password_specifics.proto 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295
  1. // Copyright (c) 2012 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. //
  5. // Sync protocol datatype extension for password data.
  6. // If you change or add any fields in this file, update proto_visitors.h and
  7. // potentially proto_enum_conversions.{h, cc}.
  8. syntax = "proto2";
  9. option java_multiple_files = true;
  10. option java_package = "org.chromium.components.sync.protocol";
  11. option optimize_for = LITE_RUNTIME;
  12. package sync_pb;
  13. import "components/sync/protocol/encryption.proto";
  14. // These are the properties that get serialized into the |encrypted| field of
  15. // PasswordSpecifics. They correspond to fields in
  16. // password_manager::PasswordForm.
  17. //
  18. // Sync unique tag is calculated as
  19. // EscapePath(origin) + "|" +
  20. // EscapePath(username_element) + "|" +
  21. // EscapePath(username_value) + "|" +
  22. // EscapePath(password_element) + "|" +
  23. // EscapePath(signon_realm)
  24. // where '+' is the string concatenation operation. EscapePath escapes a partial
  25. // or complete file/pathname. This includes non-printable, non-7bit, and
  26. // (including space) the following characters ' "#%:<>?[\]^`{|}'. The space
  27. // character is encoded as '%20'.
  28. // All the strings are encoded with UTF-8. URLs are encoded in Punycode.
  29. message PasswordSpecificsData {
  30. // The different types of the saved credential.
  31. enum Scheme {
  32. // SCHEME_HTML, the credential represents either a parsed HTML form, or an
  33. // android credential or a password saved through Credential Management API
  34. // (https://w3c.github.io/webappsec/specs/credentialmanagement/).
  35. SCHEME_HTML = 0;
  36. // SCHEME_BASIC, basic access http authentication.
  37. SCHEME_BASIC = 1;
  38. // SCHEME_DIGEST, digest access authentication.
  39. SCHEME_DIGEST = 2;
  40. // SCHEME_OTHER, another proxy access authentication.
  41. SCHEME_OTHER = 3;
  42. // USERNAME_ONLY, partial credentials saved on Android that contain only
  43. // username and miss the password.
  44. USERNAME_ONLY = 4;
  45. }
  46. // See the enum above.
  47. optional int32 scheme = 1;
  48. // Signon realm stores information on where the saved password was stored, and
  49. // where it's supposed to be filled again.
  50. //
  51. // It can take various formats depending on the exact circumstances where it
  52. // was recorded. Note that the format is *not* guaranteed to be a valid URL or
  53. // URI:
  54. //
  55. // * For parsed web forms and normal passwords saved through Credential
  56. // Manager
  57. // API: <http-scheme>://<url-host>[:<url-port>]/
  58. //
  59. // where
  60. // <http-scheme> is one of "http" or "https"
  61. // <url-host> is the host for which the password was stored
  62. // <url-port> is the option port on the host
  63. // The signon realm is a valid URL in this case with an empty path.
  64. // Examples:
  65. // http://www.example.com/
  66. // https://127.0.0.1/
  67. // http://www.google.com:8080/
  68. // http://192.168.1.254/
  69. // https://accounts.google.com/
  70. //
  71. // * For Android apps saved through Autofill with Google:
  72. // android://<hash-of-cert>@<package-name>/
  73. // where
  74. // <hash-of-cert> is the base64 encoded SHA512 of the app's public
  75. // certificate <package-name> is the app's package name
  76. // Examples:
  77. // android://kCyQDzpaoAX2gs-1zdGPKNAeICb8LzRFOxa4NCq0jO8c8d_NFS_q-Y35bU3Nq3GmFV2lLurmNvIZa6YPYZwmWg==@com.pinterest/
  78. // android://mNUCvTnoWBkzIhSSkVj-uzAdK42YagmCmyUtPoC6JPmYAN3wKpmTdIRsdJtz6pzNBye8XL7nBbEcx-y9CJeo9A==@com.twitter.android.lite/
  79. //
  80. // * For federated credentials:
  81. // federation://<origin_host>/<federation_host>
  82. // where
  83. // <origin_host> is the host for which the login information was stored
  84. // <federation_host> is the host of the federation provider that was
  85. // used to sign in
  86. // Examples:
  87. // federation://www.example.com/accounts.google.com
  88. // federation://uk.trustpilot.com/www.facebook.com
  89. //
  90. // * For proxy auth:
  91. // <proxy-host>[:<proxy_port>]/<auth-realm>
  92. // where
  93. // <proxy-host> is the host of the proxy for which the password was
  94. // stored
  95. // <proxy-port> is the port of the proxy
  96. // <auth-realm> is a string provided by the proxy during authentication.
  97. // It can contain spaces.
  98. // Examples:
  99. // proxy2.eq.edu.au:80/MISldap
  100. // proxy.det.nsw.edu.au:8080/NSW Department of Education
  101. // 10.47.2.250:3128/Squid Proxy Server CPUT
  102. // default.go2https.com:443/(******Get password from vpnso.com/account/
  103. // *****)
  104. //
  105. // * For HTTP basic auth:
  106. // <http-scheme>://<url-host>[:<url-port>]/<auth-realm>
  107. // where
  108. // <http-scheme> is one of "http" or "https"
  109. // <url-host> is the host for which the password was stored
  110. // <url-port> is the option port on the host
  111. // <auth-realm> is a string provided by the host during authentication.
  112. // It can contain spaces.
  113. // Examples:
  114. // http://192.168.1.1/Broadband Router
  115. // http://192.168.0.1/TP-LINK Wireless N Router WR841N
  116. // http://192.168.1.1/index.htm
  117. // https://www.edge.asic.gov.au/ASIC eBusiness
  118. optional string signon_realm = 2;
  119. // For parsed web forms and Credential Management API:
  120. // url-scheme://url-host[:url-port]/path
  121. // For Android: "android://<hash of cert>@<package name>/"
  122. // For proxy/HTTP auth: url-scheme://url-host[:url-port]/path
  123. optional string origin = 3;
  124. // Only for web-parsed forms - the action target of the form:
  125. // url-scheme://url-host[:url-port]/path
  126. optional string action = 4;
  127. // Only for web-parsed forms - the name of the element containing username.
  128. optional string username_element = 5;
  129. // For all: the username.
  130. // For blacklisted forms: <empty>.
  131. optional string username_value = 6;
  132. // Only for web-parsed forms - the name of the element containing password.
  133. optional string password_element = 7;
  134. // For all: the password.
  135. // For federated logins and blacklisted forms: <empty>
  136. optional string password_value = 8;
  137. // Deprecated: http://crbug.com/413020
  138. // True if the credential was saved for a HTTPS session with a valid SSL cert.
  139. // Ignored for Android apps.
  140. optional bool ssl_valid = 9 [deprecated = true];
  141. // True for the last credential used for logging in on a given site.
  142. // Deprecated in M81.
  143. optional bool preferred = 10 [deprecated = true];
  144. // Time when the credential was created. Amount of microseconds since 1601.
  145. optional int64 date_created = 11;
  146. // True, if user chose permanently not to save the credentials for the form.
  147. optional bool blacklisted = 12;
  148. // kFormSubmission(0), user manually filled the username and the password
  149. // in the form.
  150. // kGenerated(1), the credential was auto generated.
  151. // kApi(2), the credential was generated from Credential Management API.
  152. // kManuallyAdded(3), user manually created the password credential
  153. // via Settings.
  154. // kImported(4), the credential was imported using the import flow.
  155. optional int32 type = 13;
  156. // Number of times this login was used for logging in. Chrome uses this field
  157. // to distinguish log-in and sign-up forms.
  158. optional int32 times_used = 14;
  159. // A human readable name of the account holder. Set by CredentialManager API
  160. // and Android.
  161. optional string display_name = 15;
  162. // A URL of the avatar for the credential. Set by CredentialManager API and
  163. // Android.
  164. optional string avatar_url = 16;
  165. // A URL of the IdP used to verify the credential. Set by Credential Manager
  166. // API and Android.
  167. optional string federation_url = 17;
  168. // Time when the credential was last used. This covers *successful* logins to
  169. // the website, and explicit updates to the password. It does *not* cover if
  170. // the password just gets filled but not actually submitted, or if the login
  171. // failed.
  172. // Note that password consumers other than Chrome (e.g. Google Play Services)
  173. // might not update this at all.
  174. // Amount of microseconds since 1601, aka Windows epoch.
  175. optional int64 date_last_used = 18;
  176. message PasswordIssues {
  177. message PasswordIssue {
  178. // Timestamp set by a client detecting the issue for the first time.
  179. // Number of microseconds since Windows epoch (1601).
  180. // This can be unset even if is_muted is set in a few cases in
  181. // storage (for a time mutes were written without setting this
  182. // field - fixed starting 2021-11-10).
  183. optional uint64 date_first_detection_microseconds = 1;
  184. // Whether the issue was muted by user.
  185. optional bool is_muted = 2;
  186. }
  187. optional PasswordIssue leaked_password_issue = 1;
  188. optional PasswordIssue reused_password_issue = 2;
  189. optional PasswordIssue weak_password_issue = 3;
  190. optional PasswordIssue phished_password_issue = 4;
  191. }
  192. // Set if an issue was detected that puts this password at risk. All the
  193. // clients are expected to clear the field when the password value is updated.
  194. // 'reused' part can be additionally reset when the analysis on the entire
  195. // password store is completed.
  196. optional PasswordIssues password_issues = 19;
  197. // Time when the |password_value| was last modified. For new credentials it
  198. // should be set to |date_created|. For subsequent updates the timestamp is
  199. // changed if and only if the new password value was saved.
  200. // Number of microseconds since Windows epoch (1601).
  201. optional int64 date_password_modified_windows_epoch_micros = 20;
  202. message Notes {
  203. message Note {
  204. // The display name must be unique within the scope of a password.
  205. optional string unique_display_name = 1;
  206. // The user-defined value of the note.
  207. optional string value = 2;
  208. // The creation time of the note. Number of microseconds since 1601.
  209. optional int64 date_created_windows_epoch_micros = 3;
  210. // Whether the value of the note is not displayed in plain text by
  211. // default.
  212. optional bool hide_by_default = 4;
  213. }
  214. repeated Note note = 1;
  215. }
  216. // Set of extra notes that the user attached to the password. The presence of
  217. // this field, even with an empty Notes message, becomes the authoritative
  218. // value for notes and would disregard whatever `encrypted_notes_backup`
  219. // contains.
  220. optional Notes notes = 21;
  221. }
  222. // Contains the password specifics metadata which simplifies its lookup.
  223. message PasswordSpecificsMetadata {
  224. optional string url = 1;
  225. // True, if user chose permanently not to save the credentials for the form.
  226. // Introduced in M82.
  227. optional bool blacklisted = 2;
  228. }
  229. // Properties of password sync objects.
  230. message PasswordSpecifics {
  231. // The actual password data. Contains an encrypted PasswordSpecificsData
  232. // message.
  233. optional EncryptedData encrypted = 1;
  234. // An unsynced field for use internally on the client. This field should
  235. // never be set in any network-based communications because it contains
  236. // unencrypted material.
  237. optional PasswordSpecificsData client_only_encrypted_data = 2;
  238. // Password related metadata, which is sent to the server side. The field
  239. // should never be set for full encryption users. If encryption is enabled,
  240. // this field must be cleared.
  241. optional PasswordSpecificsMetadata unencrypted_metadata = 3;
  242. // An encrypted backup of the notes field inside the PasswordSpecificsData.
  243. // The Sync server preserves the contents of this field across commits from
  244. // legacy clients that don't set this field. It is the responsibility of Sync
  245. // clients to populate the contents of PasswordSpecificsData notes fields
  246. // using the contents of this field. This should be deprecated together with
  247. // the logic for preserving it on the server when clients without support for
  248. // the |notes| field are no longer allowed by the server (below support
  249. // version horizon).
  250. //
  251. // Encryption key considerations:
  252. // a) For commits, the client must use the same key for both encrypted blobs.
  253. // b) For handling getupdates, the two keys may NOT necessarily match the
  254. // encryption key used, as in theory the new blob could be "behind" if key
  255. // rotation took place. As of today, it is safe to assume that if
  256. // |encrypted| is decryptable by a client, then |encrypted_notes_backup|
  257. // must be decryptable too (i.e. the Nigori keybag should include older
  258. // versions of the key). But not the other way round.
  259. //
  260. // If both `encrypted_notes_backup` and the `notes` in `encrypted` are
  261. // populated, the one in notes is considered the authoritative value.
  262. optional EncryptedData encrypted_notes_backup = 4;
  263. }