Google OAuth Device Flow support for FNL

mojo/services/authentication/interfaces/authentication.mojom

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 [DartPackage="mojo_services", JavaPackage="org.chromium.mojo.authentication"]
 module authentication;
 
 // Interface to handle user identity and authentication tokens.
 // TODO(qsr): This API only handles google accounts at this time. It will need
 //            to be extended to allow generic account manager on the platform.
 [ServiceName="authentication::AuthenticationService"]
 interface AuthenticationService {
   // Requests a Google account to use. In case of success, error will be null.
   // In case of error, username will be null and error will contain a
   // description of the error. If |return_last_selected| is true and the client
   // application already selected an account, the same account will be returned
   // without user intervention.
   SelectAccount(bool return_last_selected) => (string? username, string? error);
 
   // Requests an oauth2 token for the given Google account with the given
-  // scopes.  In case of error, username will be null and error will contain a
+  // scopes.  In case of error, token will be null and error will contain a
   // description of the error.
   GetOAuth2Token(string username, array<string> scopes) =>

[jln (very slow on Chromium), 2015/12/08 22:27:29]

Meta-remark (not for this CL): should the scopes really be strings? I wonder if
we shouldn't give them their own type with some checking etc..

[ukode, 2015/12/16 19:24:12]

OAuth scopes are in general strings, so most of Google3 and Android code
directly takes a list of scope strings, (optional) normalizes them and then
passes it to Google OAuth endpoints.Scope checking is already done at the LSO
backends, not sure how much we would like to validate these in our frontends
other than nullchecks.

       (string? token, string? error);
 
   // Requests to clear a previously acquired token. This should be called when a
   // token is refused by a server component before requesting a new token to
   // clear the token from any cache.
   ClearOAuth2Token(string token);
+
+  // Requests an oauth2 device code response for the given set of scopes. In
+  // case of error, response will be null and error will contain a description
+  // of the error.
+  GetOAuth2DeviceCode(array<string> scopes) => (string? verification_url, string? device_code, string? user_code, string? error);
+
+  // Exchanges an oauth2 device code to a refresh token for the granted user,
+  // and stores it locally in a secure storage location. For future
+  // GetOAuth2Token requests, a new access token is minted from this refresh
+  // token and returned to the calling mojo app.
+  AddAccount(string device_code) => (string? username, string? error);
 };