Module sasl 

Signing in to IMAP and SMTP with an OAuth 2.0 access token instead of a password: SASL XOAUTH2, as Google defines it (https://developers.google.com/workspace/gmail/imap/xoauth2-protocol), and as Microsoft takes it too. The client’s first answer is base64("user=" user "\x01auth=Bearer " token "\x01\x01"); a refused token brings a last challenge, the reason as base64 JSON ({"status":"401","schemes":"bearer mac","scope":"https://mail.google.com/"}), answered with an empty line, then the refusal (NO, 535).

Who gives the tokens is OAuth: Google only, for now. Nothing here is Google’s but that choice, so that another provider’s sign-in is one more arm of it.

Structs

ImapXoauth2 🔒

XOAUTH2 for async-imap’s AUTHENTICATE: the token at the first continuation, an empty line at the next one (the refusal’s reason, kept).

Enums

OAuth

Who gives an account its access tokens, when it signs in with OAuth rather than a password.

Functions

reason

What a refusal’s challenge says, read for a person: Google’s JSON status and scope, else the text as it came.

smtp_xoauth2 🔒

AUTH XOAUTH2 on an SMTP connection already encrypted and greeted: Ok when accepted, the refusal’s words otherwise (after the empty line its challenge asks). mail-send’s own XOAUTH2 answers that challenge with the token again, not with the empty line Google’s page asks: done here instead.

xoauth2

The initial client response, before base64 (the IMAP and SMTP clients encode it).

xoauth2_base64

The same, as sent on the wire.