@hera-al/server 1.6.12 → 1.6.13

package/bundled/google-workspace/scripts/drive.sh

@@ -0,0 +1,459 @@
+#!/usr/bin/env bash
+# Google Drive API client — REST API v3 with OAuth2
+# Usage: drive.sh <command> [options]
+#
+# Commands:
+#   list [--max N] [--folder ID]           List files
+#   search "query" [--max N]               Search files (Drive query syntax)
+#   info <fileId>                          Get file metadata
+#   read <fileId>                          Read/export file content (text)
+#   download <fileId> --output PATH        Download binary file
+#   upload PATH [--folder ID] [--name N]   Upload a file
+#   create-doc --name N [--content T]      Create a Google Doc
+#   move <fileId> --to FOLDER_ID           Move file to folder
+#   rename <fileId> --name NEW_NAME        Rename a file
+#   share <fileId> [options]               Share a file
+#   trash <fileId>                         Move to trash
+
+set -euo pipefail
+
+# --- Config ---
+API_BASE="https://www.googleapis.com/drive/v3"
+UPLOAD_BASE="https://www.googleapis.com/upload/drive/v3"
+TOKEN_FILE="${HOME}/.gmab-google-token.json"
+
+# --- Token management ---
+get_access_token() {
+  local client_id="${GOOGLE_CLIENT_ID:-}"
+  local client_secret="${GOOGLE_CLIENT_SECRET:-}"
+  local refresh_token="${GOOGLE_REFRESH_TOKEN:-}"
+
+  # Try token file if env vars not set
+  if [[ -z "$refresh_token" && -f "$TOKEN_FILE" ]]; then
+    client_id=$(jq -r '.client_id // empty' "$TOKEN_FILE" 2>/dev/null || true)
+    client_secret=$(jq -r '.client_secret // empty' "$TOKEN_FILE" 2>/dev/null || true)
+    refresh_token=$(jq -r '.refresh_token // empty' "$TOKEN_FILE" 2>/dev/null || true)
+  fi
+
+  if [[ -z "$client_id" || -z "$client_secret" || -z "$refresh_token" ]]; then
+    echo "ERROR: Google credentials not configured." >&2
+    echo "Set GOOGLE_CLIENT_ID, GOOGLE_CLIENT_SECRET, GOOGLE_REFRESH_TOKEN" >&2
+    echo "Or run scripts/google/auth.sh to set up OAuth2." >&2
+    exit 1
+  fi
+
+  # Check cached token
+  if [[ -f "$TOKEN_FILE" ]]; then
+    local cached_token cached_expiry
+    cached_token=$(jq -r '.access_token // empty' "$TOKEN_FILE" 2>/dev/null || true)
+    cached_expiry=$(jq -r '.expires_at // 0' "$TOKEN_FILE" 2>/dev/null || true)
+    local now
+    now=$(date +%s)
+    if [[ -n "$cached_token" && "$cached_expiry" -gt "$now" ]]; then
+      echo "$cached_token"
+      return
+    fi
+  fi
+
+  # Refresh the token
+  local response
+  response=$(curl -s "https://oauth2.googleapis.com/token" \
+    -d "client_id=$client_id" \
+    -d "client_secret=$client_secret" \
+    -d "refresh_token=$refresh_token" \
+    -d "grant_type=refresh_token")
+
+  local access_token
+  access_token=$(echo "$response" | jq -r '.access_token // empty')
+  local expires_in
+  expires_in=$(echo "$response" | jq -r '.expires_in // 3600')
+
+  if [[ -z "$access_token" ]]; then
+    echo "ERROR: Failed to refresh access token" >&2
+    echo "$response" >&2
+    exit 1
+  fi
+
+  # Cache token
+  local expires_at
+  expires_at=$(($(date +%s) + expires_in - 60))
+
+  if [[ -f "$TOKEN_FILE" ]]; then
+    local tmp
+    tmp=$(jq --arg at "$access_token" --argjson ea "$expires_at" \
+      '. + {access_token: $at, expires_at: $ea}' "$TOKEN_FILE")
+    echo "$tmp" > "$TOKEN_FILE"
+  else
+    jq -n \
+      --arg ci "$client_id" \
+      --arg cs "$client_secret" \
+      --arg rt "$refresh_token" \
+      --arg at "$access_token" \
+      --argjson ea "$expires_at" \
+      '{client_id: $ci, client_secret: $cs, refresh_token: $rt, access_token: $at, expires_at: $ea}' \
+      > "$TOKEN_FILE"
+  fi
+  chmod 600 "$TOKEN_FILE"
+
+  echo "$access_token"
+}
+
+api_get() {
+  local url="$1"
+  local token
+  token=$(get_access_token)
+  curl -s -H "Authorization: Bearer $token" "$url"
+}
+
+api_post() {
+  local url="$1"
+  local data="${2:-}"
+  local token
+  token=$(get_access_token)
+  if [[ -n "$data" ]]; then
+    curl -s -H "Authorization: Bearer $token" \
+      -H "Content-Type: application/json" \
+      -d "$data" "$url"
+  else
+    curl -s -X POST -H "Authorization: Bearer $token" "$url"
+  fi
+}
+
+api_patch() {
+  local url="$1"
+  local data="$2"
+  local token
+  token=$(get_access_token)
+  curl -s -X PATCH -H "Authorization: Bearer $token" \
+    -H "Content-Type: application/json" \
+    -d "$data" "$url"
+}
+
+api_download() {
+  local url="$1"
+  local output="$2"
+  local token
+  token=$(get_access_token)
+  curl -s -H "Authorization: Bearer $token" -o "$output" "$url"
+}
+
+urlencode() {
+  python3 -c "import sys, urllib.parse; print(urllib.parse.quote(sys.stdin.read().strip()))" <<< "$1" 2>/dev/null || echo "$1"
+}
+
+# --- Commands ---
+cmd_list() {
+  local max=20 folder=""
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --max) max="$2"; shift 2 ;;
+      --folder) folder="$2"; shift 2 ;;
+      *) shift ;;
+    esac
+  done
+
+  local query="trashed=false"
+  if [[ -n "$folder" ]]; then
+    query="'${folder}' in parents and trashed=false"
+  fi
+
+  local encoded_q
+  encoded_q=$(urlencode "$query")
+
+  api_get "${API_BASE}/files?pageSize=${max}&q=${encoded_q}&fields=files(id,name,mimeType,modifiedTime,size,parents)&orderBy=modifiedTime%20desc" | \
+    jq '[.files[]? | {id, name, mimeType, modifiedTime, size, parents}]'
+}
+
+cmd_search() {
+  local query="$1"; shift
+  local max=20
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --max) max="$2"; shift 2 ;;
+      *) shift ;;
+    esac
+  done
+
+  local full_query="${query} and trashed=false"
+  local encoded_q
+  encoded_q=$(urlencode "$full_query")
+
+  api_get "${API_BASE}/files?pageSize=${max}&q=${encoded_q}&fields=files(id,name,mimeType,modifiedTime,size,parents)&orderBy=modifiedTime%20desc" | \
+    jq '[.files[]? | {id, name, mimeType, modifiedTime, size, parents}]'
+}
+
+cmd_info() {
+  local file_id="$1"
+  api_get "${API_BASE}/files/${file_id}?fields=id,name,mimeType,modifiedTime,createdTime,size,parents,webViewLink,webContentLink,shared,owners,permissions" | jq .
+}
+
+cmd_read() {
+  local file_id="$1"
+
+  # First get the mime type to determine export format
+  local info
+  info=$(api_get "${API_BASE}/files/${file_id}?fields=mimeType,name")
+  local mime
+  mime=$(echo "$info" | jq -r '.mimeType')
+  local name
+  name=$(echo "$info" | jq -r '.name')
+
+  echo "# File: $name ($mime)" >&2
+
+  case "$mime" in
+    application/vnd.google-apps.document)
+      api_get "${API_BASE}/files/${file_id}/export?mimeType=text/plain"
+      ;;
+    application/vnd.google-apps.spreadsheet)
+      api_get "${API_BASE}/files/${file_id}/export?mimeType=text/csv"
+      ;;
+    application/vnd.google-apps.presentation)
+      api_get "${API_BASE}/files/${file_id}/export?mimeType=text/plain"
+      ;;
+    text/*|application/json|application/xml|application/javascript)
+      api_get "${API_BASE}/files/${file_id}?alt=media"
+      ;;
+    *)
+      echo "Binary file — use 'download' command instead." >&2
+      echo "MIME type: $mime"
+      ;;
+  esac
+}
+
+cmd_download() {
+  local file_id="$1"; shift
+  local output=""
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --output|-o) output="$2"; shift 2 ;;
+      *) shift ;;
+    esac
+  done
+
+  if [[ -z "$output" ]]; then
+    # Auto-name from file metadata
+    local info
+    info=$(api_get "${API_BASE}/files/${file_id}?fields=name")
+    output=$(echo "$info" | jq -r '.name')
+  fi
+
+  # Check if it's a Google Workspace file (needs export)
+  local info
+  info=$(api_get "${API_BASE}/files/${file_id}?fields=mimeType")
+  local mime
+  mime=$(echo "$info" | jq -r '.mimeType')
+
+  case "$mime" in
+    application/vnd.google-apps.document)
+      api_download "${API_BASE}/files/${file_id}/export?mimeType=application/pdf" "$output"
+      ;;
+    application/vnd.google-apps.spreadsheet)
+      api_download "${API_BASE}/files/${file_id}/export?mimeType=application/pdf" "$output"
+      ;;
+    application/vnd.google-apps.presentation)
+      api_download "${API_BASE}/files/${file_id}/export?mimeType=application/pdf" "$output"
+      ;;
+    *)
+      api_download "${API_BASE}/files/${file_id}?alt=media" "$output"
+      ;;
+  esac
+
+  echo "Downloaded to: $output"
+}
+
+cmd_upload() {
+  local file_path="$1"; shift
+  local folder="" name=""
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --folder) folder="$2"; shift 2 ;;
+      --name) name="$2"; shift 2 ;;
+      *) shift ;;
+    esac
+  done
+
+  if [[ ! -f "$file_path" ]]; then
+    echo "ERROR: File not found: $file_path" >&2
+    exit 1
+  fi
+
+  [[ -z "$name" ]] && name=$(basename "$file_path")
+
+  # Detect MIME type
+  local mime
+  mime=$(file --mime-type -b "$file_path")
+
+  # Build metadata
+  local metadata
+  if [[ -n "$folder" ]]; then
+    metadata=$(jq -n --arg name "$name" --arg folder "$folder" '{name: $name, parents: [$folder]}')
+  else
+    metadata=$(jq -n --arg name "$name" '{name: $name}')
+  fi
+
+  local token
+  token=$(get_access_token)
+
+  # Multipart upload
+  local boundary="gmab_upload_boundary"
+  local tmpfile
+  tmpfile=$(mktemp)
+
+  {
+    printf -- "--%s\r\nContent-Type: application/json; charset=UTF-8\r\n\r\n%s\r\n" "$boundary" "$metadata"
+    printf -- "--%s\r\nContent-Type: %s\r\n\r\n" "$boundary" "$mime"
+    cat "$file_path"
+    printf "\r\n--%s--\r\n" "$boundary"
+  } > "$tmpfile"
+
+  curl -s -X POST \
+    -H "Authorization: Bearer $token" \
+    -H "Content-Type: multipart/related; boundary=$boundary" \
+    --data-binary "@$tmpfile" \
+    "${UPLOAD_BASE}/files?uploadType=multipart&fields=id,name,mimeType,webViewLink" | jq .
+
+  rm -f "$tmpfile"
+}
+
+cmd_create_doc() {
+  local name="" content="" folder=""
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --name) name="$2"; shift 2 ;;
+      --content) content="$2"; shift 2 ;;
+      --folder) folder="$2"; shift 2 ;;
+      *) shift ;;
+    esac
+  done
+
+  if [[ -z "$name" ]]; then
+    echo "ERROR: --name is required" >&2
+    exit 1
+  fi
+
+  local metadata
+  if [[ -n "$folder" ]]; then
+    metadata=$(jq -n --arg name "$name" --arg folder "$folder" \
+      '{name: $name, mimeType: "application/vnd.google-apps.document", parents: [$folder]}')
+  else
+    metadata=$(jq -n --arg name "$name" \
+      '{name: $name, mimeType: "application/vnd.google-apps.document"}')
+  fi
+
+  local result
+  result=$(api_post "${API_BASE}/files?fields=id,name,mimeType,webViewLink" "$metadata")
+  echo "$result" | jq .
+
+  # If content provided, update the document
+  if [[ -n "$content" ]]; then
+    local file_id
+    file_id=$(echo "$result" | jq -r '.id')
+    # For Google Docs, we need to use the Docs API to insert content
+    # Simpler approach: create as plain text then convert
+    echo "Note: Document created. Content insertion for Google Docs requires the Docs API." >&2
+    echo "Consider uploading a .txt file with --mime application/vnd.google-apps.document instead." >&2
+  fi
+}
+
+cmd_move() {
+  local file_id="$1"; shift
+  local to_folder=""
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --to) to_folder="$2"; shift 2 ;;
+      *) shift ;;
+    esac
+  done
+
+  if [[ -z "$to_folder" ]]; then
+    echo "ERROR: --to folder ID is required" >&2
+    exit 1
+  fi
+
+  # Get current parents
+  local info
+  info=$(api_get "${API_BASE}/files/${file_id}?fields=parents")
+  local current_parents
+  current_parents=$(echo "$info" | jq -r '.parents[]? // empty' | paste -sd, -)
+
+  local token
+  token=$(get_access_token)
+  curl -s -X PATCH \
+    -H "Authorization: Bearer $token" \
+    -H "Content-Type: application/json" \
+    "${API_BASE}/files/${file_id}?addParents=${to_folder}&removeParents=${current_parents}&fields=id,name,parents" | jq .
+}
+
+cmd_rename() {
+  local file_id="$1"; shift
+  local new_name=""
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --name) new_name="$2"; shift 2 ;;
+      *) shift ;;
+    esac
+  done
+
+  if [[ -z "$new_name" ]]; then
+    echo "ERROR: --name is required" >&2
+    exit 1
+  fi
+
+  api_patch "${API_BASE}/files/${file_id}?fields=id,name" \
+    "$(jq -n --arg name "$new_name" '{name: $name}')" | jq .
+}
+
+cmd_share() {
+  local file_id="$1"; shift
+  local email="" role="reader" anyone=false
+  while [[ $# -gt 0 ]]; do
+    case "$1" in
+      --email) email="$2"; shift 2 ;;
+      --role) role="$2"; shift 2 ;;
+      --anyone) anyone=true; shift ;;
+      *) shift ;;
+    esac
+  done
+
+  local data
+  if [[ "$anyone" == "true" ]]; then
+    data=$(jq -n --arg role "$role" '{type: "anyone", role: $role}')
+  elif [[ -n "$email" ]]; then
+    data=$(jq -n --arg email "$email" --arg role "$role" '{type: "user", emailAddress: $email, role: $role}')
+  else
+    echo "ERROR: --email or --anyone is required" >&2
+    exit 1
+  fi
+
+  api_post "${API_BASE}/files/${file_id}/permissions" "$data" | jq .
+}
+
+cmd_trash() {
+  local file_id="$1"
+  api_patch "${API_BASE}/files/${file_id}" '{"trashed": true}' | jq .
+}
+
+# --- Dispatch ---
+COMMAND="${1:-}"
+shift || true
+
+case "$COMMAND" in
+  list) cmd_list "$@" ;;
+  search) cmd_search "$@" ;;
+  info) cmd_info "$@" ;;
+  read) cmd_read "$@" ;;
+  download) cmd_download "$@" ;;
+  upload) cmd_upload "$@" ;;
+  create-doc) cmd_create_doc "$@" ;;
+  move) cmd_move "$@" ;;
+  rename) cmd_rename "$@" ;;
+  share) cmd_share "$@" ;;
+  trash) cmd_trash "$@" ;;
+  *)
+    echo "Usage: drive.sh <command> [options]" >&2
+    echo "" >&2
+    echo "Commands: list, search, info, read, download, upload," >&2
+    echo "          create-doc, move, rename, share, trash" >&2
+    exit 1
+    ;;
+esac