Subject: bug#79207: 30.1; [ELPA] oauth2: update plstore id calculation to include user name

From: Xiyue Deng <[email-masked]>
Date: Mon, 11 Aug 2025 00:19:57 -0700

Xiyue Deng <[email-masked]> writes:

> Xiyue Deng <[email-masked]> writes:
>
>> (Note that this is separate from bug#79168[1].)
>>
>> Another request update plstore id calculation.  I have been
>> experimenting with using client-id/client-secret from other registered
>> applications, e.g. thunderbird, evolution, and it is working, except
>> that I cannot make multiple accounts on Gmail to work, which turns out
>> that they all share the same plstore id because now that all values used
>> for calculating plstore are the same for a same service.  Adding user
>> helps creating a distinct plstore id for different accounts.
>>
>> I have also taken the opportunity to update NEWS and bump the version,
>> and would request a new release of 0.18.  I have also tested this end to
>> end with multiple accounts so hopefully there is less brown-paper-bag
>> bugs.
>>
>> However, as there are also important fixes from bug#79168 (3 patches
>> from [2][3][4]), I'll send the patches after those are reviewed and
>> applied.  As I'm using git-send-email this placeholder is needed anyway
>> :P
>>
>> Thanks in advance, and please stay tuned.
>>
>> [1] https://debbugs.gnu.org/79168
>> [2] https://debbugs.gnu.org/cgi/bugreport.cgi?att=1;msg=97;bug=79168;filename=0001-Use-locate-user-emacs-file-instead-of-concat-user-em.patch
>> [3] https://debbugs.gnu.org/cgi/bugreport.cgi?msg=100;att=1;bug=79168;filename=0001-Fix-missing-parameter.patch
>> [4] https://debbugs.gnu.org/cgi/bugreport.cgi?att=1;msg=103;bug=79168;filename=0001-Drop-accidentally-added-parameter.patch
>>
>
> Actually I should have attached the patch for implementing the new
> plstore id for review, and here it is.

Here is an updated patch for better logging.

> [...]

-- 
Regards,
Xiyue Deng

From 11ba948e38d99de3a6dcf31b6d7b5ed8b7be8fb9 Mon Sep 17 00:00:00 2001
From: Xiyue Deng <[email-masked]>
Date: Sat, 9 Aug 2025 17:29:08 -0700
Subject: [PATCH] Update plstore-id calculation including user-name

One way to use OAuth2 authentication is to use predefined
`client-id'/`client-secret' values that are already registered,
e.g. thunderbird, evolution.  Meanwhile, plstore-id calculation only
considers `auth-url', `token-url', `scope', and `client-id'.  When
trying to use predefined client-{id,secret} values, it unfortunately
results in the same value of plstore-id when registering multiple
accounts on the same service, preventing users to use multiple
accounts.

This patch adds `user-name' to be part of the values when calculating
plstore-id so that different accounts on the same service using
predefined values will be stored separately.

* plstore/oauth2/oauth2.el (oauth2-compute-id): Add user-name
parameter and include it when calculating plstore-id.
* plstore/oauth2/oauth2.el (oauth2-auth-and-store): Add user-name
parameter and update oauth2-compute-id invocation to include
user-name.
---
 oauth2.el | 35 +++++++++++++++++++++--------------
 1 file changed, 21 insertions(+), 14 deletions(-)

diff --git a/oauth2.el b/oauth2.el
index 0da4883bc3..35a3d14fca 100644
--- a/oauth2.el
+++ b/oauth2.el
@@ -257,14 +257,14 @@ TOKEN should be obtained with `oauth2-request-access'."
     auth-url client-id scope state redirect-uri)
    redirect-uri))
 
-(defun oauth2-compute-id (auth-url token-url scope client-id)
+(defun oauth2-compute-id (auth-url token-url scope client-id user-name)
   "Compute an unique id based on AUTH-URL, TOKEN-URL, SCOPE, and CLIENT-ID.
 This allows to store the token in an unique way."
-  (secure-hash 'sha512 (concat auth-url token-url scope client-id)))
+  (secure-hash 'sha512 (concat auth-url token-url scope client-id user-name)))
 
 ;;;###autoload
 (defun oauth2-auth-and-store (auth-url token-url scope client-id client-secret
-                                       &optional redirect-uri state)
+                                       &optional redirect-uri state user-name)
   "Request access to a resource and store it.
 AUTH-URL and TOKEN-URL are provided by the service provider.  CLIENT-ID
 and CLIENT-SECRET should be generated by the service provider when a
@@ -276,21 +276,28 @@ redirect response.
 Returns an `oauth2-token'."
   ;; We store a MD5 sum of all URL
   (oauth2--with-plstore
-   (let* ((plstore-id (oauth2-compute-id auth-url token-url scope client-id))
+   (let* ((plstore-id (oauth2-compute-id auth-url token-url scope client-id
+                                         user-name))
           (plist (cdr (plstore-get plstore plstore-id))))
+     (oauth2--do-trivia "user-name: %s\nplstore-id: %s"
+                        user-name plstore-id)
      ;; Check if we found something matching this access
      (if plist
          ;; We did, return the token object
-         (make-oauth2-token :plstore-id plstore-id
-                            :client-id client-id
-                            :client-secret client-secret
-                            :access-token (plist-get plist :access-token)
-                            :refresh-token (plist-get plist :refresh-token)
-                            :request-timestamp (plist-get plist
-                                                          :request-timestamp)
-                            :auth-url auth-url
-                            :token-url token-url
-                            :access-response (plist-get plist :access-response))
+         (progn
+           (oauth2--do-trivia "Found matching plstore-id from plstore.")
+           (make-oauth2-token :plstore-id plstore-id
+                              :client-id client-id
+                              :client-secret client-secret
+                              :access-token (plist-get plist :access-token)
+                              :refresh-token (plist-get plist :refresh-token)
+                              :request-timestamp (plist-get plist
+                                                            :request-timestamp)
+                              :auth-url auth-url
+                              :token-url token-url
+                              :access-response (plist-get plist
+                                                          :access-response)))
+       (oauth2--do-trivia "Requesting new oauth2-token.")
        (let ((token (oauth2-auth auth-url token-url
                                  client-id client-secret scope state
                                  redirect-uri)))
-- 
2.50.1