1920419 - Cached `OAuth2` objects aren't reused if their scope changes

Status: RESOLVED FIXED

(Thunderbird :: Account Manager, defect)

Description

[Geoff Lankow (:darktrojan)]

In bug 1880211 I added a cache for OAuth2 objects created by OAuthModule.sys.mjs to solve a problem with multiple authentication problems appearing for the same account. When checking if a cached object can be reused, the OAuth scopes are only checked for string equality, and this will break if the server grants different scopes from those requested. A cached object should be reused if the scopes it has are a superset of the scopes that are wanted.

Comment 1

[Geoff Lankow (:darktrojan)]

Attachment: Bug 1920419 - Test that OAuth2Module correctly saves and restores tokens. r=#thunderbird-reviewers

Comment 2

[Geoff Lankow (:darktrojan)]

Attachment: Bug 1920419 - Handle OAuth scopes with Set functions, and fix cache checking. r=#thunderbird-reviewers

Using isSupersetOf makes the intention of the code clearer, and hopefully prevents future mistakes.

Comment 3

[Geoff Lankow (:darktrojan)]

Attachment: Bug 1920419 - Add logging to OAuth2Module.sys.mjs. r=#thunderbird-reviewers

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/4651b592ec50
Test that OAuth2Module correctly saves and restores tokens. r=mkmelin
https://hg.mozilla.org/comm-central/rev/975ed9f251a7
Handle OAuth scopes with Set functions, and fix cache checking. r=mkmelin
https://hg.mozilla.org/comm-central/rev/d7a05df28f55
Add logging to OAuth2Module.sys.mjs. r=mkmelin

Comment 5

[Geoff Lankow (:darktrojan)]

Found an edge case, and a bad log message.

Comment 6

[Geoff Lankow (:darktrojan)]

Attachment: Bug 1920419 - Fix what happens if an *.oauth2.scope pref is empty. r=#thunderbird-reviewers

Comment 7

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/comm-central/rev/6b462bda90c9
Fix what happens if an *.oauth2.scope pref is empty. r=mkmelin

Comment 8

[Corey Bryant]

Uplift to 128?

Comment 9

[Geoff Lankow (:darktrojan)]

Nope. This depends on six patches ahead of it, which you have experience with, and I've no intention of pushing them to ESR again this side of Christmas, especially while we're deep in other problems on ESR.