[PATCH cluster/docs/manager/proxmox{,-perl-rs,-widget-toolkit} 00/17] fix #7238: Add XOAUTH2 authentication support for SMTP notification targets

[Arthur Bied-Charreton <a.bied-charreton@proxmox.com>]

This series adds XOAUTH2 support for SMTP notification targets, motivated by Microsoft's
upcoming deprecation of basic authentication for SMTP [0]. Google and Microsoft are supported as
OAuth2 providers.

OAuth2 refresh tokens may need to be rotated, therefore they are treated as state, not config.
They are persisted in separate JSON files and managed entirely from the Rust side. Each endpoint
has its own state file to avoid having to lock the entire file system everytime a state update
is made.

The oauth2 crate is used with a local ureq backend (newtype over ureq::Agent). oauth2's ureq
feature is currently patched out in Debian due to a ureq 2/3 version mismatch (oauth2 still
depends on ureq 2.x, and Debian only packages 3.x).

Since tokens that are not used for extended periods of time may expire, token refresh is triggered
proactively via pveupdate, additionally to every time a notification is sent, to prevent
unused endpoints' tokens from expiring.

The UI part of the OAuth2 flow is made opt-in in order to allow adding it only to PVE, and later
to PBS in a follow-up series.

This series requires the following version requirement bumps:
* pve-manager requires bumped proxmox-widget-toolkit and proxmox-perl-rs
* proxmox-perl-rs requires bumped proxmox-notify

Known issues:
- Microsoft OAuth2 support is untested (no test tenant, somehow impossible to create a free test
  account). It is implemented by following the Microsoft Entra ID docs, but there might be something
  I overlooked. I would highly appreciate it if someone was able to test it with their account.

Changes since RFC:

proxmox-notify:
    * Simplify state handling logic simplified by special-casing SMTP endpoints instead of making it
      generic
    * Only pull oauth2 and ureq crates with the smtp feature
    * Create state files in `/etc/pve/priv/notifications` subdirectory
    * Create one state file per endpoint (as opposed to one for all) to avoid races
    * Fix TOCTOU errors by using `proxmox_sys::fs::file_get_optional_contents` for IO
    * Add logging and state-related error types
    * Factor out SMTP transport building to its own function

pve-manager,proxmox-perl-rs:
    * Pass SMTP endpoints configs as hash instead of flat list of parameters

pve-manager:
    * Use `let` instead of `const` for JS variables
    * Rename endpoint for triggering endpoint state refresh from `refresh-targets` to
      `trigger-state-refresh`

pve-docs:
    * Add some more provider-related tips/warnings
    * Explain what is meant by "manual intervention"
    * Show how to add an XOAUTH2 SMTP endpoint via `pvesh`


[0] https://techcommunity.microsoft.com/blog/exchange/updated-exchange-online-smtp-auth-basic-authentication-deprecation-timeline/4489835
[1] https://git.proxmox.com/?p=debcargo-conf.git;a=blob;f=src/oauth2/debian/patches/disable-ureq.patch;h=828b883a83a86927c5cd32df055226a5e78e8bea;hb=refs/heads/proxmox/trixie


proxmox:

Arthur Bied-Charreton (7):
  notify (smtp): Introduce xoauth2 module
  notify (smtp): Introduce state module
  notify (smtp): Factor out transport building logic into own function
  notify (smtp): Update API with OAuth2 parameters
  notify (smtp): Add state handling logic
  notify (smtp): Add XOAUTH2 authentication support
  notify (smtp): Add logging and state-related error types

 proxmox-notify/Cargo.toml                    |   6 +-
 proxmox-notify/debian/control                |  14 +-
 proxmox-notify/src/api/common.rs             |  16 ++
 proxmox-notify/src/api/smtp.rs               | 120 ++++++++--
 proxmox-notify/src/context/mod.rs            |   6 +
 proxmox-notify/src/context/pbs.rs            |   8 +
 proxmox-notify/src/context/pve.rs            |   8 +
 proxmox-notify/src/context/test.rs           |   8 +
 proxmox-notify/src/endpoints/smtp.rs         | 237 +++++++++++++++++--
 proxmox-notify/src/endpoints/smtp/state.rs   |  76 ++++++
 proxmox-notify/src/endpoints/smtp/xoauth2.rs | 167 +++++++++++++
 proxmox-notify/src/lib.rs                    |  35 ++-
 12 files changed, 649 insertions(+), 52 deletions(-)
 create mode 100644 proxmox-notify/src/endpoints/smtp/state.rs
 create mode 100644 proxmox-notify/src/endpoints/smtp/xoauth2.rs


proxmox-perl-rs:

Arthur Bied-Charreton (1):
  notify (smtp): add oauth2 parameters to bindings

 common/src/bindings/notify.rs | 82 ++++++++++++-----------------------
 1 file changed, 28 insertions(+), 54 deletions(-)


proxmox-widget-toolkit:

Arthur Bied-Charreton (2):
  utils: Add OAuth2 flow handlers
  notifications: Add opt-in OAuth2 support for SMTP targets

 src/Utils.js                   |  88 +++++++++++++++
 src/panel/SmtpEditPanel.js     | 200 +++++++++++++++++++++++++++++++--
 src/window/EndpointEditBase.js |   1 +
 3 files changed, 278 insertions(+), 11 deletions(-)


pve-manager:

Arthur Bied-Charreton (5):
  notifications: Add OAuth2 parameters to schema and add/update
    endpoints
  notifications: Add trigger-state-refresh endpoint
  notifications: Trigger notification target refresh in pveupdate
  notifications: Handle OAuth2 callback in login handler
  notifications: Opt into OAuth2 authentication

 PVE/API2/Cluster/Notifications.pm | 144 +++++++++++++++++++++++++-----
 bin/pveupdate                     |   9 ++
 www/manager6/Utils.js             |  10 +++
 www/manager6/Workspace.js         |  20 +++++
 4 files changed, 160 insertions(+), 23 deletions(-)


pve-cluster:

Arthur Bied-Charreton (1):
  notifications: Add refresh_targets subroutine to PVE::Notify

 src/PVE/Notify.pm | 6 ++++++
 1 file changed, 6 insertions(+)


pve-docs:

Arthur Bied-Charreton (1):
  notifications: Add section about OAuth2 to SMTP targets docs

 notifications.adoc | 99 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 99 insertions(+)


Summary over all repositories:
  22 files changed, 1220 insertions(+), 140 deletions(-)

-- 
Generated by murpp 0.9.0