[Chromoting] The webapp revokes OAuth refresh tokens when they will no longer be used.

remoting/webapp/host_controller.js

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 'use strict';
 
 /** @suppress {duplicate} */
 var remoting = remoting || {};
 
 /** @constructor */
@@ skipping 138 matching lines @@
   /** @param {string} privateKey
    *  @param {XMLHttpRequest} xhr */
   function onRegistered(privateKey, xhr) {
     var success = (xhr.status == 200);
 
     if (success) {
       var hostSecretHash =
           'hmac:' + that.plugin_.getPinHash(newHostId, hostPin);
       var hostConfig = JSON.stringify({
           xmpp_login: remoting.oauth2.getCachedEmail(),
-          oauth_refresh_token: remoting.oauth2.getRefreshToken(),
+          oauth_refresh_token: remoting.oauth2.exportRefreshToken(),
           host_id: newHostId,
           host_name: hostName,
           host_secret_hash: hostSecretHash,
           private_key: privateKey
       });
       /** @param {remoting.HostController.AsyncResult} result */
       var onStartDaemon = function(result) {
         onStarted(callback, result, hostName);
       };
       that.plugin_.startDaemon(hostConfig, onStartDaemon);
@@ skipping 40 matching lines @@
 
   this.plugin_.generateKeyPair(onKeyGenerated);
 };
 
 /**
  * Stop the daemon process.
  * @param {function(remoting.HostController.AsyncResult):void} callback
  *     Callback to be called when finished.
  * @return {void} Nothing.
  */
 remoting.HostController.prototype.stop = function(callback) {

[Jamie, 2012/04/16 17:04:45]

I think we can mark the token as revokable again here can't we? I'm not sure how
much it buys us (it depends on the relative frequency of sign-out vs. stop) but
it feels safe.

[simonmorris, 2012/04/16 22:37:51]

I see what you mean, but the claim that that's safe feels fragile, and not easy
to verify. It also complicates the interface added in this CL, and I think it
seldom buys very much.

   /** @type {remoting.HostController} */
   var that = this;
 
   /** @param {remoting.HostController.AsyncResult} result */
   function onStopped(result) {
     if (that.localHost && that.localHost.hostId)
       remoting.HostList.unregisterHostById(that.localHost.hostId);
     window.localStorage.removeItem('me2me-host-id');
     callback(result);
   };
@@ skipping 77 matching lines @@
   if (hostId && typeof(hostId) == 'string') {
     this.setHost(hostList.getHostForId(/** @type{string} */(hostId)));
   } else {
     this.setHost(null);
   }
   onDone();
 };
 
 /** @type {remoting.HostController} */
 remoting.hostController = null;