Re: Making GNUS continue to work with Gmail

[David De La Harpe Golden]

On 15/08/2020 20:39, Cesar Crusius wrote:

>  From what I've seen from Kmail/Kontact/KPim/etc replies, (a) and (b) is exactly what they are 
> doing, and there's no way around this. The only question is how to achieve those in a way that is 
> compatible with both Google terms and FSF requirements, if there is such a way. Thunderbird 
> "achieves" (b) by having "secret" keys in source code. I don't know what the K* 
> applications do, it did not seem to be specified in their discussions.

For the morbidly curious like myself:

N.B. I'm far from familiar with the sprawling KDE sources in general, 
but it's freely licensed (LGPL), so had a quick look.

Anyway, their source-embedded static values were trivial to locate at 
time of writing:

https://invent.kde.org/pim/kdepim-runtime/-/blob/master/resources/imap/gmailpasswordrequester.cpp#L16

https://invent.kde.org/pim/kdepim-runtime/-/blob/master/resources/google-groupware/googlesettings.cpp#L143

https://invent.kde.org/pim/kmailtransport/-/blob/master/src/kmailtransport/plugins/smtp/smtpjob.cpp#L32

The referenced kde KGAPI component (implements enough oauth2 to work 
against google) appears to be use the 
spawn-transient-http-server-on-localhost redirect_uri approach/trick to 
pick up the authorization code (to convert to access+refresh tokens with 
second request).  Don't seem to be doing code_challenge/code_verifier 
i.e. pkce /rfc7636 yet (presumably should). To make the request they 
actually currently appear to use / still use embedded webview, not 
delegating to user's browser, in contrast to recent 
https://tools.ietf.org/html/rfc8252#section-8.12

(skipping pkce and embedded webview may be "grandfathered in", can well 
imagine google and other providers frowning on it for newly-issued app 
client ids)

https://invent.kde.org/pim/libkgapi/-/blob/master/src/core/ui/authwidget.cpp#L100

code req to auth endpoint

https://invent.kde.org/pim/libkgapi/-/blob/master/src/core/ui/authwidget.cpp#L121

code response receipt

https://invent.kde.org/pim/libkgapi/-/blob/master/src/core/ui/authwidget_p.cpp#L277

code->token req to token endpoint

https://invent.kde.org/pim/libkgapi/-/blob/master/src/core/private/newtokensfetchjob.cpp#L88

token response processed

https://invent.kde.org/pim/libkgapi/-/blob/master/src/core/private/newtokensfetchjob.cpp#L124