ported from mozilla: Bug 1538409 - implement oAuth authentication for POP accounts r=benc a=mkmelin (f6219b04be)

mailnews/base/prefs/content/am-server.js

@@ -30,10 +30,12 @@ function onInit(aPageId, aServerId)
   if (serverType == "imap")
     setupImapDeleteUI(aServerId);
 
-  // TLS Cert (External) and OAuth2 are only supported on IMAP.
 #ifdef MOZ_MAILNEWS_OAUTH2
-  document.getElementById("authMethod-oauth2").hidden = (serverType != "imap");
+  // OAuth2 are only supported on IMAP and POP.
+  document.getElementById("authMethod-oauth2").hidden =
+    serverType != "imap" && serverType != "pop3";
 #endif
+  // TLS Cert (External) and OAuth2 are only supported on IMAP.
   document.getElementById("authMethod-external").hidden = (serverType != "imap");
 
   // "STARTTLS, if available" is vulnerable to MITM attacks so we shouldn't

mailnews/base/prefs/content/am-smtp.js

@@ -5,6 +5,9 @@
 
 Components.utils.import("resource://gre/modules/Services.jsm");
 Components.utils.import("resource:///modules/mailServices.js");
+#ifdef MOZ_MAILNEWS_OAUTH2
+Components.utils.import("resource:///modules/OAuth2Providers.js");
+#endif
 
 var gSmtpServerListWindow =
 {
@@ -155,9 +158,19 @@ var gSmtpServerListWindow =
         Components.utils.reportError("Warning: unknown value for smtpserver... authMethod: " +
           aServer.authMethod);
     }
-    if (authStr)
+    if (authStr) {
+#ifdef MOZ_MAILNEWS_OAUTH2
+      let details = OAuth2Providers.getHostnameDetails(aServer.hostname);
+      if (!details) {
+        document
+          .getElementById("authMethod-oauth2")
+          .toggleAttribute("disabled", true);
+      }
+#endif
+
       document.getElementById("authMethodValue").value =
           this.mBundle.getString(authStr);
+    }
   },
 
   refreshServerList: function(aServerKeyToSelect, aFocusList)

mailnews/base/util/OAuth2Providers.jsm

@@ -13,16 +13,20 @@ var {classes: Cc, interfaces: Ci, results: Cr, utils: Cu} = Components;
 var kHostnames = new Map([
   ["imap.googlemail.com", ["accounts.google.com", "https://mail.google.com/"]],
   ["smtp.googlemail.com", ["accounts.google.com", "https://mail.google.com/"]],
+  ["pop.googlemail.com", ["accounts.google.com", "https://mail.google.com/"]],
   ["imap.gmail.com", ["accounts.google.com", "https://mail.google.com/"]],
   ["smtp.gmail.com", ["accounts.google.com", "https://mail.google.com/"]],
+  ["pop.gmail.com", ["accounts.google.com", "https://mail.google.com/"]],
 
   ["imap.mail.ru", ["o2.mail.ru", "mail.imap"]],
   ["smtp.mail.ru", ["o2.mail.ru", "mail.imap"]],
 
   ["imap.mail.yahoo.com", ["login.yahoo.com", "mail-w"]],
+  ["pop.mail.yahoo.com", ["login.yahoo.com", "mail-w"]],
   ["smtp.mail.yahoo.com", ["login.yahoo.com", "mail-w"]],
 
   ["imap.aol.com", ["login.aol.com", "mail-w"]],
+  ["pop.aol.com", ["login.aol.com", "mail-w"]],
   ["smtp.aol.com", ["login.aol.com", "mail-w"]],
 
   ["outlook.office365.com", [

mailnews/imap/src/nsImapProtocol.cpp

@@ -5618,6 +5618,11 @@ void nsImapProtocol::InitPrefAuthMethods(int32_t authMethodPrefValue)
             kHasAuthGssApiCapability |
             kHasAuthNTLMCapability | kHasAuthMSNCapability;
         break;
+#ifdef MOZ_MAILNEWS_OAUTH2
+      case nsMsgAuthMethod::OAuth2:
+        m_prefAuthMethods = kHasXOAuth2Capability;
+        break;
+#endif
       default:
         NS_ASSERTION(false, "IMAP: authMethod pref invalid");
         // TODO log to error console
@@ -5632,9 +5637,6 @@ void nsImapProtocol::InitPrefAuthMethods(int32_t authMethodPrefValue)
             kHasAuthNTLMCapability | kHasAuthMSNCapability |
 #ifdef MOZ_MAILNEWS_OAUTH2
             kHasAuthExternalCapability | kHasXOAuth2Capability;
-        break;
-      case nsMsgAuthMethod::OAuth2:
-        m_prefAuthMethods = kHasXOAuth2Capability;
 #else
             kHasAuthExternalCapability;
 #endif
@@ -5643,13 +5645,16 @@ void nsImapProtocol::InitPrefAuthMethods(int32_t authMethodPrefValue)
     }
 
 #ifdef MOZ_MAILNEWS_OAUTH2
-    if (m_prefAuthMethods & kHasXOAuth2Capability)
+    if (m_prefAuthMethods & kHasXOAuth2Capability) {
       mOAuth2Support = new mozilla::mailnews::OAuth2ThreadHelper(aServer);
-
+      if (!mOAuth2Support || !mOAuth2Support->SupportsOAuth2()) {
         // Disable OAuth2 support if we don't have the prefs installed.
-    if (m_prefAuthMethods & kHasXOAuth2Capability &&
-        (!mOAuth2Support || !mOAuth2Support->SupportsOAuth2()))
         m_prefAuthMethods &= ~kHasXOAuth2Capability;
+        mOAuth2Support = nullptr;
+        MOZ_LOG(IMAP, LogLevel::Warning,
+                ("IMAP: no OAuth2 support for this server."));
+      }
+    }
 #endif
 
     NS_ASSERTION(m_prefAuthMethods != kCapabilityUndefined,
@@ -5706,17 +5711,17 @@ nsresult nsImapProtocol::ChooseAuthMethod()
     m_currentAuthMethod = kHasAuthOldLoginCapability;
   else
   {
-    MOZ_LOG(IMAP, LogLevel::Debug, ("no remaining auth method"));
+    MOZ_LOG(IMAP, LogLevel::Debug, ("No remaining auth method"));
     m_currentAuthMethod = kCapabilityUndefined;
     return NS_ERROR_FAILURE;
   }
-  MOZ_LOG(IMAP, LogLevel::Debug, ("trying auth method 0x%llx", m_currentAuthMethod));
+  MOZ_LOG(IMAP, LogLevel::Debug, ("Trying auth method 0x%llx", m_currentAuthMethod));
   return NS_OK;
 }
 
 void nsImapProtocol::MarkAuthMethodAsFailed(eIMAPCapabilityFlags failedAuthMethod)
 {
-  MOZ_LOG(IMAP, LogLevel::Debug, ("marking auth method 0x%llx failed", failedAuthMethod));
+  MOZ_LOG(IMAP, LogLevel::Debug, ("Marking auth method 0x%llx failed", failedAuthMethod));
   m_failedAuthMethods |= failedAuthMethod;
 }
 
@@ -8594,7 +8599,7 @@ nsImapProtocol::OnPromptCanceled()
 
 bool nsImapProtocol::TryToLogon()
 {
-  MOZ_LOG(IMAP, LogLevel::Debug, ("try to log in"));
+  MOZ_LOG(IMAP, LogLevel::Debug, ("Try to log in"));
   NS_ENSURE_TRUE(m_imapServerSink, false);
   bool loginSucceeded = false;
   bool skipLoop = false;

mailnews/local/src/nsPop3Protocol.cpp

@@ -440,6 +440,9 @@ NS_IMPL_RELEASE_INHERITED(nsPop3Protocol, nsMsgProtocol)
 
 NS_INTERFACE_MAP_BEGIN(nsPop3Protocol)
   NS_INTERFACE_MAP_ENTRY(nsIPop3Protocol)
+#ifdef MOZ_MAILNEWS_OAUTH2
+  NS_INTERFACE_MAP_ENTRY(msgIOAuth2ModuleListener)
+#endif
   NS_INTERFACE_MAP_ENTRY(nsIMsgAsyncPromptListener)
 NS_INTERFACE_MAP_END_INHERITING(nsMsgProtocol)
 
@@ -490,6 +493,18 @@ nsresult nsPop3Protocol::Initialize(nsIURI * aURL)
       mailnewsUrl->GetServer(getter_AddRefs(server));
       NS_ENSURE_TRUE(server, NS_MSG_INVALID_OR_MISSING_SERVER);
 
+#ifdef MOZ_MAILNEWS_OAUTH2
+      // Query for OAuth2 support. If the POP server preferences don't allow
+      // for OAuth2, then don't carry around the OAuth2 module any longer
+      // since we won't need it.
+      mOAuth2Support = do_CreateInstance(MSGIOAUTH2MODULE_CONTRACTID);
+        if (mOAuth2Support) {
+        bool supportsOAuth = false;
+        mOAuth2Support->InitFromMail(server, &supportsOAuth);
+        if (!supportsOAuth) mOAuth2Support = nullptr;
+      }
+#endif
+
       rv = server->GetSocketType(&m_socketType);
       NS_ENSURE_SUCCESS(rv,rv);
 
@@ -1362,10 +1377,9 @@ int32_t nsPop3Protocol::Pop3SendData(const char * dataBuffer, bool aSuppressLogg
   return -1;
 }
 
-/*
+/**
  * POP3 AUTH extension
  */
-
 int32_t nsPop3Protocol::SendAuth()
 {
   MOZ_LOG(POP3LOGMODULE, LogLevel::Debug, (POP3LOG("SendAuth()")));
@@ -1437,6 +1451,10 @@ int32_t nsPop3Protocol::AuthResponse(nsIInputStream* inputStream,
         SetCapFlag(POP3_HAS_AUTH_PLAIN);
     else if (!PL_strcasecmp (line, "LOGIN"))
         SetCapFlag(POP3_HAS_AUTH_LOGIN);
+#ifdef MOZ_MAILNEWS_OAUTH2
+    else if (!PL_strcasecmp(line, "XOAUTH2"))
+        SetCapFlag(POP3_HAS_AUTH_XOAUTH2);
+#endif
 
     PR_Free(line);
     return 0;
@@ -1546,6 +1564,11 @@ int32_t nsPop3Protocol::CapaResponse(nsIInputStream* inputStream,
         if (responseLine.Find("MSN", CaseInsensitiveCompare) >= 0)
           SetCapFlag(POP3_HAS_AUTH_NTLM|POP3_HAS_AUTH_MSN);
 
+#ifdef MOZ_MAILNEWS_OAUTH2
+        if (responseLine.Find("XOAUTH2", CaseInsensitiveCompare) >= 0)
+          SetCapFlag(POP3_HAS_AUTH_XOAUTH2|POP3_HAS_AUTH_MSN);
+#endif
+
         m_pop3Server->SetPop3CapabilityFlags(m_pop3ConData->capability_flags);
     }
 
@@ -1628,6 +1651,11 @@ void nsPop3Protocol::InitPrefAuthMethods(int32_t authMethodPrefValue)
     case nsMsgAuthMethod::GSSAPI:
       m_prefAuthMethods = POP3_HAS_AUTH_GSSAPI;
       break;
+#ifdef MOZ_MAILNEWS_OAUTH2
+    case nsMsgAuthMethod::OAuth2:
+      m_prefAuthMethods = POP3_HAS_AUTH_XOAUTH2;
+      break;
+#endif
     case nsMsgAuthMethod::secure:
       m_prefAuthMethods = POP3_HAS_AUTH_APOP |
           POP3_HAS_AUTH_CRAM_MD5 | POP3_HAS_AUTH_GSSAPI |
@@ -1641,14 +1669,26 @@ void nsPop3Protocol::InitPrefAuthMethods(int32_t authMethodPrefValue)
       // fall to any
       MOZ_FALLTHROUGH;
     case nsMsgAuthMethod::anything:
-      m_prefAuthMethods = POP3_HAS_AUTH_USER |
+      m_prefAuthMethods =
-          POP3_HAS_AUTH_LOGIN | POP3_HAS_AUTH_PLAIN |
+          POP3_HAS_AUTH_USER | POP3_HAS_AUTH_LOGIN | POP3_HAS_AUTH_PLAIN |
-          POP3_HAS_AUTH_CRAM_MD5 | POP3_HAS_AUTH_APOP |
+          POP3_HAS_AUTH_CRAM_MD5 | POP3_HAS_AUTH_APOP | POP3_HAS_AUTH_GSSAPI |
-          POP3_HAS_AUTH_GSSAPI |
+#ifdef MOZ_MAILNEWS_OAUTH2
+          POP3_HAS_AUTH_NTLM | POP3_HAS_AUTH_MSN | POP3_HAS_AUTH_XOAUTH2;
+#else
           POP3_HAS_AUTH_NTLM | POP3_HAS_AUTH_MSN;
+#endif
+
       // TODO needed?
       break;
   }
+
+#ifdef MOZ_MAILNEWS_OAUTH2
+  // Only enable OAuth2 support if we can do the lookup.
+  if ((m_prefAuthMethods & POP3_HAS_AUTH_XOAUTH2) && !mOAuth2Support) {
+    m_prefAuthMethods &= ~POP3_HAS_AUTH_XOAUTH2;  // disable it
+  }
+#endif
+
   NS_ASSERTION(m_prefAuthMethods != POP3_AUTH_MECH_UNDEFINED,
       "POP: InitPrefAuthMethods() didn't work");
 }
@@ -1665,12 +1705,44 @@ nsresult nsPop3Protocol::ChooseAuthMethod()
   MOZ_LOG(POP3LOGMODULE, LogLevel::Debug,
           (POP3LOG("POP auth: server caps 0x%X, pref 0x%X, failed 0x%X, avail caps 0x%X"),
            GetCapFlags(), m_prefAuthMethods, m_failedAuthMethods, availCaps));
+#ifdef MOZ_MAILNEWS_OAUTH2
+  MOZ_LOG(POP3LOGMODULE, LogLevel::Debug,
+          (POP3LOG("(GSSAPI = 0x%X, CRAM = 0x%X, APOP = 0x%X, NTLM = 0x%X, "
+                   "MSN = 0x%X, PLAIN = 0x%X, LOGIN = 0x%X, USER/PASS = 0x%X, "
+                   "XOAUTH2 = 0x%X)"),
+           POP3_HAS_AUTH_GSSAPI, POP3_HAS_AUTH_CRAM_MD5, POP3_HAS_AUTH_APOP,
+           POP3_HAS_AUTH_NTLM, POP3_HAS_AUTH_MSN, POP3_HAS_AUTH_PLAIN,
+           POP3_HAS_AUTH_LOGIN, POP3_HAS_AUTH_USER, POP3_HAS_AUTH_XOAUTH2));
+#else
   MOZ_LOG(POP3LOGMODULE, LogLevel::Debug,
           (POP3LOG("(GSSAPI = 0x%X, CRAM = 0x%X, APOP = 0x%X, NTLM = 0x%X, "
                    "MSN = 0x%X, PLAIN = 0x%X, LOGIN = 0x%X, USER/PASS = 0x%X)"),
            POP3_HAS_AUTH_GSSAPI, POP3_HAS_AUTH_CRAM_MD5, POP3_HAS_AUTH_APOP,
            POP3_HAS_AUTH_NTLM, POP3_HAS_AUTH_MSN, POP3_HAS_AUTH_PLAIN,
            POP3_HAS_AUTH_LOGIN, POP3_HAS_AUTH_USER));
+#endif
+
+#ifdef MOZ_MAILNEWS_OAUTH2
+  MOZ_LOG(POP3LOGMODULE, LogLevel::Debug,
+      (POP3LOG("(Ehabled - GSSAPI=%d, CRAM=%d, APOP=%d, NTLM=%d, "
+               "MSN=%d, PLAIN=%d, LOGIN=%d, USER/PASS=%d, "
+               "XOAUTH2=%d)"),
+       !!(POP3_HAS_AUTH_GSSAPI & availCaps),
+       !!(POP3_HAS_AUTH_CRAM_MD5 & availCaps),
+       !!(POP3_HAS_AUTH_APOP & availCaps), !!(POP3_HAS_AUTH_NTLM & availCaps),
+       !!(POP3_HAS_AUTH_MSN & availCaps), !!(POP3_HAS_AUTH_PLAIN & availCaps),
+       !!(POP3_HAS_AUTH_LOGIN & availCaps), !!(POP3_HAS_AUTH_USER & availCaps),
+       !!(POP3_HAS_AUTH_XOAUTH2 & availCaps)));
+#else
+  MOZ_LOG(POP3LOGMODULE, LogLevel::Debug,
+      (POP3LOG("(Ehabled - GSSAPI=%d, CRAM=%d, APOP=%d, NTLM=%d, "
+               "MSN=%d, PLAIN=%d, LOGIN=%d, USER/PASS=%d)"),
+       !!(POP3_HAS_AUTH_GSSAPI & availCaps),
+       !!(POP3_HAS_AUTH_CRAM_MD5 & availCaps),
+       !!(POP3_HAS_AUTH_APOP & availCaps), !!(POP3_HAS_AUTH_NTLM & availCaps),
+       !!(POP3_HAS_AUTH_MSN & availCaps), !!(POP3_HAS_AUTH_PLAIN & availCaps),
+       !!(POP3_HAS_AUTH_LOGIN & availCaps), !!(POP3_HAS_AUTH_USER & availCaps)));
+#endif
 
   if (POP3_HAS_AUTH_GSSAPI & availCaps)
     m_currentAuthMethod = POP3_HAS_AUTH_GSSAPI;
@@ -1688,22 +1760,27 @@ nsresult nsPop3Protocol::ChooseAuthMethod()
     m_currentAuthMethod = POP3_HAS_AUTH_LOGIN;
   else if (POP3_HAS_AUTH_USER & availCaps)
     m_currentAuthMethod = POP3_HAS_AUTH_USER;
+#ifdef MOZ_MAILNEWS_OAUTH2
+  else if (POP3_HAS_AUTH_XOAUTH2 & availCaps)
+    m_currentAuthMethod = POP3_HAS_AUTH_XOAUTH2;
+#endif
+
   else
   {
     // there are no matching login schemes at all, per server and prefs
     m_currentAuthMethod = POP3_AUTH_MECH_UNDEFINED;
-    MOZ_LOG(POP3LOGMODULE, LogLevel::Debug, (POP3LOG("no auth method remaining")));
+    MOZ_LOG(POP3LOGMODULE, LogLevel::Debug, (POP3LOG("No auth method remaining")));
     return NS_ERROR_FAILURE;
   }
   MOZ_LOG(POP3LOGMODULE, LogLevel::Debug,
-          (POP3LOG("trying auth method 0x%X"), m_currentAuthMethod));
+          (POP3LOG("Trying auth method 0x%X"), m_currentAuthMethod));
   return NS_OK;
 }
 
 void nsPop3Protocol::MarkAuthMethodAsFailed(int32_t failedAuthMethod)
 {
   MOZ_LOG(POP3LOGMODULE, LogLevel::Debug,
-          (POP3LOG("marking auth method 0x%X failed"), failedAuthMethod));
+          (POP3LOG("Marking auth method 0x%X failed"), failedAuthMethod));
   m_failedAuthMethods |= failedAuthMethod;
 }
 
@@ -1712,7 +1789,7 @@ void nsPop3Protocol::MarkAuthMethodAsFailed(int32_t failedAuthMethod)
  */
 void nsPop3Protocol::ResetAuthMethods()
 {
-  MOZ_LOG(POP3LOGMODULE, LogLevel::Debug, (POP3LOG("resetting (failed) auth methods")));
+  MOZ_LOG(POP3LOGMODULE, LogLevel::Debug, (POP3LOG("Resetting (failed) auth methods")));
   m_currentAuthMethod = POP3_AUTH_MECH_UNDEFINED;
   m_failedAuthMethods = 0;
 }
@@ -1821,6 +1898,13 @@ int32_t nsPop3Protocol::ProcessAuth()
         m_pop3ConData->command_succeeded = true;
         m_pop3ConData->next_state = POP3_NEXT_AUTH_STEP;
         break;
+#ifdef MOZ_MAILNEWS_OAUTH2
+      case POP3_HAS_AUTH_XOAUTH2:
+        MOZ_LOG(POP3LOGMODULE, LogLevel::Debug, (POP3LOG("POP XOAUTH2")));
+        m_pop3ConData->command_succeeded = true;
+        m_pop3ConData->next_state = POP3_AUTH_OAUTH2_RESPONSE;
+        break;
+#endif
       default:
         MOZ_LOG(POP3LOGMODULE, LogLevel::Error,
                 (POP3LOG("POP: m_currentAuthMethod has unknown value")));
@@ -1832,6 +1916,52 @@ int32_t nsPop3Protocol::ProcessAuth()
     return 0;
 }
 
+#ifdef MOZ_MAILNEWS_OAUTH2
+int32_t nsPop3Protocol::AuthOAuth2Response() {
+  if (!mOAuth2Support) {
+    return Error("pop3AuthMechNotSupported");
+  }
+  nsresult rv = mOAuth2Support->Connect(true, this);
+  if (NS_FAILED(rv)) {
+    MOZ_LOG(POP3LOGMODULE, LogLevel::Error,
+            (POP3LOG("OAuth2 authorizattion failed")));
+    return -1;
+  }
+  m_pop3ConData->pause_for_read = true;
+  return 0;
+}
+
+/** msgIOAuth2ModuleListener implementation */
+nsresult nsPop3Protocol::OnSuccess(const nsACString &aOAuth2String) {
+  MOZ_ASSERT(mOAuth2Support, "Can't do anything without OAuth2 support");
+  // Send the AUTH XOAUTH2 command, and then siphon us back to the regular
+  // authentication login stream.
+  nsAutoCString cmd;
+  cmd.AppendLiteral("AUTH XOAUTH2 ");
+  cmd += aOAuth2String;
+  cmd += CRLF;
+  m_pop3ConData->next_state = POP3_WAIT_FOR_RESPONSE;
+  m_pop3ConData->next_state_after_response = POP3_NEXT_AUTH_STEP;
+  m_pop3ConData->pause_for_read = true;
+  m_password_already_sent = true;
+  if (Pop3SendData(cmd.get(), true)) {
+    MOZ_LOG(POP3LOGMODULE, LogLevel::Error,
+            (POP3LOG("POP: XOAUTH2 authentication failed")));
+    m_pop3ConData->next_state = POP3_ERROR_DONE;
+  }
+  ProcessProtocolState(nullptr, nullptr, 0, 0);
+  return NS_OK;
+}
+
+/** msgIOAuth2ModuleListener implementation */
+nsresult nsPop3Protocol::OnFailure(nsresult aError) {
+  MOZ_LOG(POP3LOGMODULE, mozilla::LogLevel::Debug,
+          ("OAuth2 login error %08x", (uint32_t)aError));
+  m_pop3ConData->next_state = POP3_ERROR_DONE;
+  return ProcessProtocolState(nullptr, nullptr, 0, 0);
+}
+#endif
+
 /**
  * state POP3_NEXT_AUTH_STEP
  * This is called when we finished one auth step (e.g. sending username
@@ -1846,7 +1976,7 @@ int32_t nsPop3Protocol::NextAuthStep()
         if (m_password_already_sent || // (also true for GSSAPI)
             m_currentAuthMethod == POP3_HAS_AUTH_NONE)
         {
-            MOZ_LOG(POP3LOGMODULE, LogLevel::Debug, (POP3LOG("login succeeded")));
+            MOZ_LOG(POP3LOGMODULE, LogLevel::Debug, (POP3LOG("Login succeeded")));
             m_nsIPop3Sink->SetUserAuthenticated(true);
             ClearFlag(POP3_PASSWORD_FAILED);
             if (m_pop3ConData->verify_logon)
@@ -3851,6 +3981,12 @@ nsresult nsPop3Protocol::ProcessProtocolState(nsIURI * url, nsIInputStream * aIn
       status = AuthGSSAPIResponse(false);
       break;
 
+#ifdef MOZ_MAILNEWS_OAUTH2
+    case POP3_AUTH_OAUTH2_RESPONSE:
+      status = AuthOAuth2Response();
+      break;
+#endif
+
     case POP3_SEND_USERNAME:
       if (NS_FAILED(StartGetAsyncPassword(POP3_OBTAIN_PASSWORD_BEFORE_USERNAME)))
         status = -1;

mailnews/local/src/nsPop3Protocol.h

@@ -22,6 +22,9 @@
 #include "nsIAuthModule.h"
 #include "nsITimer.h"
 #include "nsIMsgAsyncPrompter.h"
+#ifdef MOZ_MAILNEWS_OAUTH2
+#include "msgIOAuth2Module.h"
+#endif
 
 #include "prerror.h"
 #include "plhash.h"
@@ -53,11 +56,6 @@ and change the POP3_QUIT_RESPONSE state to flush the newly committed deletes. */
 
 #define OUTPUT_BUFFER_SIZE 8192 // maximum size of command string
 
-/* structure to hold data pertaining to the active state of
- * a transfer in progress.
- *
- */
-
 enum Pop3CapabilityEnum {
     POP3_CAPABILITY_UNDEFINED   = 0x00000000,
     POP3_HAS_XSENDER            = 0x00000001,
@@ -80,7 +78,8 @@ enum Pop3CapabilityEnum {
     POP3_HAS_RESP_CODES         = 0x00020000,
     POP3_HAS_AUTH_RESP_CODE     = 0x00040000,
     POP3_HAS_STLS               = 0x00080000,
-    POP3_HAS_AUTH_GSSAPI        = 0x00100000
+    POP3_HAS_AUTH_GSSAPI        = 0x00100000,
+    POP3_HAS_AUTH_XOAUTH2       = 0x00200000
 };
 
 // TODO use value > 0?
@@ -153,7 +152,10 @@ enum Pop3StatesEnum {
     POP3_OBTAIN_PASSWORD_BEFORE_USERNAME,       // 47
     POP3_FINISH_OBTAIN_PASSWORD_BEFORE_USERNAME,// 48
     POP3_OBTAIN_PASSWORD_BEFORE_PASSWORD,       // 49
-    POP3_FINISH_OBTAIN_PASSWORD_BEFORE_PASSWORD // 50
+    POP3_FINISH_OBTAIN_PASSWORD_BEFORE_PASSWORD,// 50
+
+    POP3_SUSPENDED,                             // 51
+    POP3_AUTH_OAUTH2_RESPONSE,                  // 52
 };
 
 
@@ -251,12 +253,18 @@ typedef struct _Pop3ConData {
 
 class nsPop3Protocol : public nsMsgProtocol,
                        public nsIPop3Protocol,
+#ifdef MOZ_MAILNEWS_OAUTH2
+                       public msgIOAuth2ModuleListener,
+#endif
                        public nsIMsgAsyncPromptListener
 {
 public:
   explicit nsPop3Protocol(nsIURI* aURL);
 
   NS_DECL_ISUPPORTS_INHERITED
+#ifdef MOZ_MAILNEWS_OAUTH2
+  NS_DECL_MSGIOAUTH2MODULELISTENER
+#endif
   NS_DECL_NSIPOP3PROTOCOL
   NS_DECL_NSIMSGASYNCPROMPTLISTENER
 
@@ -365,6 +373,9 @@ private:
   int32_t NextAuthStep();
   int32_t AuthLogin();
   int32_t AuthLoginResponse();
+#ifdef MOZ_MAILNEWS_OAUTH2
+  int32_t AuthOAuth2Response();
+#endif
   int32_t AuthNtlm();
   int32_t AuthNtlmResponse();
   int32_t AuthGSSAPI();
@@ -397,6 +408,12 @@ private:
 
   Pop3StatesEnum GetNextPasswordObtainState();
   nsresult RerunUrl();
+
+#ifdef MOZ_MAILNEWS_OAUTH2
+  // The support module for OAuth2 logon, only present if OAuth2 is enabled
+  // and working.
+  nsCOMPtr<msgIOAuth2Module> mOAuth2Support;
+#endif
 };
 
 #endif /* nsPop3Protocol_h__ */