[PATCH proxmox 6/7] notify (smtp): Add XOAUTH2 authentication support

[Arthur Bied-Charreton <a.bied-charreton@proxmox.com>]

Extend the transport building logic to authenticate via XOAUTH2 if
configured, and manage the related state updates.

Signed-off-by: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
---
 proxmox-notify/src/endpoints/smtp.rs | 81 +++++++++++++++++++++++-----
 proxmox-notify/src/lib.rs            |  4 +-
 2 files changed, 70 insertions(+), 15 deletions(-)

diff --git a/proxmox-notify/src/endpoints/smtp.rs b/proxmox-notify/src/endpoints/smtp.rs
index 244799fd..4364bd11 100644
--- a/proxmox-notify/src/endpoints/smtp.rs
+++ b/proxmox-notify/src/endpoints/smtp.rs
@@ -202,7 +202,7 @@ pub struct SmtpPrivateConfig {
     pub oauth2_client_secret: Option<String>,
 }
 
-/// A sendmail notification endpoint.
+/// A SMTP notification endpoint.
 pub struct SmtpEndpoint {
     pub config: SmtpConfig,
     pub private_config: SmtpPrivateConfig,
@@ -246,22 +246,79 @@ impl SmtpEndpoint {
         }
     }
 
+    /// Infer the auth method based on the presence of a password field in the private config.
+    ///
+    /// This is required for backwards compatibility for configs created before the `auth_method`
+    /// field was added, i.e., the presence of a password implicitly meant plain authentication
+    /// was to be used.
+    fn auth_method(&self) -> Option<SmtpAuthMethod> {
+        self.config.auth_method.or_else(|| {
+            if self.private_config.password.is_some() {
+                Some(SmtpAuthMethod::Plain)
+            } else {
+                None
+            }
+        })
+    }
+
+    /// Build an [`SmtpTransport`].
+    ///
+    /// If OAuth2 authentication is configured, this method will additionally load,
+    /// update and store the OAuth2-related state for this endpoint.
     fn build_transport(&self, tls: Tls, port: u16) -> Result<SmtpTransport, Error> {
-        let mut transport_builder = SmtpTransport::builder_dangerous(&self.config.server)
+        let transport_builder = SmtpTransport::builder_dangerous(&self.config.server)
             .tls(tls)
             .port(port)
             .timeout(Some(Duration::from_secs(SMTP_TIMEOUT.into())));
 
-        if let Some(username) = self.config.username.as_deref() {
-            if let Some(password) = self.private_config.password.as_deref() {
-                transport_builder = transport_builder.credentials((username, password).into());
-            } else {
-                return Err(Error::NotifyFailed(
-                    self.name().into(),
-                    Box::new(Error::Generic(
-                        "username is set but no password was provided".to_owned(),
-                    )),
-                ));
+        let transport_builder = match &self.auth_method() {
+            None => transport_builder,
+            Some(SmtpAuthMethod::Plain) => match (
+                self.config.username.as_deref(),
+                self.private_config.password.as_deref(),
+            ) {
+                (Some(username), Some(password)) => {
+                    transport_builder.credentials((username, password).into())
+                }
+                (Some(_), None) => {
+                    return Err(Error::NotifyFailed(
+                        self.name().into(),
+                        Box::new(Error::Generic(
+                            "username is set but no password was provided".to_owned(),
+                        )),
+                    ))
+                }
+                _ => transport_builder,
+            },
+            Some(method) => {
+                let state = State::load(self.name())?;
+
+                let refresh_token =
+                    state
+                        .oauth2_refresh_token
+                        .clone()
+                        .ok_or(Error::NotifyFailed(
+                            self.name().into(),
+                            Box::new(Error::Generic("no refresh token found".into())),
+                        ))?;
+                let token_exchange_result = self.get_access_token(&refresh_token, method)?;
+
+                state
+                    .set_oauth2_refresh_token(Some(
+                        token_exchange_result
+                            .refresh_token
+                            .map(|t| t.into_secret())
+                            .unwrap_or_else(|| refresh_token),
+                    ))
+                    .set_last_refreshed(proxmox_time::epoch_i64())
+                    .store(self.name())?;
+
+                transport_builder
+                    .credentials(Credentials::new(
+                        self.config.from_address.to_owned(),
+                        token_exchange_result.access_token.into_secret(),
+                    ))
+                    .authentication(vec![Mechanism::Xoauth2])
             }
         };
 
diff --git a/proxmox-notify/src/lib.rs b/proxmox-notify/src/lib.rs
index c1a5e535..996393c2 100644
--- a/proxmox-notify/src/lib.rs
+++ b/proxmox-notify/src/lib.rs
@@ -557,9 +557,7 @@ impl Bus {
                 }
 
                 match endpoint.send(notification) {
-                    Ok(_) => {
-                        info!("notified via target `{name}`");
-                    }
+                    Ok(_) => info!("notified via target `{name}`"),
                     Err(e) => {
                         // Only log on errors, do not propagate fail to the caller.
                         error!("could not notify via target `{name}`: {e}");
-- 
2.47.3