/* -*- mode: C; c-file-style: "gnu"; indent-tabs-mode: nil; -*- */

/*

 * Copyright © 2011 – 2017 Red Hat, Inc.

 *

 * This library is free software; you can redistribute it and/or

 * modify it under the terms of the GNU Lesser General Public

 * License as published by the Free Software Foundation; either

 * version 2 of the License, or (at your option) any later version.

 *

 * This library is distributed in the hope that it will be useful,

 * but WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General

 * Public License along with this library; if not, see <http://www.gnu.org/licenses/>.

 */

#include "config.h"

#include <glib/gi18n-lib.h>

#include <stdlib.h>

#include <rest/oauth2-proxy.h>

#include <libsoup/soup.h>

#include <json-glib/json-glib.h>

#include <webkit2/webkit2.h>

#include "goaprovider.h"

#include "goautils.h"

#include "goawebview.h"

#include "goaoauth2provider.h"

#include "goaoauth2provider-priv.h"

#include "goaoauth2provider-web-extension.h"

#include "goaoauth2provider-web-view.h"

#include "goarestproxy.h"

/**

 * SECTION:goaoauth2provider

 * @title: GoaOAuth2Provider

 * @short_description: Abstract base class for OAuth 2.0 providers

 *

 * #GoaOAuth2Provider is an abstract base class for 

 * url="http://tools.ietf.org/html/draft-ietf-oauth-v2-15">OAuth

 * 2.0</ulink> based providers.

 *

 * Subclasses must implement

 * #GoaOAuth2ProviderClass.get_authorization_uri,

 * #GoaOAuth2ProviderClass.get_token_uri,

 * #GoaOAuth2ProviderClass.get_redirect_uri,

 * #GoaOAuth2ProviderClass.get_scope,

 * #GoaOAuth2ProviderClass.get_client_id,

 * #GoaOAuth2ProviderClass.get_client_secret and

 * #GoaOAuth2ProviderClass.get_identity_sync methods.

 *

 * Additionally, the

 * #GoaProviderClass.get_provider_type,

 * #GoaProviderClass.get_provider_name,

 * #GoaProviderClass.build_object (this should chain up to its

 * parent class) methods must be implemented.

 *

 * Note that the #GoaProviderClass.add_account,

 * #GoaProviderClass.refresh_account and

 * #GoaProviderClass.ensure_credentials_sync methods do not

 * need to be implemented - this type implements these methods..

 */

struct _GoaOAuth2ProviderPrivate

{

  GtkDialog *dialog;

  GError *error;

  GMainLoop *loop;

  const gchar *existing_identity;

  gchar *account_object_path;

  gchar *authorization_code;

  gchar *access_token;

  gint   access_token_expires_in;

  gchar *refresh_token;

  gchar *identity;

  gchar *presentation_identity;

  gchar *password;

};

G_LOCK_DEFINE_STATIC (provider_lock);

G_DEFINE_ABSTRACT_TYPE_WITH_PRIVATE (GoaOAuth2Provider, goa_oauth2_provider, GOA_TYPE_PROVIDER);

static gboolean

is_authorization_error (GError *error)

{

  gboolean ret;

  g_return_val_if_fail (error != NULL, FALSE);

  ret = FALSE;

  if (error->domain == REST_PROXY_ERROR || error->domain == SOUP_HTTP_ERROR)

    {

      if (SOUP_STATUS_IS_CLIENT_ERROR (error->code))

        ret = TRUE;

    }

  return ret;

}

/* ---------------------------------------------------------------------------------------------------- */

static gboolean

goa_oauth2_provider_get_use_mobile_browser_default (GoaOAuth2Provider  *self)

{

  return FALSE;

}

/**

 * goa_oauth2_provider_get_use_mobile_browser:

 * @self: A #GoaOAuth2Provider.

 *

 * Returns whether there is a need for the embedded browser to identify

 * itself as running on a mobile phone in order to get a more compact

 * version of the approval page.

 *

 * This is a virtual method where the default implementation returns

 * %FALSE.

 *

 * Returns: %TRUE if the embedded browser should identify itself as

 * running on a mobile platform, %FALSE otherwise.

 */

gboolean

goa_oauth2_provider_get_use_mobile_browser (GoaOAuth2Provider *self)

{

  g_return_val_if_fail (GOA_IS_OAUTH2_PROVIDER (self), FALSE);

  return GOA_OAUTH2_PROVIDER_GET_CLASS (self)->get_use_mobile_browser (self);

}

/* ---------------------------------------------------------------------------------------------------- */

static gboolean

goa_oauth2_provider_is_deny_node_default (GoaOAuth2Provider *self, WebKitDOMNode *node)

{

  return FALSE;

}

/**

 * goa_oauth2_provider_is_deny_node:

 * @self: A #GoaOAuth2Provider.

 * @node: A WebKitDOMNode.

 *

 * Checks whether @node is the HTML UI element that the user can use

 * to deny permission to access his account. Usually they are either a

 * WebKitDOMHTMLButtonElement or a WebKitDOMHTMLInputElement.

 *

 * Please note that providers may have multiple such elements in their

 * UI and this method should catch all of them.

 *

 * This is a virtual method where the default implementation returns

 * %FALSE.

 *

 * Returns: %TRUE if the @node can be used to deny permission.

 */

gboolean

goa_oauth2_provider_is_deny_node (GoaOAuth2Provider *self, WebKitDOMNode *node)

{

  g_return_val_if_fail (GOA_IS_OAUTH2_PROVIDER (self), FALSE);

  return GOA_OAUTH2_PROVIDER_GET_CLASS (self)->is_deny_node (self, node);

}

/* ---------------------------------------------------------------------------------------------------- */

static gboolean

goa_oauth2_provider_is_password_node_default (GoaOAuth2Provider *self, WebKitDOMHTMLInputElement *element)

{

  return FALSE;

}

/**

 * goa_oauth2_provider_is_password_node:

 * @self: A #GoaOAuth2Provider.

 * @element: A WebKitDOMHTMLInputElement

 *

 * Checks whether @element is the HTML UI element that the user can

 * use to enter her password. This can be used to offer a

 * #GoaPasswordBased interface by saving the user's

 * password. Providers usually frown upon doing this, so this is not

 * recommended.

 *

 * This is a virtual method where the default implementation returns

 * %FALSE.

 *

 * Returns: %TRUE if @element can be used to enter the password.

 */

gboolean

goa_oauth2_provider_is_password_node (GoaOAuth2Provider *self, WebKitDOMHTMLInputElement *element)

{

  g_return_val_if_fail (GOA_IS_OAUTH2_PROVIDER (self), FALSE);

  g_return_val_if_fail (WEBKIT_DOM_IS_HTML_INPUT_ELEMENT (element), FALSE);

  return GOA_OAUTH2_PROVIDER_GET_CLASS (self)->is_password_node (self, element);

}

/* ---------------------------------------------------------------------------------------------------- */

static void

goa_oauth2_provider_add_account_key_values_default (GoaOAuth2Provider *self,

                                                    GVariantBuilder   *builder)

{

  /* do nothing */

}

/**

 * goa_oauth2_provider_add_account_key_values:

 * @self: A #GoaProvider.

 * @builder: A #GVariantBuilder for a <literal>a{ss}</literal> variant.

 *

 * Hook for implementations to add key/value pairs to the key-file

 * when creating an account.

 *

 * This is a virtual method where the default implementation does nothing.

 */

void

goa_oauth2_provider_add_account_key_values (GoaOAuth2Provider  *self,

                                            GVariantBuilder    *builder)

{

  g_return_if_fail (GOA_IS_OAUTH2_PROVIDER (self));

  return GOA_OAUTH2_PROVIDER_GET_CLASS (self)->add_account_key_values (self, builder);

}

/* ---------------------------------------------------------------------------------------------------- */

static gchar *

goa_oauth2_provider_build_authorization_uri_default (GoaOAuth2Provider  *self,

                                                     const gchar        *authorization_uri,

                                                     const gchar        *escaped_redirect_uri,

                                                     const gchar        *escaped_client_id,

                                                     const gchar        *escaped_scope)

{

  return g_strdup_printf ("%s"

                          "?response_type=code"

                          "&redirect_uri=%s"

                          "&client_id=%s"

                          "&scope=%s",

                          authorization_uri,

                          escaped_redirect_uri,

                          escaped_client_id,

                          escaped_scope);

}

/**

 * goa_oauth2_provider_build_authorization_uri:

 * @self: A #GoaOAuth2Provider.

 * @authorization_uri: An authorization URI.

 * @escaped_redirect_uri: An escaped redirect URI

 * @escaped_client_id: An escaped client id

 * @escaped_scope: (allow-none): The escaped scope or %NULL

 *

 * Builds the URI that can be opened in a web browser (or embedded web

 * browser widget) to start authenticating an user.

 *

 * The default implementation just returns the expected URI

 * (e.g. <literal>http://example.com/dialog/oauth2?response_type=code&redirect_uri=https%3A%2F%2Fclient%2Eexample%2Ecom%2Fcb&client_id=foo&scope=email%20stuff</literal>)

 * - override (and chain up) if you e.g. need to to pass additional

 * parameters.

 *

 * The @authorization_uri, @escaped_redirect_uri, @escaped_client_id

 * and @escaped_scope parameters originate from the result of the

 * the goa_oauth2_provider_get_authorization_uri(), goa_oauth2_provider_get_redirect_uri(), goa_oauth2_provider_get_client_id()

 * and goa_oauth2_provider_get_scope() methods with the latter

 * three escaped using g_uri_escape_string().

 *

 * Returns: (transfer full): An authorization URI that must be freed with g_free().

 */

gchar *

goa_oauth2_provider_build_authorization_uri (GoaOAuth2Provider  *self,

                                             const gchar        *authorization_uri,

                                             const gchar        *escaped_redirect_uri,

                                             const gchar        *escaped_client_id,

                                             const gchar        *escaped_scope)

{

  g_return_val_if_fail (GOA_IS_OAUTH2_PROVIDER (self), NULL);

  g_return_val_if_fail (authorization_uri != NULL, NULL);

  g_return_val_if_fail (escaped_redirect_uri != NULL, NULL);

  g_return_val_if_fail (escaped_client_id != NULL, NULL);

  return GOA_OAUTH2_PROVIDER_GET_CLASS (self)->build_authorization_uri (self,

                                                                        authorization_uri,

                                                                        escaped_redirect_uri,

                                                                        escaped_client_id,

                                                                        escaped_scope);

}

/* ---------------------------------------------------------------------------------------------------- */

static gboolean

goa_oauth2_provider_decide_navigation_policy_default (GoaOAuth2Provider               *self,

                                                      WebKitWebView                   *web_view,

                                                      WebKitNavigationPolicyDecision  *decision)

{

  return FALSE;

}

/*

 * goa_oauth2_provider_decide_navigation_policy_default:

 * @self: A #GoaOAuth2Provider.

 * @decision: A #WebKitNavigationPolicyDecision

 *

 * Certain OAuth2-like, but not exactly 

 * url="http://tools.ietf.org/html/draft-ietf-oauth-v2-15">OAuth2</ulink>,

 * providers may not send us to the redirect URI, as expected. They

 * might need some special handling for that. This is a provider

 * specific hook to accommodate them.

 *

 * This is a virtual method where the default implementation returns

 * %FALSE.

 *

 * Returns: %TRUE if @provider decided what to do with @decision,

 * %FALSE otherwise.

 */

gboolean

goa_oauth2_provider_decide_navigation_policy (GoaOAuth2Provider               *self,

                                              WebKitWebView                   *web_view,

                                              WebKitNavigationPolicyDecision  *decision)

{

  g_return_val_if_fail (GOA_IS_OAUTH2_PROVIDER (self), FALSE);

  g_return_val_if_fail (WEBKIT_IS_WEB_VIEW (web_view), FALSE);

  g_return_val_if_fail (WEBKIT_IS_NAVIGATION_POLICY_DECISION (decision), FALSE);

  return GOA_OAUTH2_PROVIDER_GET_CLASS (self)->decide_navigation_policy (self, web_view, decision);

}

/* ---------------------------------------------------------------------------------------------------- */

/**

 * goa_oauth2_provider_process_redirect_url:

 * @self: A #GoaOAuth2Provider.

 * @redirect_url: A redirect URI from the web browser

 * @authorization_code: (out): Return location for access token

 * @error: Return location for error or %NULL

 *

 * Certain OAuth2-like, but not exactly 

 * url="http://tools.ietf.org/html/draft-ietf-oauth-v2-15">OAuth2</ulink>,

 * providers do not follow the standard mechanisms for extracting the

 * access token or auth code from the redirect URI. They use some

 * non-standard technique to do so. This is a provider specific hook

 * to accommodate them and will only be used if implemented.

 *

 * This is a pure virtual method - a subclass must provide an

 * implementation if needed.

 *

 * Returns: %TRUE if @provider could process @redirect_url, %FALSE

 * otherwise.

 */

gboolean

goa_oauth2_provider_process_redirect_url (GoaOAuth2Provider  *self,

                                          const gchar        *redirect_url,

                                          gchar             **authorization_code,

                                          GError            **error)

{

  g_return_val_if_fail (GOA_IS_OAUTH2_PROVIDER (self), FALSE);

  g_return_val_if_fail (redirect_url != NULL, FALSE);

  g_return_val_if_fail (authorization_code != NULL, FALSE);

  g_return_val_if_fail (error == NULL || *error == NULL, FALSE);

  return GOA_OAUTH2_PROVIDER_GET_CLASS (self)->process_redirect_url (self, redirect_url, authorization_code, error);

}

/**

 * goa_oauth2_provider_get_authorization_uri:

 * @self: A #GoaOAuth2Provider.

 *

 * Gets the 

 * url="http://tools.ietf.org/html/draft-ietf-oauth-v2-15#section-2.1">authorization

 * endpoint</ulink> used for authenticating the user and obtaining

 * authorization.

 *

 * You should not include any parameters in the returned URI. If you

 * need to include additional parameters than the standard ones,

 * override #GoaOAuth2ProviderClass.build_authorization_uri -

 * see goa_oauth2_provider_build_authorization_uri() for more

 * details.

 *

 * This is a pure virtual method - a subclass must provide an

 * implementation.

 *

 * Returns: (transfer none): A string owned by @self - do not free.

 */

const gchar *

goa_oauth2_provider_get_authorization_uri (GoaOAuth2Provider *self)

{

  g_return_val_if_fail (GOA_IS_OAUTH2_PROVIDER (self), NULL);

  return GOA_OAUTH2_PROVIDER_GET_CLASS (self)->get_authorization_uri (self);

}

/* ---------------------------------------------------------------------------------------------------- */

static const gchar *

goa_oauth2_provider_get_token_uri_default (GoaOAuth2Provider  *self)

{

  return NULL;

}

/**

 * goa_oauth2_provider_get_token_uri:

 * @self: A #GoaOAuth2Provider.

 *

 * Gets the 

 * url="http://tools.ietf.org/html/draft-ietf-oauth-v2-15#section-2.2">token

 * endpoint</ulink> used for obtaining an access token.

 *

 * A token URI is only needed when the OAuth2 provider does not support

 * a separate client-side flow. In such cases, override

 * #GoaOAuth2ProviderClass.get_token_uri. You should not include any

 * parameters in the returned URI.

 *

 * This is a virtual method where the default implementation returns

 * %NULL.

 *

 * Returns: (transfer none): A string owned by @self - do not free.

 */

const gchar *

goa_oauth2_provider_get_token_uri (GoaOAuth2Provider *self)

{

  g_return_val_if_fail (GOA_IS_OAUTH2_PROVIDER (self), NULL);

  return GOA_OAUTH2_PROVIDER_GET_CLASS (self)->get_token_uri (self);

}

/* ---------------------------------------------------------------------------------------------------- */

/**

 * goa_oauth2_provider_get_redirect_uri:

 * @self: A #GoaOAuth2Provider.

 *

 * Gets the 

 * url="http://tools.ietf.org/html/draft-ietf-oauth-v2-15#section-2.1.1">redirect_uri</ulink>

 * used when requesting authorization.

 *

 * This is a pure virtual method - a subclass must provide an

 * implementation.

 *

 * Returns: (transfer none): A string owned by @self - do not free.

 */

const gchar *

goa_oauth2_provider_get_redirect_uri (GoaOAuth2Provider *self)

{

  g_return_val_if_fail (GOA_IS_OAUTH2_PROVIDER (self), NULL);

  return GOA_OAUTH2_PROVIDER_GET_CLASS (self)->get_redirect_uri (self);

}

/* ---------------------------------------------------------------------------------------------------- */

static const gchar *

goa_oauth2_provider_get_scope_default (GoaOAuth2Provider *self)

{

  return NULL;

}

/**

 * goa_oauth2_provider_get_scope:

 * @self: A #GoaOAuth2Provider.

 *

 * Gets the 

 * url="http://tools.ietf.org/html/draft-ietf-oauth-v2-15#section-2.1.1">scope</ulink>

 * used when requesting authorization.

 *

 * This is a virtual method where the default implementation returns

 * %NULL.

 *

 * Returns: (transfer none): A string owned by @self - do not free.

 */

const gchar *

goa_oauth2_provider_get_scope (GoaOAuth2Provider *self)

{

  g_return_val_if_fail (GOA_IS_OAUTH2_PROVIDER (self), NULL);

  return GOA_OAUTH2_PROVIDER_GET_CLASS (self)->get_scope (self);

}

/* ---------------------------------------------------------------------------------------------------- */

/**

 * goa_oauth2_provider_get_client_id:

 * @self: A #GoaOAuth2Provider.

 *

 * Gets the 

 * url="http://tools.ietf.org/html/draft-ietf-oauth-v2-15#section-3">client_id</ulink>

 * identifying the client.

 *

 * This is a pure virtual method - a subclass must provide an

 * implementation.

 *

 * Returns: (transfer none): A string owned by @self - do not free.

 */

const gchar *

goa_oauth2_provider_get_client_id (GoaOAuth2Provider *self)

{

  g_return_val_if_fail (GOA_IS_OAUTH2_PROVIDER (self), NULL);

  return GOA_OAUTH2_PROVIDER_GET_CLASS (self)->get_client_id (self);

}

/**

 * goa_oauth2_provider_get_client_secret:

 * @self: A #GoaOAuth2Provider.

 *

 * Gets the 

 * url="http://tools.ietf.org/html/draft-ietf-oauth-v2-15#section-3">client_secret</ulink>

 * associated with the client.

 *

 * This is a pure virtual method - a subclass must provide an

 * implementation.

 *

 * Returns: (transfer none): A string owned by @self - do not free.

 */

const gchar *

goa_oauth2_provider_get_client_secret (GoaOAuth2Provider *self)

{

  g_return_val_if_fail (GOA_IS_OAUTH2_PROVIDER (self), NULL);

  return GOA_OAUTH2_PROVIDER_GET_CLASS (self)->get_client_secret (self);

}

/**

 * goa_oauth2_provider_get_identity_sync:

 * @self: A #GoaOAuth2Provider.

 * @access_token: A valid OAuth 2.0 access token.

 * @out_presentation_identity: (out): Return location for presentation identity or %NULL.

 * @cancellable: (allow-none): A #GCancellable or %NULL.

 * @error: Return location for @error or %NULL.

 *

 * Method that returns the identity corresponding to

 * @access_token.

 *

 * The identity is needed because all authentication happens out of

 * band. In addition to the identity, an implementation also returns a

 * <emphasis>presentation identity</emphasis> that is more suitable

 * for presentation (the identity could be a GUID for example).

 *

 * The calling thread is blocked while the identity is obtained.

 *

 * Returns: The identity or %NULL if error is set. The returned string

 * must be freed with g_free().

 */

gchar *

goa_oauth2_provider_get_identity_sync (GoaOAuth2Provider    *self,

                                       const gchar          *access_token,

                                       gchar               **out_presentation_identity,

                                       GCancellable         *cancellable,

                                       GError              **error)

{

  g_return_val_if_fail (GOA_IS_OAUTH2_PROVIDER (self), NULL);

  g_return_val_if_fail (access_token != NULL, NULL);

  g_return_val_if_fail (cancellable == NULL || G_IS_CANCELLABLE (cancellable), NULL);

  g_return_val_if_fail (error == NULL || *error == NULL, NULL);

  return GOA_OAUTH2_PROVIDER_GET_CLASS (self)->get_identity_sync (self,

                                                                  access_token,

                                                                  out_presentation_identity,

                                                                  cancellable,

                                                                  error);

}

/**

 * goa_oauth2_provider_is_identity_node:

 * @self: A #GoaOAuth2Provider.

 * @element: A WebKitDOMHTMLInputElement.

 *

 * Checks whether @element is the HTML UI element that the user can

 * use to identify herself at the provider.

 *

 * This is a pure virtual method - a subclass must provide an

 * implementation.

 *

 * Returns: %TRUE if the @element can be used to deny permission.

 */

gboolean

goa_oauth2_provider_is_identity_node (GoaOAuth2Provider *self, WebKitDOMHTMLInputElement *element)

{

  g_return_val_if_fail (GOA_IS_OAUTH2_PROVIDER (self), FALSE);

  return GOA_OAUTH2_PROVIDER_GET_CLASS (self)->is_identity_node (self, element);

}

/* ---------------------------------------------------------------------------------------------------- */

static gchar *

get_tokens_sync (GoaOAuth2Provider  *self,

                 const gchar        *authorization_code,

                 const gchar        *refresh_token,

                 gchar             **out_refresh_token,

                 gint               *out_access_token_expires_in,

                 GCancellable       *cancellable,

                 GError            **error)

{

  GError *tokens_error = NULL;

  RestProxy *proxy;

  RestProxyCall *call;

  gchar *ret = NULL;

  guint status_code;

  gchar *ret_access_token = NULL;

  gint ret_access_token_expires_in = 0;

  gchar *ret_refresh_token = NULL;

  const gchar *payload;

  gsize payload_length;

  const gchar *client_secret;

  proxy = goa_rest_proxy_new (goa_oauth2_provider_get_token_uri (self), FALSE);

  call = rest_proxy_new_call (proxy);

  rest_proxy_call_set_method (call, "POST");

  rest_proxy_call_add_header (call, "Content-Type", "application/x-www-form-urlencoded");

  rest_proxy_call_add_param (call, "client_id", goa_oauth2_provider_get_client_id (self));

  client_secret = goa_oauth2_provider_get_client_secret (self);

  if (client_secret != NULL)

    rest_proxy_call_add_param (call, "client_secret", client_secret);

  if (refresh_token != NULL)

    {

      /* Swell, we have a refresh code - just use that */

      rest_proxy_call_add_param (call, "grant_type", "refresh_token");

      rest_proxy_call_add_param (call, "refresh_token", refresh_token);

    }

  else

    {

      /* No refresh code.. request an access token using the authorization code instead */

      rest_proxy_call_add_param (call, "grant_type", "authorization_code");

      rest_proxy_call_add_param (call, "redirect_uri", goa_oauth2_provider_get_redirect_uri (self));

      rest_proxy_call_add_param (call, "code", authorization_code);

    }

  /* TODO: cancellable support? */

  if (!rest_proxy_call_sync (call, error))

    goto out;

  status_code = rest_proxy_call_get_status_code (call);

  if (status_code != 200)

    {

      g_set_error (error,

                   GOA_ERROR,

                   GOA_ERROR_FAILED,

                   _("Expected status 200 when requesting access token, instead got status %d (%s)"),

                   status_code,

                   rest_proxy_call_get_status_message (call));

      goto out;

    }

  payload = rest_proxy_call_get_payload (call);

  payload_length = rest_proxy_call_get_payload_length (call);

  /* some older OAuth2 implementations does not return json - handle that too */

  if (g_str_has_prefix (payload, "access_token="))

    {

      GHashTable *hash;

      const gchar *expires_in_str;

      g_debug ("Response is not JSON - possibly old OAuth2 implementation");

      hash = soup_form_decode (payload);

      ret_access_token = g_strdup (g_hash_table_lookup (hash, "access_token"));

      if (ret_access_token == NULL)

        {

          g_warning ("Did not find access_token in non-JSON data");

          g_set_error (error,

                       GOA_ERROR,

                       GOA_ERROR_FAILED,

                       _("Could not parse response"));

          g_hash_table_unref (hash);

          goto out;

        }

      /* refresh_token is optional */

      ret_refresh_token = g_hash_table_lookup (hash, "refresh_token");

      /* expires_in is optional */

      expires_in_str = g_hash_table_lookup (hash, "expires_in");

      /* sometimes "expires_in" appears as "expires" */

      if (expires_in_str == NULL)

        expires_in_str = g_hash_table_lookup (hash, "expires");

      if (expires_in_str != NULL)

        ret_access_token_expires_in = atoi (expires_in_str);

      g_hash_table_unref (hash);

    }

  else

    {

      JsonParser *parser;

      JsonObject *object;

      parser = json_parser_new ();

      if (!json_parser_load_from_data (parser, payload, payload_length, &tokens_error))

        {

          g_warning ("json_parser_load_from_data() failed: %s (%s, %d)",

                     tokens_error->message,

                     g_quark_to_string (tokens_error->domain),

                     tokens_error->code);

          g_set_error (error,

                       GOA_ERROR,

                       GOA_ERROR_FAILED,

                       _("Could not parse response"));

          g_object_unref (parser);

          goto out;

        }

      object = json_node_get_object (json_parser_get_root (parser));

      if (!json_object_has_member (object, "access_token"))

        {

          g_warning ("Did not find access_token in JSON data");

          g_set_error (error,

                       GOA_ERROR,

                       GOA_ERROR_FAILED,

                       _("Could not parse response"));

          g_object_unref (parser);

          goto out;

        }

      ret_access_token = g_strdup (json_object_get_string_member (object, "access_token"));

      /* refresh_token is optional... */

      if (json_object_has_member (object, "refresh_token"))

        ret_refresh_token = g_strdup (json_object_get_string_member (object, "refresh_token"));

      if (json_object_has_member (object, "expires_in"))

        ret_access_token_expires_in = json_object_get_int_member (object, "expires_in");

      g_object_unref (parser);

    }

  ret = ret_access_token;

  ret_access_token = NULL;

  if (out_access_token_expires_in != NULL)

    *out_access_token_expires_in = ret_access_token_expires_in;

  if (out_refresh_token != NULL)

    {

      *out_refresh_token = ret_refresh_token;

      ret_refresh_token = NULL;

    }

 out:

  g_clear_error (&tokens_error);

  g_free (ret_access_token);

  g_free (ret_refresh_token);

  g_clear_object (&call);

  g_clear_object (&proxy);

  return ret;

}

/* ---------------------------------------------------------------------------------------------------- */

static void

on_web_view_deny_click (GoaWebView *web_view, gpointer user_data)

{

  GoaOAuth2Provider *self = GOA_OAUTH2_PROVIDER (user_data);

  GoaOAuth2ProviderPrivate *priv;

  priv = goa_oauth2_provider_get_instance_private (self);

  gtk_dialog_response (priv->dialog, GTK_RESPONSE_CANCEL);

}

static void

on_web_view_password_submit (GoaWebView *web_view, const gchar *password, gpointer user_data)

{

  GoaOAuth2Provider *self = GOA_OAUTH2_PROVIDER (user_data);

  GoaOAuth2ProviderPrivate *priv;

  priv = goa_oauth2_provider_get_instance_private (self);

  g_free (priv->password);

  priv->password = g_strdup (password);

}

static gboolean

on_web_view_decide_policy (WebKitWebView            *web_view,

                           WebKitPolicyDecision     *decision,

                           WebKitPolicyDecisionType  decision_type,

                           gpointer                  user_data)

{

  GoaOAuth2Provider *self = GOA_OAUTH2_PROVIDER (user_data);

  GoaOAuth2ProviderPrivate *priv;

  GHashTable *key_value_pairs;

  WebKitNavigationAction *action;

  WebKitURIRequest *request;

  SoupURI *uri;

  const gchar *fragment;

  const gchar *oauth2_error;

  const gchar *query;

  const gchar *redirect_uri;

  const gchar *requested_uri;

  gint response_id = GTK_RESPONSE_NONE;

  priv = goa_oauth2_provider_get_instance_private (self);

  if (decision_type != WEBKIT_POLICY_DECISION_TYPE_NAVIGATION_ACTION)

    goto default_behaviour;

  if (goa_oauth2_provider_decide_navigation_policy (self,

                                                    web_view,

                                                    WEBKIT_NAVIGATION_POLICY_DECISION (decision)))

    {

      response_id = 0;

      goto ignore_request;

    }

  /* TODO: use oauth2_proxy_extract_access_token() */

  action = webkit_navigation_policy_decision_get_navigation_action (WEBKIT_NAVIGATION_POLICY_DECISION (decision));

  request = webkit_navigation_action_get_request (action);

  requested_uri = webkit_uri_request_get_uri (request);

  redirect_uri = goa_oauth2_provider_get_redirect_uri (self);

  if (!g_str_has_prefix (requested_uri, redirect_uri))

    goto default_behaviour;

  uri = soup_uri_new (requested_uri);

  fragment = soup_uri_get_fragment (uri);

  query = soup_uri_get_query (uri);

  /* Three cases:

   * 1) we can either have the backend handle the URI for us, or

   * 2) we can either have the access_token and other information

   *    directly in the fragment part of the URI, or

   * 3) the auth code can be in the query part of the URI, with which

   *    we'll obtain the token later.

   */

  if (GOA_OAUTH2_PROVIDER_GET_CLASS (self)->process_redirect_url)

    {

      gchar *url;

      url = soup_uri_to_string (uri, FALSE);

      if (!goa_oauth2_provider_process_redirect_url (self, url, &priv->access_token, &priv->error))

        {

          g_prefix_error (&priv->error, _("Authorization response: "));

          priv->error->domain = GOA_ERROR;

          priv->error->code = GOA_ERROR_NOT_AUTHORIZED;

          response_id = GTK_RESPONSE_CLOSE;

        }

      else

        response_id = GTK_RESPONSE_OK;

      g_free (url);

      goto ignore_request;

    }

  if (fragment != NULL)

    {

      /* fragment is encoded into a key/value pairs for the token and

       * expiration values, using the same syntax as a URL query */

      key_value_pairs = soup_form_decode (fragment);

      /* We might use oauth2_proxy_extract_access_token() here but

       * we can also extract other information.

       */

      priv->access_token = g_strdup (g_hash_table_lookup (key_value_pairs, "access_token"));

      if (priv->access_token != NULL)

        {

          gchar *expires_in_str = NULL;

          expires_in_str = g_hash_table_lookup (key_value_pairs, "expires_in");

          /* sometimes "expires_in" appears as "expires" */

          if (expires_in_str == NULL)

            expires_in_str = g_hash_table_lookup (key_value_pairs, "expires");

          if (expires_in_str != NULL)

            priv->access_token_expires_in = atoi (expires_in_str);

          priv->refresh_token = g_strdup (g_hash_table_lookup (key_value_pairs, "refresh_token"));

          response_id = GTK_RESPONSE_OK;

        }

      g_hash_table_unref (key_value_pairs);

    }

  if (priv->access_token != NULL)

    goto ignore_request;

  if (query != NULL)

    {

      key_value_pairs = soup_form_decode (query);

      priv->authorization_code = g_strdup (g_hash_table_lookup (key_value_pairs, "code"));

      if (priv->authorization_code != NULL)

        response_id = GTK_RESPONSE_OK;

      g_hash_table_unref (key_value_pairs);

    }

  if (priv->authorization_code != NULL)

    goto ignore_request;

  /* In case we don't find the access_token or auth code, then look

   * for the error in the query part of the URI.

   */

  key_value_pairs = soup_form_decode (query);

  oauth2_error = (const gchar *) g_hash_table_lookup (key_value_pairs, "error");

  if (g_strcmp0 (oauth2_error, GOA_OAUTH2_ACCESS_DENIED) == 0)

    response_id = GTK_RESPONSE_CANCEL;

  else

    {