Revert 111270 - Part 1 of work to do user sign in based on OAuth2:

chrome/common/net/gaia/gaia_auth_fetcher.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/common/net/gaia/gaia_auth_fetcher.h"
 
-#include <algorithm>
 #include <string>
 #include <utility>
 #include <vector>
 
-#include "base/json/json_reader.h"
 #include "base/string_split.h"
 #include "base/string_util.h"
 #include "base/stringprintf.h"
-#include "base/values.h"
 #include "chrome/common/net/gaia/gaia_auth_consumer.h"
 #include "chrome/common/net/gaia/gaia_constants.h"
 #include "chrome/common/net/gaia/gaia_urls.h"
 #include "chrome/common/net/gaia/google_service_auth_error.h"
 #include "chrome/common/net/http_return.h"
 #include "content/public/common/url_fetcher.h"
 #include "net/base/escape.h"
 #include "net/base/load_flags.h"
 #include "net/url_request/url_request_context_getter.h"
 #include "net/url_request/url_request_status.h"
 
-namespace {
-static bool CookiePartsContains(const std::vector<std::string>& parts,
-                                const char* part) {
-  return std::find(parts.begin(), parts.end(), part) != parts.end();
-}
-}  // namespace
-
 // TODO(chron): Add sourceless version of this formatter.
 // static
 const char GaiaAuthFetcher::kClientLoginFormat[] =
     "Email=%s&"
     "Passwd=%s&"
     "PersistentCookie=%s&"
     "accountType=%s&"
     "source=%s&"
     "service=%s";
 // static
 const char GaiaAuthFetcher::kClientLoginCaptchaFormat[] =
     "Email=%s&"
     "Passwd=%s&"
     "PersistentCookie=%s&"
     "accountType=%s&"
     "source=%s&"
     "service=%s&"
     "logintoken=%s&"
     "logincaptcha=%s";
 // static
 const char GaiaAuthFetcher::kIssueAuthTokenFormat[] =
     "SID=%s&"
     "LSID=%s&"
     "service=%s&"
     "Session=%s";
 // static
-const char GaiaAuthFetcher::kClientLoginToOAuth2BodyFormat[] =
-    "scope=%s&client_id=%s";
-// static
-const char GaiaAuthFetcher::kOAuth2CodeToTokenPairBodyFormat[] =
-    "scope=%s&"
-    "grant_type=authorization_code&"
-    "client_id=%s&"
-    "client_secret=%s&"
-    "code=%s";
-// static
 const char GaiaAuthFetcher::kGetUserInfoFormat[] =
     "LSID=%s";
 // static
 const char GaiaAuthFetcher::kTokenAuthFormat[] =
     "auth=%s&"
     "continue=%s&"
     "source=%s";
 // static
 const char GaiaAuthFetcher::kMergeSessionFormat[] =
     "uberauth=%s&"
@@ skipping 32 matching lines @@
 // TODO(johnnyg): When hosted accounts are supported by sync,
 // we can always use "HOSTED_OR_GOOGLE"
 const char GaiaAuthFetcher::kAccountTypeHostedOrGoogle[] =
     "HOSTED_OR_GOOGLE";
 const char GaiaAuthFetcher::kAccountTypeGoogle[] =
     "GOOGLE";
 
 // static
 const char GaiaAuthFetcher::kSecondFactor[] = "Info=InvalidSecondFactor";
 
-// static
-const char GaiaAuthFetcher::kAuthHeaderFormat[] =
-    "Authorization: GoogleLogin auth=%s";
-// static
-const char GaiaAuthFetcher::kClientLoginToOAuth2CookiePartSecure[] = "Secure";
-// static
-const char GaiaAuthFetcher::kClientLoginToOAuth2CookiePartHttpOnly[] =
-    "HttpOnly";
-// static
-const char GaiaAuthFetcher::kClientLoginToOAuth2CookiePartCodePrefix[] =
-    "oauth_code=";
-// static
-const int GaiaAuthFetcher::kClientLoginToOAuth2CookiePartCodePrefixLength =
-    arraysize(GaiaAuthFetcher::kClientLoginToOAuth2CookiePartCodePrefix) - 1;
-// static
-const char GaiaAuthFetcher::kOAuth2RefreshTokenKey[] = "refresh_token";
-// static
-const char GaiaAuthFetcher::kOAuth2AccessTokenKey[] = "access_token";
-// static
-const char GaiaAuthFetcher::kOAuth2ExpiresInKey[] = "expires_in";
-
 GaiaAuthFetcher::GaiaAuthFetcher(GaiaAuthConsumer* consumer,
                                        const std::string& source,
                                        net::URLRequestContextGetter* getter)
     : consumer_(consumer),
       getter_(getter),
       source_(source),
       client_login_gurl_(GaiaUrls::GetInstance()->client_login_url()),
       issue_auth_token_gurl_(GaiaUrls::GetInstance()->issue_auth_token_url()),
-      client_login_to_oauth2_gurl_(
-          GaiaUrls::GetInstance()->client_login_to_oauth2_url()),
-      oauth2_token_gurl_(GaiaUrls::GetInstance()->oauth2_token_url()),
       get_user_info_gurl_(GaiaUrls::GetInstance()->get_user_info_url()),
       token_auth_gurl_(GaiaUrls::GetInstance()->token_auth_url()),
       merge_session_gurl_(GaiaUrls::GetInstance()->merge_session_url()),
       fetch_pending_(false) {}
 
 GaiaAuthFetcher::~GaiaAuthFetcher() {}
 
 bool GaiaAuthFetcher::HasPendingFetch() {
   return fetch_pending_;
 }
 
 void GaiaAuthFetcher::CancelRequest() {
   fetcher_.reset();
   fetch_pending_ = false;
 }
 
 // static
 content::URLFetcher* GaiaAuthFetcher::CreateGaiaFetcher(
     net::URLRequestContextGetter* getter,
     const std::string& body,
-    const std::string& headers,
     const GURL& gaia_gurl,
-    bool use_cookies,
+    bool send_cookies,
     content::URLFetcherDelegate* delegate) {
   content::URLFetcher* to_return = content::URLFetcher::Create(
       0, gaia_gurl, content::URLFetcher::POST, delegate);
   to_return->SetRequestContext(getter);
   to_return->SetUploadData("application/x-www-form-urlencoded", body);
 
   // The Gaia token exchange requests do not require any cookie-based
   // identification as part of requests.  We suppress sending any cookies to
   // maintain a separation between the user's browsing and Chrome's internal
   // services.  Where such mixing is desired (MergeSession), it will be done
   // explicitly.
-  if (!use_cookies) {
-    to_return->SetLoadFlags(net::LOAD_DO_NOT_SEND_COOKIES |
-                            net::LOAD_DO_NOT_SAVE_COOKIES);
-  }
-  if (!headers.empty())
-    to_return->SetExtraRequestHeaders(headers);
+  if (!send_cookies)
+    to_return->SetLoadFlags(net::LOAD_DO_NOT_SEND_COOKIES);
 
   return to_return;
 }
 
 // static
 std::string GaiaAuthFetcher::MakeClientLoginBody(
     const std::string& username,
     const std::string& password,
     const std::string& source,
     const char* service,
@@ skipping 46 matching lines @@
     session = false;
 
   return base::StringPrintf(kIssueAuthTokenFormat,
                             encoded_sid.c_str(),
                             encoded_lsid.c_str(),
                             service,
                             session ? "true" : "false");
 }
 
 // static
-std::string GaiaAuthFetcher::MakeGetAuthCodeBody() {
-  std::string encoded_scope = net::EscapeUrlEncodedData(
-      GaiaUrls::GetInstance()->oauth1_login_scope(), true);
-  std::string encoded_client_id = net::EscapeUrlEncodedData(
-      GaiaUrls::GetInstance()->oauth2_chrome_client_id(), true);
-  return StringPrintf(kClientLoginToOAuth2BodyFormat,
-                      encoded_scope.c_str(),
-                      encoded_client_id.c_str());
-}
-
-// static
-std::string GaiaAuthFetcher::MakeGetTokenPairBody(
-    const std::string& auth_code) {
-  std::string encoded_scope = net::EscapeUrlEncodedData(
-      GaiaUrls::GetInstance()->oauth1_login_scope(), true);
-  std::string encoded_client_id = net::EscapeUrlEncodedData(
-      GaiaUrls::GetInstance()->oauth2_chrome_client_id(), true);
-  std::string encoded_client_secret = net::EscapeUrlEncodedData(
-      GaiaUrls::GetInstance()->oauth2_chrome_client_secret(), true);
-  std::string encoded_auth_code = net::EscapeUrlEncodedData(auth_code, true);
-  return StringPrintf(kOAuth2CodeToTokenPairBodyFormat,
-                      encoded_scope.c_str(),
-                      encoded_client_id.c_str(),
-                      encoded_client_secret.c_str(),
-                      encoded_auth_code.c_str());
-}
-
-// static
 std::string GaiaAuthFetcher::MakeGetUserInfoBody(const std::string& lsid) {
   std::string encoded_lsid = net::EscapeUrlEncodedData(lsid, true);
   return base::StringPrintf(kGetUserInfoFormat, encoded_lsid.c_str());
 }
 
 // static
 std::string GaiaAuthFetcher::MakeTokenAuthBody(const std::string& auth_token,
                                                const std::string& continue_url,
                                                const std::string& source) {
   std::string encoded_auth_token = net::EscapeUrlEncodedData(auth_token, true);
@@ skipping 14 matching lines @@
   std::string encoded_auth_token = net::EscapeUrlEncodedData(auth_token, true);
   std::string encoded_continue_url = net::EscapeUrlEncodedData(continue_url,
                                                                true);
   std::string encoded_source = net::EscapeUrlEncodedData(source, true);
   return base::StringPrintf(kMergeSessionFormat,
                             encoded_auth_token.c_str(),
                             encoded_continue_url.c_str(),
                             encoded_source.c_str());
 }
 
-// static
-std::string GaiaAuthFetcher::MakeGetAuthCodeHeader(
-    const std::string& auth_token) {
-  return StringPrintf(kAuthHeaderFormat, auth_token.c_str());
-}
-
 // Helper method that extracts tokens from a successful reply.
 // static
 void GaiaAuthFetcher::ParseClientLoginResponse(const std::string& data,
                                                   std::string* sid,
                                                   std::string* lsid,
                                                   std::string* token) {
   using std::vector;
   using std::pair;
   using std::string;
 
@@ skipping 30 matching lines @@
     } else if (i->first == kErrorUrlParam) {
       error_url->assign(i->second);
     } else if (i->first == kCaptchaUrlParam) {
       captcha_url->assign(i->second);
     } else if (i->first == kCaptchaTokenParam) {
       captcha_token->assign(i->second);
     }
   }
 }
 
-// static
-bool GaiaAuthFetcher::ParseClientLoginToOAuth2Response(
-    const net::ResponseCookies& cookies,
-    std::string* auth_code) {
-  DCHECK(auth_code);
-  net::ResponseCookies::const_iterator iter;
-  for (iter = cookies.begin(); iter != cookies.end(); ++iter) {
-    if (ParseClientLoginToOAuth2Cookie(*iter, auth_code))
-      return true;
-  }
-  return false;
-}
-
-// static
-bool GaiaAuthFetcher::ParseOAuth2TokenPairResponse(const std::string& data,
-                                                   std::string* refresh_token,
-                                                   std::string* access_token,
-                                                   int* expires_in_secs) {
-  DCHECK(refresh_token);
-  DCHECK(access_token);
-  base::JSONReader reader;
-  scoped_ptr<base::Value> value(reader.Read(data, false));
-  if (!value.get() || value->GetType() != base::Value::TYPE_DICTIONARY)
-    return false;
-
-  DictionaryValue* dict = static_cast<DictionaryValue*>(value.get());
-  std::string rt;
-  std::string at;
-  int exp;
-
-  if (!dict->GetStringWithoutPathExpansion(kOAuth2RefreshTokenKey, &rt) ||
-      !dict->GetStringWithoutPathExpansion(kOAuth2AccessTokenKey, &at) ||
-      !dict->GetIntegerWithoutPathExpansion(kOAuth2ExpiresInKey, &exp)) {
-    return false;
-  }
-
-  refresh_token->assign(rt);
-  access_token->assign(at);
-  *expires_in_secs = exp;
-  return true;
-}
-
-// static
-bool GaiaAuthFetcher::ParseClientLoginToOAuth2Cookie(const std::string& cookie,
-                                                     std::string* auth_code) {
-  std::vector<std::string> parts;
-  base::SplitString(cookie, ';', &parts);
-  // Per documentation, the cookie should have Secure and HttpOnly.
-  if (!CookiePartsContains(parts, kClientLoginToOAuth2CookiePartSecure) ||
-      !CookiePartsContains(parts, kClientLoginToOAuth2CookiePartHttpOnly)) {
-    return false;
-  }
-
-  std::vector<std::string>::const_iterator iter;
-  for (iter = parts.begin(); iter != parts.end(); ++iter) {
-    const std::string& part = *iter;
-    if (StartsWithASCII(
-        part, kClientLoginToOAuth2CookiePartCodePrefix, false)) {
-      auth_code->assign(part.substr(
-          kClientLoginToOAuth2CookiePartCodePrefixLength));
-      return true;
-    }
-  }
-  return false;
-}
-
 void GaiaAuthFetcher::StartClientLogin(
     const std::string& username,
     const std::string& password,
     const char* const service,
     const std::string& login_token,
     const std::string& login_captcha,
     HostedAccountsSetting allow_hosted_accounts) {
 
   DCHECK(!fetch_pending_) << "Tried to fetch two things at once!";
 
   // This class is thread agnostic, so be sure to call this only on the
   // same thread each time.
   DVLOG(1) << "Starting new ClientLogin fetch for:" << username;
 
   // Must outlive fetcher_.
   request_body_ = MakeClientLoginBody(username,
                                       password,
                                       source_,
                                       service,
                                       login_token,
                                       login_captcha,
                                       allow_hosted_accounts);
   fetcher_.reset(CreateGaiaFetcher(getter_,
                                    request_body_,
-                                   "",
                                    client_login_gurl_,
                                    false,
                                    this));
   fetch_pending_ = true;
   fetcher_->Start();
 }
 
 void GaiaAuthFetcher::StartIssueAuthToken(const std::string& sid,
                                           const std::string& lsid,
                                           const char* const service) {
   DCHECK(!fetch_pending_) << "Tried to fetch two things at once!";
 
   DVLOG(1) << "Starting IssueAuthToken for: " << service;
   requested_service_ = service;
   request_body_ = MakeIssueAuthTokenBody(sid, lsid, service);
   fetcher_.reset(CreateGaiaFetcher(getter_,
                                    request_body_,
-                                   "",
                                    issue_auth_token_gurl_,
                                    false,
                                    this));
   fetch_pending_ = true;
   fetcher_->Start();
 }
 
-void GaiaAuthFetcher::StartOAuthLoginTokenFetch(
-    const std::string& auth_token) {
-  DCHECK(!fetch_pending_) << "Tried to fetch two things at once!";
-
-  DVLOG(1) << "Starting OAuth login token fetch";
-  request_body_ = MakeGetAuthCodeBody();
-  fetcher_.reset(CreateGaiaFetcher(getter_,
-                                   request_body_,
-                                   MakeGetAuthCodeHeader(auth_token),
-                                   client_login_to_oauth2_gurl_,
-                                   false,
-                                   this));
-  fetch_pending_ = true;
-  fetcher_->Start();
-}
-
 void GaiaAuthFetcher::StartGetUserInfo(const std::string& lsid,
                                        const std::string& info_key) {
   DCHECK(!fetch_pending_) << "Tried to fetch two things at once!";
 
   DVLOG(1) << "Starting GetUserInfo for lsid=" << lsid;
   request_body_ = MakeGetUserInfoBody(lsid);
   fetcher_.reset(CreateGaiaFetcher(getter_,
                                    request_body_,
-                                   "",
                                    get_user_info_gurl_,
                                    false,
                                    this));
   fetch_pending_ = true;
   requested_info_key_ = info_key;
   fetcher_->Start();
 }
 
 void GaiaAuthFetcher::StartTokenAuth(const std::string& auth_token) {
   DCHECK(!fetch_pending_) << "Tried to fetch two things at once!";
 
   DVLOG(1) << "Starting TokenAuth with auth_token=" << auth_token;
 
   // The continue URL is a required parameter of the TokenAuth API, but in this
   // case we don't actually need or want to navigate to it.  Setting it to
   // an arbitrary Google URL.
   std::string continue_url("http://www.google.com");
   request_body_ = MakeTokenAuthBody(auth_token, continue_url, source_);
   fetcher_.reset(CreateGaiaFetcher(getter_,
                                    request_body_,
-                                   "",
                                    token_auth_gurl_,
                                    false,
                                    this));
   fetch_pending_ = true;
   fetcher_->Start();
 }
 
 void GaiaAuthFetcher::StartMergeSession(const std::string& auth_token) {
   DCHECK(!fetch_pending_) << "Tried to fetch two things at once!";
 
   DVLOG(1) << "Starting MergeSession with auth_token=" << auth_token;
 
   // The continue URL is a required parameter of the MergeSession API, but in
   // this case we don't actually need or want to navigate to it.  Setting it to
   // an arbitrary Google URL.
   //
   // In order for the new session to be merged correctly, the server needs to
   // know what sessions already exist in the browser.  The fetcher needs to be
   // created such that it sends the cookies with the request, which is
   // different from all other requests the fetcher can make.
   std::string continue_url("http://www.google.com");
   request_body_ = MakeMergeSessionBody(auth_token, continue_url, source_);
   fetcher_.reset(CreateGaiaFetcher(getter_,
                                    request_body_,
-                                   "",
                                    merge_session_gurl_,
                                    true,
                                    this));
   fetch_pending_ = true;
   fetcher_->Start();
 }
 
 // static
 GoogleServiceAuthError GaiaAuthFetcher::GenerateAuthError(
     const std::string& data,
@@ skipping 123 matching lines @@
   if (status.is_success() && response_code == RC_REQUEST_OK) {
     // Only the bare token is returned in the body of this Gaia call
     // without any padding.
     consumer_->OnIssueAuthTokenSuccess(requested_service_, data);
   } else {
     consumer_->OnIssueAuthTokenFailure(requested_service_,
         GenerateAuthError(data, status));
   }
 }
 
-void GaiaAuthFetcher::OnClientLoginToOAuth2Fetched(
-    const std::string& data,
-    const net::ResponseCookies& cookies,
-    const net::URLRequestStatus& status,
-    int response_code) {
-  if (status.is_success() && response_code == RC_REQUEST_OK) {
-    std::string auth_code;
-    if (!ParseClientLoginToOAuth2Response(cookies, &auth_code)) {
-      consumer_->OnOAuthLoginTokenFailure(GoogleServiceAuthError(
-          GoogleServiceAuthError::UNEXPECTED_RESPONSE));
-    } else {
-      // Start GetTokenPair.
-      StartOAuth2TokenPairFetch(auth_code);
-    }
-  } else {
-    consumer_->OnOAuthLoginTokenFailure(GenerateAuthError(data, status));
-  }
-}
-
-void GaiaAuthFetcher::StartOAuth2TokenPairFetch(const std::string& auth_code) {
-  DCHECK(!fetch_pending_) << "Tried to fetch two things at once!";
-
-  DVLOG(1) << "Starting OAuth token pair fetch";
-  request_body_ = MakeGetTokenPairBody(auth_code);
-  fetcher_.reset(CreateGaiaFetcher(getter_,
-                                   request_body_,
-                                   "",
-                                   oauth2_token_gurl_,
-                                   false,
-                                   this));
-  fetch_pending_ = true;
-  fetcher_->Start();
-}
-
-void GaiaAuthFetcher::OnOAuth2TokenPairFetched(
-    const std::string& data,
-    const net::URLRequestStatus& status,
-    int response_code) {
-  if (status.is_success() && response_code == RC_REQUEST_OK) {
-    std::string refresh_token;
-    std::string access_token;
-    int expires_in_secs;
-    if (ParseOAuth2TokenPairResponse(
-        data, &refresh_token, &access_token, &expires_in_secs)) {
-      consumer_->OnOAuthLoginTokenSuccess(
-          refresh_token, access_token, expires_in_secs);
-    } else {
-      consumer_->OnOAuthLoginTokenFailure(GoogleServiceAuthError(
-          GoogleServiceAuthError::UNEXPECTED_RESPONSE));
-    }
-  } else {
-    consumer_->OnOAuthLoginTokenFailure(GenerateAuthError(data, status));
-  }
-}
-
 void GaiaAuthFetcher::OnGetUserInfoFetched(
     const std::string& data,
     const net::URLRequestStatus& status,
     int response_code) {
   using std::vector;
   using std::string;
   using std::pair;
 
   if (status.is_success() && response_code == RC_REQUEST_OK) {
     vector<pair<string, string> > tokens;
@@ skipping 35 matching lines @@
   fetch_pending_ = false;
   const GURL& url = source->GetURL();
   const net::URLRequestStatus& status = source->GetStatus();
   int response_code = source->GetResponseCode();
   std::string data;
   source->GetResponseAsString(&data);
   if (url == client_login_gurl_) {
     OnClientLoginFetched(data, status, response_code);
   } else if (url == issue_auth_token_gurl_) {
     OnIssueAuthTokenFetched(data, status, response_code);
-  } else if (url == client_login_to_oauth2_gurl_) {
-    OnClientLoginToOAuth2Fetched(
-        data, source->GetCookies(), status, response_code);
-  } else if (url == oauth2_token_gurl_) {
-    OnOAuth2TokenPairFetched(data, status, response_code);
   } else if (url == get_user_info_gurl_) {
     OnGetUserInfoFetched(data, status, response_code);
   } else if (url == token_auth_gurl_) {
     OnTokenAuthFetched(data, status, response_code);
   } else if (url == merge_session_gurl_ ||
       (source && source->GetOriginalURL() == merge_session_gurl_)) {
     // MergeSession may redirect, so check the original URL of the fetcher.
     OnMergeSessionFetched(data, status, response_code);
   } else {
     NOTREACHED();
   }
 }
 
 // static
 bool GaiaAuthFetcher::IsSecondFactorSuccess(
     const std::string& alleged_error) {
   return alleged_error.find(kSecondFactor) !=
       std::string::npos;
 }