account_manager.mojom 9.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258
  1. // Copyright 2020 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. // Next MinVersion: 11
  5. module crosapi.mojom;
  6. import "mojo/public/mojom/base/time.mojom";
  7. // Types of accounts which can be stored in Account Manager.
  8. // This must be kept in sync with
  9. // //components/account_manager_core/chromeos/tokens.proto.
  10. [Stable, Extensible]
  11. enum AccountType {
  12. kUnspecified = 0,
  13. kGaia = 1,
  14. kActiveDirectory = 2,
  15. };
  16. // Uniquely identifies an account in Account Manager.
  17. [Stable]
  18. struct AccountKey {
  19. // |id| is obfuscated Gaia id for Gaia accounts.
  20. // |id| is the object GUID for Microsoft Active Directory accounts.
  21. string id@0;
  22. // Type of the account - such as Gaia, or Microsoft Active Directory.
  23. AccountType account_type@1;
  24. };
  25. // Information about an account in Account Manager.
  26. [Stable]
  27. struct Account {
  28. // A unique identifier for this account.
  29. AccountKey key@0;
  30. // The raw, un-canonicalized email id (The.Rock@gmail.com, as opposed to
  31. // therock@gmail.com) for this account.
  32. string raw_email@1;
  33. };
  34. // See google_apis/gaia/google_service_auth_error.h
  35. // Currently sent from ash to lacros.
  36. // Next value: 15.
  37. [Stable]
  38. struct GoogleServiceAuthError {
  39. [Stable, Extensible]
  40. enum State {
  41. kNone = 0,
  42. kInvalidGaiaCredentials = 1,
  43. kUserNotSignedUp = 2,
  44. kConnectionFailed = 3,
  45. // DEPRECATED kCaptchaRequired = 4,
  46. // DEPRECATED kAccountDeleted = 5,
  47. // DEPRECATED kAccountDisabled = 6,
  48. kServiceUnavailable = 7,
  49. // DEPRECATED kTwoFactor = 8,
  50. kRequestCanceled = 9,
  51. // DEPRECATED kHostedNotAllowedDeprecated = 10,
  52. kUnexpectedServiceResponse = 11,
  53. kServiceError = 12,
  54. // DEPRECATED kWebLoginRequired = 13,
  55. [MinVersion=10] kScopeLimitedUnrecoverableError = 14,
  56. };
  57. // Next value: 4.
  58. [Stable, Extensible]
  59. enum InvalidGaiaCredentialsReason {
  60. kUnknown = 0,
  61. kCredentialsRejectedByServer = 1,
  62. kCredentialsRejectedByClient = 2,
  63. kCredentialsMissing = 3,
  64. };
  65. State state@0;
  66. // Network error is set only if `state` is set to `kConnectionFailed`.
  67. // In case of no network error, `network_error` is set to 0.
  68. int64 network_error@1;
  69. string error_message@2;
  70. InvalidGaiaCredentialsReason invalid_gaia_credentials_reason@3;
  71. };
  72. // See components/account_manager_core/account_addition_options.h
  73. [Stable]
  74. struct AccountAdditionOptions {
  75. bool is_available_in_arc@0;
  76. bool show_arc_availability_picker@1;
  77. };
  78. [Stable]
  79. struct AccountAdditionResult {
  80. // The result of account addition request.
  81. // Next value: 6.
  82. [Stable, Extensible]
  83. enum Status {
  84. kSuccess = 0,
  85. kAlreadyInProgress = 1,
  86. kCancelledByUser = 2,
  87. kNetworkError = 3,
  88. kUnexpectedResponse = 4,
  89. [MinVersion = 9] kBlockedByPolicy = 5,
  90. };
  91. Status status@0;
  92. // The account that was added.
  93. Account? account@1;
  94. // The error is set only if `status` is set to `kNetworkError`.
  95. GoogleServiceAuthError? error@2;
  96. };
  97. // Next ordinal value: 3
  98. [Stable]
  99. struct AccessTokenInfo {
  100. // OAuth2 access token.
  101. string access_token@0;
  102. // Expiration time of `access_token`. This value has a built-in safety margin
  103. // so it can be used as-is.
  104. mojo_base.mojom.Time expiration_time@1;
  105. // Contains extra information regarding the user's currently registered
  106. // services.
  107. string id_token@2;
  108. };
  109. [Stable]
  110. union AccessTokenResult {
  111. AccessTokenInfo access_token_info;
  112. GoogleServiceAuthError error;
  113. };
  114. // Interface for observers of Chrome OS Account Manager.
  115. // This interface is implemented by lacros-chrome, and is used by ash-chrome to
  116. // send account update notifications.
  117. //
  118. // Next version: 2
  119. // Next method id: 3
  120. [Stable, Uuid="f75c4963-497b-411f-97ab-c53c7f6b46ed"]
  121. interface AccountManagerObserver {
  122. // Called when the token for |account| is updated/inserted.
  123. // Note: Observers which register with |AccountManager| before its
  124. // initialization is complete will get notified when |AccountManager| is fully
  125. // initialized.
  126. // Note: Observers which register with |AccountManager| after its
  127. // initialization is complete will not get an immediate
  128. // notification-on-registration.
  129. OnTokenUpserted@0(Account account);
  130. // Called when an account has been removed from Account Manager.
  131. // Note: Observers that may have cached access tokens for |account| must clear
  132. // their cache entry for this |account| on receiving this callback.
  133. OnAccountRemoved@1(Account account);
  134. // Called when an `account`'s `error` status changes. See `ReportAuthError` in
  135. // `AccountManager` interface for details.
  136. // Note: Observers that may have cached access tokens for `account` must clear
  137. // their cache entries for this `account` on receiving this callback. They may
  138. // short-circuit future access token requests with an immediate `error` for a
  139. // given `account` as appropriate (e.g. if the error is a non-transient
  140. // error).
  141. // Note: Observers must reset their cached error states (if any) for
  142. // `account` - if the `state` of `error` is `kNone`.
  143. [MinVersion = 1]
  144. OnAuthErrorChanged@2(AccountKey account, GoogleServiceAuthError error);
  145. };
  146. // Interface for Chrome OS Account Manager.
  147. // Chrome OS Account Manager is the source of truth for accounts on Chrome OS -
  148. // including ARC, and Chrome content area. It supports Google accounts and
  149. // Microsoft Active Directory accounts, as of this writing.
  150. // This interface is implemented by ash-chrome, and is used by lacros-chrome to
  151. // query accounts residing in the Chrome OS Account Manager.
  152. // ARC++ uses components/arc/mojom/auth.mojom to talk to the Chrome OS Account
  153. // Manager.
  154. //
  155. // Next version: 10
  156. // Next method id: 9
  157. [Stable, Uuid="85b9a674-9d8e-497f-98d5-22c8dca6f2b8"]
  158. interface AccountManager {
  159. // Returns |true| if Chrome OS Account Manager has been fully initialized, and
  160. // |false| otherwise.
  161. IsInitialized@0() => (bool is_initialized);
  162. // Creates and returns a new receiver for |AccountManagerObserver|.
  163. // This API is supposed to be called by lacros-chrome, fairly early during its
  164. // initialization, to receive updates related to accounts stored in Account
  165. // Manager.
  166. // The connection, and the corresponding remote, is destroyed when |receiver|
  167. // is destroyed. This will happen automatically when lacros is shut down.
  168. [MinVersion = 1]
  169. AddObserver@1() => (pending_receiver<AccountManagerObserver> receiver);
  170. // Returns the list of accounts in AccountManager. Can be invoked before the
  171. // initialization is completed (in this case the callback will be invoked
  172. // after the initialization is done).
  173. [MinVersion = 2]
  174. GetAccounts@2() => (array<Account> accounts);
  175. // Launches account addition dialog and returns `result` with the added
  176. // account.
  177. [MinVersion = 3]
  178. ShowAddAccountDialog@3(
  179. [MinVersion=8] AccountAdditionOptions? add_account_options) =>
  180. (AccountAdditionResult result);
  181. // Launches account reauthentication dialog for provided `email`.
  182. [MinVersion = 3]
  183. ShowReauthAccountDialog@4(string email) => ();
  184. // Launches OS Settings > Accounts.
  185. [MinVersion = 4]
  186. ShowManageAccountsSettings@5();
  187. // Returns a persistent error state for `account`. If `account` doesn't have
  188. // a persistent error or AccountManager doesn't have such an account -
  189. // `GoogleServiceAuthError` with `kNone` state will be returned.
  190. [MinVersion = 5]
  191. GetPersistentErrorForAccount@6(AccountKey account) =>
  192. (GoogleServiceAuthError error);
  193. // Returns a remote to an interface to fetch an access token for
  194. // `account_key`, to be used by `oauth_consumer_name` OAuth2 client.
  195. // `account_key` must be a Gaia account. If `account_key` is invalid or not
  196. // known to Chrome OS Account Manager, fetching an access token via
  197. // `AccessTokenFetcher` will result in an error (`kUserNotSignedUp`). If the
  198. // account's refresh token is no longer valid, it will result in
  199. // `kInvalidGaiaCredentials` error. See `GoogleServiceAuthError` for all error
  200. // types.
  201. [MinVersion = 6]
  202. CreateAccessTokenFetcher@7(AccountKey account_key,
  203. string oauth_consumer_name) =>
  204. (pending_remote<AccessTokenFetcher> access_token_fetcher);
  205. // Reports an `error` for `account`.
  206. // The implementation uses a pubsub model to propagate errors for accounts.
  207. // Any application can report (Publish) account errors. These errors will be
  208. // fanned out to `AccountManagerObserver`s (Subscribers).
  209. // A typical use-case is sharing of account error information between Ash and
  210. // Lacros. Since these errors are OAuth errors, they can be discovered by any
  211. // application (or the OS) - and must be communicated to other applications
  212. // (or the OS).
  213. // `account` must be a valid account known to Account Manager.
  214. // Setting the error `state` as `kNone` resets the error state for `account`.
  215. [MinVersion = 9]
  216. ReportAuthError@8(AccountKey account, GoogleServiceAuthError error);
  217. };
  218. // Interface for fetching OAuth2 access tokens.
  219. [Stable, Uuid="71476f25-fb77-414f-848e-3e5368a9ee35"]
  220. interface AccessTokenFetcher {
  221. // Starts the request for fetching an access token with the provided `scopes`.
  222. // If `scopes` is empty, `access_token` will have the same scope as the
  223. // underlying refresh token - login scope.
  224. // Don't call this method multiple times - create a new `AccessTokenFetcher`
  225. // instead.
  226. Start@0(array<string> scopes) => (AccessTokenResult result);
  227. };