1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
|
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this file,
* You can obtain one at http://mozilla.org/MPL/2.0/. */
/**
* Details of supported OAuth2 Providers.
*/
var EXPORTED_SYMBOLS = ["OAuth2Providers"];
// When we add a Google mail account, ask for address book and calendar scopes
// as well. Then we can add an address book or calendar without asking again.
//
// Don't ask for all the scopes when adding an address book or calendar
// independently of the mail set-up process. If a mail account already exists,
// we already have a token, and if it doesn't the user is likely to be setting
// up an address book/calendar without wanting mail.
const GOOGLE_SCOPES =
"https://mail.google.com/ https://www.googleapis.com/auth/carddav https://www.googleapis.com/auth/calendar";
const FASTMAIL_SCOPES =
"https://www.fastmail.com/dev/protocol-imap https://www.fastmail.com/dev/protocol-pop https://www.fastmail.com/dev/protocol-smtp https://www.fastmail.com/dev/protocol-carddav https://www.fastmail.com/dev/protocol-caldav";
const COMCAST_SCOPES = "https://email.comcast.net/ profile openid";
/**
* Map of hostnames to [issuer, scope].
*/
var kHostnames = new Map([
["imap.googlemail.com", ["accounts.google.com", GOOGLE_SCOPES]],
["smtp.googlemail.com", ["accounts.google.com", GOOGLE_SCOPES]],
["pop.googlemail.com", ["accounts.google.com", GOOGLE_SCOPES]],
["imap.gmail.com", ["accounts.google.com", GOOGLE_SCOPES]],
["smtp.gmail.com", ["accounts.google.com", GOOGLE_SCOPES]],
["pop.gmail.com", ["accounts.google.com", GOOGLE_SCOPES]],
[
"www.googleapis.com",
["accounts.google.com", "https://www.googleapis.com/auth/carddav"],
],
["imap.mail.ru", ["o2.mail.ru", "mail.imap"]],
["smtp.mail.ru", ["o2.mail.ru", "mail.imap"]],
["imap.yandex.com", ["oauth.yandex.com", "mail:imap_full"]],
["smtp.yandex.com", ["oauth.yandex.com", "mail:smtp"]],
["imap.mail.yahoo.com", ["login.yahoo.com", "mail-w"]],
["pop.mail.yahoo.com", ["login.yahoo.com", "mail-w"]],
["smtp.mail.yahoo.com", ["login.yahoo.com", "mail-w"]],
["imap.aol.com", ["login.aol.com", "mail-w"]],
["pop.aol.com", ["login.aol.com", "mail-w"]],
["smtp.aol.com", ["login.aol.com", "mail-w"]],
[
"outlook.office365.com",
[
"login.microsoftonline.com",
"https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/POP.AccessAsUser.All https://outlook.office.com/SMTP.Send offline_access",
],
],
[
"smtp.office365.com",
[
"login.microsoftonline.com",
"https://outlook.office.com/IMAP.AccessAsUser.All https://outlook.office.com/POP.AccessAsUser.All https://outlook.office.com/SMTP.Send offline_access",
],
],
["imap.fastmail.com", ["www.fastmail.com", FASTMAIL_SCOPES]],
["pop.fastmail.com", ["www.fastmail.com", FASTMAIL_SCOPES]],
["smtp.fastmail.com", ["www.fastmail.com", FASTMAIL_SCOPES]],
[
"carddav.fastmail.com",
["www.fastmail.com", "https://www.fastmail.com/dev/protocol-carddav"],
],
["imap.comcast.net", ["comcast.net", COMCAST_SCOPES]],
["pop.comcast.net", ["comcast.net", COMCAST_SCOPES]],
["smtp.comcast.net", ["comcast.net", COMCAST_SCOPES]],
// For testing purposes.
["mochi.test", ["mochi.test", "test_scope"]],
]);
/**
* Map of issuers to clientId, clientSecret, authorizationEndpoint, tokenEndpoint,
* and usePKCE (RFC7636).
* Issuer is a unique string for the organization that a Thunderbird account
* was registered at.
*
* For the moment these details are hard-coded, since dynamic client
* registration is not yet supported. Don't copy these values for your
* own application - register one for yourself! This code (and possibly even the
* registration itself) will disappear when this is switched to dynamic
* client registration.
*/
var kIssuers = new Map([
[
"accounts.google.com",
{
clientId:
"406964657835-aq8lmia8j95dhl1a2bvharmfk3t1hgqj.apps.googleusercontent.com",
clientSecret: "kSmqreRr0qwBWJgbf5Y-PjSU",
authorizationEndpoint: "https://accounts.google.com/o/oauth2/auth",
tokenEndpoint: "https://www.googleapis.com/oauth2/v3/token",
},
],
[
"o2.mail.ru",
{
clientId: "thunderbird",
clientSecret: "I0dCAXrcaNFujaaY",
authorizationEndpoint: "https://o2.mail.ru/login",
tokenEndpoint: "https://o2.mail.ru/token",
},
],
[
"oauth.yandex.com",
{
clientId: "2a00bba7374047a6ab79666485ffce31",
clientSecret: "3ded85b4ec574c2187a55dc49d361280",
authorizationEndpoint: "https://oauth.yandex.com/authorize",
tokenEndpoint: "https://oauth.yandex.com/token",
},
],
[
"login.yahoo.com",
{
clientId:
"dj0yJmk9NUtCTWFMNVpTaVJmJmQ9WVdrOVJ6UjVTa2xJTXpRbWNHbzlNQS0tJnM9Y29uc3VtZXJzZWNyZXQmeD0yYw--",
clientSecret: "f2de6a30ae123cdbc258c15e0812799010d589cc",
authorizationEndpoint: "https://api.login.yahoo.com/oauth2/request_auth",
tokenEndpoint: "https://api.login.yahoo.com/oauth2/get_token",
},
],
[
"login.aol.com",
{
clientId:
"dj0yJmk9OXRHc1FqZHRQYzVvJmQ9WVdrOU1UQnJOR0pvTjJrbWNHbzlNQS0tJnM9Y29uc3VtZXJzZWNyZXQmeD02NQ--",
clientSecret: "79c1c11991d148ddd02a919000d69879942fc278",
authorizationEndpoint: "https://api.login.aol.com/oauth2/request_auth",
tokenEndpoint: "https://api.login.aol.com/oauth2/get_token",
},
],
[
"login.microsoftonline.com",
{
clientId: "9e5f94bc-e8a4-4e73-b8be-63364c29d753", // Application (client) ID
// https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-v2-protocols#endpoints
authorizationEndpoint:
"https://login.microsoftonline.com/common/oauth2/v2.0/authorize",
tokenEndpoint:
"https://login.microsoftonline.com/common/oauth2/v2.0/token",
redirectionEndpoint: "https://localhost",
},
],
[
"www.fastmail.com",
{
clientId: "35f141ae",
authorizationEndpoint: "https://api.fastmail.com/oauth/authorize",
tokenEndpoint: "https://api.fastmail.com/oauth/refresh",
usePKCE: true,
},
],
[
"comcast.net",
{
clientId: "thunderbird-oauth",
clientSecret: "fc5d0a314549bb3d059e0cec751fa4bd40a9cc7b",
authorizationEndpoint: "https://oauth.xfinity.com/oauth/authorize",
tokenEndpoint: "https://oauth.xfinity.com/oauth/token",
usePKCE: true,
},
],
// For testing purposes.
[
"mochi.test",
{
clientId: "test_client_id",
clientSecret: "test_secret",
authorizationEndpoint:
"http://mochi.test:8888/browser/comm/mail/components/addrbook/test/browser/data/redirect_auto.sjs",
tokenEndpoint:
"http://mochi.test:8888/browser/comm/mail/components/addrbook/test/browser/data/token.sjs",
// I don't know why, but tests refuse to work with a plain HTTP endpoint
// (the request is redirected to HTTPS, which we're not listening to).
// Just use an HTTPS endpoint.
redirectionEndpoint: "https://localhost",
},
],
]);
/**
* OAuth2Providers: Methods to lookup OAuth2 parameters for supported OAuth2
* providers.
*/
var OAuth2Providers = {
/**
* Map a hostname to the relevant issuer and scope.
*
* @param {string} hostname - The hostname of the server. For example
* "imap.googlemail.com".
*
* @returns {Array} An array containing [issuer, scope] for the hostname, or
* undefined if not found.
* - issuer is a string representing the organization
* - scope is an OAuth2 parameter describing the required access level
*/
getHostnameDetails(hostname) {
// During CardDAV SRV autodiscovery, rfc6764#section-6 says:
//
// * The client will need to make authenticated HTTP requests to
// the service. Typically, a "user identifier" is required for
// some form of user/password authentication. When a user
// identifier is required, clients MUST first use the "mailbox"
//
// However macOS Contacts does not do this and just uses the "localpart"
// instead. To work around this bug, during SRV autodiscovery Fastmail
// returns SRV records of the form '0 1 443 d[0-9]+.carddav.fastmail.com.'
// which encodes the internal domainid of the queried SRV domain in the
// sub-domain of the Target (rfc2782) of the SRV result. This can
// then be extracted from the Host header on each DAV request, the
// original domain looked up and attached to the "localpart" to create
// a full "mailbox", allowing autodiscovery to just work for usernames
// in any domain including self hosted domains.
//
// So for this hostname -> issuer/scope lookup to work, we need to
// look not just at the hostname, but also any sub-domains of this
// hostname.
while (hostname.includes(".")) {
let foundHost = kHostnames.get(hostname);
if (foundHost) {
return foundHost;
}
hostname = hostname.replace(/^[^.]*[.]/, "");
}
return undefined;
},
/**
* Map an issuer to OAuth2 account details.
*
* @param {string} issuer - The organization issuing OAuth2 parameters, e.g.
* "accounts.google.com".
*
* @returns {Array} An array containing [clientId, clientSecret, authorizationEndpoint, tokenEndpoint].
* clientId and clientSecret are strings representing the account registered
* for Thunderbird with the organization.
* authorizationEndpoint and tokenEndpoint are url strings representing
* endpoints to access OAuth2 authentication.
*/
getIssuerDetails(issuer) {
return kIssuers.get(issuer);
},
};
|
