Merge lp:~mardy/account-plugins/lp1029289 into lp:account-plugins

[Alberto Mardegan]

Use web-server authentication with Google, to take advantage of refresh tokens

Use the web-authentication as described in https://developers.google.com/accounts/docs/OAuth2#installed

[David King (amigadave)]

Looks fine, except:

32 + var oauth_params = get_parameters(ParametersUser.ACCOUNT_PLUGIN);
33 + set_oauth_parameters (oauth_params);
34 +
35 + oauth_params = get_parameters(ParametersUser.CLIENT_APPLICATIONS);
36 + set_account_oauth_parameters (oauth_params);
37 +
38 + set_mechanism(Ap.OAuthMechanism.WEB_SERVER);
39 +
40 + set_ignore_cookies (true);

It is better to be consistent by adding a space before every opening bracket.

review: Needs Fixing

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:82
http://s-jenkins:8080/job/account-plugins-ci/12/
Executed test runs:
    SUCCESS: http://s-jenkins:8080/job/account-plugins-ci/./build=pbuilder,distribution=raring,flavor=amd64/12/console
    SUCCESS: http://s-jenkins:8080/job/account-plugins-ci/./build=pbuilder,distribution=raring,flavor=i386/12/console

Click here to trigger a rebuild:
http://s-jenkins:8080/job/account-plugins-ci/12//rebuild/?

review: Approve (continuous-integration)

[lp:~mardy/account-plugins/lp1029289]

83. By Alberto Mardegan on 2012-12-10

Fix coding style

[Alberto Mardegan (mardy)]

> It is better to be consistent by adding a space before every opening bracket.

Indeed. I updated the code, should be better now.

[David King (amigadave)]

review: Approve

[PS Jenkins bot (ps-jenkins)]

PASSED: Continuous integration, rev:83
http://s-jenkins:8080/job/account-plugins-ci/13/
Executed test runs:
    SUCCESS: http://s-jenkins:8080/job/account-plugins-ci/./build=pbuilder,distribution=raring,flavor=amd64/13/console
    SUCCESS: http://s-jenkins:8080/job/account-plugins-ci/./build=pbuilder,distribution=raring,flavor=i386/13/console

Click here to trigger a rebuild:
http://s-jenkins:8080/job/account-plugins-ci/13//rebuild/?

review: Approve (continuous-integration)

=== modified file 'debian/rules'
--- debian/rules	2012-11-09 16:15:25 +0000
+++ debian/rules	2012-12-10 07:54:21 +0000
@@ -13,6 +13,7 @@
 		--with-windows-live-client-id="00000000400D5635" \
 		--with-foursquare-client-id="1I2UNJXPHNDZT3OPZOOA5LCPIUEUJFMKRXSF42UFCN1KXKTK" \
 		--with-google-client-id="759250720802-4sii0me9963n9fdqdmi7cepn6ub8luoh.apps.googleusercontent.com" \
+		--with-google-client-secret="juFngKUcuhB7IRQqHtSLavqJ" \
 		--with-flickr-consumer-key="d87224f0b467093b2a87fd788d950e27" \
 		--with-flickr-consumer-secret="4c7e48102c226509"
 

=== modified file 'src/google.vala'
--- src/google.vala	2012-11-12 11:24:22 +0000
+++ src/google.vala	2012-12-10 07:54:21 +0000
@@ -20,12 +20,31 @@
  */
 
 public class GooglePlugin : Ap.OAuthPlugin {
+    private enum ParametersUser
+    {
+        ACCOUNT_PLUGIN,
+        CLIENT_APPLICATIONS
+    }
+
     public GooglePlugin (Ag.Account account) {
         Object (account: account);
     }
 
     construct
     {
+        var oauth_params = get_parameters (ParametersUser.ACCOUNT_PLUGIN);
+        set_oauth_parameters (oauth_params);
+
+        oauth_params = get_parameters (ParametersUser.CLIENT_APPLICATIONS);
+        set_account_oauth_parameters (oauth_params);
+
+        set_mechanism (Ap.OAuthMechanism.WEB_SERVER);
+
+        set_ignore_cookies (true);
+    }
+
+    private HashTable<string, GLib.Value?> get_parameters (ParametersUser user)
+    {
         var oauth_params = new HashTable<string, GLib.Value?> (str_hash, null);
         oauth_params.insert ("Host", "accounts.google.com");
         oauth_params.insert ("AuthPath", "o/oauth2/auth");
@@ -33,8 +52,28 @@
         oauth_params.insert ("RedirectUri",
                              "https://wiki.ubuntu.com/");
         oauth_params.insert ("ClientId", Config.GOOGLE_CLIENT_ID);
-        oauth_params.insert ("ResponseType", "token");
+        oauth_params.insert ("ClientSecret", Config.GOOGLE_CLIENT_SECRET);
 
+        /* Note the evil trick here: Google uses a couple of non-standard OAuth
+         * parameters: "access_type" and "approval_prompt"; the signon OAuth
+         * plugin doesn't (yet?) give us a way to provide extra parameters, so
+         * we fool it by appending them to the value of the "ResponseType".
+         *
+         * We need to specify "access_type=offline" if we want Google to return
+         * us a refresh token.
+         */
+        if (user == ParametersUser.ACCOUNT_PLUGIN)
+        {
+            /* The "approval_prompt=force" string forces Google to ask for
+             * authentication. */
+            oauth_params.insert ("ResponseType",
+                                 "code&access_type=offline&approval_prompt=force");
+        }
+        else
+        {
+            oauth_params.insert ("ResponseType",
+                                 "code&access_type=offline");
+        }
         string[] scopes = {
             "https://docs.google.com/feeds/",
             "https://www.googleapis.com/auth/googletalk",
@@ -50,9 +89,7 @@
         };
         oauth_params.insert ("AllowedSchemes", schemes);
 
-        set_oauth_parameters (oauth_params);
-
-        set_ignore_cookies (true);
+        return oauth_params;
     }
 }