Subject: Re: 30.1; [ELPA] oauth2: update plstore id calculation to include user name

From: Xiyue Deng <[email-masked]>
Date: Sun, 10 Aug 2025 02:22:41 -0700

Xiyue Deng <[email-masked]> writes:

> (Note that this is separate from bug#79168[1].)
>
> Another request update plstore id calculation.  I have been
> experimenting with using client-id/client-secret from other registered
> applications, e.g. thunderbird, evolution, and it is working, except
> that I cannot make multiple accounts on Gmail to work, which turns out
> that they all share the same plstore id because now that all values used
> for calculating plstore are the same for a same service.  Adding user
> helps creating a distinct plstore id for different accounts.
>
> I have also taken the opportunity to update NEWS and bump the version,
> and would request a new release of 0.18.  I have also tested this end to
> end with multiple accounts so hopefully there is less brown-paper-bag
> bugs.
>
> However, as there are also important fixes from bug#79168 (3 patches
> from [2][3][4]), I'll send the patches after those are reviewed and
> applied.  As I'm using git-send-email this placeholder is needed anyway
> :P
>
> Thanks in advance, and please stay tuned.
>
> [1] https://debbugs.gnu.org/79168
> [2] https://debbugs.gnu.org/cgi/bugreport.cgi?att=1;msg=97;bug=79168;filename=0001-Use-locate-user-emacs-file-instead-of-concat-user-em.patch
> [3] https://debbugs.gnu.org/cgi/bugreport.cgi?msg=100;att=1;bug=79168;filename=0001-Fix-missing-parameter.patch
> [4] https://debbugs.gnu.org/cgi/bugreport.cgi?att=1;msg=103;bug=79168;filename=0001-Drop-accidentally-added-parameter.patch
>

Actually I should have attached the patch for implementing the new
plstore id for review, and here it is.

-- 
Regards,
Xiyue Deng

From ee943eca195304f24b6f22ddfea0cf1c66a7de22 Mon Sep 17 00:00:00 2001
From: Xiyue Deng <[email-masked]>
Date: Sat, 9 Aug 2025 17:29:08 -0700
Subject: [PATCH 1/3] Update plstore-id calculation including user-name

One way to use OAuth2 authentication is to use predefined
`client-id'/`client-secret' values that are already registered,
e.g. thunderbird, evolution.  Meanwhile, plstore-id calculation only
considers `auth-url', `token-url', `scope', and `client-id'.  When
trying to use predefined client-{id,secret} values, it unfortunately
results in the same value of plstore-id when registering multiple
accounts on the same service, preventing users to use multiple
accounts.

This patch adds `user-name' to be part of the values when calculating
plstore-id so that different accounts on the same service using
predefined values will be stored separately.

* plstore/oauth2/oauth2.el (oauth2-compute-id): Add user-name
parameter and include it when calculating plstore-id.
* plstore/oauth2/oauth2.el (oauth2-auth-and-store): Add user-name
parameter and update oauth2-compute-id invocation to include
user-name.
---
 oauth2.el | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/oauth2.el b/oauth2.el
index 0da4883bc3..e4a9fc8db6 100644
--- a/oauth2.el
+++ b/oauth2.el
@@ -257,14 +257,14 @@ TOKEN should be obtained with `oauth2-request-access'."
     auth-url client-id scope state redirect-uri)
    redirect-uri))
 
-(defun oauth2-compute-id (auth-url token-url scope client-id)
+(defun oauth2-compute-id (auth-url token-url scope client-id user-name)
   "Compute an unique id based on AUTH-URL, TOKEN-URL, SCOPE, and CLIENT-ID.
 This allows to store the token in an unique way."
-  (secure-hash 'sha512 (concat auth-url token-url scope client-id)))
+  (secure-hash 'sha512 (concat auth-url token-url scope client-id user-name)))
 
 ;;;###autoload
 (defun oauth2-auth-and-store (auth-url token-url scope client-id client-secret
-                                       &optional redirect-uri state)
+                                       &optional redirect-uri state user-name)
   "Request access to a resource and store it.
 AUTH-URL and TOKEN-URL are provided by the service provider.  CLIENT-ID
 and CLIENT-SECRET should be generated by the service provider when a
@@ -276,7 +276,8 @@ redirect response.
 Returns an `oauth2-token'."
   ;; We store a MD5 sum of all URL
   (oauth2--with-plstore
-   (let* ((plstore-id (oauth2-compute-id auth-url token-url scope client-id))
+   (let* ((plstore-id (oauth2-compute-id auth-url token-url scope client-id
+                                         user-name))
           (plist (cdr (plstore-get plstore plstore-id))))
      ;; Check if we found something matching this access
      (if plist
-- 
2.50.1