Disable view source for Developer Tools.
[chromium-blink-merge.git] / chrome / browser / password_manager / password_store_mac_internal.h
blob542af32ab9fc47ebcd86adaf962d1f3214444e5d
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
5 #ifndef CHROME_BROWSER_PASSWORD_MANAGER_PASSWORD_STORE_MAC_INTERNAL_H_
6 #define CHROME_BROWSER_PASSWORD_MANAGER_PASSWORD_STORE_MAC_INTERNAL_H_
8 #include <Security/Security.h>
10 #include <string>
11 #include <vector>
13 #include "components/autofill/core/common/password_form.h"
14 #include "crypto/apple_keychain.h"
16 using crypto::AppleKeychain;
18 // Adapter that wraps a AppleKeychain and provides interaction in terms of
19 // PasswordForms instead of Keychain items.
20 class MacKeychainPasswordFormAdapter {
21 public:
22 // Creates an adapter for |keychain|. This class does not take ownership of
23 // |keychain|, so the caller must make sure that the keychain outlives the
24 // created object.
25 explicit MacKeychainPasswordFormAdapter(const AppleKeychain* keychain);
27 // Returns PasswordForms for each keychain entry that could be used to fill
28 // |form|. Caller is responsible for deleting the returned forms.
29 std::vector<autofill::PasswordForm*> PasswordsFillingForm(
30 const autofill::PasswordForm& query_form);
32 // Returns the PasswordForm for the Keychain entry that matches |form| on all
33 // of the fields that uniquely identify a Keychain item, or NULL if there is
34 // no such entry.
35 // Caller is responsible for deleting the returned form.
36 autofill::PasswordForm* PasswordExactlyMatchingForm(
37 const autofill::PasswordForm& query_form);
39 // Returns true if the keychain contains any items that are mergeable with
40 // |query_form|. This is different from actually extracting the passwords
41 // and checking the return count, since doing that would require reading the
42 // passwords from the keychain, thus potentially triggering authorizaiton UI,
43 // whereas this won't.
44 bool HasPasswordsMergeableWithForm(
45 const autofill::PasswordForm& query_form);
47 // Returns all keychain items of types corresponding to password forms.
48 std::vector<SecKeychainItemRef> GetAllPasswordFormKeychainItems();
50 // Returns password data from all keychain items of types corresponding to
51 // password forms. Caller is responsible for deleting the returned forms.
52 std::vector<autofill::PasswordForm*> GetAllPasswordFormPasswords();
54 // Creates a new keychain entry from |form|, or updates the password of an
55 // existing keychain entry if there is a collision. Returns true if a keychain
56 // entry was successfully added/updated.
57 bool AddPassword(const autofill::PasswordForm& form);
59 // Removes the keychain password matching |form| if any. Returns true if a
60 // keychain item was found and successfully removed.
61 bool RemovePassword(const autofill::PasswordForm& form);
63 // Controls whether or not Chrome will restrict Keychain searches to items
64 // that it created. Defaults to false.
65 void SetFindsOnlyOwnedItems(bool finds_only_owned);
67 private:
68 // Returns PasswordForms constructed from the given Keychain items, calling
69 // AppleKeychain::Free on all of the keychain items and clearing the vector.
70 // Caller is responsible for deleting the returned forms.
71 std::vector<autofill::PasswordForm*> ConvertKeychainItemsToForms(
72 std::vector<SecKeychainItemRef>* items);
74 // Searches |keychain| for the specific keychain entry that corresponds to the
75 // given form, and returns it (or NULL if no match is found). The caller is
76 // responsible for calling AppleKeychain::Free on on the returned item.
77 SecKeychainItemRef KeychainItemForForm(
78 const autofill::PasswordForm& form);
80 // Returns the Keychain items matching the given signon_realm, scheme, and
81 // optionally path and username (either of both can be NULL).
82 // The caller is responsible for calling AppleKeychain::Free on the
83 // returned items.
84 std::vector<SecKeychainItemRef> MatchingKeychainItems(
85 const std::string& signon_realm,
86 autofill::PasswordForm::Scheme scheme,
87 const char* path,
88 const char* username);
90 // Returns the Keychain SecAuthenticationType type corresponding to |scheme|.
91 SecAuthenticationType AuthTypeForScheme(
92 autofill::PasswordForm::Scheme scheme);
94 // Changes the password for keychain_item to |password|; returns true if the
95 // password was successfully changed.
96 bool SetKeychainItemPassword(const SecKeychainItemRef& keychain_item,
97 const std::string& password);
99 // Sets the creator code of keychain_item to creator_code; returns true if the
100 // creator code was successfully set.
101 bool SetKeychainItemCreatorCode(const SecKeychainItemRef& keychain_item,
102 OSType creator_code);
104 // Returns the creator code to be used for a Keychain search, depending on
105 // whether this object was instructed to search only for items it created.
106 // If searches should be restricted in this way, the application-specific
107 // creator code will be returned. Otherwise, 0 will be returned, indicating
108 // a search of all items, regardless of creator.
109 OSType CreatorCodeForSearch();
111 const AppleKeychain* keychain_;
113 // If true, Keychain searches are restricted to items created by Chrome.
114 bool finds_only_owned_;
116 DISALLOW_COPY_AND_ASSIGN(MacKeychainPasswordFormAdapter);
119 namespace internal_keychain_helpers {
121 // Pair of pointers to a SecKeychainItemRef and a corresponding PasswordForm.
122 typedef std::pair<SecKeychainItemRef*, autofill::PasswordForm*> ItemFormPair;
124 // Sets the fields of |form| based on the keychain data from |keychain_item|.
125 // Fields that can't be determined from |keychain_item| will be unchanged. If
126 // |extract_password_data| is true, the password data will be copied from
127 // |keychain_item| in addition to its attributes, and the |blacklisted_by_user|
128 // field will be set to true for empty passwords ("" or " ").
129 // If |extract_password_data| is false, only the password attributes will be
130 // copied, and the |blacklisted_by_user| field will always be false.
132 // IMPORTANT: If |extract_password_data| is true, this function can cause the OS
133 // to trigger UI (to allow access to the keychain item if we aren't trusted for
134 // the item), and block until the UI is dismissed.
136 // If excessive prompting for access to other applications' keychain items
137 // becomes an issue, the password storage API will need to intially call this
138 // function with |extract_password_data| set to false, and retrieve the password
139 // later (accessing other fields doesn't require authorization).
140 bool FillPasswordFormFromKeychainItem(const AppleKeychain& keychain,
141 const SecKeychainItemRef& keychain_item,
142 autofill::PasswordForm* form,
143 bool extract_password_data);
145 // Returns true if the two given forms match based on signon_reaml, scheme, and
146 // username_value, and are thus suitable for merging (see MergePasswordForms).
147 bool FormsMatchForMerge(const autofill::PasswordForm& form_a,
148 const autofill::PasswordForm& form_b);
150 // Populates merged_forms by combining the password data from keychain_forms and
151 // the metadata from database_forms, removing used entries from the two source
152 // lists.
154 // On return, database_forms and keychain_forms will have only unused
155 // entries; for database_forms that means entries for which no corresponding
156 // password can be found (and which aren't blacklist entries), and for
157 // keychain_forms its entries that weren't merged into at least one database
158 // form.
159 void MergePasswordForms(
160 std::vector<autofill::PasswordForm*>* keychain_forms,
161 std::vector<autofill::PasswordForm*>* database_forms,
162 std::vector<autofill::PasswordForm*>* merged_forms);
164 // Fills in the passwords for as many of the forms in |database_forms| as
165 // possible using entries from |keychain| and returns them. On return,
166 // |database_forms| will contain only the forms for which no password was found.
167 std::vector<autofill::PasswordForm*> GetPasswordsForForms(
168 const AppleKeychain& keychain,
169 std::vector<autofill::PasswordForm*>* database_forms);
171 // Loads all items in the system keychain into |keychain_items|, creates for
172 // each keychain item a corresponding PasswordForm that doesn't contain any
173 // password data, and returns the two collections as a vector of ItemFormPairs.
174 // Used by GetPasswordsForForms for optimized matching of keychain items with
175 // PasswordForms in the database.
176 // Note: Since no password data is loaded here, the resulting PasswordForms
177 // will include blacklist entries, which will have to be filtered out later.
178 // Caller owns the SecKeychainItemRefs and PasswordForms that are returned.
179 // This operation does not require OS authorization.
180 std::vector<ItemFormPair> ExtractAllKeychainItemAttributesIntoPasswordForms(
181 std::vector<SecKeychainItemRef>* keychain_items,
182 const AppleKeychain& keychain);
184 // Takes a PasswordForm's signon_realm and parses it into its component parts,
185 // which are returned though the appropriate out parameters.
186 // Returns true if it can be successfully parsed, in which case all out params
187 // that are non-NULL will be set. If there is no port, port will be 0.
188 // If the return value is false, the state of the out params is undefined.
189 bool ExtractSignonRealmComponents(const std::string& signon_realm,
190 std::string* server, int* port,
191 bool* is_secure,
192 std::string* security_domain);
194 // Returns true if the signon_realm of |query_form| can be successfully parsed
195 // by ExtractSignonRealmComponents, and if |query_form| matches |other_form|.
196 bool FormIsValidAndMatchesOtherForm(const autofill::PasswordForm& query_form,
197 const autofill::PasswordForm& other_form);
199 // Returns PasswordForms populated with password data for each keychain entry
200 // in |item_form_pairs| that could be merged with |query_form|.
201 // Caller is responsible for deleting the returned forms.
202 std::vector<autofill::PasswordForm*> ExtractPasswordsMergeableWithForm(
203 const AppleKeychain& keychain,
204 const std::vector<ItemFormPair>& item_form_pairs,
205 const autofill::PasswordForm& query_form);
207 } // namespace internal_keychain_helpers
209 #endif // CHROME_BROWSER_PASSWORD_MANAGER_PASSWORD_STORE_MAC_INTERNAL_H_