1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
|
// Copyright 2022 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#ifndef CHROME_BROWSER_ASH_PRINTING_OAUTH2_AUTHORIZATION_ZONES_MANAGER_H_
#define CHROME_BROWSER_ASH_PRINTING_OAUTH2_AUTHORIZATION_ZONES_MANAGER_H_
#include <memory>
#include <string>
#include "base/functional/callback.h"
#include "chrome/browser/ash/printing/oauth2/status_code.h"
#include "components/keyed_service/core/keyed_service.h"
#include "components/sync/model/data_type_store.h"
#include "components/sync/model/data_type_sync_bridge.h"
class GURL;
class Profile;
namespace chromeos {
class Uri;
} // namespace chromeos
namespace syncer {
class DataTypeLocalChangeProcessor;
} // namespace syncer
namespace ash::printing::oauth2 {
class AuthorizationZone;
class ClientIdsDatabase;
// This class is responsible for managing OAuth2 sessions required to get access
// to some printers. In the API provided by the class, printers are referred to
// as IPP Endpoints. IPP Endpoints that require OAuth2 token report the
// following IPP attributes in the response for Get-Printer-Attributes request:
// * oauth-authorization-server-uri - the URL of the Authorization Server;
// * oauth-authorization-scope - optional, if missing use an empty string.
// These two values correspond to the parameters `auth_server` and `scope` in
// the API below.
//
// How to use:
// * SaveAuthorizationServerAsTrusted() - this must be called once for each
// Authorization Server to mark it as trusted. The list of trusted
// Authorization Servers is saved in user's profile. All API calls for any
// Authorization Server not included in the trusted list will fail with the
// error StatusCode::kUntrustedAuthorizationServer.
// * InitAuthorization() - the callback returns a URL that must be opened in an
// internet browser to allow a user to go through an authorization procedure.
// * FinishAuthorization() - this method finalizes the authorization procedure
// started by InitAuthorization(). The authorization procedure in the
// internet browser is completed when the browser receives a response with
// the HTTP 302 status code. The value of the "Location" attribute from the
// HTTP header must be passed to this method to finalize the process and
// open an OAuth2 session with the Authorization Server.
// * GetEndpointAccessToken() - the callback returns an endpoint access token
// for given IPP Endpoint. You can call this method as the first one and
// then fallback to InitAuthorization()/FinishAuthorization() when it
// returns the status StatusCode::kAuthorizationNeeded. This method can
// be called repeatedly and will return the same token for the same
// parameters until the method MarkEndpointAccessTokenAsExpired() is called.
// * MarkEndpointAccessTokenAsExpired() - call this method to mark the
// endpoint access token as expired. Then the following call to
// GetEndpointAccessToken() will try to obtain a new endpoint access token
// or returns StatusCode::kAuthorizationNeeded when a new authorization
// procedure is needed (i.e. a new call to InitAuthorization() and
// FinishAuthorization() is required).
//
// Results and errors are returned by StatusCallback passed as the last
// parameter. See chrome/browser/ash/printing/oauth2/status_code.h for more
// details.
class AuthorizationZonesManager : public KeyedService {
public:
using CreateAuthZoneCallback =
base::RepeatingCallback<std::unique_ptr<AuthorizationZone>(
const GURL& url,
ClientIdsDatabase* client_ids_database)>;
// `profile` must not be nullptr.
static std::unique_ptr<AuthorizationZonesManager> Create(Profile* profile);
static std::unique_ptr<AuthorizationZonesManager> CreateForTesting(
Profile* profile,
CreateAuthZoneCallback auth_zone_creator,
std::unique_ptr<ClientIdsDatabase> client_ids_database,
std::unique_ptr<syncer::DataTypeLocalChangeProcessor> change_processor,
syncer::OnceDataTypeStoreFactory store_factory);
~AuthorizationZonesManager() override;
virtual syncer::DataTypeSyncBridge* GetDataTypeSyncBridge() = 0;
// Marks `auth_server` as trusted.
virtual StatusCode SaveAuthorizationServerAsTrusted(
const GURL& auth_server) = 0;
// Starts authorization process. If successful, the `callback` is called
// with StatusCode::kOK and with an authorization URL that must be opened in
// an internet browser to enable the user to complete the authorization
// process. Before calling this method the caller should make sure that
// creating a new session is necessary by calling the method
// GetEndpointAccessToken() first.
virtual void InitAuthorization(const GURL& auth_server,
const std::string& scope,
StatusCallback callback) = 0;
// Finalizes authorization process. As an parameter this method takes an URL
// that the internet browser was redirected to at the end of the authorization
// procedure completed by the user. The return code StatusCode::kOK means
// that a new OAuth2 session was created and the caller can now use the method
// GetEndpointAccessToken() to get an endpoint access token.
virtual void FinishAuthorization(const GURL& auth_server,
const GURL& redirect_url,
StatusCallback callback) = 0;
// Obtains an endpoint access token to use with the given IPP Endpoint. If
// succeeded `callback` returns StatusCode::kOK and endpoint access token as
// `data`. StatusCode::kAuthorizationNeeded means that the caller must call
// methods InitAuthorization() and FinishAuthorization() first to open OAuth2
// session. The parameter `scope` is used only when an endpoint access token
// for the given IPP endpoint does not exists yet (the parameter has no
// effects when the endpoint access token already exists).
virtual void GetEndpointAccessToken(const GURL& auth_server,
const chromeos::Uri& ipp_endpoint,
const std::string& scope,
StatusCallback callback) = 0;
// This method marks the `endpoint_access_token` issued for `ipp_endpoint` as
// expired. The next call to GetEndpointAccessToken() will start internally a
// procedure to obtain a new endpoint access token. This method should be
// called when the IPP Endpoint rejects a request with `endpoint_access_token`
// by sending back a response with the HTTP 401 status code. If the HTTP
// header of that response contains "error" attribute, you should check if it
// equals "invalid_token" before calling this method. See RFC 6750 for more
// details.
virtual void MarkEndpointAccessTokenAsExpired(
const GURL& auth_server,
const chromeos::Uri& ipp_endpoint,
const std::string& endpoint_access_token) = 0;
protected:
AuthorizationZonesManager();
};
} // namespace ash::printing::oauth2
#endif // CHROME_BROWSER_ASH_PRINTING_OAUTH2_AUTHORIZATION_ZONES_MANAGER_H_
|
