| OLD | NEW |
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #ifndef CHROME_BROWSER_CHROMEOS_SETTINGS_DEVICE_OAUTH2_TOKEN_SERVICE_H_ | 5 #ifndef CHROME_BROWSER_CHROMEOS_SETTINGS_DEVICE_OAUTH2_TOKEN_SERVICE_DELEGATE_H_ |
| 6 #define CHROME_BROWSER_CHROMEOS_SETTINGS_DEVICE_OAUTH2_TOKEN_SERVICE_H_ | 6 #define CHROME_BROWSER_CHROMEOS_SETTINGS_DEVICE_OAUTH2_TOKEN_SERVICE_DELEGATE_H_ |
| 7 | 7 |
| 8 #include <string> | 8 #include <string> |
| 9 #include <vector> | 9 #include <vector> |
| 10 | 10 |
| 11 #include "base/basictypes.h" | 11 #include "base/basictypes.h" |
| 12 #include "base/callback.h" | 12 #include "base/callback.h" |
| 13 #include "base/gtest_prod_util.h" | 13 #include "base/gtest_prod_util.h" |
| 14 #include "base/memory/scoped_ptr.h" | 14 #include "base/memory/scoped_ptr.h" |
| 15 #include "base/memory/weak_ptr.h" | 15 #include "base/memory/weak_ptr.h" |
| 16 #include "base/stl_util.h" | 16 #include "base/stl_util.h" |
| 17 #include "base/time/time.h" | |
| 18 #include "chrome/browser/chromeos/settings/cros_settings.h" | 17 #include "chrome/browser/chromeos/settings/cros_settings.h" |
| 19 #include "google_apis/gaia/gaia_oauth_client.h" | 18 #include "google_apis/gaia/gaia_oauth_client.h" |
| 20 #include "google_apis/gaia/oauth2_token_service.h" | 19 #include "google_apis/gaia/oauth2_token_service_delegate.h" |
| 21 #include "net/url_request/url_request_context_getter.h" | 20 #include "net/url_request/url_request_context_getter.h" |
| 22 | 21 |
| 23 namespace gaia { | 22 namespace gaia { |
| 24 class GaiaOAuthClient; | 23 class GaiaOAuthClient; |
| 25 } | 24 } |
| 26 | 25 |
| 27 namespace net { | 26 namespace net { |
| 28 class URLRequestContextGetter; | 27 class URLRequestContextGetter; |
| 29 } | 28 } |
| 30 | 29 |
| 31 class PrefRegistrySimple; | |
| 32 class PrefService; | 30 class PrefService; |
| 33 | 31 |
| 34 namespace chromeos { | 32 namespace chromeos { |
| 35 | 33 |
| 36 // DeviceOAuth2TokenService retrieves OAuth2 access tokens for a given | 34 class DeviceOAuth2TokenServiceDelegate |
| 37 // set of scopes using the device-level OAuth2 any-api refresh token | 35 : public OAuth2TokenServiceDelegate, |
| 38 // obtained during enterprise device enrollment. | 36 public gaia::GaiaOAuthClient::Delegate { |
| 39 // | |
| 40 // See |OAuth2TokenService| for usage details. | |
| 41 // | |
| 42 // When using DeviceOAuth2TokenService, a value of |GetRobotAccountId| should | |
| 43 // be used in places where API expects |account_id|. | |
| 44 // | |
| 45 // Note that requests must be made from the UI thread. | |
| 46 class DeviceOAuth2TokenService : public OAuth2TokenService, | |
| 47 public gaia::GaiaOAuthClient::Delegate { | |
| 48 public: | 37 public: |
| 38 DeviceOAuth2TokenServiceDelegate(net::URLRequestContextGetter* getter, |
| 39 PrefService* local_state); |
| 40 ~DeviceOAuth2TokenServiceDelegate() override; |
| 41 |
| 49 typedef base::Callback<void(bool)> StatusCallback; | 42 typedef base::Callback<void(bool)> StatusCallback; |
| 50 | 43 |
| 51 // Persist the given refresh token on the device. Overwrites any previous | 44 // Persist the given refresh token on the device. Overwrites any previous |
| 52 // value. Should only be called during initial device setup. Signals | 45 // value. Should only be called during initial device setup. Signals |
| 53 // completion via the given callback, passing true if the operation succeeded. | 46 // completion via the given callback, passing true if the operation succeeded. |
| 54 void SetAndSaveRefreshToken(const std::string& refresh_token, | 47 void SetAndSaveRefreshToken(const std::string& refresh_token, |
| 55 const StatusCallback& callback); | 48 const StatusCallback& callback); |
| 56 | 49 |
| 57 static void RegisterPrefs(PrefRegistrySimple* registry); | 50 // Pull the robot account ID from device policy. |
| 51 std::string GetRobotAccountId() const; |
| 58 | 52 |
| 59 // Implementation of OAuth2TokenService. | 53 // Implementation of OAuth2TokenServiceDelegate. |
| 60 bool RefreshTokenIsAvailable(const std::string& account_id) const override; | 54 bool RefreshTokenIsAvailable(const std::string& account_id) const override; |
| 61 | 55 |
| 62 // Pull the robot account ID from device policy. | 56 net::URLRequestContextGetter* GetRequestContext() const override; |
| 63 virtual std::string GetRobotAccountId() const; | 57 |
| 58 OAuth2AccessTokenFetcher* CreateAccessTokenFetcher( |
| 59 const std::string& account_id, |
| 60 net::URLRequestContextGetter* getter, |
| 61 OAuth2AccessTokenConsumer* consumer) override; |
| 64 | 62 |
| 65 // gaia::GaiaOAuthClient::Delegate implementation. | 63 // gaia::GaiaOAuthClient::Delegate implementation. |
| 66 void OnRefreshTokenResponse(const std::string& access_token, | 64 void OnRefreshTokenResponse(const std::string& access_token, |
| 67 int expires_in_seconds) override; | 65 int expires_in_seconds) override; |
| 68 void OnGetTokenInfoResponse( | 66 void OnGetTokenInfoResponse( |
| 69 scoped_ptr<base::DictionaryValue> token_info) override; | 67 scoped_ptr<base::DictionaryValue> token_info) override; |
| 70 void OnOAuthError() override; | 68 void OnOAuthError() override; |
| 71 void OnNetworkError(int response_code) override; | 69 void OnNetworkError(int response_code) override; |
| 72 | 70 |
| 73 protected: | 71 private: |
| 74 // Implementation of OAuth2TokenService. | 72 friend class DeviceOAuth2TokenService; |
| 75 net::URLRequestContextGetter* GetRequestContext() override; | 73 friend class DeviceOAuth2TokenServiceTest; |
| 76 void FetchOAuth2Token(RequestImpl* request, | |
| 77 const std::string& account_id, | |
| 78 net::URLRequestContextGetter* getter, | |
| 79 const std::string& client_id, | |
| 80 const std::string& client_secret, | |
| 81 const ScopeSet& scopes) override; | |
| 82 OAuth2AccessTokenFetcher* CreateAccessTokenFetcher( | |
| 83 const std::string& account_id, | |
| 84 net::URLRequestContextGetter* getter, | |
| 85 OAuth2AccessTokenConsumer* consumer) override; | |
| 86 | 74 |
| 87 private: | 75 class ValidationStatusDelegate { |
| 88 struct PendingRequest; | 76 public: |
| 89 friend class DeviceOAuth2TokenServiceFactory; | 77 virtual void OnValidationCompleted(GoogleServiceAuthError::State error) {} |
| 90 friend class DeviceOAuth2TokenServiceTest; | 78 }; |
| 91 | 79 |
| 92 // Describes the operational state of this object. | 80 // Describes the operational state of this object. |
| 93 enum State { | 81 enum State { |
| 94 // Pending system salt / refresh token load. | 82 // Pending system salt / refresh token load. |
| 95 STATE_LOADING, | 83 STATE_LOADING, |
| 96 // No token available. | 84 // No token available. |
| 97 STATE_NO_TOKEN, | 85 STATE_NO_TOKEN, |
| 98 // System salt loaded, validation not started yet. | 86 // System salt loaded, validation not started yet. |
| 99 STATE_VALIDATION_PENDING, | 87 STATE_VALIDATION_PENDING, |
| 100 // Refresh token validation underway. | 88 // Refresh token validation underway. |
| 101 STATE_VALIDATION_STARTED, | 89 STATE_VALIDATION_STARTED, |
| 102 // Token validation failed. | 90 // Token validation failed. |
| 103 STATE_TOKEN_INVALID, | 91 STATE_TOKEN_INVALID, |
| 104 // Refresh token is valid. | 92 // Refresh token is valid. |
| 105 STATE_TOKEN_VALID, | 93 STATE_TOKEN_VALID, |
| 106 }; | 94 }; |
| 107 | 95 |
| 108 // Invoked by CrosSettings when the robot account ID becomes available. | 96 // Invoked by CrosSettings when the robot account ID becomes available. |
| 109 void OnServiceAccountIdentityChanged(); | 97 void OnServiceAccountIdentityChanged(); |
| 110 | 98 |
| 111 // Use DeviceOAuth2TokenServiceFactory to get an instance of this class. | |
| 112 // Ownership of |token_encryptor| will be taken. | |
| 113 explicit DeviceOAuth2TokenService(net::URLRequestContextGetter* getter, | |
| 114 PrefService* local_state); | |
| 115 ~DeviceOAuth2TokenService() override; | |
| 116 | |
| 117 // Returns the refresh token for account_id. | 99 // Returns the refresh token for account_id. |
| 118 std::string GetRefreshToken(const std::string& account_id) const; | 100 std::string GetRefreshToken(const std::string& account_id) const; |
| 119 | 101 |
| 120 // Handles completion of the system salt input. | 102 // Handles completion of the system salt input. |
| 121 void DidGetSystemSalt(const std::string& system_salt); | 103 void DidGetSystemSalt(const std::string& system_salt); |
| 122 | 104 |
| 123 // Checks whether |gaia_robot_id| matches the expected account ID indicated in | 105 // Checks whether |gaia_robot_id| matches the expected account ID indicated in |
| 124 // device settings. | 106 // device settings. |
| 125 void CheckRobotAccountId(const std::string& gaia_robot_id); | 107 void CheckRobotAccountId(const std::string& gaia_robot_id); |
| 126 | 108 |
| 127 // Encrypts and saves the refresh token. Should only be called when the system | 109 // Encrypts and saves the refresh token. Should only be called when the system |
| 128 // salt is available. | 110 // salt is available. |
| 129 void EncryptAndSaveToken(); | 111 void EncryptAndSaveToken(); |
| 130 | 112 |
| 131 // Starts the token validation flow, i.e. token info fetch. | 113 // Starts the token validation flow, i.e. token info fetch. |
| 132 void StartValidation(); | 114 void StartValidation(); |
| 133 | 115 |
| 134 // Flushes |pending_requests_|, indicating the specified result. | |
| 135 void FlushPendingRequests(bool token_is_valid, | |
| 136 GoogleServiceAuthError::State error); | |
| 137 | |
| 138 // Flushes |token_save_callbacks_|, indicating the specified result. | 116 // Flushes |token_save_callbacks_|, indicating the specified result. |
| 139 void FlushTokenSaveCallbacks(bool result); | 117 void FlushTokenSaveCallbacks(bool result); |
| 140 | 118 |
| 141 // Signals failure on the specified request, passing |error| as the reason. | 119 void RequestValidation(); |
| 142 void FailRequest(RequestImpl* request, GoogleServiceAuthError::State error); | 120 |
| 121 void SetValidationStatusDelegate(ValidationStatusDelegate* delegate); |
| 143 | 122 |
| 144 // Dependencies. | 123 // Dependencies. |
| 145 scoped_refptr<net::URLRequestContextGetter> url_request_context_getter_; | 124 scoped_refptr<net::URLRequestContextGetter> url_request_context_getter_; |
| 146 PrefService* local_state_; | 125 PrefService* local_state_; |
| 147 | 126 |
| 148 // Current operational state. | 127 // Current operational state. |
| 149 State state_; | 128 State state_; |
| 150 | 129 |
| 151 // Token save callbacks waiting to be completed. | 130 // Token save callbacks waiting to be completed. |
| 152 std::vector<StatusCallback> token_save_callbacks_; | 131 std::vector<StatusCallback> token_save_callbacks_; |
| 153 | 132 |
| 154 // Currently open requests that are waiting while loading the system salt or | |
| 155 // validating the token. | |
| 156 std::vector<PendingRequest*> pending_requests_; | |
| 157 | |
| 158 // The system salt for encrypting and decrypting the refresh token. | 133 // The system salt for encrypting and decrypting the refresh token. |
| 159 std::string system_salt_; | 134 std::string system_salt_; |
| 160 | 135 |
| 161 int max_refresh_token_validation_retries_; | 136 int max_refresh_token_validation_retries_; |
| 162 | 137 |
| 138 // Flag to indicate whether there are pending requests. |
| 139 bool validation_requested_; |
| 140 |
| 141 // Validation status delegate |
| 142 ValidationStatusDelegate* validation_status_delegate_; |
| 143 |
| 163 // Cache the decrypted refresh token, so we only decrypt once. | 144 // Cache the decrypted refresh token, so we only decrypt once. |
| 164 std::string refresh_token_; | 145 std::string refresh_token_; |
| 165 | 146 |
| 166 scoped_ptr<gaia::GaiaOAuthClient> gaia_oauth_client_; | 147 scoped_ptr<gaia::GaiaOAuthClient> gaia_oauth_client_; |
| 167 | 148 |
| 168 scoped_ptr<CrosSettings::ObserverSubscription> | 149 scoped_ptr<CrosSettings::ObserverSubscription> |
| 169 service_account_identity_subscription_; | 150 service_account_identity_subscription_; |
| 170 | 151 |
| 171 base::WeakPtrFactory<DeviceOAuth2TokenService> weak_ptr_factory_; | 152 base::WeakPtrFactory<DeviceOAuth2TokenServiceDelegate> weak_ptr_factory_; |
| 172 | 153 |
| 173 DISALLOW_COPY_AND_ASSIGN(DeviceOAuth2TokenService); | 154 DISALLOW_COPY_AND_ASSIGN(DeviceOAuth2TokenServiceDelegate); |
| 174 }; | 155 }; |
| 175 | 156 |
| 176 } // namespace chromeos | 157 } // namespace chromeos |
| 177 | 158 |
| 178 #endif // CHROME_BROWSER_CHROMEOS_SETTINGS_DEVICE_OAUTH2_TOKEN_SERVICE_H_ | 159 #endif // CHROME_BROWSER_CHROMEOS_SETTINGS_DEVICE_OAUTH2_TOKEN_SERVICE_DELEGATE
_H_ |
| OLD | NEW |