-  manager_->SetSyncPrimaryAccountInfo(
-      account_tracker()->GetAccountInfo(account_id));
+  manager_->SetPrimaryAccountInfo(account_tracker()->GetAccountInfo(account_id),
+                                  ConsentLevel::kSync);
   EXPECT_TRUE(manager_->HasPrimaryAccount(ConsentLevel::kSync));
 
   manager_->RevokeSyncConsent(signin_metrics::ProfileSignout::SIGNOUT_TEST,
@@ -571,8 +559,8 @@ TEST_F(PrimaryAccountManagerTest, RevokeSyncConsent) {
 TEST_F(PrimaryAccountManagerTest, ClearPrimaryAccount) {
   CreatePrimaryAccountManager();
   CoreAccountId account_id = AddToAccountTracker("gaia_id", "user@gmail.com");
-  manager_->SetSyncPrimaryAccountInfo(
-      account_tracker()->GetAccountInfo(account_id));
+  manager_->SetPrimaryAccountInfo(account_tracker()->GetAccountInfo(account_id),
+                                  ConsentLevel::kSync);
   EXPECT_TRUE(manager_->HasPrimaryAccount(ConsentLevel::kSync));
 
   manager_->ClearPrimaryAccount(signin_metrics::ProfileSignout::SIGNOUT_TEST,
diff --git a/chromium/components/signin/internal/identity_manager/primary_account_mutator_impl.cc b/chromium/components/signin/internal/identity_manager/primary_account_mutator_impl.cc
index a330da198d7..e611eba72c1 100644
--- a/chromium/components/signin/internal/identity_manager/primary_account_mutator_impl.cc
+++ b/chromium/components/signin/internal/identity_manager/primary_account_mutator_impl.cc
@@ -37,9 +37,9 @@ PrimaryAccountMutatorImpl::PrimaryAccountMutatorImpl(
 
 #if BUILDFLAG(IS_CHROMEOS_ASH)
   // |account_consistency_| is not used on CHROMEOS_ASH, however it is preferred
-  // to have it defined to avoid a lof of ifdefs in the header file.
-  signin::AccountConsistencyMethod unused = account_consistency_;
-  ALLOW_UNUSED_LOCAL(unused);
+  // to have it defined to avoid a lot of ifdefs in the header file.
+  [[maybe_unused]] signin::AccountConsistencyMethod unused =
+      account_consistency_;
 #endif
 }
 
@@ -75,8 +75,7 @@ PrimaryAccountMutatorImpl::SetPrimaryAccount(const CoreAccountId& account_id,
       if (primary_account_manager_->HasPrimaryAccount(ConsentLevel::kSync))
         return PrimaryAccountError::kSyncConsentAlreadySet;
 #endif
-      primary_account_manager_->SetSyncPrimaryAccountInfo(account_info);
-      return PrimaryAccountError::kNoError;
+      break;
     case ConsentLevel::kSignin:
 #if BUILDFLAG(IS_CHROMEOS_ASH)
       // On Chrome OS the UPA can only be set once and never removed or changed.
@@ -84,10 +83,9 @@ PrimaryAccountMutatorImpl::SetPrimaryAccount(const CoreAccountId& account_id,
           !primary_account_manager_->HasPrimaryAccount(ConsentLevel::kSignin));
 #endif
       DCHECK(!primary_account_manager_->HasPrimaryAccount(ConsentLevel::kSync));
-      primary_account_manager_->SetUnconsentedPrimaryAccountInfo(account_info);
-      return PrimaryAccountError::kNoError;
+      break;
   }
-  CHECK(false) << "Unknown consent level: " << static_cast<int>(consent_level);
+  primary_account_manager_->SetPrimaryAccountInfo(account_info, consent_level);
   return PrimaryAccountError::kNoError;
 }
 
@@ -110,8 +108,17 @@ bool PrimaryAccountMutatorImpl::RevokeConsentShouldClearPrimaryAccount() const {
       // should consider moving it to |SigninManager|.
       return token_service_->RefreshTokenHasError(
           primary_account_manager_->GetPrimaryAccountId(ConsentLevel::kSync));
-    case AccountConsistencyMethod::kDisabled:
     case AccountConsistencyMethod::kMirror:
+#if BUILDFLAG(IS_CHROMEOS_LACROS)
+      // TODO(crbug.com/1217645): Consider making this return false only for the
+      // main profile and return true, otherwise. This requires implementing
+      // ProfileOAuth2TokenServiceDelegateChromeOS::Revoke* and it's not clear
+      // what these functions should do.
+      return false;
+#else
+      return true;
+#endif
+    case AccountConsistencyMethod::kDisabled:
       return true;
   }
 }
@@ -120,11 +127,6 @@ bool PrimaryAccountMutatorImpl::RevokeConsentShouldClearPrimaryAccount() const {
 void PrimaryAccountMutatorImpl::RevokeSyncConsent(
     signin_metrics::ProfileSignout source_metric,
     signin_metrics::SignoutDelete delete_metric) {
-#if BUILDFLAG(IS_CHROMEOS_LACROS)
-  // On Lacros with Mirror, revoking consent is not supported yet.
-  // TODO(https://crbug.com/1260291): Remove this when it is supported.
-  CHECK_NE(account_consistency_, AccountConsistencyMethod::kMirror);
-#endif
   DCHECK(primary_account_manager_->HasPrimaryAccount(ConsentLevel::kSync));
 
 #if !BUILDFLAG(IS_CHROMEOS_ASH)
@@ -143,12 +145,6 @@ bool PrimaryAccountMutatorImpl::ClearPrimaryAccount(
   if (!primary_account_manager_->HasPrimaryAccount(ConsentLevel::kSignin))
     return false;
 
-#if BUILDFLAG(IS_CHROMEOS_LACROS)
-  // On Lacros with Mirror, signout is not supported yet.
-  // TODO(https://crbug.com/1260291): Remove this when signout is supported.
-  CHECK_NE(account_consistency_, AccountConsistencyMethod::kMirror);
-#endif
-
   primary_account_manager_->ClearPrimaryAccount(source_metric, delete_metric);
   return true;
 }
diff --git a/chromium/components/signin/internal/identity_manager/profile_oauth2_token_service.cc b/chromium/components/signin/internal/identity_manager/profile_oauth2_token_service.cc
index b554cd39768..a98fecb0302 100644
--- a/chromium/components/signin/internal/identity_manager/profile_oauth2_token_service.cc
+++ b/chromium/components/signin/internal/identity_manager/profile_oauth2_token_service.cc
@@ -58,8 +58,8 @@ std::string SourceToString(SourceForRefreshTokenOperation source) {
       return "DiceResponseHandler::Signin";
     case SourceForRefreshTokenOperation::kDiceResponseHandler_Signout:
       return "DiceResponseHandler::Signout";
-    case SourceForRefreshTokenOperation::kDiceTurnOnSyncHelper_Abort:
-      return "DiceTurnOnSyncHelper::Abort";
+    case SourceForRefreshTokenOperation::kTurnOnSyncHelper_Abort:
+      return "TurnOnSyncHelper::Abort";
     case SourceForRefreshTokenOperation::kMachineLogon_CredentialProvider:
       return "MachineLogon::CredentialProvider";
     case SourceForRefreshTokenOperation::kTokenService_ExtractCredentials:
diff --git a/chromium/components/signin/internal/identity_manager/profile_oauth2_token_service_builder.cc b/chromium/components/signin/internal/identity_manager/profile_oauth2_token_service_builder.cc
index 55a8894c4d3..f9018596b17 100644
--- a/chromium/components/signin/internal/identity_manager/profile_oauth2_token_service_builder.cc
+++ b/chromium/components/signin/internal/identity_manager/profile_oauth2_token_service_builder.cc
@@ -7,6 +7,7 @@
 #include <string>
 #include <utility>
 
+#include "build/build_config.h"
 #include "build/chromeos_buildflags.h"
 #include "components/prefs/pref_service.h"
 #include "components/signin/internal/identity_manager/profile_oauth2_token_service.h"
@@ -15,7 +16,7 @@
 #include "components/signin/public/base/signin_client.h"
 #include "components/signin/public/base/signin_switches.h"
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 #include "components/signin/internal/identity_manager/profile_oauth2_token_service_delegate_android.h"
 #endif
 
@@ -28,14 +29,14 @@
 #include "components/signin/internal/identity_manager/profile_oauth2_token_service_delegate_chromeos.h"
 #endif
 
-#if defined(OS_IOS)
+#if BUILDFLAG(IS_IOS)
 #include "components/signin/internal/identity_manager/profile_oauth2_token_service_delegate_ios.h"
 #include "components/signin/public/identity_manager/ios/device_accounts_provider.h"
 #endif
 
 namespace {
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 // TODO(crbug.com/986435) Provide AccountManagerFacade as a parameter once
 // IdentityServicesProvider owns its instance management.
 std::unique_ptr<ProfileOAuth2TokenServiceDelegateAndroid>
@@ -43,7 +44,7 @@ CreateAndroidOAuthDelegate(AccountTrackerService* account_tracker_service) {
   return std::make_unique<ProfileOAuth2TokenServiceDelegateAndroid>(
       account_tracker_service);
 }
-#elif defined(OS_IOS)
+#elif BUILDFLAG(IS_IOS)
 std::unique_ptr<ProfileOAuth2TokenServiceIOSDelegate> CreateIOSOAuthDelegate(
     SigninClient* signin_client,
     std::unique_ptr<DeviceAccountsProvider> device_accounts_provider,
@@ -71,7 +72,7 @@ CreateMutableProfileOAuthDelegate(
     bool delete_signin_cookies_on_exit,
     scoped_refptr<TokenWebData> token_web_data,
     SigninClient* signin_client,
-#if defined(OS_WIN)
+#if BUILDFLAG(IS_WIN)
     MutableProfileOAuth2TokenServiceDelegate::FixRequestErrorCallback
         reauth_callback,
 #endif
@@ -85,14 +86,14 @@ CreateMutableProfileOAuthDelegate(
   return std::make_unique<MutableProfileOAuth2TokenServiceDelegate>(
       signin_client, account_tracker_service, network_connection_tracker,
       token_web_data, account_consistency, revoke_all_tokens_on_load,
-#if defined(OS_WIN)
+#if BUILDFLAG(IS_WIN)
       reauth_callback
 #else
       MutableProfileOAuth2TokenServiceDelegate::FixRequestErrorCallback()
-#endif  // defined(OS_WIN)
+#endif  // BUILDFLAG(IS_WIN)
   );
 }
-#endif  // defined(OS_ANDROID)
+#endif  // BUILDFLAG(IS_ANDROID)
 
 std::unique_ptr<ProfileOAuth2TokenServiceDelegate>
 CreateOAuth2TokenServiceDelegate(
@@ -107,17 +108,17 @@ CreateOAuth2TokenServiceDelegate(
     bool delete_signin_cookies_on_exit,
     scoped_refptr<TokenWebData> token_web_data,
 #endif
-#if defined(OS_IOS)
+#if BUILDFLAG(IS_IOS)
     std::unique_ptr<DeviceAccountsProvider> device_accounts_provider,
 #endif
-#if defined(OS_WIN)
+#if BUILDFLAG(IS_WIN)
     MutableProfileOAuth2TokenServiceDelegate::FixRequestErrorCallback
         reauth_callback,
 #endif
     network::NetworkConnectionTracker* network_connection_tracker) {
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   return CreateAndroidOAuthDelegate(account_tracker_service);
-#elif defined(OS_IOS)
+#elif BUILDFLAG(IS_IOS)
   return CreateIOSOAuthDelegate(signin_client,
                                 std::move(device_accounts_provider),
                                 account_tracker_service);
@@ -131,14 +132,14 @@ CreateOAuth2TokenServiceDelegate(
   return CreateMutableProfileOAuthDelegate(
       account_tracker_service, account_consistency,
       delete_signin_cookies_on_exit, token_web_data, signin_client,
-#if defined(OS_WIN)
+#if BUILDFLAG(IS_WIN)
       reauth_callback,
-#endif  // defined(OS_WIN)
+#endif  // BUILDFLAG(IS_WIN)
       network_connection_tracker);
 #else
   NOTREACHED();
   return nullptr;
-#endif  // defined(OS_ANDROID)
+#endif  // BUILDFLAG(IS_ANDROID)
 }
 
 }  // namespace
@@ -156,10 +157,10 @@ std::unique_ptr<ProfileOAuth2TokenService> BuildProfileOAuth2TokenService(
     bool delete_signin_cookies_on_exit,
     scoped_refptr<TokenWebData> token_web_data,
 #endif
-#if defined(OS_IOS)
+#if BUILDFLAG(IS_IOS)
     std::unique_ptr<DeviceAccountsProvider> device_accounts_provider,
 #endif
-#if defined(OS_WIN)
+#if BUILDFLAG(IS_WIN)
     MutableProfileOAuth2TokenServiceDelegate::FixRequestErrorCallback
         reauth_callback,
 #endif
@@ -183,10 +184,10 @@ std::unique_ptr<ProfileOAuth2TokenService> BuildProfileOAuth2TokenService(
 #if BUILDFLAG(ENABLE_DICE_SUPPORT)
           delete_signin_cookies_on_exit, token_web_data,
 #endif
-#if defined(OS_IOS)
+#if BUILDFLAG(IS_IOS)
           std::move(device_accounts_provider),
 #endif
-#if defined(OS_WIN)
+#if BUILDFLAG(IS_WIN)
           reauth_callback,
 #endif
           network_connection_tracker));
diff --git a/chromium/components/signin/internal/identity_manager/profile_oauth2_token_service_builder.h b/chromium/components/signin/internal/identity_manager/profile_oauth2_token_service_builder.h
index 19a13e6a45d..ffbb90f818b 100644
--- a/chromium/components/signin/internal/identity_manager/profile_oauth2_token_service_builder.h
+++ b/chromium/components/signin/internal/identity_manager/profile_oauth2_token_service_builder.h
@@ -12,11 +12,11 @@
 #include "build/chromeos_buildflags.h"
 #include "components/signin/public/base/signin_buildflags.h"
 
-#if !defined(OS_ANDROID)
+#if !BUILDFLAG(IS_ANDROID)
 #include "base/memory/scoped_refptr.h"
 #endif
 
-#if defined(OS_WIN)
+#if BUILDFLAG(IS_WIN)
 #include "components/signin/internal/identity_manager/mutable_profile_oauth2_token_service_delegate.h"
 #endif
 
@@ -25,7 +25,7 @@ class PrefService;
 class ProfileOAuth2TokenService;
 class SigninClient;
 
-#if defined(OS_IOS)
+#if BUILDFLAG(IS_IOS)
 class DeviceAccountsProvider;
 #endif
 
@@ -60,10 +60,10 @@ std::unique_ptr<ProfileOAuth2TokenService> BuildProfileOAuth2TokenService(
     bool delete_signin_cookies_on_exit,
     scoped_refptr<TokenWebData> token_web_data,
 #endif
-#if defined(OS_IOS)
+#if BUILDFLAG(IS_IOS)
     std::unique_ptr<DeviceAccountsProvider> device_accounts_provider,
 #endif
-#if defined(OS_WIN)
+#if BUILDFLAG(IS_WIN)
     MutableProfileOAuth2TokenServiceDelegate::FixRequestErrorCallback
         reauth_callback,
 #endif
diff --git a/chromium/components/signin/internal/identity_manager/profile_oauth2_token_service_delegate.h b/chromium/components/signin/internal/identity_manager/profile_oauth2_token_service_delegate.h
index bb9d332bcbe..7cbe1702118 100644
--- a/chromium/components/signin/internal/identity_manager/profile_oauth2_token_service_delegate.h
+++ b/chromium/components/signin/internal/identity_manager/profile_oauth2_token_service_delegate.h
@@ -21,7 +21,7 @@
 #include "net/base/backoff_entry.h"
 #include "third_party/abseil-cpp/absl/types/optional.h"
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 #include "base/android/jni_android.h"
 #endif
 
@@ -48,10 +48,11 @@ class ProfileOAuth2TokenServiceDelegate {
 
   virtual ~ProfileOAuth2TokenServiceDelegate();
 
-  virtual std::unique_ptr<OAuth2AccessTokenFetcher> CreateAccessTokenFetcher(
+  [[nodiscard]] virtual std::unique_ptr<OAuth2AccessTokenFetcher>
+  CreateAccessTokenFetcher(
       const CoreAccountId& account_id,
       scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory,
-      OAuth2AccessTokenConsumer* consumer) WARN_UNUSED_RESULT = 0;
+      OAuth2AccessTokenConsumer* consumer) = 0;
 
   // Returns |true| if a refresh token is available for |account_id|, and
   // |false| otherwise.
@@ -133,19 +134,19 @@ class ProfileOAuth2TokenServiceDelegate {
   // and false otherwise.
   virtual bool FixRequestErrorIfPossible();
 
-#if defined(OS_IOS) || defined(OS_ANDROID)
+#if BUILDFLAG(IS_IOS) || BUILDFLAG(IS_ANDROID)
   // Triggers platform specific implementation to reload accounts from system.
   virtual void ReloadAllAccountsFromSystemWithPrimaryAccount(
       const absl::optional<CoreAccountId>& primary_account_id) {}
 #endif
 
-#if defined(OS_IOS)
+#if BUILDFLAG(IS_IOS)
   // Triggers platform specific implementation for iOS to add a given account
   // to the token service from a system account.
   virtual void ReloadAccountFromSystem(const CoreAccountId& account_id) {}
 #endif
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   // Returns a reference to the corresponding Java object.
   virtual base::android::ScopedJavaLocalRef<jobject> GetJavaObject() = 0;
 #endif
diff --git a/chromium/components/signin/ios/browser/BUILD.gn b/chromium/components/signin/ios/browser/BUILD.gn
index 79715757758..55fdf5b766f 100644
--- a/chromium/components/signin/ios/browser/BUILD.gn
+++ b/chromium/components/signin/ios/browser/BUILD.gn
@@ -82,6 +82,7 @@ source_set("unit_tests") {
     "//components/sync_preferences:test_support",
     "//ios/web",
     "//ios/web/public/test",
+    "//ios/web/public/test:test_fixture",
     "//ios/web/public/test/fakes",
     "//net:test_support",
     "//testing/gmock",
diff --git a/chromium/components/signin/ios/browser/account_consistency_service.h b/chromium/components/signin/ios/browser/account_consistency_service.h
index 6f72ce6fd5c..04b9fa53352 100644
--- a/chromium/components/signin/ios/browser/account_consistency_service.h
+++ b/chromium/components/signin/ios/browser/account_consistency_service.h
@@ -51,7 +51,7 @@ class AccountConsistencyService : public KeyedService,
   // Sets the handler for |web_state| that reacts on Gaia responses with the
   // X-Chrome-Manage-Accounts header and notifies |delegate|.
   void SetWebStateHandler(web::WebState* web_state,
-                          id<ManageAccountsDelegate> delegate);
+                          ManageAccountsDelegate* delegate);
   // Removes the handler associated with |web_state|.
   void RemoveWebStateHandler(web::WebState* web_state);
 
diff --git a/chromium/components/signin/ios/browser/account_consistency_service.mm b/chromium/components/signin/ios/browser/account_consistency_service.mm
index 9a768a889c4..03de401f8cb 100644
--- a/chromium/components/signin/ios/browser/account_consistency_service.mm
+++ b/chromium/components/signin/ios/browser/account_consistency_service.mm
@@ -107,7 +107,7 @@ class AccountConsistencyService::AccountConsistencyHandler
                             AccountConsistencyService* service,
                             AccountReconcilor* account_reconcilor,
                             signin::IdentityManager* identity_manager,
-                            id<ManageAccountsDelegate> delegate);
+                            ManageAccountsDelegate* delegate);
 
   void WebStateDestroyed(web::WebState* web_state) override;
 
@@ -137,12 +137,15 @@ class AccountConsistencyService::AccountConsistencyHandler
   // Handles the AddAccount request depending on |has_cookie_changed|.
   void HandleAddAccountRequest(GURL url, BOOL has_cookie_changed);
 
-  bool show_consistency_promo_ = false;
+  // The consistency web sign-in needs to be shown once the page is loaded.
+  // It is required to avoid having the keyboard showing up on top of the web
+  // sign-in dialog.
+  bool show_consistency_web_signin_ = false;
   AccountConsistencyService* account_consistency_service_;  // Weak.
   AccountReconcilor* account_reconcilor_;                   // Weak.
   signin::IdentityManager* identity_manager_;
   web::WebState* web_state_;
-  __weak id<ManageAccountsDelegate> delegate_;
+  ManageAccountsDelegate* delegate_;  // Weak.
   base::WeakPtrFactory<AccountConsistencyHandler> weak_ptr_factory_;
 };
 
@@ -151,7 +154,7 @@ AccountConsistencyService::AccountConsistencyHandler::AccountConsistencyHandler(
     AccountConsistencyService* service,
     AccountReconcilor* account_reconcilor,
     signin::IdentityManager* identity_manager,
-    id<ManageAccountsDelegate> delegate)
+    ManageAccountsDelegate* delegate)
     : web::WebStatePolicyDecider(web_state),
       account_consistency_service_(service),
       account_reconcilor_(account_reconcilor),
@@ -199,11 +202,6 @@ void AccountConsistencyService::AccountConsistencyHandler::ShouldAllowResponse(
         {url, GURL(kGoogleUrl)});
   }
 
-  // Reset boolean that tracks displaying the sign-in consistency promo. This
-  // ensures that the promo is cancelled once navigation has started and the
-  // WKWebView is cancelling previous navigations.
-  show_consistency_promo_ = false;
-
   if (!gaia::IsGaiaSignonRealm(url.DeprecatedGetOriginAsURL())) {
     std::move(callback).Run(PolicyDecision::Allow());
     return;
@@ -218,7 +216,7 @@ void AccountConsistencyService::AccountConsistencyHandler::ShouldAllowResponse(
     NSString* x_autologin_header = [[http_response allHeaderFields]
         objectForKey:[NSString stringWithUTF8String:signin::kAutoLoginHeader]];
     if (x_autologin_header) {
-      show_consistency_promo_ = true;
+      show_consistency_web_signin_ = true;
     }
     std::move(callback).Run(PolicyDecision::Allow());
     return;
@@ -234,7 +232,8 @@ void AccountConsistencyService::AccountConsistencyHandler::ShouldAllowResponse(
       GURL continue_url = GURL(params.continue_url);
       DLOG_IF(ERROR, !params.continue_url.empty() && !continue_url.is_valid())
           << "Invalid continuation URL: \"" << continue_url << "\"";
-      [delegate_ onGoIncognito:continue_url];
+      if (delegate_)
+        delegate_->OnGoIncognito(continue_url);
       break;
     }
     case signin::GAIA_SERVICE_TYPE_SIGNUP:
@@ -254,19 +253,14 @@ void AccountConsistencyService::AccountConsistencyHandler::ShouldAllowResponse(
           // have been restored.
           return;
         }
-      } else if (!identity_manager_->GetAccountsWithRefreshTokens().empty()) {
-        show_consistency_promo_ = true;
-        // Allows the URL response to load before showing the consistency promo.
-        // The promo should always be displayed in the foreground of Gaia
-        // sign-on.
-        std::move(callback).Run(PolicyDecision::Allow());
-        return;
       }
-      [delegate_ onAddAccount];
+      if (delegate_)
+        delegate_->OnAddAccount();
       break;
     case signin::GAIA_SERVICE_TYPE_SIGNOUT:
     case signin::GAIA_SERVICE_TYPE_DEFAULT:
-      [delegate_ onManageAccounts];
+      if (delegate_)
+        delegate_->OnManageAccounts();
       break;
     case signin::GAIA_SERVICE_TYPE_NONE:
       NOTREACHED();
@@ -290,13 +284,15 @@ void AccountConsistencyService::AccountConsistencyHandler::
     // is not in an inconsistent state (where the identities on the device
     // are different than those on the web). Fallback to asking the user to
     // add an account.
-    [delegate_ onAddAccount];
+    if (delegate_)
+      delegate_->OnAddAccount();
     return;
   }
   web_state_->OpenURL(web::WebState::OpenURLParams(
       url, web::Referrer(), WindowOpenDisposition::CURRENT_TAB,
       ui::PAGE_TRANSITION_AUTO_TOPLEVEL, false));
-  [delegate_ onRestoreGaiaCookies];
+  if (delegate_)
+    delegate_->OnRestoreGaiaCookies();
   LogIOSGaiaCookiesState(
       GaiaCookieStateOnSignedInNavigation::kGaiaCookieRestoredOnShowInfobar);
 }
@@ -312,11 +308,11 @@ void AccountConsistencyService::AccountConsistencyHandler::PageLoaded(
     return;
   }
 
-  if (show_consistency_promo_ &&
+  if (delegate_ && show_consistency_web_signin_ &&
       gaia::IsGaiaSignonRealm(url.DeprecatedGetOriginAsURL())) {
-    [delegate_ onShowConsistencyPromo:url webState:web_state];
-    show_consistency_promo_ = false;
+    delegate_->OnShowConsistencyPromo(url, web_state);
   }
+  show_consistency_web_signin_ = false;
 }
 
 void AccountConsistencyService::AccountConsistencyHandler::WebStateDestroyed(
@@ -406,7 +402,7 @@ void AccountConsistencyService::RunGaiaCookiesRestoredCallbacks(
 
 void AccountConsistencyService::SetWebStateHandler(
     web::WebState* web_state,
-    id<ManageAccountsDelegate> delegate) {
+    ManageAccountsDelegate* delegate) {
   DCHECK(!is_shutdown_) << "SetWebStateHandler called after Shutdown";
   DCHECK(handlers_map_.find(web_state) == handlers_map_.end());
   handlers_map_.insert(std::make_pair(
diff --git a/chromium/components/signin/ios/browser/account_consistency_service_unittest.mm b/chromium/components/signin/ios/browser/account_consistency_service_unittest.mm
index 21906c9e82b..4621cd690ab 100644
--- a/chromium/components/signin/ios/browser/account_consistency_service_unittest.mm
+++ b/chromium/components/signin/ios/browser/account_consistency_service_unittest.mm
@@ -44,6 +44,8 @@
 #error "This file requires ARC support."
 #endif
 
+using testing::NiceMock;
+
 namespace {
 // Fake identity email.
 const char* kFakeEmail = "janedoe@gmail.com";
@@ -94,6 +96,34 @@ class MockAccountReconcilor : public AccountReconcilor {
   MOCK_METHOD1(OnReceivedManageAccountsResponse, void(signin::GAIAServiceType));
 };
 
+// Fake delegate implementation; all it does it count delegate calls.
+class FakeManageAccountsDelegate : public ManageAccountsDelegate {
+ public:
+  FakeManageAccountsDelegate() {}
+  ~FakeManageAccountsDelegate() override {}
+
+  void OnRestoreGaiaCookies() override { restore_cookies_call_count_++; }
+  void OnManageAccounts() override { manage_accounts_call_count_++; }
+  void OnAddAccount() override { add_account_call_count_++; }
+  void OnShowConsistencyPromo(const GURL& url,
+                              web::WebState* webState) override {
+    show_promo_call_count_++;
+  }
+  void OnGoIncognito(const GURL& url) override { go_incognito_call_count_++; }
+
+  int total_call_count() {
+    return restore_cookies_call_count_ + manage_accounts_call_count_ +
+           add_account_call_count_ + show_promo_call_count_ +
+           go_incognito_call_count_;
+  }
+
+  int restore_cookies_call_count_ = 0;
+  int manage_accounts_call_count_ = 0;
+  int add_account_call_count_ = 0;
+  int show_promo_call_count_ = 0;
+  int go_incognito_call_count_ = 0;
+};
+
 // FakeWebState that allows control over its policy decider.
 class FakeWebState : public web::FakeWebState {
  public:
@@ -155,8 +185,9 @@ class AccountConsistencyServiceTest : public PlatformTest {
         false /* restore_session */);
     cookie_settings_ = new content_settings::CookieSettings(settings_map_.get(),
                                                             &prefs_, false, "");
+    // Use a NiceMock here to suppress "uninteresting call" warnings.
     account_reconcilor_ =
-        std::make_unique<MockAccountReconcilor>(signin_client_.get());
+        std::make_unique<NiceMock<MockAccountReconcilor>>(signin_client_.get());
     ResetAccountConsistencyService();
   }
 
@@ -230,7 +261,7 @@ class AccountConsistencyServiceTest : public PlatformTest {
 
   // Navigation APIs.
   void SimulateNavigateToURL(NSURLResponse* response,
-                             id<ManageAccountsDelegate> delegate) {
+                             ManageAccountsDelegate* delegate) {
     SimulateNavigateToURL(response, delegate,
                           web::PageLoadCompletionStatus::SUCCESS,
                           /* expected_allowed_response=*/true);
@@ -238,15 +269,14 @@ class AccountConsistencyServiceTest : public PlatformTest {
 
   void SimulateNavigateToURLWithPageLoadFailure(
       NSURLResponse* response,
-      id<ManageAccountsDelegate> delegate) {
+      ManageAccountsDelegate* delegate) {
     SimulateNavigateToURL(response, delegate,
                           web::PageLoadCompletionStatus::FAILURE,
                           /* expected_allowed_response=*/true);
   }
 
-  void SimulateNavigateToURLWithInterruption(
-      NSURLResponse* response,
-      id<ManageAccountsDelegate> delegate) {
+  void SimulateNavigateToURLWithInterruption(NSURLResponse* response,
+                                             ManageAccountsDelegate* delegate) {
     SimulateNavigateToURL(response, delegate,
                           web::PageLoadCompletionStatus::SUCCESS,
                           /* expected_allowed_response=*/false);
@@ -283,7 +313,7 @@ class AccountConsistencyServiceTest : public PlatformTest {
                                   base::OnceCallback<void(uint)>());
   }
 
-  void SetWebStateHandler(id<ManageAccountsDelegate> delegate) {
+  void SetWebStateHandler(ManageAccountsDelegate* delegate) {
     // If we have already added the |web_state_| with a previous |delegate|,
     // remove it to enforce a one-to-one mapping between web state handler and
     // web state.
@@ -301,6 +331,7 @@ class AccountConsistencyServiceTest : public PlatformTest {
   web::FakeBrowserState browser_state_;
   sync_preferences::TestingPrefServiceSyncable prefs_;
   FakeWebState web_state_;
+  FakeManageAccountsDelegate delegate_;
   network::TestURLLoaderFactory test_url_loader_factory_;
 
   std::unique_ptr<signin::IdentityTestEnvironment> identity_test_env_;
@@ -309,7 +340,7 @@ class AccountConsistencyServiceTest : public PlatformTest {
 
  private:
   void SimulateNavigateToURL(NSURLResponse* response,
-                             id<ManageAccountsDelegate> delegate,
+                             ManageAccountsDelegate* delegate,
                              web::PageLoadCompletionStatus page_status,
                              bool expect_allowed_response) {
     SetWebStateHandler(delegate);
@@ -361,8 +392,6 @@ TEST_F(AccountConsistencyServiceTest, SignInSignOut) {
   CheckDomainHasChromeConnectedCookie(kYoutubeDomain);
   CheckNoChromeConnectedCookieForDomain(kCountryGoogleDomain);
 
-  id delegate =
-      [OCMockObject mockForProtocol:@protocol(ManageAccountsDelegate)];
   NSDictionary* headers = [NSDictionary dictionary];
 
   NSHTTPURLResponse* response = [[NSHTTPURLResponse alloc]
@@ -371,7 +400,7 @@ TEST_F(AccountConsistencyServiceTest, SignInSignOut) {
        HTTPVersion:@"HTTP/1.1"
       headerFields:headers];
 
-  SimulateNavigateToURL(response, delegate);
+  SimulateNavigateToURL(response, &delegate_);
 
   // Check that cookies was also added for |kCountryGoogleDomain|.
   CheckDomainHasChromeConnectedCookie(kGoogleDomain);
@@ -393,8 +422,6 @@ TEST_F(AccountConsistencyServiceTest, SignOutWithoutDomains) {
 // Tests that the X-Chrome-Manage-Accounts header is ignored unless it comes
 // from Gaia signon realm.
 TEST_F(AccountConsistencyServiceTest, ChromeManageAccountsNotOnGaia) {
-  id delegate =
-      [OCMockObject mockForProtocol:@protocol(ManageAccountsDelegate)];
   NSDictionary* headers =
       [NSDictionary dictionaryWithObject:@"action=DEFAULT"
                                   forKey:@"X-Chrome-Manage-Accounts"];
@@ -404,17 +431,13 @@ TEST_F(AccountConsistencyServiceTest, ChromeManageAccountsNotOnGaia) {
        HTTPVersion:@"HTTP/1.1"
       headerFields:headers];
 
-  SimulateNavigateToURL(response, delegate);
-
-  EXPECT_OCMOCK_VERIFY(delegate);
+  SimulateNavigateToURL(response, &delegate_);
+  EXPECT_EQ(0, delegate_.total_call_count());
 }
 
 // Tests that navigation to Gaia signon realm with no X-Chrome-Manage-Accounts
 // header in the response are simply untouched.
 TEST_F(AccountConsistencyServiceTest, ChromeManageAccountsNoHeader) {
-  id delegate =
-      [OCMockObject mockForProtocol:@protocol(ManageAccountsDelegate)];
-
   NSDictionary* headers = [NSDictionary dictionary];
   NSHTTPURLResponse* response = [[NSHTTPURLResponse alloc]
        initWithURL:[NSURL URLWithString:@"https://accounts.google.com/"]
@@ -422,20 +445,14 @@ TEST_F(AccountConsistencyServiceTest, ChromeManageAccountsNoHeader) {
        HTTPVersion:@"HTTP/1.1"
       headerFields:headers];
 
-  SimulateNavigateToURL(response, delegate);
-
-  EXPECT_OCMOCK_VERIFY(delegate);
+  SimulateNavigateToURL(response, &delegate_);
+  EXPECT_EQ(0, delegate_.total_call_count());
 }
 
 // Tests that the ManageAccountsDelegate is notified when a navigation on Gaia
 // signon realm returns with a X-Chrome-Manage-Accounts header with action
 // DEFAULT.
 TEST_F(AccountConsistencyServiceTest, ChromeManageAccountsDefault) {
-  id delegate =
-      [OCMockObject mockForProtocol:@protocol(ManageAccountsDelegate)];
-  // Default action is |onManageAccounts|.
-  [[delegate expect] onManageAccounts];
-
   NSDictionary* headers =
       [NSDictionary dictionaryWithObject:@"action=DEFAULT"
                                   forKey:@"X-Chrome-Manage-Accounts"];
@@ -448,19 +465,15 @@ TEST_F(AccountConsistencyServiceTest, ChromeManageAccountsDefault) {
                                         signin::GAIA_SERVICE_TYPE_DEFAULT))
       .Times(1);
 
-  SimulateNavigateToURLWithInterruption(response, delegate);
+  SimulateNavigateToURLWithInterruption(response, &delegate_);
 
-  EXPECT_OCMOCK_VERIFY(delegate);
+  EXPECT_EQ(1, delegate_.total_call_count());
+  EXPECT_EQ(1, delegate_.manage_accounts_call_count_);
 }
 
 // Tests that the ManageAccountsDelegate is notified when a navigation on Gaia
 // signon realm returns with a X-Auto-Login header.
 TEST_F(AccountConsistencyServiceTest, ChromeShowConsistencyPromo) {
-  id delegate =
-      [OCMockObject mockForProtocol:@protocol(ManageAccountsDelegate)];
-  [[[delegate expect] ignoringNonObjectArgs] onShowConsistencyPromo:GURL()
-                                                           webState:nullptr];
-
   NSDictionary* headers = [NSDictionary dictionaryWithObject:@"args=unused"
                                                       forKey:@"X-Auto-Login"];
   NSHTTPURLResponse* response = [[NSHTTPURLResponse alloc]
@@ -469,19 +482,15 @@ TEST_F(AccountConsistencyServiceTest, ChromeShowConsistencyPromo) {
        HTTPVersion:@"HTTP/1.1"
       headerFields:headers];
 
-  SimulateNavigateToURL(response, delegate);
+  SimulateNavigateToURL(response, &delegate_);
 
-  EXPECT_OCMOCK_VERIFY(delegate);
+  EXPECT_EQ(1, delegate_.total_call_count());
+  EXPECT_EQ(1, delegate_.show_promo_call_count_);
 }
 
 // Tests that the consistency promo is not displayed when a page fails to load.
 TEST_F(AccountConsistencyServiceTest,
        ChromeNotShowConsistencyPromoOnPageLoadFailure) {
-  id delegate =
-      [OCMockObject mockForProtocol:@protocol(ManageAccountsDelegate)];
-  [[[delegate reject] ignoringNonObjectArgs] onShowConsistencyPromo:GURL()
-                                                           webState:nullptr];
-
   NSDictionary* headers = [NSDictionary dictionaryWithObject:@"args=unused"
                                                       forKey:@"X-Auto-Login"];
   NSHTTPURLResponse* response = [[NSHTTPURLResponse alloc]
@@ -490,21 +499,14 @@ TEST_F(AccountConsistencyServiceTest,
        HTTPVersion:@"HTTP/1.1"
       headerFields:headers];
 
-  SimulateNavigateToURLWithPageLoadFailure(response, delegate);
-
-  EXPECT_OCMOCK_VERIFY(delegate);
+  SimulateNavigateToURLWithPageLoadFailure(response, &delegate_);
+  EXPECT_EQ(0, delegate_.total_call_count());
 }
 
 // Tests that the consistency promo is not displayed when a page fails to load
 // and user chooses another action.
 TEST_F(AccountConsistencyServiceTest,
        ChromeNotShowConsistencyPromoOnPageLoadFailureRedirect) {
-  id delegate =
-      [OCMockObject mockForProtocol:@protocol(ManageAccountsDelegate)];
-  [[delegate expect] onAddAccount];
-  [[[delegate reject] ignoringNonObjectArgs] onShowConsistencyPromo:GURL()
-                                                           webState:nullptr];
-
   EXPECT_CALL(*account_reconcilor_, OnReceivedManageAccountsResponse(
                                         signin::GAIA_SERVICE_TYPE_ADDSESSION));
 
@@ -516,7 +518,7 @@ TEST_F(AccountConsistencyServiceTest,
        HTTPVersion:@"HTTP/1.1"
       headerFields:headers];
 
-  SimulateNavigateToURLWithPageLoadFailure(responseSignin, delegate);
+  SimulateNavigateToURLWithPageLoadFailure(responseSignin, &delegate_);
 
   NSDictionary* headersAddAccount =
       [NSDictionary dictionaryWithObject:@"action=ADDSESSION"
@@ -527,19 +529,17 @@ TEST_F(AccountConsistencyServiceTest,
        HTTPVersion:@"HTTP/1.1"
       headerFields:headersAddAccount];
 
-  SimulateNavigateToURLWithInterruption(responseAddAccount, delegate);
+  SimulateNavigateToURLWithInterruption(responseAddAccount, &delegate_);
 
-  EXPECT_OCMOCK_VERIFY(delegate);
+  EXPECT_EQ(1, delegate_.total_call_count());
+  EXPECT_EQ(1, delegate_.add_account_call_count_);
+  EXPECT_EQ(0, delegate_.show_promo_call_count_);
 }
 
 // Tests that the ManageAccountsDelegate is notified when a navigation on Gaia
 // signon realm returns with a X-Chrome-Manage-Accounts header with ADDSESSION
 // action.
 TEST_F(AccountConsistencyServiceTest, ChromeManageAccountsShowAddAccount) {
-  id delegate =
-      [OCMockObject mockForProtocol:@protocol(ManageAccountsDelegate)];
-  [[delegate expect] onAddAccount];
-
   NSDictionary* headers =
       [NSDictionary dictionaryWithObject:@"action=ADDSESSION"
                                   forKey:@"X-Chrome-Manage-Accounts"];
@@ -552,9 +552,9 @@ TEST_F(AccountConsistencyServiceTest, ChromeManageAccountsShowAddAccount) {
                                         signin::GAIA_SERVICE_TYPE_ADDSESSION))
       .Times(1);
 
-  SimulateNavigateToURLWithInterruption(response, delegate);
-
-  EXPECT_OCMOCK_VERIFY(delegate);
+  SimulateNavigateToURLWithInterruption(response, &delegate_);
+  EXPECT_EQ(1, delegate_.total_call_count());
+  EXPECT_EQ(1, delegate_.add_account_call_count_);
 }
 
 // Tests that domains with cookie are correctly loaded from the prefs on service
@@ -619,8 +619,6 @@ TEST_F(AccountConsistencyServiceTest,
 TEST_F(AccountConsistencyServiceTest, SetChromeConnectedCookie) {
   SignIn();
 
-  id delegate =
-      [OCMockObject mockForProtocol:@protocol(ManageAccountsDelegate)];
   NSDictionary* headers = [NSDictionary dictionary];
 
   // HTTP response URL is eligible for Mirror (the test does not use google.com
@@ -631,10 +629,10 @@ TEST_F(AccountConsistencyServiceTest, SetChromeConnectedCookie) {
        HTTPVersion:@"HTTP/1.1"
       headerFields:headers];
 
-  SimulateNavigateToURL(response, delegate);
+  SimulateNavigateToURL(response, &delegate_);
   SimulateExternalSourceRemovesAllGoogleDomainCookies();
 
-  SimulateNavigateToURL(response, delegate);
+  SimulateNavigateToURL(response, &delegate_);
 
   CheckDomainHasChromeConnectedCookie(kGoogleDomain);
   CheckDomainHasChromeConnectedCookie(kYoutubeDomain);
@@ -645,10 +643,6 @@ TEST_F(AccountConsistencyServiceTest, SetChromeConnectedCookie) {
 TEST_F(AccountConsistencyServiceTest, GAIACookieMissingOnSignin) {
   SignIn();
 
-  id delegate =
-      [OCMockObject mockForProtocol:@protocol(ManageAccountsDelegate)];
-  [[delegate expect] onAddAccount];
-
   NSDictionary* headers =
       [NSDictionary dictionaryWithObject:@"action=ADDSESSION"
                                   forKey:@"X-Chrome-Manage-Accounts"];
@@ -661,17 +655,18 @@ TEST_F(AccountConsistencyServiceTest, GAIACookieMissingOnSignin) {
                                         signin::GAIA_SERVICE_TYPE_ADDSESSION))
       .Times(2);
 
-  SimulateNavigateToURL(response, delegate);
+  SimulateNavigateToURL(response, &delegate_);
   base::HistogramTester histogram_tester;
   histogram_tester.ExpectTotalCount(kGAIACookieOnNavigationHistogram, 0);
 
   SimulateExternalSourceRemovesAllGoogleDomainCookies();
 
   // Gaia cookie is not restored due to one-hour time restriction.
-  SimulateNavigateToURLWithInterruption(response, delegate);
+  SimulateNavigateToURLWithInterruption(response, &delegate_);
   histogram_tester.ExpectTotalCount(kGAIACookieOnNavigationHistogram, 1);
 
-  EXPECT_OCMOCK_VERIFY(delegate);
+  EXPECT_EQ(1, delegate_.total_call_count());
+  EXPECT_EQ(1, delegate_.add_account_call_count_);
 }
 
 // Ensures that set and remove cookie operations are handled in the order
@@ -716,9 +711,6 @@ TEST_F(AccountConsistencyServiceTest, SetChromeConnectedCookiesAfterDelete) {
 // is signed out and navigating to google.com.
 TEST_F(AccountConsistencyServiceTest,
        SetChromeConnectedCookiesSignedOutGoogleVisitor) {
-  id delegate =
-      [OCMockObject mockForProtocol:@protocol(ManageAccountsDelegate)];
-
   NSDictionary* headers =
       [NSDictionary dictionaryWithObject:@"action=ADDSESSION"
                                   forKey:@"X-Chrome-Manage-Accounts"];
@@ -730,21 +722,16 @@ TEST_F(AccountConsistencyServiceTest,
 
   CheckNoChromeConnectedCookies();
 
-  SimulateNavigateToURL(response, delegate);
+  SimulateNavigateToURL(response, &delegate_);
 
   CheckNoChromeConnectedCookies();
-  EXPECT_OCMOCK_VERIFY(delegate);
+  EXPECT_EQ(0, delegate_.total_call_count());
 }
 
 // Ensures that CHROME_CONNECTED cookies are not set when the user is signed out
 // after the sign-in promo is shown.
 TEST_F(AccountConsistencyServiceTest,
        SetChromeConnectedCookiesSignedOutGaiaVisitor) {
-  id delegate =
-      [OCMockObject mockForProtocol:@protocol(ManageAccountsDelegate)];
-  [[[delegate expect] ignoringNonObjectArgs] onShowConsistencyPromo:GURL()
-                                                           webState:nullptr];
-
   NSDictionary* headers = [NSDictionary dictionaryWithObject:@"args=unused"
                                                       forKey:@"X-Auto-Login"];
   NSHTTPURLResponse* response = [[NSHTTPURLResponse alloc]
@@ -753,7 +740,7 @@ TEST_F(AccountConsistencyServiceTest,
        HTTPVersion:@"HTTP/1.1"
       headerFields:headers];
 
-  SetWebStateHandler(delegate);
+  SetWebStateHandler(&delegate_);
   EXPECT_TRUE(web_state_.ShouldAllowResponse(response,
                                              /* for_main_frame = */ true));
 
@@ -761,7 +748,8 @@ TEST_F(AccountConsistencyServiceTest,
   web_state_.OnPageLoaded(web::PageLoadCompletionStatus::SUCCESS);
 
   CheckNoChromeConnectedCookies();
-  EXPECT_OCMOCK_VERIFY(delegate);
+  EXPECT_EQ(1, delegate_.total_call_count());
+  EXPECT_EQ(1, delegate_.show_promo_call_count_);
 }
 
 TEST_F(AccountConsistencyServiceTest, SetGaiaCookieUpdateBeforeDelay) {
@@ -781,7 +769,7 @@ TEST_F(AccountConsistencyServiceTest, SetGaiaCookieUpdateBeforeDelay) {
   // Advance clock, but stay within the one-hour Gaia update time.
   base::TimeDelta oneMinuteDelta = base::Minutes(1);
   task_environment_.FastForwardBy(oneMinuteDelta);
-  SimulateNavigateToURLWithInterruption(response, nil);
+  SimulateNavigateToURLWithInterruption(response, nullptr);
 
   // Does not process the second Gaia restore event.
   CheckGaiaCookieWithUpdateTime(base::Time::Now() - oneMinuteDelta);
diff --git a/chromium/components/signin/ios/browser/features.cc b/chromium/components/signin/ios/browser/features.cc
index 27c8fcb3324..c3b4640bb80 100644
--- a/chromium/components/signin/ios/browser/features.cc
+++ b/chromium/components/signin/ios/browser/features.cc
@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "components/signin/ios/browser/features.h"
+
 #include "components/signin/public/base/signin_switches.h"
 
 namespace signin {
@@ -22,4 +23,10 @@ const char kDelayThresholdMinutesToUpdateGaiaCookie[] =
 const char kWaitThresholdMillisecondsForCapabilitiesApi[] =
     "wait-threshold-milliseconds-for-capabilities-api";
 
+const base::Feature kFREMobileIdentityConsistency{
+    "FREMobileIdentityConsistency", base::FEATURE_DISABLED_BY_DEFAULT};
+
+const base::Feature kEnableUnicornAccountSupport{
+    "EnableUnicornAccountSupport", base::FEATURE_DISABLED_BY_DEFAULT};
+
 }  // namespace signin
diff --git a/chromium/components/signin/ios/browser/features.h b/chromium/components/signin/ios/browser/features.h
index b301ec1e280..3a780500408 100644
--- a/chromium/components/signin/ios/browser/features.h
+++ b/chromium/components/signin/ios/browser/features.h
@@ -23,6 +23,12 @@ extern const char kDelayThresholdMinutesToUpdateGaiaCookie[];
 // waiting for a response from the Account Capabilities API.
 extern const char kWaitThresholdMillisecondsForCapabilitiesApi[];
 
+// Feature to enable FRE MICe.
+extern const base::Feature kFREMobileIdentityConsistency;
+
+// Feature to enable Unicorn account sign-in for iOS.
+extern const base::Feature kEnableUnicornAccountSupport;
+
 }  // namespace signin
 
 #endif  // COMPONENTS_SIGNIN_IOS_BROWSER_FEATURES_H_
diff --git a/chromium/components/signin/ios/browser/manage_accounts_delegate.h b/chromium/components/signin/ios/browser/manage_accounts_delegate.h
index 5d3293d269e..4a4c4ac6d83 100644
--- a/chromium/components/signin/ios/browser/manage_accounts_delegate.h
+++ b/chromium/components/signin/ios/browser/manage_accounts_delegate.h
@@ -10,32 +10,40 @@ namespace web {
 class WebState;
 }
 
-@protocol ManageAccountsDelegate<NSObject>
-
-// Called when Gaia cookies have been regenerated for a specific user sign-in.
-// This occurs when a SAPISID cookie has been deleted by the operating system.
-- (void)onRestoreGaiaCookies;
-
-// Called when the user taps on a manage accounts button in a Google web
-// property.
-- (void)onManageAccounts;
-
-// Called when the user taps on an add account button in a Google web property.
-- (void)onAddAccount;
-
-// Called when the user taps a sign-in or add account button in a Google web
-// property.
-// |url| is the continuation URL received from the server. If it is valid,
-// then this delegate should navigate to |url|.
-- (void)onShowConsistencyPromo:(const GURL&)url
-                      webState:(web::WebState*)webState;
-
-// Called when the user taps on go incognito button in a Google web property.
-// |url| is the continuation URL received from the server. If it is valid,
-// then this delegate should open an incognito tab and navigate to |url|.
-// If it is not valid, then this delegate should open a new incognito tab.
-- (void)onGoIncognito:(const GURL&)url;
-
-@end
+class ManageAccountsDelegate {
+ public:
+  ManageAccountsDelegate(const ManageAccountsDelegate&) = delete;
+  ManageAccountsDelegate& operator=(const ManageAccountsDelegate&) = delete;
+
+  virtual ~ManageAccountsDelegate() = default;
+
+  // Called when Gaia cookies have been regenerated for a specific user sign-in.
+  // This occurs when a SAPISID cookie has been deleted by the operating system.
+  virtual void OnRestoreGaiaCookies() = 0;
+
+  // Called when the user taps on a manage accounts button in a Google web
+  // property.
+  virtual void OnManageAccounts() = 0;
+
+  // Called when the user taps on an add account button in a Google web
+  // property.
+  virtual void OnAddAccount() = 0;
+
+  // Called when the user taps a sign-in or add account button in a Google web
+  // property.
+  // |url| is the continuation URL received from the server. If it is valid,
+  // then this delegate should navigate to |url|.
+  virtual void OnShowConsistencyPromo(const GURL& url,
+                                      web::WebState* webState) = 0;
+
+  // Called when the user taps on go incognito button in a Google web property.
+  // |url| is the continuation URL received from the server. If it is valid,
+  // then this delegate should open an incognito tab and navigate to |url|.
+  // If it is not valid, then this delegate should open a new incognito tab.
+  virtual void OnGoIncognito(const GURL& url) = 0;
+
+ protected:
+  ManageAccountsDelegate() = default;
+};
 
 #endif  // COMPONENTS_SIGNIN_IOS_BROWSER_MANAGE_ACCOUNTS_DELEGATE_H_
diff --git a/chromium/components/signin/public/android/BUILD.gn b/chromium/components/signin/public/android/BUILD.gn
index 53ace5c5c3d..51428c88de6 100644
--- a/chromium/components/signin/public/android/BUILD.gn
+++ b/chromium/components/signin/public/android/BUILD.gn
@@ -30,7 +30,6 @@ android_library("java") {
     "java/src/org/chromium/components/signin/AccountsChangeObserver.java",
     "java/src/org/chromium/components/signin/AuthException.java",
     "java/src/org/chromium/components/signin/ChildAccountInfoFetcher.java",
-    "java/src/org/chromium/components/signin/ChildAccountStatus.java",
     "java/src/org/chromium/components/signin/ConnectionRetry.java",
     "java/src/org/chromium/components/signin/PatternMatcher.java",
     "java/src/org/chromium/components/signin/SystemAccountManagerDelegate.java",
diff --git a/chromium/components/signin/public/android/junit/src/org/chromium/components/signin/AccountManagerFacadeImplTest.java b/chromium/components/signin/public/android/junit/src/org/chromium/components/signin/AccountManagerFacadeImplTest.java
index 88aad1c98f5..715c1f75948 100644
--- a/chromium/components/signin/public/android/junit/src/org/chromium/components/signin/AccountManagerFacadeImplTest.java
+++ b/chromium/components/signin/public/android/junit/src/org/chromium/components/signin/AccountManagerFacadeImplTest.java
@@ -36,6 +36,7 @@ import org.mockito.quality.Strictness;
 import org.robolectric.RuntimeEnvironment;
 import org.robolectric.android.util.concurrent.RoboExecutorService;
 import org.robolectric.annotation.Config;
+import org.robolectric.annotation.LooperMode;
 import org.robolectric.shadows.ShadowAccountManager;
 import org.robolectric.shadows.ShadowUserManager;
 
@@ -59,6 +60,7 @@ import java.util.List;
 @RunWith(BaseRobolectricTestRunner.class)
 @Config(shadows = {CustomShadowAsyncTask.class, ShadowUserManager.class,
                 ShadowAccountManager.class})
+@LooperMode(LooperMode.Mode.LEGACY)
 public class AccountManagerFacadeImplTest {
     private static final String TEST_TOKEN_SCOPE = "test-token-scope";
 
@@ -257,37 +259,13 @@ public class AccountManagerFacadeImplTest {
     }
 
     @Test
-    public void testCheckChildAccountForRegularChild() {
-        final Account account = setFeaturesForAccount(
-                "uca@gmail.com", AccountManagerFacadeImpl.FEATURE_IS_CHILD_ACCOUNT_KEY);
-
-        mFacadeWithSystemDelegate.checkChildAccountStatus(account, mChildAccountStatusListenerMock);
-
-        verify(mChildAccountStatusListenerMock)
-                .onStatusReady(ChildAccountStatus.REGULAR_CHILD, account);
-    }
-
-    @Test
-    public void testCheckChildAccountForUSMChild() {
+    public void testCheckChildAccount() {
         final Account account = setFeaturesForAccount(
                 "usm@gmail.com", AccountManagerFacadeImpl.FEATURE_IS_USM_ACCOUNT_KEY);
 
         mFacadeWithSystemDelegate.checkChildAccountStatus(account, mChildAccountStatusListenerMock);
 
-        verify(mChildAccountStatusListenerMock)
-                .onStatusReady(ChildAccountStatus.USM_CHILD, account);
-    }
-
-    @Test
-    public void testCheckChildAccountForRegularUSMChild() {
-        final Account account = setFeaturesForAccount("usm_uca@gmail.com",
-                AccountManagerFacadeImpl.FEATURE_IS_USM_ACCOUNT_KEY,
-                AccountManagerFacadeImpl.FEATURE_IS_CHILD_ACCOUNT_KEY);
-
-        mFacadeWithSystemDelegate.checkChildAccountStatus(account, mChildAccountStatusListenerMock);
-
-        verify(mChildAccountStatusListenerMock)
-                .onStatusReady(ChildAccountStatus.REGULAR_CHILD, account);
+        verify(mChildAccountStatusListenerMock).onStatusReady(true, account);
     }
 
     @Test
@@ -296,7 +274,7 @@ public class AccountManagerFacadeImplTest {
 
         mFacadeWithSystemDelegate.checkChildAccountStatus(account, mChildAccountStatusListenerMock);
 
-        verify(mChildAccountStatusListenerMock).onStatusReady(ChildAccountStatus.NOT_CHILD, null);
+        verify(mChildAccountStatusListenerMock).onStatusReady(false, null);
     }
 
     @Test
diff --git a/chromium/components/signin/public/android/junit/src/org/chromium/components/signin/AccountRenameCheckerTest.java b/chromium/components/signin/public/android/junit/src/org/chromium/components/signin/AccountRenameCheckerTest.java
index af336538277..00e1e5abcac 100644
--- a/chromium/components/signin/public/android/junit/src/org/chromium/components/signin/AccountRenameCheckerTest.java
+++ b/chromium/components/signin/public/android/junit/src/org/chromium/components/signin/AccountRenameCheckerTest.java
@@ -19,6 +19,7 @@ import org.junit.runner.RunWith;
 import org.robolectric.annotation.Config;
 import org.robolectric.annotation.Implementation;
 import org.robolectric.annotation.Implements;
+import org.robolectric.annotation.LooperMode;
 
 import org.chromium.base.task.test.CustomShadowAsyncTask;
 import org.chromium.base.test.BaseRobolectricTestRunner;
@@ -36,6 +37,7 @@ import java.util.concurrent.atomic.AtomicReference;
 @RunWith(BaseRobolectricTestRunner.class)
 @Config(shadows = {AccountRenameCheckerTest.ShadowGoogleAuthUtil.class,
                 CustomShadowAsyncTask.class})
+@LooperMode(LooperMode.Mode.LEGACY)
 public class AccountRenameCheckerTest {
     @Implements(GoogleAuthUtil.class)
     static final class ShadowGoogleAuthUtil {
diff --git a/chromium/components/signin/public/android/junit/src/org/chromium/components/signin/AccountUtilsTest.java b/chromium/components/signin/public/android/junit/src/org/chromium/components/signin/AccountUtilsTest.java
index 2d1474eef0c..b673a4c25ab 100644
--- a/chromium/components/signin/public/android/junit/src/org/chromium/components/signin/AccountUtilsTest.java
+++ b/chromium/components/signin/public/android/junit/src/org/chromium/components/signin/AccountUtilsTest.java
@@ -47,7 +47,7 @@ public class AccountUtilsTest {
     @Test
     public void testChildAccountStatusWhenNoAccountsOnDevice() {
         AccountUtils.checkChildAccountStatus(mFakeFacade, Collections.emptyList(), mListenerMock);
-        verify(mListenerMock).onStatusReady(ChildAccountStatus.NOT_CHILD, null);
+        verify(mListenerMock).onStatusReady(/*is_child_account=*/false, null);
     }
 
     @Test
@@ -55,7 +55,7 @@ public class AccountUtilsTest {
         // This is a supported configuration (where the second account might be an EDU account).
         AccountUtils.checkChildAccountStatus(
                 mFakeFacade, List.of(CHILD_ACCOUNT1, EDU_ACCOUNT), mListenerMock);
-        verify(mListenerMock).onStatusReady(ChildAccountStatus.REGULAR_CHILD, CHILD_ACCOUNT1);
+        verify(mListenerMock).onStatusReady(/*is_child_account=*/true, CHILD_ACCOUNT1);
     }
 
     @Test
@@ -64,25 +64,25 @@ public class AccountUtilsTest {
         // is present then it must be the default one).  This test is here for completeness.
         AccountUtils.checkChildAccountStatus(
                 mFakeFacade, List.of(EDU_ACCOUNT, CHILD_ACCOUNT1), mListenerMock);
-        verify(mListenerMock).onStatusReady(ChildAccountStatus.NOT_CHILD, null);
+        verify(mListenerMock).onStatusReady(/*is_child_account=*/false, null);
     }
 
     @Test
     public void testChildAccountStatusWhenTwoAdultAccountsOnDevice() {
         AccountUtils.checkChildAccountStatus(
                 mFakeFacade, List.of(ADULT_ACCOUNT1, ADULT_ACCOUNT2), mListenerMock);
-        verify(mListenerMock).onStatusReady(ChildAccountStatus.NOT_CHILD, null);
+        verify(mListenerMock).onStatusReady(/*is_child_account=*/false, null);
     }
 
     @Test
     public void testChildAccountStatusWhenOnlyOneAdultAccountOnDevice() {
         AccountUtils.checkChildAccountStatus(mFakeFacade, List.of(ADULT_ACCOUNT1), mListenerMock);
-        verify(mListenerMock).onStatusReady(ChildAccountStatus.NOT_CHILD, null);
+        verify(mListenerMock).onStatusReady(/*is_child_account=*/false, null);
     }
 
     @Test
     public void testChildAccountStatusWhenOnlyOneChildAccountOnDevice() {
         AccountUtils.checkChildAccountStatus(mFakeFacade, List.of(CHILD_ACCOUNT1), mListenerMock);
-        verify(mListenerMock).onStatusReady(ChildAccountStatus.REGULAR_CHILD, CHILD_ACCOUNT1);
+        verify(mListenerMock).onStatusReady(/*is_child_account=*/true, CHILD_ACCOUNT1);
     }
 }
diff --git a/chromium/components/signin/public/android/junit/src/org/chromium/components/signin/identitymanager/AccountTrackerServiceTest.java b/chromium/components/signin/public/android/junit/src/org/chromium/components/signin/identitymanager/AccountTrackerServiceTest.java
index 0b30930c4b2..dd9648bb5b3 100644
--- a/chromium/components/signin/public/android/junit/src/org/chromium/components/signin/identitymanager/AccountTrackerServiceTest.java
+++ b/chromium/components/signin/public/android/junit/src/org/chromium/components/signin/identitymanager/AccountTrackerServiceTest.java
@@ -32,6 +32,7 @@ import org.mockito.junit.MockitoJUnit;
 import org.mockito.junit.MockitoRule;
 import org.mockito.quality.Strictness;
 import org.robolectric.annotation.Config;
+import org.robolectric.annotation.LooperMode;
 
 import org.chromium.base.Promise;
 import org.chromium.base.task.test.CustomShadowAsyncTask;
@@ -51,6 +52,7 @@ import java.util.concurrent.atomic.AtomicInteger;
  */
 @RunWith(BaseRobolectricTestRunner.class)
 @Config(manifest = Config.NONE, shadows = {CustomShadowAsyncTask.class})
+@LooperMode(LooperMode.Mode.LEGACY)
 public class AccountTrackerServiceTest {
     private static final long ACCOUNT_TRACKER_SERVICE_NATIVE = 10001L;
     private static final String ACCOUNT_EMAIL = "test@gmail.com";
diff --git a/chromium/components/signin/public/base/account_consistency_method.cc b/chromium/components/signin/public/base/account_consistency_method.cc
index dbd69e50bf8..b1bc6af8743 100644
--- a/chromium/components/signin/public/base/account_consistency_method.cc
+++ b/chromium/components/signin/public/base/account_consistency_method.cc
@@ -4,15 +4,11 @@
 
 #include "components/signin/public/base/account_consistency_method.h"
 
+#include "build/build_config.h"
 
 namespace signin {
 
-// Do not merge the two feature flags.
-// Experiments for MICE will be run independently per platform (Android, iOS).
-#if defined(OS_ANDROID)
-// Feature flag for FRE related changes as part of MICE.
-const base::Feature kMobileIdentityConsistencyFRE{
-    "MobileIdentityConsistencyFRE", base::FEATURE_DISABLED_BY_DEFAULT};
+#if BUILDFLAG(IS_ANDROID)
 const base::Feature kMobileIdentityConsistencyPromos{
     "MobileIdentityConsistencyPromos", base::FEATURE_ENABLED_BY_DEFAULT};
 #endif
diff --git a/chromium/components/signin/public/base/account_consistency_method.h b/chromium/components/signin/public/base/account_consistency_method.h
index b5b7935097f..06028904800 100644
--- a/chromium/components/signin/public/base/account_consistency_method.h
+++ b/chromium/components/signin/public/base/account_consistency_method.h
@@ -14,13 +14,10 @@
 
 namespace signin {
 
-#if defined(OS_ANDROID)
-// Feature flag for FRE related changes as part of MICE.
-extern const base::Feature kMobileIdentityConsistencyFRE;
-
+#if BUILDFLAG(IS_ANDROID)
 // Feature flag for promo-related changes of `kMobileIdentityConsistency`.
 extern const base::Feature kMobileIdentityConsistencyPromos;
-#endif  // defined(OS_ANDROID)
+#endif  // BUILDFLAG(IS_ANDROID)
 
 enum class AccountConsistencyMethod : int {
   // No account consistency.
diff --git a/chromium/components/signin/public/base/signin_metrics.cc b/chromium/components/signin/public/base/signin_metrics.cc
index fe89b842780..d7d90415914 100644
--- a/chromium/components/signin/public/base/signin_metrics.cc
+++ b/chromium/components/signin/public/base/signin_metrics.cc
@@ -12,6 +12,7 @@
 #include "base/metrics/user_metrics.h"
 #include "base/numerics/safe_conversions.h"
 #include "base/time/time.h"
+#include "build/build_config.h"
 
 namespace signin_metrics {
 
@@ -133,6 +134,7 @@ void RecordSigninUserActionForAccessPoint(AccessPoint access_point) {
     case AccessPoint::ACCESS_POINT_FORCED_SIGNIN:
     case AccessPoint::ACCESS_POINT_ACCOUNT_RENAMED:
     case AccessPoint::ACCESS_POINT_WEB_SIGNIN:
+    case AccessPoint::ACCESS_POINT_SIGNIN_INTERCEPT_FIRST_RUN_EXPERIENCE:
       NOTREACHED() << "Access point " << static_cast<int>(access_point)
                    << " is not supposed to log signin user actions.";
       break;
@@ -215,6 +217,7 @@ void RecordSigninWithDefaultUserActionForAccessPoint(
     case AccessPoint::ACCESS_POINT_WEB_SIGNIN:
     case AccessPoint::ACCESS_POINT_SAFETY_CHECK:
     case AccessPoint::ACCESS_POINT_KALEIDOSCOPE:
+    case AccessPoint::ACCESS_POINT_SIGNIN_INTERCEPT_FIRST_RUN_EXPERIENCE:
       NOTREACHED() << "Signin_SigninWithDefault_From* user actions"
                    << " are not recorded for access_point "
                    << static_cast<int>(access_point)
@@ -295,6 +298,7 @@ void RecordSigninNotDefaultUserActionForAccessPoint(
     case AccessPoint::ACCESS_POINT_WEB_SIGNIN:
     case AccessPoint::ACCESS_POINT_SAFETY_CHECK:
     case AccessPoint::ACCESS_POINT_KALEIDOSCOPE:
+    case AccessPoint::ACCESS_POINT_SIGNIN_INTERCEPT_FIRST_RUN_EXPERIENCE:
       NOTREACHED() << "Signin_SigninNotDefault_From* user actions"
                    << " are not recorded for access point "
                    << static_cast<int>(access_point)
@@ -379,6 +383,7 @@ void RecordSigninNewAccountNoExistingAccountUserActionForAccessPoint(
     case AccessPoint::ACCESS_POINT_WEB_SIGNIN:
     case AccessPoint::ACCESS_POINT_SAFETY_CHECK:
     case AccessPoint::ACCESS_POINT_KALEIDOSCOPE:
+    case AccessPoint::ACCESS_POINT_SIGNIN_INTERCEPT_FIRST_RUN_EXPERIENCE:
       // These access points do not support personalized sign-in promos, so
       // |Signin_SigninNewAccountNoExistingAccount_From*| user actions should
       // not be recorded for them. Note: To avoid bloating the sign-in APIs, the
@@ -466,6 +471,7 @@ void RecordSigninNewAccountExistingAccountUserActionForAccessPoint(
     case AccessPoint::ACCESS_POINT_WEB_SIGNIN:
     case AccessPoint::ACCESS_POINT_SAFETY_CHECK:
     case AccessPoint::ACCESS_POINT_KALEIDOSCOPE:
+    case AccessPoint::ACCESS_POINT_SIGNIN_INTERCEPT_FIRST_RUN_EXPERIENCE:
       // These access points do not support personalized sign-in promos, so
       // |Signin_SigninNewAccountExistingAccount_From*| user actions should not
       // be recorded for them. Note: To avoid bloating the sign-in APIs, the
@@ -651,7 +657,7 @@ void LogAuthError(const GoogleServiceAuthError& auth_error) {
 
 void LogAccountReconcilorStateOnGaiaResponse(AccountReconcilorState state) {
   UMA_HISTOGRAM_ENUMERATION("Signin.AccountReconcilorState.OnGaiaResponse",
-                            state, ACCOUNT_RECONCILOR_HISTOGRAM_COUNT);
+                            state);
 }
 
 void LogAccountEquality(AccountEquality equality) {
@@ -879,6 +885,7 @@ void RecordSigninImpressionUserActionForAccessPoint(AccessPoint access_point) {
     case AccessPoint::ACCESS_POINT_ACCOUNT_RENAMED:
     case AccessPoint::ACCESS_POINT_WEB_SIGNIN:
     case AccessPoint::ACCESS_POINT_SAFETY_CHECK:
+    case AccessPoint::ACCESS_POINT_SIGNIN_INTERCEPT_FIRST_RUN_EXPERIENCE:
       NOTREACHED() << "Signin_Impression_From* user actions"
                    << " are not recorded for access point "
                    << static_cast<int>(access_point);
@@ -1014,6 +1021,7 @@ void RecordSigninImpressionWithAccountUserActionForAccessPoint(
     case AccessPoint::ACCESS_POINT_WEB_SIGNIN:
     case AccessPoint::ACCESS_POINT_SAFETY_CHECK:
     case AccessPoint::ACCESS_POINT_KALEIDOSCOPE:
+    case AccessPoint::ACCESS_POINT_SIGNIN_INTERCEPT_FIRST_RUN_EXPERIENCE:
       NOTREACHED() << "Signin_Impression{With|WithNo}Account_From* user actions"
                    << " are not recorded for access point "
                    << static_cast<int>(access_point)
@@ -1025,12 +1033,12 @@ void RecordSigninImpressionWithAccountUserActionForAccessPoint(
   }
 }
 
-#if defined(OS_IOS)
+#if BUILDFLAG(IS_IOS)
 void RecordConsistencyPromoUserAction(AccountConsistencyPromoAction action) {
   UMA_HISTOGRAM_ENUMERATION(
       "Signin.AccountConsistencyPromoAction", static_cast<int>(action),
       static_cast<int>(AccountConsistencyPromoAction::MAX));
 }
-#endif  // defined(OS_IOS)
+#endif  // BUILDFLAG(IS_IOS)
 
 }  // namespace signin_metrics
diff --git a/chromium/components/signin/public/base/signin_metrics.h b/chromium/components/signin/public/base/signin_metrics.h
index 43ae5032632..2523c63fab2 100644
--- a/chromium/components/signin/public/base/signin_metrics.h
+++ b/chromium/components/signin/public/base/signin_metrics.h
@@ -168,6 +168,9 @@ enum class AccessPoint : int {
   ACCESS_POINT_SAFETY_CHECK = 32,
   ACCESS_POINT_KALEIDOSCOPE = 33,
   ACCESS_POINT_ENTERPRISE_SIGNOUT_COORDINATOR = 34,
+  ACCESS_POINT_SIGNIN_INTERCEPT_FIRST_RUN_EXPERIENCE = 35,
+  // Add values above this line with a corresponding label to the
+  // "SigninAccessPoint" enum in tools/metrics/histograms/enums.xml
   ACCESS_POINT_MAX,  // This must be last.
 };
 
@@ -210,7 +213,7 @@ enum class PromoAction : int {
   PROMO_ACTION_NEW_ACCOUNT_EXISTING_ACCOUNT
 };
 
-#if defined(OS_ANDROID) || defined(OS_IOS)
+#if BUILDFLAG(IS_ANDROID) || BUILDFLAG(IS_IOS)
 // This class is used to record user action that was taken after
 // receiving the header from Gaia in the web sign-in flow.
 // GENERATED_JAVA_ENUM_PACKAGE: org.chromium.components.signin.metrics
@@ -266,7 +269,7 @@ enum class AccountConsistencyPromoAction : int {
   TIMEOUT_ERROR_SHOWN = 17,
   MAX = 18,
 };
-#endif  // defined(OS_ANDROID) || defined(OS_IOS)
+#endif  // BUILDFLAG(IS_ANDROID) || BUILDFLAG(IS_IOS)
 
 // Enum values which enumerates all reasons to start sign in process.
 // These values are persisted to logs. Entries should not be renumbered and
@@ -303,8 +306,11 @@ enum AccountReconcilorState {
   ACCOUNT_RECONCILOR_ERROR,
   // The account reconcilor will start running soon.
   ACCOUNT_RECONCILOR_SCHEDULED,
+  // The account reconcilor is inactive, e.g. initializing or disabled.
+  ACCOUNT_RECONCILOR_INACTIVE,
+
   // Always the last enumerated type.
-  ACCOUNT_RECONCILOR_HISTOGRAM_COUNT,
+  kMaxValue = ACCOUNT_RECONCILOR_SCHEDULED,
 };
 
 // Values of histogram comparing account id and email.
@@ -402,7 +408,7 @@ enum class SourceForRefreshTokenOperation {
   kAccountReconcilor_Reconcile = 12,
   kDiceResponseHandler_Signin = 13,
   kDiceResponseHandler_Signout = 14,
-  kDiceTurnOnSyncHelper_Abort = 15,
+  kTurnOnSyncHelper_Abort = 15,
   kMachineLogon_CredentialProvider = 16,
   kTokenService_ExtractCredentials = 17,
   // DEPRECATED on 09/2021 (used for force migration to DICE)
@@ -540,10 +546,10 @@ void RecordSigninImpressionWithAccountUserActionForAccessPoint(
     AccessPoint access_point,
     bool with_account);
 
-#if defined(OS_IOS)
+#if BUILDFLAG(IS_IOS)
 // Records |Signin.AccountConsistencyPromoAction| histogram.
 void RecordConsistencyPromoUserAction(AccountConsistencyPromoAction action);
-#endif  // defined(OS_IOS)
+#endif  // BUILDFLAG(IS_IOS)
 
 }  // namespace signin_metrics
 
diff --git a/chromium/components/signin/public/base/signin_metrics_unittest.cc b/chromium/components/signin/public/base/signin_metrics_unittest.cc
index 4002a434e58..58581394b77 100644
--- a/chromium/components/signin/public/base/signin_metrics_unittest.cc
+++ b/chromium/components/signin/public/base/signin_metrics_unittest.cc
@@ -146,6 +146,8 @@ class SigninMetricsTest : public ::testing::Test {
         return "Kaleidoscope";
       case AccessPoint::ACCESS_POINT_ENTERPRISE_SIGNOUT_COORDINATOR:
         return "EnterpriseSignoutResignSheet";
+      case AccessPoint::ACCESS_POINT_SIGNIN_INTERCEPT_FIRST_RUN_EXPERIENCE:
+        return "SigninInterceptFirstRunExperience";
       case AccessPoint::ACCESS_POINT_MAX:
         NOTREACHED();
         return "";
diff --git a/chromium/components/signin/public/base/signin_switches.cc b/chromium/components/signin/public/base/signin_switches.cc
index 95adc32a0b5..7f2ff625e4a 100644
--- a/chromium/components/signin/public/base/signin_switches.cc
+++ b/chromium/components/signin/public/base/signin_switches.cc
@@ -4,12 +4,22 @@
 
 #include "components/signin/public/base/signin_switches.h"
 
-#include "base/feature_list.h"
-#include "build/build_config.h"
-#include "build/chromeos_buildflags.h"
-
 namespace switches {
 
+// All switches in alphabetical order.
+
+#if BUILDFLAG(IS_CHROMEOS_ASH)
+const base::Feature kAccountIdMigration{"AccountIdMigration",
+                                        base::FEATURE_DISABLED_BY_DEFAULT};
+#endif
+
+#if BUILDFLAG(IS_ANDROID)
+// If enabled, child accounts (i.e. Unicorn accounts) on Android do not have the
+// Sync feature forced on.
+const base::Feature kAllowSyncOffForChildAccounts{
+    "AllowSyncOffForChildAccounts", base::FEATURE_DISABLED_BY_DEFAULT};
+#endif
+
 // Clears the token service before using it. This allows simulating the
 // expiration of credentials during testing.
 const char kClearTokenService[] = "clear-token-service";
@@ -17,17 +27,20 @@ const char kClearTokenService[] = "clear-token-service";
 // Disables sending signin scoped device id to LSO with refresh token request.
 const char kDisableSigninScopedDeviceId[] = "disable-signin-scoped-device-id";
 
-#if BUILDFLAG(IS_CHROMEOS_ASH)
-const base::Feature kAccountIdMigration{"AccountIdMigration",
-                                        base::FEATURE_DISABLED_BY_DEFAULT};
-#endif
+// This feature disables all extended sync promos.
+const base::Feature kForceDisableExtendedSyncPromos{
+    "ForceDisableExtendedSyncPromos", base::FEATURE_DISABLED_BY_DEFAULT};
 
-#if defined(OS_ANDROID) || defined(OS_IOS)
+#if BUILDFLAG(IS_ANDROID) || BUILDFLAG(IS_IOS)
+// Features to trigger the startup sign-in promo at boot.
 const base::Feature kForceStartupSigninPromo{"ForceStartupSigninPromo",
                                              base::FEATURE_DISABLED_BY_DEFAULT};
 #endif
 
-const base::Feature kForceDisableExtendedSyncPromos{
-    "ForceDisableExtendedSyncPromos", base::FEATURE_DISABLED_BY_DEFAULT};
+#if BUILDFLAG(IS_CHROMEOS_LACROS)
+// Allows local (not signed-in) profiles on lacros.
+const base::Feature kLacrosNonSyncingProfiles{
+    "LacrosNonSyncingProfiles", base::FEATURE_DISABLED_BY_DEFAULT};
+#endif
 
 }  // namespace switches
diff --git a/chromium/components/signin/public/base/signin_switches.h b/chromium/components/signin/public/base/signin_switches.h
index 061abc063ac..e394a215681 100644
--- a/chromium/components/signin/public/base/signin_switches.h
+++ b/chromium/components/signin/public/base/signin_switches.h
@@ -18,25 +18,28 @@ namespace switches {
 
 // All switches in alphabetical order. The switches should be documented
 // alongside the definition of their values in the .cc file.
-extern const char kClearTokenService[];
-extern const char kDisableSigninScopedDeviceId[];
 
 #if BUILDFLAG(IS_CHROMEOS_ASH)
 extern const base::Feature kAccountIdMigration;
 #endif
 
-#if defined(OS_ANDROID)
-// This feature flag is used to wipe device data on child account signin.
-extern const base::Feature kWipeDataOnChildAccountSignin;
-#endif  // defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
+extern const base::Feature kAllowSyncOffForChildAccounts;
+#endif
+
+extern const char kClearTokenService[];
 
-#if defined(OS_ANDROID) || defined(OS_IOS)
-// Features to trigger the startup sign-in promo at boot.
+extern const char kDisableSigninScopedDeviceId[];
+
+extern const base::Feature kForceDisableExtendedSyncPromos;
+
+#if BUILDFLAG(IS_ANDROID) || BUILDFLAG(IS_IOS)
 extern const base::Feature kForceStartupSigninPromo;
 #endif
 
-// This feature disables all extended sync promos.
-extern const base::Feature kForceDisableExtendedSyncPromos;
+#if BUILDFLAG(IS_CHROMEOS_LACROS)
+extern const base::Feature kLacrosNonSyncingProfiles;
+#endif
 
 }  // namespace switches
 
diff --git a/chromium/components/signin/public/identity_manager/access_token_constants.cc b/chromium/components/signin/public/identity_manager/access_token_constants.cc
index cda6a367fb0..d18d4d050dc 100644
--- a/chromium/components/signin/public/identity_manager/access_token_constants.cc
+++ b/chromium/components/signin/public/identity_manager/access_token_constants.cc
@@ -57,6 +57,10 @@ const std::set<std::string> GetUnconsentedOAuth2Scopes() {
       GaiaConstants::kPhotosModuleOAuth2Scope,
       GaiaConstants::kPhotosModuleImageOAuth2Scope,
 
+      // Required for displaying information about parents on supervised child
+      // devices.  Consent is obtained outside Chrome within Family Link flows.
+      GaiaConstants::kKidFamilyReadonlyOAuth2Scope,
+
     // Required by ChromeOS only.
 #if BUILDFLAG(IS_CHROMEOS_ASH)
       GaiaConstants::kAccountsReauthOAuth2Scope,
diff --git a/chromium/components/signin/public/identity_manager/access_token_fetcher.cc b/chromium/components/signin/public/identity_manager/access_token_fetcher.cc
index a49158ae293..bb41d02c07f 100644
--- a/chromium/components/signin/public/identity_manager/access_token_fetcher.cc
+++ b/chromium/components/signin/public/identity_manager/access_token_fetcher.cc
@@ -97,7 +97,7 @@ AccessTokenFetcher::AccessTokenFetcher(
       mode_(mode),
       callback_(std::move(callback)) {
   DCHECK(client_id_.empty() == client_secret_.empty());
-  DCHECK(client_id_.empty() || !url_loader_factory);
+  DCHECK(client_id_.empty() || !url_loader_factory_);
 
   if (mode_ == Mode::kImmediate || IsRefreshTokenAvailable()) {
     StartAccessTokenRequest();
diff --git a/chromium/components/signin/public/identity_manager/access_token_fetcher.h b/chromium/components/signin/public/identity_manager/access_token_fetcher.h
index 3770ba05860..0595ef34757 100644
--- a/chromium/components/signin/public/identity_manager/access_token_fetcher.h
+++ b/chromium/components/signin/public/identity_manager/access_token_fetcher.h
@@ -251,7 +251,7 @@ class AccessTokenFetcher : public ProfileOAuth2TokenServiceObserver,
   raw_ptr<ProfileOAuth2TokenService> token_service_;
   // Suppress unused typedef warnings in some compiler builds when DCHECK is
   // disabled.
-  raw_ptr<PrimaryAccountManager> primary_account_manager_ ALLOW_UNUSED_TYPE;
+  [[maybe_unused]] raw_ptr<PrimaryAccountManager> primary_account_manager_;
   scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory_;
   const ScopeSet scopes_;
   const Mode mode_;
diff --git a/chromium/components/signin/public/identity_manager/access_token_fetcher_unittest.cc b/chromium/components/signin/public/identity_manager/access_token_fetcher_unittest.cc
index 81f36b720a9..e9db325aa28 100644
--- a/chromium/components/signin/public/identity_manager/access_token_fetcher_unittest.cc
+++ b/chromium/components/signin/public/identity_manager/access_token_fetcher_unittest.cc
@@ -81,18 +81,11 @@ class AccessTokenFetcherTest
     token_service_.RemoveAccessTokenDiagnosticsObserver(this);
   }
 
-  CoreAccountId AddSyncPrimaryAccount(const std::string& gaia_id,
-                                      const std::string& email) {
+  CoreAccountId SetPrimaryAccount(const std::string& gaia_id,
+                                  const std::string& email,
+                                  ConsentLevel consent_level) {
     CoreAccountInfo account_info = AddAccount(gaia_id, email);
-    primary_account_manager_.SetSyncPrimaryAccountInfo(account_info);
-
-    return account_info.account_id;
-  }
-
-  CoreAccountId AddPrimaryAccount(const std::string& gaia_id,
-                                  const std::string& email) {
-    CoreAccountInfo account_info = AddAccount(gaia_id, email);
-    primary_account_manager_.SetUnconsentedPrimaryAccountInfo(account_info);
+    primary_account_manager_.SetPrimaryAccountInfo(account_info, consent_level);
 
     return account_info.account_id;
   }
@@ -225,7 +218,8 @@ TEST_F(AccessTokenFetcherTest, OneShotShouldCallBackOnFulfilledRequest) {
   base::RunLoop run_loop;
   set_on_access_token_request_callback(run_loop.QuitClosure());
 
-  CoreAccountId account_id = AddSyncPrimaryAccount(kTestGaiaId, kTestEmail);
+  CoreAccountId account_id =
+      SetPrimaryAccount(kTestGaiaId, kTestEmail, ConsentLevel::kSync);
   token_service()->UpdateCredentials(account_id, "refresh token");
 
   // This should result in a request for an access token.
@@ -254,7 +248,8 @@ TEST_F(AccessTokenFetcherTest,
   base::RunLoop run_loop;
   set_on_access_token_request_callback(run_loop.QuitClosure());
 
-  CoreAccountId account_id = AddSyncPrimaryAccount(kTestGaiaId, kTestEmail);
+  CoreAccountId account_id =
+      SetPrimaryAccount(kTestGaiaId, kTestEmail, ConsentLevel::kSync);
   token_service()->UpdateCredentials(account_id, "refresh token");
 
   // Since the refresh token is already available, this should result in an
@@ -285,7 +280,8 @@ TEST_F(AccessTokenFetcherTest,
   base::RunLoop run_loop;
   set_on_access_token_request_callback(run_loop.QuitClosure());
 
-  CoreAccountId account_id = AddSyncPrimaryAccount(kTestGaiaId, kTestEmail);
+  CoreAccountId account_id =
+      SetPrimaryAccount(kTestGaiaId, kTestEmail, ConsentLevel::kSync);
 
   // Since the refresh token is not available yet, this should just start
   // waiting for it.
@@ -332,7 +328,8 @@ TEST_F(AccessTokenFetcherTest,
   MockCallback<base::OnceClosure> access_token_request_callback;
   set_on_access_token_request_callback(access_token_request_callback.Get());
 
-  CoreAccountId account_id = AddSyncPrimaryAccount(kTestGaiaId, kTestEmail);
+  CoreAccountId account_id =
+      SetPrimaryAccount(kTestGaiaId, kTestEmail, ConsentLevel::kSync);
   CoreAccountId other_account_id =
       AddAccount(kTestGaiaId2, kTestEmail2).account_id;
 
@@ -356,7 +353,8 @@ TEST_F(AccessTokenFetcherTest, ShouldNotReplyIfDestroyed) {
   base::RunLoop run_loop;
   set_on_access_token_request_callback(run_loop.QuitClosure());
 
-  CoreAccountId account_id = AddSyncPrimaryAccount(kTestGaiaId, kTestEmail);
+  CoreAccountId account_id =
+      SetPrimaryAccount(kTestGaiaId, kTestEmail, ConsentLevel::kSync);
   token_service()->UpdateCredentials(account_id, "refresh token");
 
   // This should result in a request for an access token.
@@ -382,7 +380,8 @@ TEST_F(AccessTokenFetcherTest, ReturnsErrorWhenAccountHasNoRefreshToken) {
 
   base::RunLoop run_loop;
 
-  CoreAccountId account_id = AddSyncPrimaryAccount(kTestGaiaId, kTestEmail);
+  CoreAccountId account_id =
+      SetPrimaryAccount(kTestGaiaId, kTestEmail, ConsentLevel::kSync);
 
   // Account has no refresh token -> we should get called back.
   auto fetcher = CreateFetcher(account_id, callback.Get(),
@@ -403,7 +402,8 @@ TEST_F(AccessTokenFetcherTest, CanceledAccessTokenRequest) {
   base::RunLoop run_loop;
   set_on_access_token_request_callback(run_loop.QuitClosure());
 
-  CoreAccountId account_id = AddSyncPrimaryAccount(kTestGaiaId, kTestEmail);
+  CoreAccountId account_id =
+      SetPrimaryAccount(kTestGaiaId, kTestEmail, ConsentLevel::kSync);
   token_service()->UpdateCredentials(account_id, "refresh token");
 
   // This should result in a request for an access token.
@@ -433,7 +433,8 @@ TEST_F(AccessTokenFetcherTest, RefreshTokenRevoked) {
 
   TestTokenCallback callback;
 
-  CoreAccountId account_id = AddSyncPrimaryAccount(kTestGaiaId, kTestEmail);
+  CoreAccountId account_id =
+      SetPrimaryAccount(kTestGaiaId, kTestEmail, ConsentLevel::kSync);
   token_service()->UpdateCredentials(account_id, "refresh token");
 
   // This should result in a request for an access token.
@@ -457,7 +458,8 @@ TEST_F(AccessTokenFetcherTest, FailedAccessTokenRequest) {
 
   TestTokenCallback callback;
 
-  CoreAccountId account_id = AddSyncPrimaryAccount(kTestGaiaId, kTestEmail);
+  CoreAccountId account_id =
+      SetPrimaryAccount(kTestGaiaId, kTestEmail, ConsentLevel::kSync);
   token_service()->UpdateCredentials(account_id, "refresh token");
 
   // Signed in and refresh token already exists, so this should result in a
@@ -483,7 +485,8 @@ TEST_F(AccessTokenFetcherTest, MultipleRequestsForSameAccountFulfilled) {
   base::RunLoop run_loop;
   set_on_access_token_request_callback(run_loop.QuitClosure());
 
-  CoreAccountId account_id = AddSyncPrimaryAccount(kTestGaiaId, kTestEmail);
+  CoreAccountId account_id =
+      SetPrimaryAccount(kTestGaiaId, kTestEmail, ConsentLevel::kSync);
   token_service()->UpdateCredentials(account_id, "refresh token");
 
   // This should result in a request for an access token.
@@ -520,7 +523,8 @@ TEST_F(AccessTokenFetcherTest, MultipleRequestsForDifferentAccountsFulfilled) {
   base::RunLoop run_loop;
   set_on_access_token_request_callback(run_loop.QuitClosure());
 
-  CoreAccountId account_id = AddSyncPrimaryAccount(kTestGaiaId, kTestEmail);
+  CoreAccountId account_id =
+      SetPrimaryAccount(kTestGaiaId, kTestEmail, ConsentLevel::kSync);
   token_service()->UpdateCredentials(account_id, "refresh token");
 
   // This should result in a request for an access token.
@@ -574,7 +578,8 @@ TEST_F(AccessTokenFetcherTest,
   base::RunLoop run_loop;
   set_on_access_token_request_callback(run_loop.QuitClosure());
 
-  CoreAccountId account_id = AddSyncPrimaryAccount(kTestGaiaId, kTestEmail);
+  CoreAccountId account_id =
+      SetPrimaryAccount(kTestGaiaId, kTestEmail, ConsentLevel::kSync);
   token_service()->UpdateCredentials(account_id, "refresh token");
 
   // This should result in a request for an access token.
@@ -629,7 +634,8 @@ TEST_F(AccessTokenFetcherTest, FetcherWithCustomURLLoaderFactory) {
   base::RunLoop run_loop;
   set_on_access_token_request_callback(run_loop.QuitClosure());
 
-  CoreAccountId account_id = AddSyncPrimaryAccount(kTestGaiaId, kTestEmail);
+  CoreAccountId account_id =
+      SetPrimaryAccount(kTestGaiaId, kTestEmail, ConsentLevel::kSync);
   token_service()->UpdateCredentials(account_id, "refresh token");
 
   network::TestURLLoaderFactory test_url_loader_factory;
@@ -709,7 +715,8 @@ TEST_F(AccessTokenFetcherTest, FetcherWithCustomURLLoaderFactory) {
 // Tests that a request with a consented client accessing an OAuth2 API
 // that requires sync consent is fulfilled.
 TEST_F(AccessTokenFetcherTest, FetcherWithConsentedClientAccessToConsentAPI) {
-  CoreAccountId account_id = AddSyncPrimaryAccount(kTestGaiaId, kTestEmail);
+  CoreAccountId account_id =
+      SetPrimaryAccount(kTestGaiaId, kTestEmail, ConsentLevel::kSync);
   VerifyScopeAccess(account_id, "test_consumer",
                     {GaiaConstants::kOAuth1LoginScope});
 }
@@ -718,7 +725,8 @@ TEST_F(AccessTokenFetcherTest, FetcherWithConsentedClientAccessToConsentAPI) {
 // that does not require sync consent is fulfilled.
 TEST_F(AccessTokenFetcherTest,
        FetcherWithConsentedClientAccessToUnconsentedAPI) {
-  CoreAccountId account_id = AddSyncPrimaryAccount(kTestGaiaId, kTestEmail);
+  CoreAccountId account_id =
+      SetPrimaryAccount(kTestGaiaId, kTestEmail, ConsentLevel::kSync);
   VerifyScopeAccess(account_id, "test_consumer",
                     {GaiaConstants::kChromeSafeBrowsingOAuth2Scope});
 }
@@ -727,7 +735,8 @@ TEST_F(AccessTokenFetcherTest,
 // that does not require consent is fulfilled.
 TEST_F(AccessTokenFetcherTest,
        FetcherWithUnconsentedClientAccessToUnconsentedAPI) {
-  CoreAccountId account_id = AddPrimaryAccount(kTestGaiaId, kTestEmail);
+  CoreAccountId account_id =
+      SetPrimaryAccount(kTestGaiaId, kTestEmail, ConsentLevel::kSignin);
   VerifyScopeAccess(account_id, "test_consumer",
                     {GaiaConstants::kChromeSafeBrowsingOAuth2Scope});
 }
@@ -738,7 +747,8 @@ TEST_F(AccessTokenFetcherTest,
        FetcherWithPriveledgedClientAccessToPriveledgedAPI) {
   EXPECT_FALSE(GetPrivilegedOAuth2Consumers().empty());
   for (const std::string& privileged_client : GetPrivilegedOAuth2Consumers()) {
-    CoreAccountId account_id = AddPrimaryAccount(kTestGaiaId, kTestEmail);
+    CoreAccountId account_id =
+        SetPrimaryAccount(kTestGaiaId, kTestEmail, ConsentLevel::kSignin);
     VerifyScopeAccess(account_id, privileged_client,
                       {GaiaConstants::kAnyApiOAuth2Scope});
   }
@@ -749,7 +759,8 @@ TEST_F(AccessTokenFetcherTest,
 TEST_F(AccessTokenFetcherTest, FetcherWithPriveledgedClientAccessToConsentAPI) {
   EXPECT_FALSE(GetPrivilegedOAuth2Consumers().empty());
   for (const std::string& privileged_client : GetPrivilegedOAuth2Consumers()) {
-    CoreAccountId account_id = AddPrimaryAccount(kTestGaiaId, kTestEmail);
+    CoreAccountId account_id =
+        SetPrimaryAccount(kTestGaiaId, kTestEmail, ConsentLevel::kSignin);
     VerifyScopeAccess(account_id, privileged_client,
                       {GaiaConstants::kOAuth1LoginScope});
   }
@@ -761,7 +772,8 @@ TEST_F(AccessTokenFetcherTest,
        FetcherWithPriveledgedClientAccessToUnconsentedAPI) {
   EXPECT_FALSE(GetPrivilegedOAuth2Consumers().empty());
   for (const std::string& privileged_client : GetPrivilegedOAuth2Consumers()) {
-    CoreAccountId account_id = AddPrimaryAccount(kTestGaiaId, kTestEmail);
+    CoreAccountId account_id =
+        SetPrimaryAccount(kTestGaiaId, kTestEmail, ConsentLevel::kSignin);
     VerifyScopeAccess(account_id, privileged_client,
                       {GaiaConstants::kChromeSafeBrowsingOAuth2Scope});
   }
@@ -771,7 +783,8 @@ TEST_F(AccessTokenFetcherTest,
 // that requires privileged access fails.
 TEST_F(AccessTokenFetcherTest,
        FetcherWithUnconsentedClientAccessToPrivelegedAPI) {
-  CoreAccountId account_id = AddPrimaryAccount(kTestGaiaId, kTestEmail);
+  CoreAccountId account_id =
+      SetPrimaryAccount(kTestGaiaId, kTestEmail, ConsentLevel::kSignin);
   EXPECT_CHECK_DEATH(VerifyScopeAccess(account_id, "test_consumer",
                                        {GaiaConstants::kAnyApiOAuth2Scope}));
 }
@@ -780,7 +793,8 @@ TEST_F(AccessTokenFetcherTest,
 // API fails.
 TEST_F(AccessTokenFetcherTest,
        FetcherWithConsentedClientAccessToPrivilegedAPI) {
-  CoreAccountId account_id = AddSyncPrimaryAccount(kTestGaiaId, kTestEmail);
+  CoreAccountId account_id =
+      SetPrimaryAccount(kTestGaiaId, kTestEmail, ConsentLevel::kSync);
   EXPECT_CHECK_DEATH(VerifyScopeAccess(account_id, "test_consumer",
                                        {GaiaConstants::kAnyApiOAuth2Scope}));
 }
diff --git a/chromium/components/signin/public/identity_manager/account_info.cc b/chromium/components/signin/public/identity_manager/account_info.cc
index 2d5444fa7cc..06fe0eb79e8 100644
--- a/chromium/components/signin/public/identity_manager/account_info.cc
+++ b/chromium/components/signin/public/identity_manager/account_info.cc
@@ -3,9 +3,11 @@
 // found in the LICENSE file.
 
 #include "components/signin/public/identity_manager/account_info.h"
+
+#include "build/build_config.h"
 #include "google_apis/gaia/gaia_auth_util.h"
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 #include "base/android/jni_string.h"
 #include "components/signin/public/android/jni_headers/AccountInfo_jni.h"
 #include "components/signin/public/android/jni_headers/CoreAccountId_jni.h"
@@ -150,7 +152,7 @@ std::ostream& operator<<(std::ostream& os, const CoreAccountInfo& account) {
   return os;
 }
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 base::android::ScopedJavaLocalRef<jobject> ConvertToJavaCoreAccountInfo(
     JNIEnv* env,
     const CoreAccountInfo& account_info) {
diff --git a/chromium/components/signin/public/identity_manager/account_info.h b/chromium/components/signin/public/identity_manager/account_info.h
index 1ec976376f3..5e95a0bf9ae 100644
--- a/chromium/components/signin/public/identity_manager/account_info.h
+++ b/chromium/components/signin/public/identity_manager/account_info.h
@@ -13,7 +13,7 @@
 #include "google_apis/gaia/core_account_id.h"
 #include "ui/gfx/image/image.h"
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 #include "base/android/scoped_java_ref.h"
 #endif
 
@@ -94,7 +94,7 @@ bool operator==(const CoreAccountInfo& l, const CoreAccountInfo& r);
 bool operator!=(const CoreAccountInfo& l, const CoreAccountInfo& r);
 std::ostream& operator<<(std::ostream& os, const CoreAccountInfo& account);
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 // Constructs a Java CoreAccountInfo from the provided C++ CoreAccountInfo
 base::android::ScopedJavaLocalRef<jobject> ConvertToJavaCoreAccountInfo(
     JNIEnv* env,
diff --git a/chromium/components/signin/public/identity_manager/accounts_cookie_mutator.h b/chromium/components/signin/public/identity_manager/accounts_cookie_mutator.h
index b7e4ac49327..a3d8c0cb57a 100644
--- a/chromium/components/signin/public/identity_manager/accounts_cookie_mutator.h
+++ b/chromium/components/signin/public/identity_manager/accounts_cookie_mutator.h
@@ -116,7 +116,7 @@ class AccountsCookieMutator {
   // know that the contents of the Gaia cookie might have changed.
   virtual void TriggerCookieJarUpdate() = 0;
 
-#if defined(OS_IOS)
+#if BUILDFLAG(IS_IOS)
   // Forces the processing of GaiaCookieManagerService::OnCookieChange. On
   // iOS, it's necessary to force-trigger the processing of cookie changes
   // from the client as the normal mechanism for internally observing them
diff --git a/chromium/components/signin/public/identity_manager/accounts_cookie_mutator_unittest.cc b/chromium/components/signin/public/identity_manager/accounts_cookie_mutator_unittest.cc
index 6677e68dde2..cdea8a820b1 100644
--- a/chromium/components/signin/public/identity_manager/accounts_cookie_mutator_unittest.cc
+++ b/chromium/components/signin/public/identity_manager/accounts_cookie_mutator_unittest.cc
@@ -493,7 +493,7 @@ TEST_F(AccountsCookieMutatorTest, TriggerCookieJarUpdate_OneListedAccounts) {
             GoogleServiceAuthError::NONE);
 }
 
-#if defined(OS_IOS)
+#if BUILDFLAG(IS_IOS)
 TEST_F(AccountsCookieMutatorTest, ForceTriggerOnCookieChange) {
   PrepareURLLoaderResponsesForAction(
       AccountsCookiesMutatorAction::kTriggerOnCookieChangeNoAccounts);
diff --git a/chromium/components/signin/public/identity_manager/device_accounts_synchronizer.h b/chromium/components/signin/public/identity_manager/device_accounts_synchronizer.h
index 20c2e3a551f..21dae3ef23f 100644
--- a/chromium/components/signin/public/identity_manager/device_accounts_synchronizer.h
+++ b/chromium/components/signin/public/identity_manager/device_accounts_synchronizer.h
@@ -24,7 +24,7 @@ class DeviceAccountsSynchronizer {
   virtual void ReloadAllAccountsFromSystemWithPrimaryAccount(
       const absl::optional<CoreAccountId>& primary_account_id) = 0;
 
-#if defined(OS_IOS)
+#if BUILDFLAG(IS_IOS)
   // Reloads the information of the device-level account with |account_id|. The
   // account will be visible in IdentityManager::GetAccountsWithRefreshTokens()
   // with any persistent error cleared after this method is called.
diff --git a/chromium/components/signin/public/identity_manager/identity_manager.cc b/chromium/components/signin/public/identity_manager/identity_manager.cc
index bc38f4cc02a..d1bcdddae0f 100644
--- a/chromium/components/signin/public/identity_manager/identity_manager.cc
+++ b/chromium/components/signin/public/identity_manager/identity_manager.cc
@@ -24,7 +24,7 @@
 #include "services/network/public/cpp/shared_url_loader_factory.h"
 #include "third_party/abseil-cpp/absl/types/optional.h"
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 #include "base/android/jni_string.h"
 #include "base/metrics/histogram_functions.h"
 #include "components/signin/internal/identity_manager/profile_oauth2_token_service_delegate.h"
@@ -140,7 +140,7 @@ IdentityManager::IdentityManager(IdentityManager::InitParameters&& parameters)
       base::BindRepeating(&IdentityManager::OnRefreshTokenRevokedFromSource,
                           base::Unretained(this)));
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   java_identity_manager_ = Java_IdentityManager_create(
       base::android::AttachCurrentThread(), reinterpret_cast<intptr_t>(this),
       token_service_->GetDelegate()->GetJavaObject());
@@ -162,7 +162,7 @@ IdentityManager::IdentityManager(IdentityManager::InitParameters&& parameters)
 }
 
 IdentityManager::~IdentityManager() {
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   if (java_identity_manager_)
     Java_IdentityManager_destroy(base::android::AttachCurrentThread(),
                                  java_identity_manager_);
@@ -430,7 +430,7 @@ DiagnosticsProvider* IdentityManager::GetDiagnosticsProvider() {
   return diagnostics_provider_.get();
 }
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 base::android::ScopedJavaLocalRef<jobject>
 IdentityManager::LegacyGetAccountTrackerServiceJavaObject() {
   return account_tracker_service_->GetJavaObject();
@@ -545,7 +545,7 @@ AccountInfo IdentityManager::GetAccountInfoForAccountWithRefreshToken(
   // enforce on Android due to the underlying relationship between
   // O2TS::GetAccounts(), O2TS::RefreshTokenIsAvailable(), and
   // O2TS::Observer::OnRefreshTokenAvailable().
-#if !defined(OS_ANDROID)
+#if !BUILDFLAG(IS_ANDROID)
   DCHECK(HasAccountWithRefreshToken(account_id));
 #endif
 
@@ -571,7 +571,7 @@ void IdentityManager::OnPrimaryAccountChanged(
         GetPrimaryAccountId(event_details.GetCurrentState().consent_level));
   }
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   if (java_identity_manager_) {
     JNIEnv* env = base::android::AttachCurrentThread();
     Java_IdentityManager_onPrimaryAccountChanged(
@@ -588,7 +588,7 @@ void IdentityManager::OnRefreshTokenAvailable(const CoreAccountId& account_id) {
   for (auto& observer : observer_list_) {
     observer.OnRefreshTokenUpdatedForAccount(account_info);
   }
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   if (java_identity_manager_) {
     JNIEnv* env = base::android::AttachCurrentThread();
     Java_IdentityManager_onRefreshTokenUpdatedForAccount(
@@ -642,7 +642,7 @@ void IdentityManager::OnGaiaCookieDeletedByUserAction() {
   for (auto& observer : observer_list_) {
     observer.OnAccountsCookieDeletedByUserAction();
   }
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   if (java_identity_manager_) {
     Java_IdentityManager_onAccountsCookieDeletedByUserAction(
         base::android::AttachCurrentThread(), java_identity_manager_);
@@ -703,7 +703,7 @@ void IdentityManager::OnAccountUpdated(const AccountInfo& info) {
   for (auto& observer : observer_list_) {
     observer.OnExtendedAccountInfoUpdated(info);
   }
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   if (java_identity_manager_) {
     if (account_info_fetch_start_times_.count(info.account_id) &&
         !info.account_image.IsEmpty()) {
diff --git a/chromium/components/signin/public/identity_manager/identity_manager.h b/chromium/components/signin/public/identity_manager/identity_manager.h
index b3c710ec7ea..4cce79d3bf3 100644
--- a/chromium/components/signin/public/identity_manager/identity_manager.h
+++ b/chromium/components/signin/public/identity_manager/identity_manager.h
@@ -27,7 +27,7 @@
 #include "components/signin/public/identity_manager/ubertoken_fetcher.h"
 #include "google_apis/gaia/oauth2_access_token_manager.h"
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 #include "base/android/jni_android.h"
 #include "base/containers/flat_map.h"
 #include "base/time/time.h"
@@ -180,34 +180,35 @@ class IdentityManager : public KeyedService,
   bool HasPrimaryAccount(ConsentLevel consent_level) const;
 
   // Creates an AccessTokenFetcher given the passed-in information.
-  std::unique_ptr<AccessTokenFetcher> CreateAccessTokenFetcherForAccount(
-      const CoreAccountId& account_id,
-      const std::string& oauth_consumer_name,
-      const ScopeSet& scopes,
-      AccessTokenFetcher::TokenCallback callback,
-      AccessTokenFetcher::Mode mode) WARN_UNUSED_RESULT;
+  [[nodiscard]] std::unique_ptr<AccessTokenFetcher>
+  CreateAccessTokenFetcherForAccount(const CoreAccountId& account_id,
+                                     const std::string& oauth_consumer_name,
+                                     const ScopeSet& scopes,
+                                     AccessTokenFetcher::TokenCallback callback,
+                                     AccessTokenFetcher::Mode mode);
 
   // Creates an AccessTokenFetcher given the passed-in information, allowing
   // to specify a custom |url_loader_factory| as well.
-  std::unique_ptr<AccessTokenFetcher> CreateAccessTokenFetcherForAccount(
+  [[nodiscard]] std::unique_ptr<AccessTokenFetcher>
+  CreateAccessTokenFetcherForAccount(
       const CoreAccountId& account_id,
       const std::string& oauth_consumer_name,
       scoped_refptr<network::SharedURLLoaderFactory> url_loader_factory,
       const ScopeSet& scopes,
       AccessTokenFetcher::TokenCallback callback,
-      AccessTokenFetcher::Mode mode) WARN_UNUSED_RESULT;
+      AccessTokenFetcher::Mode mode);
 
   // Creates an AccessTokenFetcher given the passed-in information, allowing to
   // specify custom |client_id| and |client_secret| to identify the OAuth client
   // app.
-  std::unique_ptr<AccessTokenFetcher> CreateAccessTokenFetcherForClient(
-      const CoreAccountId& account_id,
-      const std::string& client_id,
-      const std::string& client_secret,
-      const std::string& oauth_consumer_name,
-      const ScopeSet& scopes,
-      AccessTokenFetcher::TokenCallback callback,
-      AccessTokenFetcher::Mode mode) WARN_UNUSED_RESULT;
+  [[nodiscard]] std::unique_ptr<AccessTokenFetcher>
+  CreateAccessTokenFetcherForClient(const CoreAccountId& account_id,
+                                    const std::string& client_id,
+                                    const std::string& client_secret,
+                                    const std::string& oauth_consumer_name,
+                                    const ScopeSet& scopes,
+                                    AccessTokenFetcher::TokenCallback callback,
+                                    AccessTokenFetcher::Mode mode);
 
   // If an entry exists in the cache of access tokens corresponding to the
   // given information, removes that entry; in this case, the next access token
@@ -434,7 +435,7 @@ class IdentityManager : public KeyedService,
     return account_consistency_;
   }
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   // Returns a pointer to the AccountTrackerService Java instance associated
   // with this object.
   // TODO(https://crbug.com/934688): Eliminate this method once
@@ -711,7 +712,7 @@ class IdentityManager : public KeyedService,
   AccountConsistencyMethod account_consistency_ =
       AccountConsistencyMethod::kDisabled;
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   // Java-side IdentityManager object.
   base::android::ScopedJavaGlobalRef<jobject> java_identity_manager_;
 
diff --git a/chromium/components/signin/public/identity_manager/identity_manager_builder.cc b/chromium/components/signin/public/identity_manager/identity_manager_builder.cc
index f948d706318..b3d1243ee17 100644
--- a/chromium/components/signin/public/identity_manager/identity_manager_builder.cc
+++ b/chromium/components/signin/public/identity_manager/identity_manager_builder.cc
@@ -7,6 +7,7 @@
 #include <string>
 #include <utility>
 
+#include "build/build_config.h"
 #include "build/chromeos_buildflags.h"
 #include "components/image_fetcher/core/image_decoder.h"
 #include "components/prefs/pref_service.h"
@@ -25,19 +26,19 @@
 #include "components/signin/public/identity_manager/accounts_mutator.h"
 #include "components/signin/public/identity_manager/device_accounts_synchronizer.h"
 
-#if !defined(OS_ANDROID)
+#if !BUILDFLAG(IS_ANDROID)
 #include "components/signin/public/webdata/token_web_data.h"
 #endif
 
-#if defined(OS_IOS)
+#if BUILDFLAG(IS_IOS)
 #include "components/signin/public/identity_manager/ios/device_accounts_provider.h"
 #endif
 
-#if defined(OS_ANDROID) || defined(OS_IOS)
+#if BUILDFLAG(IS_ANDROID) || BUILDFLAG(IS_IOS)
 #include "components/signin/internal/identity_manager/device_accounts_synchronizer_impl.h"
 #endif
 
-#if !defined(OS_ANDROID) && !defined(OS_IOS)
+#if !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_IOS)
 #include "components/signin/internal/identity_manager/accounts_mutator_impl.h"
 #endif
 
@@ -64,7 +65,7 @@ std::unique_ptr<PrimaryAccountManager> BuildPrimaryAccountManager(
     PrefService* local_state) {
   std::unique_ptr<PrimaryAccountManager> primary_account_manager;
   std::unique_ptr<PrimaryAccountPolicyManager> policy_manager;
-#if !BUILDFLAG(IS_CHROMEOS_ASH) && !defined(OS_IOS)
+#if !BUILDFLAG(IS_CHROMEOS_ASH) && !BUILDFLAG(IS_IOS)
   policy_manager = std::make_unique<PrimaryAccountPolicyManagerImpl>(client);
 #endif
   primary_account_manager = std::make_unique<PrimaryAccountManager>(
@@ -79,7 +80,7 @@ std::unique_ptr<AccountsMutator> BuildAccountsMutator(
     AccountTrackerService* account_tracker_service,
     ProfileOAuth2TokenService* token_service,
     PrimaryAccountManager* primary_account_manager) {
-#if !defined(OS_ANDROID) && !defined(OS_IOS)
+#if !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_IOS)
   return std::make_unique<AccountsMutatorImpl>(
       token_service, account_tracker_service, primary_account_manager, prefs);
 #else
@@ -120,10 +121,10 @@ IdentityManager::InitParameters BuildIdentityManagerInitParameters(
 #if BUILDFLAG(ENABLE_DICE_SUPPORT)
           params->delete_signin_cookies_on_exit, params->token_web_data,
 #endif
-#if defined(OS_IOS)
+#if BUILDFLAG(IS_IOS)
           std::move(params->device_accounts_provider),
 #endif
-#if defined(OS_WIN)
+#if BUILDFLAG(IS_WIN)
           params->reauth_callback,
 #endif
           params->signin_client);
@@ -160,7 +161,7 @@ IdentityManager::InitParameters BuildIdentityManagerInitParameters(
       params->signin_client, token_service.get(), account_tracker_service.get(),
       std::move(params->image_decoder));
 
-#if defined(OS_IOS) || defined(OS_ANDROID)
+#if BUILDFLAG(IS_IOS) || BUILDFLAG(IS_ANDROID)
   init_params.device_accounts_synchronizer =
       std::make_unique<DeviceAccountsSynchronizerImpl>(
           token_service->GetDelegate());
diff --git a/chromium/components/signin/public/identity_manager/identity_manager_builder.h b/chromium/components/signin/public/identity_manager/identity_manager_builder.h
index 21bc1f82e84..3f76111603d 100644
--- a/chromium/components/signin/public/identity_manager/identity_manager_builder.h
+++ b/chromium/components/signin/public/identity_manager/identity_manager_builder.h
@@ -14,11 +14,11 @@
 #include "components/signin/public/base/signin_buildflags.h"
 #include "components/signin/public/identity_manager/identity_manager.h"
 
-#if !defined(OS_ANDROID)
+#if !BUILDFLAG(IS_ANDROID)
 #include "base/memory/scoped_refptr.h"
 #endif
 
-#if defined(OS_WIN)
+#if BUILDFLAG(IS_WIN)
 #include "base/callback.h"
 #endif
 
@@ -29,7 +29,7 @@ class SigninClient;
 class TokenWebData;
 #endif
 
-#if defined(OS_IOS)
+#if BUILDFLAG(IS_IOS)
 class DeviceAccountsProvider;
 #endif
 
@@ -73,11 +73,11 @@ struct IdentityManagerBuildParams {
   bool is_regular_profile = false;
 #endif
 
-#if defined(OS_IOS)
+#if BUILDFLAG(IS_IOS)
   std::unique_ptr<DeviceAccountsProvider> device_accounts_provider;
 #endif
 
-#if defined(OS_WIN)
+#if BUILDFLAG(IS_WIN)
   base::RepeatingCallback<bool()> reauth_callback;
 #endif
 };
diff --git a/chromium/components/signin/public/identity_manager/identity_manager_builder_unittest.cc b/chromium/components/signin/public/identity_manager/identity_manager_builder_unittest.cc
index 20fee48f400..8d57ea54e6e 100644
--- a/chromium/components/signin/public/identity_manager/identity_manager_builder_unittest.cc
+++ b/chromium/components/signin/public/identity_manager/identity_manager_builder_unittest.cc
@@ -19,7 +19,7 @@
 #include "services/network/test/test_url_loader_factory.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 #include "components/signin/public/identity_manager/identity_test_utils.h"
 #endif
 
@@ -27,7 +27,7 @@
 #include "components/account_manager_core/mock_account_manager_facade.h"
 #endif
 
-#if defined(OS_IOS)
+#if BUILDFLAG(IS_IOS)
 #include "components/signin/public/identity_manager/ios/fake_device_accounts_provider.h"
 #endif
 
@@ -67,7 +67,7 @@ TEST_F(IdentityManagerBuilderTest, BuildIdentityManagerInitParameters) {
   ASSERT_TRUE(temp_dir.CreateUniqueTempDir());
   base::FilePath dest_path = temp_dir.GetPath();
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   SetUpMockAccountManagerFacade();
 #endif
 
@@ -81,7 +81,7 @@ TEST_F(IdentityManagerBuilderTest, BuildIdentityManagerInitParameters) {
   params.profile_path = dest_path;
   params.signin_client = GetSigninClient();
 
-#if defined(OS_IOS)
+#if BUILDFLAG(IS_IOS)
   params.device_accounts_provider =
       std::make_unique<FakeDeviceAccountsProvider>();
 #endif
@@ -104,7 +104,7 @@ TEST_F(IdentityManagerBuilderTest, BuildIdentityManagerInitParameters) {
   EXPECT_NE(init_params.primary_account_mutator, nullptr);
   EXPECT_NE(init_params.accounts_cookie_mutator, nullptr);
   EXPECT_NE(init_params.diagnostics_provider, nullptr);
-#if defined(OS_IOS) || defined(OS_ANDROID)
+#if BUILDFLAG(IS_IOS) || BUILDFLAG(IS_ANDROID)
   EXPECT_NE(init_params.device_accounts_synchronizer, nullptr);
   EXPECT_EQ(init_params.accounts_mutator, nullptr);
 #else
diff --git a/chromium/components/signin/public/identity_manager/identity_manager_unittest.cc b/chromium/components/signin/public/identity_manager/identity_manager_unittest.cc
index b2a19425c68..5fb341a9e2e 100644
--- a/chromium/components/signin/public/identity_manager/identity_manager_unittest.cc
+++ b/chromium/components/signin/public/identity_manager/identity_manager_unittest.cc
@@ -56,7 +56,7 @@
 #include "services/network/test/test_url_loader_factory.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 #include "components/signin/internal/identity_manager/child_account_info_fetcher_android.h"
 #endif
 
@@ -417,8 +417,9 @@ class IdentityManagerTest : public testing::Test {
         PrimaryAccountManagerSetup::kWithAuthenticatedAccout) {
       CoreAccountId account_id =
           account_tracker_service->SeedAccountInfo(kTestGaiaId, kTestEmail);
-      primary_account_manager->SetSyncPrimaryAccountInfo(
-          account_tracker_service->GetAccountInfo(account_id));
+      primary_account_manager->SetPrimaryAccountInfo(
+          account_tracker_service->GetAccountInfo(account_id),
+          ConsentLevel::kSync);
     }
 
     IdentityManager::InitParameters init_params;
@@ -437,7 +438,7 @@ class IdentityManagerTest : public testing::Test {
             account_tracker_service.get(), token_service.get(),
             primary_account_manager.get(), &pref_service_, account_consistency);
 
-#if defined(OS_ANDROID) || defined(OS_IOS)
+#if BUILDFLAG(IS_ANDROID) || BUILDFLAG(IS_IOS)
     init_params.device_accounts_synchronizer =
         std::make_unique<DeviceAccountsSynchronizerImpl>(
             token_service->GetDelegate());
@@ -543,7 +544,7 @@ TEST_F(IdentityManagerTest, Construct) {
   EXPECT_NE(identity_manager()->GetPrimaryAccountMutator(), nullptr);
   EXPECT_NE(identity_manager()->GetAccountsCookieMutator(), nullptr);
   EXPECT_NE(identity_manager()->GetDiagnosticsProvider(), nullptr);
-#if defined(OS_ANDROID) || defined(OS_IOS)
+#if BUILDFLAG(IS_ANDROID) || BUILDFLAG(IS_IOS)
   EXPECT_EQ(identity_manager()->GetAccountsMutator(), nullptr);
   EXPECT_NE(identity_manager()->GetDeviceAccountsSynchronizer(), nullptr);
 #else
@@ -2454,7 +2455,7 @@ TEST_F(IdentityManagerTest, TestPickAccountIdForAccount) {
   }
 }
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 TEST_F(IdentityManagerTest, RefreshAccountInfoIfStale) {
   // The flow of this test results in an interaction with
   // ChildAccountInfoFetcherAndroid, which requires initialization of
diff --git a/chromium/components/signin/public/identity_manager/identity_mutator.cc b/chromium/components/signin/public/identity_manager/identity_mutator.cc
index 7e33dbdeedf..e0d1d8d02c7 100644
--- a/chromium/components/signin/public/identity_manager/identity_mutator.cc
+++ b/chromium/components/signin/public/identity_manager/identity_mutator.cc
@@ -4,13 +4,14 @@
 
 #include "components/signin/public/identity_manager/identity_mutator.h"
 
+#include "build/build_config.h"
 #include "components/signin/public/base/consent_level.h"
 #include "components/signin/public/identity_manager/accounts_cookie_mutator.h"
 #include "components/signin/public/identity_manager/accounts_mutator.h"
 #include "components/signin/public/identity_manager/device_accounts_synchronizer.h"
 #include "components/signin/public/identity_manager/primary_account_mutator.h"
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 #include "base/android/jni_string.h"
 #include "components/signin/public/android/jni_headers/IdentityMutator_jni.h"
 #include "components/signin/public/identity_manager/account_info.h"
@@ -18,7 +19,7 @@
 
 namespace signin {
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 JniIdentityMutator::JniIdentityMutator(IdentityMutator* identity_mutator)
     : identity_mutator_(identity_mutator) {}
 
@@ -62,7 +63,7 @@ void JniIdentityMutator::ReloadAllAccountsFromSystemWithPrimaryAccount(
   device_accounts_synchronizer->ReloadAllAccountsFromSystemWithPrimaryAccount(
       primary_account_id);
 }
-#endif  // defined(OS_ANDROID)
+#endif  // BUILDFLAG(IS_ANDROID)
 
 IdentityMutator::IdentityMutator(
     std::unique_ptr<PrimaryAccountMutator> primary_account_mutator,
@@ -77,7 +78,7 @@ IdentityMutator::IdentityMutator(
   DCHECK(!accounts_mutator_ || !device_accounts_synchronizer_)
       << "Cannot have both an AccountsMutator and a DeviceAccountsSynchronizer";
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   jni_identity_mutator_.reset(new JniIdentityMutator(this));
   java_identity_mutator_ = Java_IdentityMutator_Constructor(
       base::android::AttachCurrentThread(),
@@ -86,14 +87,14 @@ IdentityMutator::IdentityMutator(
 }
 
 IdentityMutator::~IdentityMutator() {
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   if (java_identity_mutator_)
     Java_IdentityMutator_destroy(base::android::AttachCurrentThread(),
                                  java_identity_mutator_);
 #endif
 }
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 base::android::ScopedJavaLocalRef<jobject> IdentityMutator::GetJavaObject() {
   DCHECK(java_identity_mutator_);
   return base::android::ScopedJavaLocalRef<jobject>(java_identity_mutator_);
diff --git a/chromium/components/signin/public/identity_manager/identity_mutator.h b/chromium/components/signin/public/identity_manager/identity_mutator.h
index 84f1a889c64..faca17ba0dd 100644
--- a/chromium/components/signin/public/identity_manager/identity_mutator.h
+++ b/chromium/components/signin/public/identity_manager/identity_mutator.h
@@ -9,7 +9,7 @@
 
 #include "base/memory/raw_ptr.h"
 #include "build/build_config.h"
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 #include "base/android/jni_android.h"
 #endif
 
@@ -19,7 +19,7 @@ class AccountsCookieMutator;
 class PrimaryAccountMutator;
 class DeviceAccountsSynchronizer;
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 class IdentityMutator;
 
 // This class is the JNI interface accessing IdentityMutator.
@@ -86,7 +86,7 @@ class IdentityMutator {
   IdentityMutator(const IdentityMutator& other) = delete;
   IdentityMutator const& operator=(const IdentityMutator& other) = delete;
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   // Get the reference on the java IdentityManager.
   base::android::ScopedJavaLocalRef<jobject> GetJavaObject();
 #endif
@@ -110,7 +110,7 @@ class IdentityMutator {
   DeviceAccountsSynchronizer* GetDeviceAccountsSynchronizer();
 
  private:
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
   // C++ endpoint for identity mutator calls originating from java.
   std::unique_ptr<JniIdentityMutator> jni_identity_mutator_;
 
diff --git a/chromium/components/signin/public/identity_manager/identity_test_environment.cc b/chromium/components/signin/public/identity_manager/identity_test_environment.cc
index 6275bcf530e..6ff97c052de 100644
--- a/chromium/components/signin/public/identity_manager/identity_test_environment.cc
+++ b/chromium/components/signin/public/identity_manager/identity_test_environment.cc
@@ -3,7 +3,6 @@
 // found in the LICENSE file.
 
 #include "components/signin/public/identity_manager/identity_test_environment.h"
-#include "base/memory/raw_ptr.h"
 
 #include <limits>
 #include <memory>
@@ -13,6 +12,7 @@
 
 #include "base/bind.h"
 #include "base/callback_helpers.h"
+#include "base/memory/raw_ptr.h"
 #include "base/run_loop.h"
 #include "base/threading/thread_task_runner_handle.h"
 #include "build/build_config.h"
@@ -51,12 +51,12 @@
 #include "components/account_manager_core/chromeos/account_manager_facade_factory.h"
 #endif
 
-#if defined(OS_IOS)
+#if BUILDFLAG(IS_IOS)
 #include "components/signin/internal/identity_manager/device_accounts_synchronizer_impl.h"
 #include "components/signin/internal/identity_manager/profile_oauth2_token_service_delegate_ios.h"
 #endif
 
-#if !defined(OS_ANDROID) && !defined(OS_IOS)
+#if !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_IOS)
 #include "components/signin/internal/identity_manager/accounts_mutator_impl.h"
 #endif
 
@@ -357,7 +357,7 @@ IdentityTestEnvironment::FinishBuildIdentityManagerForTests(
           account_tracker_service.get(), token_service.get(),
           primary_account_manager.get(), pref_service, account_consistency);
 
-#if !defined(OS_ANDROID) && !defined(OS_IOS)
+#if !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_IOS)
   init_params.accounts_mutator = std::make_unique<AccountsMutatorImpl>(
       token_service.get(), account_tracker_service.get(),
       primary_account_manager.get(), pref_service);
@@ -371,7 +371,7 @@ IdentityTestEnvironment::FinishBuildIdentityManagerForTests(
           signin_client, token_service.get(), gaia_cookie_manager_service.get(),
           account_tracker_service.get());
 
-#if defined(OS_IOS)
+#if BUILDFLAG(IS_IOS)
   init_params.device_accounts_synchronizer =
       std::make_unique<DeviceAccountsSynchronizerImpl>(
           token_service->GetDelegate());
diff --git a/chromium/components/signin/public/identity_manager/identity_test_utils.cc b/chromium/components/signin/public/identity_manager/identity_test_utils.cc
index 168fb13fd43..a583e60bbe1 100644
--- a/chromium/components/signin/public/identity_manager/identity_test_utils.cc
+++ b/chromium/components/signin/public/identity_manager/identity_test_utils.cc
@@ -31,7 +31,7 @@
 #include "components/account_manager_core/chromeos/account_manager_facade_factory.h"
 #endif  // BUILDFLAG(IS_CHROMEOS_LACROS)
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 #include "components/signin/internal/identity_manager/profile_oauth2_token_service_delegate_android.h"
 #include "components/signin/public/android/test_support_jni_headers/AccountManagerFacadeUtil_jni.h"
 #endif
@@ -40,7 +40,7 @@ namespace signin {
 
 namespace {
 
-#if defined(OS_CHROMEOS)
+#if BUILDFLAG(IS_CHROMEOS)
 // Whether identity_test_utils uses `AccountManagerFacade` or
 // `ProfileOAuth2TokenService` for managing credentials.
 bool ShouldUseAccountManagerFacade(IdentityManager* identity_manager) {
@@ -54,7 +54,7 @@ bool ShouldUseAccountManagerFacade(IdentityManager* identity_manager) {
   return true;
 #endif
 }
-#endif  // defined(OS_CHROMEOS)
+#endif  // BUILDFLAG(IS_CHROMEOS)
 
 // Helper function that updates the refresh token for |account_id| to
 // |new_token|. Before updating the refresh token, blocks until refresh tokens
@@ -162,13 +162,7 @@ CoreAccountInfo SetPrimaryAccount(IdentityManager* identity_manager,
 
   PrimaryAccountManager* primary_account_manager =
       identity_manager->GetPrimaryAccountManager();
-  switch (consent_level) {
-    case ConsentLevel::kSync:
-      primary_account_manager->SetSyncPrimaryAccountInfo(account_info);
-      break;
-    case ConsentLevel::kSignin:
-      primary_account_manager->SetUnconsentedPrimaryAccountInfo(account_info);
-  }
+  primary_account_manager->SetPrimaryAccountInfo(account_info, consent_level);
 
   DCHECK(identity_manager->HasPrimaryAccount(consent_level));
   DCHECK_EQ(account_info.gaia,
@@ -486,7 +480,7 @@ void EnableAccountCapabilitiesFetches(IdentityManager* identity_manager) {
       ->EnableAccountCapabilitiesFetcherForTest(true);
 }
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 void SetUpMockAccountManagerFacade() {
   Java_AccountManagerFacadeUtil_setUpMockFacade(
       base::android::AttachCurrentThread());
diff --git a/chromium/components/signin/public/identity_manager/identity_test_utils.h b/chromium/components/signin/public/identity_manager/identity_test_utils.h
index cb09fc2e67b..499bb6ed890 100644
--- a/chromium/components/signin/public/identity_manager/identity_test_utils.h
+++ b/chromium/components/signin/public/identity_manager/identity_test_utils.h
@@ -21,7 +21,7 @@ class TestURLLoaderFactory;
 namespace account_manager {
 class AccountManagerFacade;
 }
-#endif  // defined(OS_CHROMEOS)
+#endif  // BUILDFLAG(IS_CHROMEOS)
 
 class GoogleServiceAuthError;
 
@@ -185,7 +185,7 @@ void DisableAccessTokenFetchRetries(IdentityManager* identity_manager);
 // Enables account capabilities fetches in AccountFetcherService.
 void EnableAccountCapabilitiesFetches(IdentityManager* identity_manager);
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 // Stubs AccountManagerFacade, which requires special initialization of the java
 // subsystems.
 void SetUpMockAccountManagerFacade();
diff --git a/chromium/components/signin/public/identity_manager/primary_account_access_token_fetcher_unittest.cc b/chromium/components/signin/public/identity_manager/primary_account_access_token_fetcher_unittest.cc
index cbc4136a7a7..a4d347a6789 100644
--- a/chromium/components/signin/public/identity_manager/primary_account_access_token_fetcher_unittest.cc
+++ b/chromium/components/signin/public/identity_manager/primary_account_access_token_fetcher_unittest.cc
@@ -10,6 +10,7 @@
 #include "base/run_loop.h"
 #include "base/test/mock_callback.h"
 #include "base/test/task_environment.h"
+#include "build/build_config.h"
 #include "build/chromeos_buildflags.h"
 #include "components/signin/public/base/consent_level.h"
 #include "components/signin/public/identity_manager/access_token_info.h"
@@ -407,7 +408,7 @@ TEST_P(PrimaryAccountAccessTokenFetcherTest,
   identity_test_env()->ClearPrimaryAccount();
 }
 
-#endif  // !OS_CHROMEOS
+#endif  // !BUILDFLAG(IS_CHROMEOS)
 
 TEST_P(PrimaryAccountAccessTokenFetcherTest,
        ShouldNotRetryCanceledAccessTokenRequestIfRefreshTokenRevoked) {
diff --git a/chromium/components/signin/public/identity_manager/primary_account_change_event.cc b/chromium/components/signin/public/identity_manager/primary_account_change_event.cc
index 3c7c7d212c6..a152c963229 100644
--- a/chromium/components/signin/public/identity_manager/primary_account_change_event.cc
+++ b/chromium/components/signin/public/identity_manager/primary_account_change_event.cc
@@ -4,7 +4,9 @@
 
 #include "components/signin/public/identity_manager/primary_account_change_event.h"
 
-#if defined(OS_ANDROID)
+#include "build/build_config.h"
+
+#if BUILDFLAG(IS_ANDROID)
 #include "components/signin/public/android/jni_headers/PrimaryAccountChangeEvent_jni.h"
 #endif
 
@@ -103,7 +105,7 @@ std::ostream& operator<<(std::ostream& os,
   return os;
 }
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 base::android::ScopedJavaLocalRef<jobject>
 ConvertToJavaPrimaryAccountChangeEvent(
     JNIEnv* env,
@@ -120,6 +122,6 @@ ConvertToJavaPrimaryAccountChangeEvent(
       env, jint(event_type_not_required), jint(event_type_sync));
 }
 
-#endif  // defined(OS_ANDROID)
+#endif  // BUILDFLAG(IS_ANDROID)
 
 }  // namespace signin
diff --git a/chromium/components/signin/public/identity_manager/primary_account_change_event.h b/chromium/components/signin/public/identity_manager/primary_account_change_event.h
index 508fea8593e..5b6dfba8cdd 100644
--- a/chromium/components/signin/public/identity_manager/primary_account_change_event.h
+++ b/chromium/components/signin/public/identity_manager/primary_account_change_event.h
@@ -9,7 +9,7 @@
 #include "components/signin/public/base/consent_level.h"
 #include "components/signin/public/identity_manager/account_info.h"
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 #include "base/android/scoped_java_ref.h"
 #endif
 
@@ -68,7 +68,7 @@ std::ostream& operator<<(std::ostream& os,
 std::ostream& operator<<(std::ostream& os,
                          const PrimaryAccountChangeEvent& event);
 
-#if defined(OS_ANDROID)
+#if BUILDFLAG(IS_ANDROID)
 base::android::ScopedJavaLocalRef<jobject>
 ConvertToJavaPrimaryAccountChangeEvent(
     JNIEnv* env,
diff --git a/chromium/components/signin/public/identity_manager/primary_account_mutator_unittest.cc b/chromium/components/signin/public/identity_manager/primary_account_mutator_unittest.cc
index 36c6081bfbb..24abd003994 100644
--- a/chromium/components/signin/public/identity_manager/primary_account_mutator_unittest.cc
+++ b/chromium/components/signin/public/identity_manager/primary_account_mutator_unittest.cc
@@ -448,13 +448,9 @@ TEST_F(PrimaryAccountMutatorTest, ClearPrimaryAccount_NotSignedIn) {
 // consistency method.
 TEST_F(PrimaryAccountMutatorTest, ClearPrimaryAccount) {
   const signin::AccountConsistencyMethod kTestedAccountConsistencyMethods[] = {
-    signin::AccountConsistencyMethod::kDisabled,
-#if !BUILDFLAG(IS_CHROMEOS_LACROS)
-    // Signout is not supported with Mirror on Lacros.
-    // TODO(https://crbug.com/1260291): Re-enable when signout is supported.
-    signin::AccountConsistencyMethod::kMirror,
-#endif
-    signin::AccountConsistencyMethod::kDice,
+      signin::AccountConsistencyMethod::kDisabled,
+      signin::AccountConsistencyMethod::kMirror,
+      signin::AccountConsistencyMethod::kDice,
   };
   for (signin::AccountConsistencyMethod account_consistency_method :
        kTestedAccountConsistencyMethods) {
@@ -470,15 +466,16 @@ TEST_F(PrimaryAccountMutatorTest, RevokeSyncConsent_DisabledConsistency) {
 }
 
 // Test that revoking sync consent when Mirror account consistency is enabled
-// clears the primary account.
-#if !BUILDFLAG(IS_CHROMEOS_LACROS)
-// Revoking sync consent not supported with Mirror on Lacros.
-// TODO(https://crbug.com/1260291): Re-enable when it is supported.
+// clears the primary account (except for lacros).
 TEST_F(PrimaryAccountMutatorTest, RevokeSyncConsent_MirrorConsistency) {
   RunRevokeSyncConsentTest(signin::AccountConsistencyMethod::kMirror,
-                           RemoveAccountExpectation::kRemoveAll);
-}
+#if BUILDFLAG(IS_CHROMEOS_LACROS)
+                           RemoveAccountExpectation::kKeepAll
+#else
+                           RemoveAccountExpectation::kRemoveAll
 #endif
+  );
+}
 
 // Test that revoking the sync consent when DICE account consistency is
 // enabled does not clear the primary account.
diff --git a/chromium/components/signin/public/identity_manager/ubertoken_fetcher.h b/chromium/components/signin/public/identity_manager/ubertoken_fetcher.h
index 178f1acfe79..cc473321fb1 100644
--- a/chromium/components/signin/public/identity_manager/ubertoken_fetcher.h
+++ b/chromium/components/signin/public/identity_manager/ubertoken_fetcher.h
@@ -5,9 +5,9 @@
 #ifndef COMPONENTS_SIGNIN_PUBLIC_IDENTITY_MANAGER_UBERTOKEN_FETCHER_H_
 #define COMPONENTS_SIGNIN_PUBLIC_IDENTITY_MANAGER_UBERTOKEN_FETCHER_H_
 
-#include <memory>
+#include <string>
 
-#include "base/bind.h"
+#include "base/callback_forward.h"
 
 class GoogleServiceAuthError;
 
diff --git a/chromium/components/signin/public/webdata/token_web_data.h b/chromium/components/signin/public/webdata/token_web_data.h
index 64c8aab5a6f..6e606e70849 100644
--- a/chromium/components/signin/public/webdata/token_web_data.h
+++ b/chromium/components/signin/public/webdata/token_web_data.h
@@ -13,7 +13,6 @@
 #include <string>
 #include <vector>
 
-#include "base/location.h"
 #include "base/memory/ref_counted.h"
 #include "components/signin/public/webdata/token_service_table.h"
 #include "components/webdata/common/web_data_results.h"