refactor: improve sasl config

Author: soywod

Cargo.lock

@@ -73,11 +73,10 @@ imap.server = "imaps://imap.example.org"
 # to skip authentication entirely (no `AUTHENTICATE` command sent).
 
 # SASL PLAIN (https://www.iana.org/go/rfc4616)
-imap.sasl.plain.authcid = "user@example.org"
-imap.sasl.plain.passwd.raw = "REPLACE_ME"
+imap.sasl.plain.username = "user@example.org"
+imap.sasl.plain.password.raw = "REPLACE_ME"
 #imap.sasl.plain.authzid = "user@example.org"  # optional authorization identity
-#imap.sasl.plain.passwd.command = "pass show mirador/example"
-#imap.sasl.plain.passwd.command = ["secret-tool", "lookup", "service", "mirador-example"]
+#imap.sasl.plain.password.command = "pass show mirador/example"
 
 # SASL LOGIN (https://datatracker.ietf.org/doc/html/draft-murchison-sasl-login-00)
 #imap.sasl.login.username = "user@example.org"
@@ -86,11 +85,9 @@ imap.sasl.plain.passwd.raw = "REPLACE_ME"
 # SASL ANONYMOUS (https://www.iana.org/go/rfc4505)
 #imap.sasl.anonymous.message = "mirador"
 
-# SASL OAUTHBEARER (https://www.iana.org/go/rfc7628). Host/port are echoed
-# verbatim in the GS2 header; usually mirror the server you connect to.
+# SASL OAUTHBEARER (https://www.iana.org/go/rfc7628). Host/port for the
+# GS2 header are derived from the IMAP server URL at connect time.
 #imap.sasl.oauthbearer.username = "user@example.org"
-#imap.sasl.oauthbearer.host = "imap.example.org"
-#imap.sasl.oauthbearer.port = 993
 #imap.sasl.oauthbearer.token.command = ["ortie", "token", "read", "example"]
 
 # SASL XOAUTH2 (Google's pre-standard OAuth 2.0 SASL).

config.sample.toml

@@ -2,7 +2,6 @@
 allow-git = [
   "https://github.com/pimalaya/cli",
   "https://github.com/pimalaya/config",
-  "https://github.com/pimalaya/io-discovery",
   "https://github.com/pimalaya/io-email",
   "https://github.com/pimalaya/io-http",
   "https://github.com/pimalaya/io-imap",

deny.toml

@@ -108,8 +108,16 @@ fn check_imap(
     let result = (|| -> Result<()> {
         let mut tls: Tls = imap_config.tls.clone().into();
         tls.rustls.alpn = vec!["imap".into()];
-        let sasl: Option<Sasl> = imap_config.sasl.clone().map(Sasl::try_from).transpose()?;
         let server = crate::client::parse_imap_server(&imap_config.server)?;
+        let sasl: Option<Sasl> = imap_config
+            .sasl
+            .clone()
+            .and_then(|cfg| {
+                let host = server.host_str()?;
+                let port = server.port_or_known_default()?;
+                Some(cfg.try_into_sasl(host, port))
+            })
+            .transpose()?;
         let _ = ImapClientStd::connect(&server, &tls, imap_config.starttls, sasl)?;
         Ok(())
     })();

src/check.rs

@@ -87,8 +87,15 @@ pub fn open(account: AccountConfig, backend: Backend) -> Result<EmailClientStd>
 fn open_imap(config: crate::config::ImapConfig) -> Result<EmailClientStd> {
     let mut tls: Tls = config.tls.into();
     tls.rustls.alpn = vec!["imap".into()];
-    let sasl: Option<Sasl> = config.sasl.map(Sasl::try_from).transpose()?;
     let server = parse_imap_server(&config.server)?;
+    let sasl: Option<Sasl> = config
+        .sasl
+        .and_then(|cfg| {
+            let host = server.host_str()?;
+            let port = server.port_or_known_default()?;
+            Some(cfg.try_into_sasl(host, port))
+        })
+        .transpose()?;
 
     let mut client = EmailClientStd::new().connect_imap(&server, &tls, config.starttls, sasl)?;
     if let Some(imap) = client.imap.as_mut() {

src/client.rs

@@ -283,7 +283,9 @@ pub struct SaslLoginConfig {
 pub struct SaslPlainConfig {
     pub authzid: Option<String>,
     #[serde(deserialize_with = "pimalaya_config::toml::shell_expanded_string")]
+    #[serde(alias = "username")]
     pub authcid: String,
+    #[serde(alias = "password")]
     pub passwd: Secret,
 }
 
@@ -293,8 +295,6 @@ pub struct SaslPlainConfig {
 pub struct SaslOauthbearerConfig {
     #[serde(deserialize_with = "pimalaya_config::toml::shell_expanded_string")]
     pub username: String,
-    pub host: String,
-    pub port: u16,
     pub token: Secret,
 }
 
@@ -317,11 +317,13 @@ pub struct SaslScramSha256Config {
 }
 
 #[cfg(feature = "imap")]
-impl TryFrom<SaslConfig> for Sasl {
-    type Error = anyhow::Error;
-
-    fn try_from(config: SaslConfig) -> Result<Self, Self::Error> {
-        Ok(match config {
+impl SaslConfig {
+    /// Resolves the SASL config into a runtime [`Sasl`]. `host` and
+    /// `port` come from the live server URL; they are only used by
+    /// OAUTHBEARER (echoed in the GS2 header) and ignored by every
+    /// other mechanism.
+    pub fn try_into_sasl(self, host: impl ToString, port: u16) -> Result<Sasl> {
+        Ok(match self {
             SaslConfig::Anonymous(c) => Sasl::Anonymous(SaslAnonymous { message: c.message }),
             SaslConfig::Login(c) => Sasl::Login(SaslLogin {
                 username: c.username,
@@ -334,8 +336,8 @@ impl TryFrom<SaslConfig> for Sasl {
             }),
             SaslConfig::Oauthbearer(c) => Sasl::Oauthbearer(SaslOauthbearer {
                 username: c.username,
-                host: c.host,
-                port: c.port,
+                host: host.to_string(),
+                port,
                 token: c.token.get()?,
             }),
             SaslConfig::Xoauth2(c) => Sasl::Xoauth2(SaslXoauth2 {