Add support for OAuth

[lwcorp]

This project relies on supplying it usernames/passwords, which is not only insecure but Google announced that starting last year it can no longer be used in Google Workspace. It can still be used in regular Gmail via the aforementioned semi secret setting, but eventually it will probably be blocked from there too.

So please change it to use OAuth instead. Since you use native PHP IMAP commands, you'll discover soon enough PHP can't natively use OAuth. This means you'll have to rely on a third party library. But it's the only way to keep your project from an early demise.

[breakerh]

Thanks for the heads up. I will look if I can integrate the Gmail api for people migrating gsuite/gmail.

[lwcorp]

A quick look at Gmail's API seems to suggest they offer only what you achieve in their normal UI, just quicker and more efficiently.

I think OAuth is unavoidable and not just for Gmail, since it became a general web standard, as Wikipedia suggests.

[breakerh]

Had a little look into solving this.
I will use a third party module that enables imap with oauth2.

https://github.com/laminas/laminas-mail

[lwcorp]

OAuth is a touchy subject in PHP, I suggest don't go for any modules which don't write in high capital bold letters they support it.

The one you mentioned has a 2 years' unsolved ticket about its lack of OAuth plus its official documentation clearly states:

All shipped connection classes require:
username
password

To be honest, its documentation makes it seem like it's a SMTP e-mail sender, not an IMAP e-mail manager like your project. Actually, its GitHub summary is "Provides generalized functionality to compose and send".
This means it probably won't help you in any way.

[breakerh]

Well I just did some tests with laminas and created a very simple parser.. and it actually worked quite well. :)
So for this use case it's actually not that bad.

[lwcorp]

Does it mean it supports IMAP and not just SMTP?

[breakerh]

Jip used Google api to generate oauth token and provided it through the correct way to get all messages. Didn't test mails older then 3 years..

Will do some stress testing etc next time.

[lwcorp]

Who/What is Jip? Not sure I understand what you mean.

[breakerh]

Who/What is Jip? Not sure I understand what you mean.

sorry i meant. "Yes i used Google api..."