device_code: String,

user_code: String,

message: Option<String>,

verification_uri: String,

expires_in: i64,

access_token: String,

refresh_token: Option<String>,

expires_in: Option<i64>,

fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {

match self {

AuthProvider::Microsoft => write!(f, "Microsoft Account"),

AuthProvider::Github => write!(f, "Github Account"),

}

}

pub fn client_id(&self) -> &'static str {

match self {

AuthProvider::Microsoft => "aebc6443-996d-45c2-90f0-388ff96faa56",

AuthProvider::Github => "01ab8ac9400c4e429b23",

}

}

pub fn code_uri(&self) -> &'static str {

match self {

AuthProvider::Microsoft => {

"https://login.microsoftonline.com/common/oauth2/v2.0/devicecode"

}

AuthProvider::Github => "https://github.com/login/device/code",

}

}

pub fn grant_uri(&self) -> &'static str {

match self {

AuthProvider::Microsoft => "https://login.microsoftonline.com/common/oauth2/v2.0/token",

AuthProvider::Github => "https://github.com/login/oauth/access_token",

}

}

pub fn get_default_scopes(&self) -> String {

match self {

AuthProvider::Microsoft => format!(

"{}/.default+offline_access+profile+openid",

PROD_FIRST_PARTY_APP_ID

),

AuthProvider::Github => "read:user+read:org".to_string(),

}

}

#[serde(rename = "p")]

provider: AuthProvider,

#[serde(rename = "a")]

access_token: String,

#[serde(rename = "r")]

refresh_token: Option<String>,

#[serde(rename = "e")]

expires_at: Option<DateTime<Utc>>,

pub async fn is_expired(&self, client: &reqwest::Client) -> bool {

match self.provider {

AuthProvider::Microsoft => self

.expires_at

.map(|e| Utc::now() + chrono::Duration::minutes(5) > e)

.unwrap_or(false),

// Make an auth request to Github. Mark the credential as expired

// only on a verifiable 4xx code. We don't error on any failed

// request since then a drop in connection could "require" a refresh

AuthProvider::Github => client

.get("https://api.github.com/user")

.header("Authorization", format!("token {}", self.access_token))

.header("User-Agent", get_default_user_agent())

.send()

.await

.map(|r| r.status().is_client_error())

.unwrap_or(false),

}

}

fn from_response(auth: AuthenticationResponse, provider: AuthProvider) -> Self {

StoredCredential {

provider,

access_token: auth.access_token,

refresh_token: auth.refresh_token,

expires_at: auth.expires_in.map(|e| Utc::now() + Duration::seconds(e)),

}

}

client: reqwest::Client,

log: log::Logger,

file_storage_path: PathBuf,

storage: Arc<std::sync::Mutex<Option<StorageWithLastRead>>>,

fn read(&mut self) -> Result<Option<StoredCredential>, WrappedError>;

fn store(&mut self, value: StoredCredential) -> Result<(), WrappedError>;

fn clear(&mut self) -> Result<(), WrappedError>;

T: Serialize + ?Sized,

let dec = serde_json::to_string(value).expect("expected to serialize");

encrypt(&dec)

T: DeserializeOwned,

// small back-compat for old unencrypted values

if let Ok(v) = serde_json::from_str::<T>(value) {

return Some(v);

}

let dec = decrypt(value)?;

serde_json::from_str::<T>(&dec).ok()

// keywring storage can be split into multiple entries due to entry length limits

// on Windows https://github.com/microsoft/vscode-cli/issues/358

entries: Vec<keyring::Entry>,

($self: expr, $i: expr) => {

match $self.entries.get($i) {

Some(e) => e,

None => {

let e = keyring::Entry::new("vscode-cli", &format!("vscode-cli-{}", $i));

$self.entries.push(e);

$self.entries.last().unwrap()

}

}

};

fn read(&mut self) -> Result<Option<StoredCredential>, WrappedError> {

let mut str = String::new();

for i in 0.. {

let entry = get_next_entry!(self, i);

let next_chunk = match entry.get_password() {

Ok(value) => value,

Err(keyring::Error::NoEntry) => return Ok(None), // missing entries?

Err(e) => return Err(wrap(e, "error reading keyring")),

};

if next_chunk.ends_with(CONTINUE_MARKER) {

str.push_str(&next_chunk[..next_chunk.len() - CONTINUE_MARKER.len()]);

} else {

str.push_str(&next_chunk);

break;

}

}

Ok(unseal(&str))

}

fn store(&mut self, value: StoredCredential) -> Result<(), WrappedError> {

let sealed = seal(&value);

let step_size = KEYCHAIN_ENTRY_LIMIT - CONTINUE_MARKER.len();

for i in (0..sealed.len()).step_by(step_size) {

let entry = get_next_entry!(self, i / step_size);

let cutoff = i + step_size;

let stored = if cutoff <= sealed.len() {

let mut part = sealed[i..cutoff].to_string();

part.push_str(CONTINUE_MARKER);

entry.set_password(&part)

} else {

entry.set_password(&sealed[i..])

};

if let Err(e) = stored {

return Err(wrap(e, "error updating keyring"));

}

}

Ok(())

}

fn clear(&mut self) -> Result<(), WrappedError> {

self.read().ok(); // make sure component parts are available

for entry in self.entries.iter() {

entry

.delete_password()

.map_err(|e| wrap(e, "error updating keyring"))?;

}

self.entries.clear();

Ok(())

}

fn read(&mut self) -> Result<Option<StoredCredential>, WrappedError> {

Ok(self.0.load().and_then(|s| unseal(&s)))

}

fn store(&mut self, value: StoredCredential) -> Result<(), WrappedError> {

self.0.save(Some(seal(&value)))

}

fn clear(&mut self) -> Result<(), WrappedError> {

self.0.save(None)

}

pub fn new(paths: &LauncherPaths, log: log::Logger) -> Auth {

Auth {

log,

client: reqwest::Client::new(),

file_storage_path: paths.root().join("token.json"),

storage: Arc::new(std::sync::Mutex::new(None)),

}

}

fn with_storage<T, F>(&self, op: F) -> T

where

F: FnOnce(&mut StorageWithLastRead) -> T,

{

let mut opt = self.storage.lock().unwrap();

if let Some(s) = opt.as_mut() {

return op(s);

}

let mut keyring_storage = KeyringStorage::default();

let mut file_storage = FileStorage(PersistedState::new(self.file_storage_path.clone()));

let keyring_storage_result = match std::env::var("VSCODE_CLI_USE_FILE_KEYCHAIN") {

Ok(_) => Err(wrap("", "user prefers file storage")),

_ => keyring_storage.read(),

};

let mut storage = match keyring_storage_result {

Ok(v) => StorageWithLastRead {

last_read: Cell::new(Ok(v)),

storage: Box::new(keyring_storage),

},

Err(_) => StorageWithLastRead {

last_read: Cell::new(file_storage.read()),

storage: Box::new(file_storage),

},

};

let out = op(&mut storage);

*opt = Some(storage);

out

}

/// Gets a tunnel Authentication for use in the tunnel management API.

pub async fn get_tunnel_authentication(&self) -> Result<Authorization, AnyError> {

let cred = self.get_credential().await?;

let auth = match cred.provider {

AuthProvider::Microsoft => Authorization::Bearer(cred.access_token),

AuthProvider::Github => Authorization::Github(format!(

"client_id={} {}",

cred.provider.client_id(),

cred.access_token

)),

};

Ok(auth)

}

/// Reads the current details from the keyring.

pub fn get_current_credential(&self) -> Result<Option<StoredCredential>, WrappedError> {

self.with_storage(|storage| {

let value = storage.last_read.replace(Ok(None));

storage.last_read.set(value.clone());

value

})

}

/// Clears login info from the keyring.

pub fn clear_credentials(&self) -> Result<(), WrappedError> {

self.with_storage(|storage| {

storage.storage.clear()?;

storage.last_read.set(Ok(None));

Ok(())

})

}

/// Runs the login flow, optionally pre-filling a provider and/or access token.

pub async fn login(

&self,

provider: Option<AuthProvider>,

access_token: Option<String>,

) -> Result<StoredCredential, AnyError> {

let provider = match provider {

Some(p) => p,

None => self.prompt_for_provider().await?,

};

let credentials = match access_token {

Some(t) => StoredCredential {

provider,

access_token: t,

refresh_token: None,

expires_at: None,

},

None => self.do_device_code_flow_with_provider(provider).await?,

};

self.store_credentials(credentials.clone());

Ok(credentials)

}

/// Gets the currently stored credentials, or asks the user to log in.

pub async fn get_credential(&self) -> Result<StoredCredential, AnyError> {

let entry = match self.get_current_credential() {

Ok(Some(old_creds)) => {

trace!(self.log, "Found token in keyring");

match self.get_refreshed_token(&old_creds).await {

Ok(Some(new_creds)) => {

self.store_credentials(new_creds.clone());

new_creds

}

Ok(None) => old_creds,

Err(e) => {

info!(self.log, "error refreshing token: {}", e);

let new_creds = self

.do_device_code_flow_with_provider(old_creds.provider)

.await?;

self.store_credentials(new_creds.clone());

new_creds

}

}

}

Ok(None) => {

trace!(self.log, "No token in keyring, getting a new one");

let creds = self.do_device_code_flow().await?;

self.store_credentials(creds.clone());

creds

}

Err(e) => {

warning!(

self.log,

"Error reading token from keyring, getting a new one: {}",

e

);

let creds = self.do_device_code_flow().await?;

self.store_credentials(creds.clone());

creds

}

};

Ok(entry)

}

/// Stores credentials, logging a warning if it fails.

fn store_credentials(&self, creds: StoredCredential) {

self.with_storage(|storage| {

if let Err(e) = storage.storage.store(creds.clone()) {

warning!(

self.log,

"Failed to update keyring with new credentials: {}",

e

);

}

storage.last_read.set(Ok(Some(creds)));

})

}

/// Refreshes the token in the credentials if necessary. Returns None if

/// the token is up to date, or Some new token otherwise.

async fn get_refreshed_token(

&self,

creds: &StoredCredential,

) -> Result<Option<StoredCredential>, AnyError> {

if !creds.is_expired(&self.client).await {

return Ok(None);

}

let refresh_token = match &creds.refresh_token {

Some(t) => t,

None => return Err(AnyError::from(RefreshTokenNotAvailableError())),

};

self.do_grant(

creds.provider,

format!(

"client_id={}&grant_type=refresh_token&refresh_token={}",

creds.provider.client_id(),

refresh_token

),

)

.await

.map(Some)

}

/// Does a "grant token" request.

async fn do_grant(

&self,

provider: AuthProvider,

body: String,

) -> Result<StoredCredential, AnyError> {

let response = self

.client

.post(provider.grant_uri())

.body(body)

.header("Accept", "application/json")

.send()

.await?;

if !response.status().is_success() {

return Err(StatusError::from_res(response).await?.into());

}

let body = response.json::<AuthenticationResponse>().await?;

Ok(StoredCredential::from_response(body, provider))

}

/// Implements the device code flow, returning the credentials upon success.

async fn do_device_code_flow(&self) -> Result<StoredCredential, AnyError> {

let provider = self.prompt_for_provider().await?;

self.do_device_code_flow_with_provider(provider).await

}

async fn prompt_for_provider(&self) -> Result<AuthProvider, AnyError> {

if std::env::var("VSCODE_CLI_ALLOW_MS_AUTH").is_err() {

return Ok(AuthProvider::Github);

}

let provider = prompt_options(

format!("How would you like to log in to {}?", PRODUCT_NAME_LONG),

&[AuthProvider::Microsoft, AuthProvider::Github],

)?;

Ok(provider)

}

async fn do_device_code_flow_with_provider(

&self,

provider: AuthProvider,

) -> Result<StoredCredential, AnyError> {

loop {

let init_code = self

.client

.post(provider.code_uri())

.header("Accept", "application/json")

.body(format!(

"client_id={}&scope={}",

provider.client_id(),

provider.get_default_scopes(),

))

.send()

.await?;

if !init_code.status().is_success() {

return Err(StatusError::from_res(init_code).await?.into());

}

let init_code_json = init_code.json::<DeviceCodeResponse>().await?;

let expires_at = Utc::now() + chrono::Duration::seconds(init_code_json.expires_in);

match &init_code_json.message {

Some(m) => self.log.result(m),

None => self.log.result(&format!(

"To grant access to the server, please log into {} and use code {}",

init_code_json.verification_uri, init_code_json.user_code

)),

};

let body = format!(

"client_id={}&grant_type=urn:ietf:params:oauth:grant-type:device_code&device_code={}",

provider.client_id(),

init_code_json.device_code

);

while Utc::now() < expires_at {

sleep(std::time::Duration::from_secs(5)).await;

match self.do_grant(provider, body.clone()).await {

Ok(creds) => return Ok(creds),

Err(e) => {

trace!(self.log, "refresh poll failed, retrying: {}", e);

}

}

}

}

}

async fn get_authorization(&self) -> Result<Authorization, HttpError> {

self.get_tunnel_authentication()

.await

.map_err(|e| HttpError::AuthorizationError(e.to_string()))

}