Modify experimental identity flow to display scope descriptions and details.

chrome/browser/extensions/api/identity/identity_api.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/api/identity/identity_api.h"
 
 #include "base/values.h"
 #include "chrome/browser/extensions/extension_function_dispatcher.h"
+#include "chrome/browser/extensions/extension_service.h"
 #include "chrome/browser/signin/token_service.h"
 #include "chrome/browser/signin/token_service_factory.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/tab_contents/tab_contents.h"
 #include "chrome/common/extensions/extension.h"
 #include "googleurl/src/gurl.h"
 
 namespace extensions {
 
 namespace {
 
 const char kInvalidClientId[] = "Invalid OAuth2 Client ID.";
 const char kInvalidScopes[] = "Invalid OAuth2 scopes.";
 const char kInvalidRedirect[] = "Did not redirect to the right URL.";
+const char kAuthFailure[] = "OAuth2 request failed: ";
+const char kGrantRevoked[] = "OAuth2 not granted or revoked.";
 
 }  // namespace
 
 GetAuthTokenFunction::GetAuthTokenFunction() {}
 GetAuthTokenFunction::~GetAuthTokenFunction() {}
 
 bool GetAuthTokenFunction::RunImpl() {
   const Extension* extension = GetExtension();
   Extension::OAuth2Info oauth2_info = extension->oauth2_info();
 
   if (oauth2_info.client_id.empty()) {
     error_ = kInvalidClientId;
     return false;
   }
 
   if (oauth2_info.scopes.size() == 0) {
     error_ = kInvalidScopes;
     return false;
   }
 
   AddRef();  // Balanced in OnMintTokenSuccess|Failure.
 
   TokenService* token_service = TokenServiceFactory::GetForProfile(profile());
 
-  flow_.reset(new OAuth2MintTokenFlow(
+  flow_ = new OAuth2MintTokenFlow(
       profile()->GetRequestContext(),
       this,
       OAuth2MintTokenFlow::Parameters(
           token_service->GetOAuth2LoginRefreshToken(),
           extension->id(),
           oauth2_info.client_id,
           oauth2_info.scopes,
-          OAuth2MintTokenFlow::MODE_MINT_TOKEN_FORCE)));
+#if defined(TOOLKIT_GTK)
+          // Do not force on Linux. We will re-prompt for authorization.
+          OAuth2MintTokenFlow::MODE_MINT_TOKEN_NO_FORCE));
+#else
+          // For now, silently force the token. The user will never see the
+          // scopes they are granting.
+          OAuth2MintTokenFlow::MODE_MINT_TOKEN_FORCE));
+#endif
   flow_->Start();
 
   return true;
 }
 
 void GetAuthTokenFunction::OnMintTokenSuccess(const std::string& access_token) {
   result_.reset(Value::CreateStringValue(access_token));
   SendResponse(true);
   Release();  // Balanced in RunImpl.
 }
 
 void GetAuthTokenFunction::OnMintTokenFailure(
     const GoogleServiceAuthError& error) {
-  error_ = error.ToString();
+  error_ = std::string(kAuthFailure) + error.ToString();
   SendResponse(false);
   Release();  // Balanced in RunImpl.
 }
+
+void GetAuthTokenFunction::OnIssueAdviceSuccess(const IssueAdviceInfo& issues) {
+  // Existing grant was revoked, so we got info back instead.

[jstritar, 2012/06/25 15:10:35]

Are you sure OnIssueAdviceSuccess is called when the grants are revoked? vs
OnMintTokenFailure?

[Evan Stade, 2012/06/25 20:31:42]

from my testing, that seems to be the case (although unintuitive). Presumably
this is done so that a new prompt can be shown with the given issues.

[Munjal (Google), 2012/06/25 20:40:09]

I think this is fine. If the grant is revoked out of band then the servers will
return "issue adivce" for the scopes in the request in NO_FORCE mode.

+  error_ = kGrantRevoked;
+
+  // Remove the oauth2 scopes from the extension's granted permissions, if
+  // revoked server-side.
+  scoped_refptr<ExtensionPermissionSet> scopes =
+      new ExtensionPermissionSet(
+          GetExtension()->GetActivePermissions()->scopes());
+  profile()->GetExtensionService()->extension_prefs()->RemoveGrantedPermissions(
+      GetExtension()->id(), scopes);
+
+  // TODO(estade): need to prompt the user for scope permissions.
+
+  SendResponse(false);
+  Release();  // Balanced in RunImpl.
+}
 
 LaunchWebAuthFlowFunction::LaunchWebAuthFlowFunction() {}
 LaunchWebAuthFlowFunction::~LaunchWebAuthFlowFunction() {}
 
 bool LaunchWebAuthFlowFunction::RunImpl() {
   DictionaryValue* arg = NULL;
   EXTENSION_FUNCTION_VALIDATE(args_->GetDictionary(0, &arg));
 
   std::string url;
   EXTENSION_FUNCTION_VALIDATE(arg->GetString("url", &url));
@@ skipping 19 matching lines @@
   Release();  // Balanced in RunImpl.
 }
 
 void LaunchWebAuthFlowFunction::OnAuthFlowFailure() {
   error_ = kInvalidRedirect;
   SendResponse(false);
   Release();  // Balanced in RunImpl.
 }
 
 }  // namespace extensions