@oomol-lab/open-connector 1.6.0 → 1.6.2

package/src/providers/google-auth.d.ts

@@ -0,0 +1,93 @@
+import type { CredentialValidators, ProviderExecutors, ResolvedCredential } from "../core/types.ts";
+import type { OAuthProviderContext, ProviderFetch, ProviderProxyAuth, ProviderRuntimeHandler } from "./provider-runtime.ts";
+/**
+ * A Google service account identity read from a stored custom credential.
+ */
+interface GoogleServiceAccountCredential {
+    /** Service account email, e.g. `bot@project.iam.gserviceaccount.com`. */
+    clientEmail: string;
+    /** RSA private key in PEM format from the same key file. */
+    privateKey: string;
+    /** Optional Workspace user to impersonate through domain-wide delegation. */
+    subject?: string;
+}
+/**
+ * An access token minted for a service account, with the scopes Google actually granted.
+ */
+export interface GoogleServiceAccountToken {
+    accessToken: string;
+    expiresAtMs: number;
+    grantedScopes: string[];
+}
+export interface GoogleServiceAccountTokenRequest {
+    service: string;
+    serviceAccount: GoogleServiceAccountCredential;
+    scopes: readonly string[];
+    fetcher: ProviderFetch;
+    signal?: AbortSignal;
+}
+/**
+ * Read the stored values of a Google provider custom credential into a service
+ * account identity. `serviceAccountJson` must be the complete key JSON file
+ * downloaded from Google Cloud Console; escaped `\\n` line breaks in the
+ * private key are accepted.
+ */
+export declare function readGoogleServiceAccountCredential(values: Record<string, string | undefined>): GoogleServiceAccountCredential;
+/**
+ * Return an access token for the service account, minting one through the
+ * Google JWT bearer grant when no cached token is still usable. Tokens are
+ * cached per (service account key, subject, scope) key until shortly before
+ * expiry; the private-key fingerprint keeps a rotated or mismatched key from
+ * reusing a token minted for a different key of the same identity.
+ */
+export declare function createGoogleServiceAccountToken(input: GoogleServiceAccountTokenRequest): Promise<GoogleServiceAccountToken>;
+interface GoogleAccessTokenInput {
+    /** Provider slug used in errors, e.g. `googledrive`. */
+    service: string;
+    /** Provider-native scopes the minted token must carry. */
+    scopes: readonly string[];
+    /** The credential stored for the provider, if any. */
+    credential: ResolvedCredential | undefined;
+    fetcher: ProviderFetch;
+    signal?: AbortSignal;
+}
+/**
+ * The bearer identity Google API calls should use, from either stored OAuth
+ * credentials or a minted service account token.
+ */
+interface GoogleAccessToken {
+    accessToken: string;
+    tokenType: string;
+    accountId: string;
+}
+/**
+ * Resolve the access token for a Google provider from either auth mode:
+ * an `oauth2` credential passes its stored token through, while a
+ * `custom_credential` mints a service account token for the provider scopes.
+ */
+export declare function resolveGoogleAccessToken(input: GoogleAccessTokenInput): Promise<GoogleAccessToken>;
+interface GoogleProviderExecutorsOptions {
+    /** Provider-native scopes a minted service account token carries; see the provider `scopes.ts`. */
+    scopes: readonly string[];
+}
+/**
+ * Define executors for a Google provider that accepts both OAuth connections
+ * and service account custom credentials. Action handlers keep receiving the
+ * regular {@link OAuthProviderContext} in both cases.
+ */
+export declare function defineGoogleProviderExecutors(service: string, handlers: Record<string, ProviderRuntimeHandler<OAuthProviderContext>>, options: GoogleProviderExecutorsOptions): ProviderExecutors;
+/**
+ * Proxy auth for Google providers: the request carries the stored OAuth token,
+ * or a service account token minted for `scopes` when the connection is a
+ * service account credential. Pass it to {@link defineProviderProxy} as
+ * `auth`.
+ */
+export declare function googleBearerProxyAuth(scopes: readonly string[]): ProviderProxyAuth;
+/**
+ * The `customCredential` validator for Google providers: mint a service account
+ * token to prove the key works and report the service account identity — or the
+ * impersonated user, when domain-wide delegation is configured — as the
+ * connection profile.
+ */
+export declare function googleServiceAccountValidator(service: string, scopes: readonly string[]): NonNullable<CredentialValidators["customCredential"]>;
+export {};

package/src/providers/google-auth.js

@@ -0,0 +1,209 @@
+import { importPKCS8, SignJWT } from "jose";
+import { sha256Hex } from "../core/aws-sigv4.js";
+import { optionalNumberLike, optionalRecord, optionalString } from "../core/cast.js";
+import { defineProviderExecutors, providerInputError, ProviderRequestError, providerUserAgent, requiredInputString, runProviderRequest, } from "./provider-runtime.js";
+const googleTokenUrl = "https://oauth2.googleapis.com/token";
+const jwtBearerGrantType = "urn:ietf:params:oauth:grant-type:jwt-bearer";
+/** Google issues one-hour access tokens for JWT bearer grants; assertions may ask for at most one hour. */
+const googleTokenLifetimeSeconds = 3600;
+/** Mint a fresh token when the cached one has less than five minutes of life left. */
+const tokenRefreshSkewMs = 5 * 60_000;
+/**
+ * Read the stored values of a Google provider custom credential into a service
+ * account identity. `serviceAccountJson` must be the complete key JSON file
+ * downloaded from Google Cloud Console; escaped `\\n` line breaks in the
+ * private key are accepted.
+ */
+export function readGoogleServiceAccountCredential(values) {
+    const raw = requiredInputString(values.serviceAccountJson, "serviceAccountJson");
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw providerInputError("serviceAccountJson must be the complete service account key JSON downloaded from Google Cloud Console.");
+    }
+    const keyFile = optionalRecord(parsed);
+    if (!keyFile) {
+        throw providerInputError("serviceAccountJson must be the complete service account key JSON downloaded from Google Cloud Console.");
+    }
+    return {
+        clientEmail: requiredInputString(keyFile.client_email, "serviceAccountJson client_email"),
+        privateKey: requiredInputString(keyFile.private_key, "serviceAccountJson private_key").replaceAll("\\n", "\n"),
+        subject: optionalString(values.subject),
+    };
+}
+const serviceAccountTokenCache = new Map();
+/**
+ * Return an access token for the service account, minting one through the
+ * Google JWT bearer grant when no cached token is still usable. Tokens are
+ * cached per (service account key, subject, scope) key until shortly before
+ * expiry; the private-key fingerprint keeps a rotated or mismatched key from
+ * reusing a token minted for a different key of the same identity.
+ */
+export async function createGoogleServiceAccountToken(input) {
+    const cacheKey = [
+        sha256Hex(input.serviceAccount.privateKey),
+        input.serviceAccount.clientEmail,
+        input.serviceAccount.subject ?? "",
+        ...input.scopes,
+    ].join("\n");
+    const cached = serviceAccountTokenCache.get(cacheKey);
+    if (cached && cached.expiresAtMs - tokenRefreshSkewMs > Date.now()) {
+        return cached;
+    }
+    const token = await mintGoogleServiceAccountToken(input);
+    serviceAccountTokenCache.set(cacheKey, token);
+    return token;
+}
+async function mintGoogleServiceAccountToken(input) {
+    const assertion = await signServiceAccountAssertion(input.serviceAccount, input.scopes);
+    return runProviderRequest({ label: `${input.service} service account token`, signal: input.signal }, async (signal) => {
+        const response = await input.fetcher(googleTokenUrl, {
+            method: "POST",
+            headers: {
+                "content-type": "application/x-www-form-urlencoded",
+                "user-agent": providerUserAgent,
+            },
+            body: new URLSearchParams({ grant_type: jwtBearerGrantType, assertion }),
+            signal,
+        });
+        const payload = optionalRecord(await response.json().catch(() => undefined)) ?? {};
+        const accessToken = optionalString(payload.access_token);
+        if (!response.ok || !accessToken) {
+            const description = optionalString(payload.error_description) ?? optionalString(payload.error);
+            throw new ProviderRequestError(response.status, description ?? `${input.service} service account token request failed with HTTP ${response.status}`, payload);
+        }
+        return {
+            accessToken,
+            expiresAtMs: Date.now() + tokenLifetimeSeconds(payload) * 1000,
+            grantedScopes: optionalString(payload.scope)?.split(" ") ?? [...input.scopes],
+        };
+    });
+}
+function tokenLifetimeSeconds(payload) {
+    const seconds = optionalNumberLike(payload.expires_in);
+    return seconds !== undefined && seconds > 0 ? seconds : googleTokenLifetimeSeconds;
+}
+async function signServiceAccountAssertion(serviceAccount, scopes) {
+    let key;
+    try {
+        key = await importPKCS8(serviceAccount.privateKey, "RS256");
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        throw providerInputError(`serviceAccountJson private_key is not a valid RSA PEM key: ${reason}`);
+    }
+    const issuedAt = Math.floor(Date.now() / 1000);
+    const assertion = new SignJWT({ scope: scopes.join(" ") })
+        .setProtectedHeader({ alg: "RS256", typ: "JWT" })
+        .setIssuer(serviceAccount.clientEmail)
+        .setAudience(googleTokenUrl)
+        .setIssuedAt(issuedAt)
+        .setExpirationTime(issuedAt + googleTokenLifetimeSeconds);
+    return serviceAccount.subject ? assertion.setSubject(serviceAccount.subject).sign(key) : assertion.sign(key);
+}
+/**
+ * Resolve the access token for a Google provider from either auth mode:
+ * an `oauth2` credential passes its stored token through, while a
+ * `custom_credential` mints a service account token for the provider scopes.
+ */
+export async function resolveGoogleAccessToken(input) {
+    const credential = input.credential;
+    if (credential?.authType === "oauth2") {
+        return {
+            accessToken: credential.accessToken,
+            tokenType: credential.tokenType,
+            accountId: credential.profile.accountId,
+        };
+    }
+    if (credential?.authType === "custom_credential") {
+        const serviceAccount = readGoogleServiceAccountCredential(credential.values);
+        const token = await createGoogleServiceAccountToken({
+            service: input.service,
+            serviceAccount,
+            scopes: input.scopes,
+            fetcher: input.fetcher,
+            signal: input.signal,
+        });
+        return {
+            accessToken: token.accessToken,
+            tokenType: "Bearer",
+            accountId: serviceAccount.subject ?? serviceAccount.clientEmail,
+        };
+    }
+    throw new ProviderRequestError(401, `Connect ${input.service} with OAuth or service account credentials first.`);
+}
+/**
+ * Define executors for a Google provider that accepts both OAuth connections
+ * and service account custom credentials. Action handlers keep receiving the
+ * regular {@link OAuthProviderContext} in both cases.
+ */
+export function defineGoogleProviderExecutors(service, handlers, options) {
+    return defineProviderExecutors({
+        service,
+        handlers,
+        async createContext(context, fetcher) {
+            const resolved = await resolveGoogleAccessToken({
+                service,
+                scopes: options.scopes,
+                credential: await context.getCredential(service),
+                fetcher,
+                signal: context.signal,
+            });
+            const providerContext = {
+                accessToken: resolved.accessToken,
+                tokenType: resolved.tokenType,
+                accountId: resolved.accountId,
+                fetcher,
+                signal: context.signal,
+            };
+            if (context.transitFiles) {
+                providerContext.transitFiles = context.transitFiles;
+            }
+            return providerContext;
+        },
+    });
+}
+/**
+ * Proxy auth for Google providers: the request carries the stored OAuth token,
+ * or a service account token minted for `scopes` when the connection is a
+ * service account credential. Pass it to {@link defineProviderProxy} as
+ * `auth`.
+ */
+export function googleBearerProxyAuth(scopes) {
+    return {
+        type: "bearer_resolver",
+        async resolve({ context, service, fetcher, signal }) {
+            const resolved = await resolveGoogleAccessToken({
+                service,
+                scopes,
+                credential: await context.getCredential(service),
+                fetcher,
+                signal,
+            });
+            return { accessToken: resolved.accessToken, tokenType: resolved.tokenType };
+        },
+    };
+}
+/**
+ * The `customCredential` validator for Google providers: mint a service account
+ * token to prove the key works and report the service account identity — or the
+ * impersonated user, when domain-wide delegation is configured — as the
+ * connection profile.
+ */
+export function googleServiceAccountValidator(service, scopes) {
+    return async (input, { fetcher, signal }) => {
+        const serviceAccount = readGoogleServiceAccountCredential(input.values);
+        const token = await createGoogleServiceAccountToken({ service, serviceAccount, scopes, fetcher, signal });
+        return {
+            profile: {
+                accountId: serviceAccount.subject ?? serviceAccount.clientEmail,
+                displayName: serviceAccount.subject
+                    ? `${serviceAccount.subject} (impersonated by ${serviceAccount.clientEmail})`
+                    : serviceAccount.clientEmail,
+                grantedScopes: token.grantedScopes,
+            },
+        };
+    };
+}

package/src/providers/google_analytics/executors.js

@@ -1,6 +1,8 @@
 import { compactObject, objectArray, optionalBooleanOrNull, optionalIntegerOrNull, optionalObjectArray, optionalRecord as asOptionalObject, optionalScalarString, optionalString as optionalNonEmptyString, optionalStringOrNull, requiredRecord, } from "../../core/cast.js";
+import { defineGoogleProviderExecutors, googleBearerProxyAuth, googleServiceAccountValidator } from "../google-auth.js";
 import { googleJsonRequest } from "../google-runtime.js";
-import { defineOAuthProviderExecutors, defineProviderProxy, ProviderRequestError } from "../provider-runtime.js";
+import { defineProviderProxy, ProviderRequestError } from "../provider-runtime.js";
+import { googleAnalyticsOAuthScopes } from "./scopes.js";
 const service = "google_analytics";
 export const googleAnalyticsDataApiBaseUrl = "https://analyticsdata.googleapis.com/v1beta";
 export const googleAnalyticsDataApiAlphaBaseUrl = "https://analyticsdata.googleapis.com/v1alpha";
@@ -35,7 +37,9 @@ export const googleAnalyticsActionHandlers = {
     update_data_retention_settings: updateDataRetentionSettings,
     list_data_streams: listDataStreams,
 };
-export const executors = defineOAuthProviderExecutors(service, googleAnalyticsActionHandlers);
+export const executors = defineGoogleProviderExecutors(service, googleAnalyticsActionHandlers, {
+    scopes: googleAnalyticsOAuthScopes,
+});
 export const credentialValidators = {
     async oauth2(input, { fetcher }) {
         const profile = await googleJsonRequest("https://www.googleapis.com/oauth2/v3/userinfo", {
@@ -52,6 +56,7 @@ export const credentialValidators = {
             },
         };
     },
+    customCredential: googleServiceAccountValidator(service, googleAnalyticsOAuthScopes),
 };
 const businessReportTemplates = {
     run_acquisition_report: {
@@ -998,5 +1003,5 @@ function extractTrailingResourceId(value) {
 export const proxy = defineProviderProxy({
     service,
     baseUrl: "https://analyticsdata.googleapis.com/v1beta",
-    auth: { type: "oauth_bearer" },
+    auth: googleBearerProxyAuth(googleAnalyticsOAuthScopes),
 });

package/src/providers/google_analytics/scopes.d.ts

@@ -0,0 +1,5 @@
+export declare const googleAnalyticsReadonlyScope = "https://www.googleapis.com/auth/analytics.readonly";
+export declare const googleAnalyticsEditScope = "https://www.googleapis.com/auth/analytics.edit";
+export declare const googleAnalyticsReadScopes: string[];
+export declare const googleAnalyticsWriteScopes: string[];
+export declare const googleAnalyticsOAuthScopes: string[];

package/src/providers/google_analytics/scopes.js

@@ -0,0 +1,5 @@
+export const googleAnalyticsReadonlyScope = "https://www.googleapis.com/auth/analytics.readonly";
+export const googleAnalyticsEditScope = "https://www.googleapis.com/auth/analytics.edit";
+export const googleAnalyticsReadScopes = [googleAnalyticsReadonlyScope];
+export const googleAnalyticsWriteScopes = [googleAnalyticsEditScope];
+export const googleAnalyticsOAuthScopes = [googleAnalyticsReadonlyScope, googleAnalyticsEditScope];

package/src/providers/google_bigquery/executors.js

@@ -1,6 +1,8 @@
 import { booleanString, compactObject, optionalBoolean, optionalInteger as asOptionalInteger, requiredRecord, } from "../../core/cast.js";
+import { defineGoogleProviderExecutors, googleBearerProxyAuth, googleServiceAccountValidator } from "../google-auth.js";
 import { googleJsonRequest, googleRequest } from "../google-runtime.js";
-import { defineOAuthProviderExecutors, defineProviderProxy, ProviderRequestError } from "../provider-runtime.js";
+import { defineProviderProxy, ProviderRequestError } from "../provider-runtime.js";
+import { googleBigQueryOAuthScopes } from "./scopes.js";
 const bigQueryApiBaseUrl = "https://bigquery.googleapis.com/bigquery/v2";
 export const googleBigQueryActionHandlers = {
     list_projects: listProjects,
@@ -36,11 +38,13 @@ export const googleBigQueryActionHandlers = {
     patch_model: patchModel,
     delete_model: deleteModel,
 };
-export const executors = defineOAuthProviderExecutors("google_bigquery", googleBigQueryActionHandlers);
+export const executors = defineGoogleProviderExecutors("google_bigquery", googleBigQueryActionHandlers, {
+    scopes: googleBigQueryOAuthScopes,
+});
 export const proxy = defineProviderProxy({
     service: "google_bigquery",
     baseUrl: bigQueryApiBaseUrl,
-    auth: { type: "oauth_bearer" },
+    auth: googleBearerProxyAuth(googleBigQueryOAuthScopes),
     skipDnsValidation: true,
 });
 export const credentialValidators = {
@@ -59,6 +63,7 @@ export const credentialValidators = {
             },
         };
     },
+    customCredential: googleServiceAccountValidator("google_bigquery", googleBigQueryOAuthScopes),
 };
 async function listProjects(input, context) {
     const payload = await googleBigQueryJsonRequest(`${bigQueryApiBaseUrl}/projects`, {

package/src/providers/google_bigquery/scopes.d.ts

@@ -0,0 +1,11 @@
+export declare const bigQueryScope = "https://www.googleapis.com/auth/bigquery";
+export declare const bigQueryReadOnlyScope = "https://www.googleapis.com/auth/bigquery.readonly";
+export declare const bigQueryInsertDataScope = "https://www.googleapis.com/auth/bigquery.insertdata";
+export declare const devStorageReadOnlyScope = "https://www.googleapis.com/auth/devstorage.read_only";
+export declare const devStorageReadWriteScope = "https://www.googleapis.com/auth/devstorage.read_write";
+export declare const googleBigQueryReadScopes: string[];
+export declare const googleBigQueryInsertDataScopes: string[];
+export declare const googleBigQueryWriteScopes: string[];
+export declare const googleBigQueryLoadJobScopes: string[];
+export declare const googleBigQueryExtractJobScopes: string[];
+export declare const googleBigQueryOAuthScopes: string[];

package/src/providers/google_bigquery/scopes.js

@@ -0,0 +1,17 @@
+export const bigQueryScope = "https://www.googleapis.com/auth/bigquery";
+export const bigQueryReadOnlyScope = "https://www.googleapis.com/auth/bigquery.readonly";
+export const bigQueryInsertDataScope = "https://www.googleapis.com/auth/bigquery.insertdata";
+export const devStorageReadOnlyScope = "https://www.googleapis.com/auth/devstorage.read_only";
+export const devStorageReadWriteScope = "https://www.googleapis.com/auth/devstorage.read_write";
+export const googleBigQueryReadScopes = [bigQueryReadOnlyScope];
+export const googleBigQueryInsertDataScopes = [bigQueryInsertDataScope];
+export const googleBigQueryWriteScopes = [bigQueryScope];
+export const googleBigQueryLoadJobScopes = [bigQueryScope, devStorageReadOnlyScope];
+export const googleBigQueryExtractJobScopes = [bigQueryScope, devStorageReadWriteScope];
+export const googleBigQueryOAuthScopes = [
+    bigQueryScope,
+    bigQueryReadOnlyScope,
+    bigQueryInsertDataScope,
+    devStorageReadOnlyScope,
+    devStorageReadWriteScope,
+];

package/src/providers/google_search_console/executors.js

@@ -1,6 +1,8 @@
 import { compactObject, optionalNumber, optionalRecord as asOptionalObject, optionalString as asOptionalString, pickOptionalInteger, pickOptionalString as pickNonEmptyString, } from "../../core/cast.js";
+import { defineGoogleProviderExecutors, googleBearerProxyAuth, googleServiceAccountValidator } from "../google-auth.js";
 import { googleJsonRequest, googleRequest } from "../google-runtime.js";
-import { defineOAuthProviderExecutors, defineProviderProxy, ProviderRequestError } from "../provider-runtime.js";
+import { defineProviderProxy, ProviderRequestError } from "../provider-runtime.js";
+import { googleSearchConsoleOAuthScopes } from "./scopes.js";
 const service = "google_search_console";
 export const searchConsoleApiBaseUrl = "https://www.googleapis.com/webmasters/v3";
 export const urlInspectionApiBaseUrl = "https://searchconsole.googleapis.com/v1";
@@ -36,7 +38,9 @@ export const googleSearchConsoleActionHandlers = {
         return inspectUrl(input, deps);
     },
 };
-export const executors = defineOAuthProviderExecutors(service, googleSearchConsoleActionHandlers);
+export const executors = defineGoogleProviderExecutors(service, googleSearchConsoleActionHandlers, {
+    scopes: googleSearchConsoleOAuthScopes,
+});
 export const credentialValidators = {
     async oauth2(input, { fetcher }) {
         const profile = await googleJsonRequest("https://www.googleapis.com/oauth2/v3/userinfo", {
@@ -53,6 +57,7 @@ export const credentialValidators = {
             },
         };
     },
+    customCredential: googleServiceAccountValidator(service, googleSearchConsoleOAuthScopes),
 };
 async function listSites(_input, { accessToken, fetcher }) {
     const payload = await searchConsoleJsonRequest("/sites", {
@@ -289,5 +294,5 @@ async function urlInspectionJsonRequest(path, input) {
 export const proxy = defineProviderProxy({
     service,
     baseUrl: "https://www.googleapis.com/webmasters/v3",
-    auth: { type: "oauth_bearer" },
+    auth: googleBearerProxyAuth(googleSearchConsoleOAuthScopes),
 });

package/src/providers/google_search_console/scopes.d.ts

@@ -0,0 +1,5 @@
+export declare const googleSearchConsoleReadonlyScope = "https://www.googleapis.com/auth/webmasters.readonly";
+export declare const googleSearchConsoleFullScope = "https://www.googleapis.com/auth/webmasters";
+export declare const googleSearchConsoleReadScopes: string[];
+export declare const googleSearchConsoleWriteScopes: string[];
+export declare const googleSearchConsoleOAuthScopes: string[];

package/src/providers/google_search_console/scopes.js

@@ -0,0 +1,8 @@
+export const googleSearchConsoleReadonlyScope = "https://www.googleapis.com/auth/webmasters.readonly";
+export const googleSearchConsoleFullScope = "https://www.googleapis.com/auth/webmasters";
+export const googleSearchConsoleReadScopes = [googleSearchConsoleReadonlyScope];
+export const googleSearchConsoleWriteScopes = [googleSearchConsoleFullScope];
+export const googleSearchConsoleOAuthScopes = [
+    googleSearchConsoleReadonlyScope,
+    googleSearchConsoleFullScope,
+];

package/src/providers/googlecalendar/executors.js

@@ -1,7 +1,9 @@
 import { compactObject, optionalString, pickOptionalBoolean, pickOptionalInteger, pickOptionalString, requiredRecord, } from "../../core/cast.js";
-import { combineProviderActionHandlers, defineOAuthProviderExecutors, defineProviderProxy, ProviderRequestError, } from "../provider-runtime.js";
+import { defineGoogleProviderExecutors, googleBearerProxyAuth, googleServiceAccountValidator } from "../google-auth.js";
+import { combineProviderActionHandlers, defineProviderProxy, ProviderRequestError } from "../provider-runtime.js";
 import { googlecalendarEventActionHandlers } from "./runtime-events.js";
 import { googlecalendarApiBaseUrl, googlecalendarJsonRequest, googlecalendarRequest, resolveCalendarId, resolveRuleId, resolveSettingId, } from "./runtime-shared.js";
+import { googlecalendarOAuthScopes } from "./scopes.js";
 function asObject(value) {
     return requiredRecord(value, "object input", (message) => new ProviderRequestError(400, message));
 }
@@ -87,11 +89,13 @@ export const googlecalendarActionHandlers = combineProviderActionHandlers("googl
         return deleteAclRule(input, deps);
     },
 }, googlecalendarEventActionHandlers);
-export const executors = defineOAuthProviderExecutors("googlecalendar", googlecalendarActionHandlers);
+export const executors = defineGoogleProviderExecutors("googlecalendar", googlecalendarActionHandlers, {
+    scopes: googlecalendarOAuthScopes,
+});
 export const proxy = defineProviderProxy({
     service: "googlecalendar",
     baseUrl: googlecalendarApiBaseUrl,
-    auth: { type: "oauth_bearer" },
+    auth: googleBearerProxyAuth(googlecalendarOAuthScopes),
     skipDnsValidation: true,
 });
 export const credentialValidators = {
@@ -111,6 +115,7 @@ export const credentialValidators = {
             },
         };
     },
+    customCredential: googleServiceAccountValidator("googlecalendar", googlecalendarOAuthScopes),
 };
 async function listCalendars(input, { accessToken, fetcher }) {
     const query = compactObject({

package/src/providers/googlecalendar/scopes.d.ts

@@ -0,0 +1,14 @@
+export declare const googleCalendarReadonlyScope = "https://www.googleapis.com/auth/calendar.readonly";
+export declare const googleCalendarEventsScope = "https://www.googleapis.com/auth/calendar.events";
+export declare const googleCalendarCalendarsScope = "https://www.googleapis.com/auth/calendar.calendars";
+export declare const googleCalendarCalendarListScope = "https://www.googleapis.com/auth/calendar.calendarlist";
+export declare const googleCalendarSettingsReadonlyScope = "https://www.googleapis.com/auth/calendar.settings.readonly";
+export declare const googleCalendarAclsScope = "https://www.googleapis.com/auth/calendar.acls";
+export declare const googleCalendarAclsReadonlyScope = "https://www.googleapis.com/auth/calendar.acls.readonly";
+export declare const googlecalendarReadScopes: string[];
+export declare const googlecalendarEventsWriteScopes: string[];
+export declare const googlecalendarCalendarsWriteScopes: string[];
+export declare const googlecalendarSettingsReadScopes: string[];
+export declare const googlecalendarAclReadScopes: string[];
+export declare const googlecalendarAclWriteScopes: string[];
+export declare const googlecalendarOAuthScopes: string[];

package/src/providers/googlecalendar/scopes.js

@@ -0,0 +1,25 @@
+export const googleCalendarReadonlyScope = "https://www.googleapis.com/auth/calendar.readonly";
+export const googleCalendarEventsScope = "https://www.googleapis.com/auth/calendar.events";
+export const googleCalendarCalendarsScope = "https://www.googleapis.com/auth/calendar.calendars";
+export const googleCalendarCalendarListScope = "https://www.googleapis.com/auth/calendar.calendarlist";
+export const googleCalendarSettingsReadonlyScope = "https://www.googleapis.com/auth/calendar.settings.readonly";
+export const googleCalendarAclsScope = "https://www.googleapis.com/auth/calendar.acls";
+export const googleCalendarAclsReadonlyScope = "https://www.googleapis.com/auth/calendar.acls.readonly";
+export const googlecalendarReadScopes = [googleCalendarReadonlyScope];
+export const googlecalendarEventsWriteScopes = [googleCalendarEventsScope];
+export const googlecalendarCalendarsWriteScopes = [
+    googleCalendarCalendarsScope,
+    googleCalendarCalendarListScope,
+];
+export const googlecalendarSettingsReadScopes = [googleCalendarSettingsReadonlyScope];
+export const googlecalendarAclReadScopes = [googleCalendarAclsReadonlyScope];
+export const googlecalendarAclWriteScopes = [googleCalendarAclsScope];
+export const googlecalendarOAuthScopes = [
+    googleCalendarReadonlyScope,
+    googleCalendarEventsScope,
+    googleCalendarCalendarsScope,
+    googleCalendarCalendarListScope,
+    googleCalendarSettingsReadonlyScope,
+    googleCalendarAclsScope,
+    googleCalendarAclsReadonlyScope,
+];

package/src/providers/googlechat/executors.js

@@ -1,7 +1,9 @@
 import { compactObject, optionalBoolean, optionalInteger, optionalRawString, optionalRecord, optionalString, } from "../../core/cast.js";
+import { defineGoogleProviderExecutors, googleBearerProxyAuth, googleServiceAccountValidator } from "../google-auth.js";
 import { googleJsonRequest } from "../google-runtime.js";
 import { asObject } from "../googledrive/runtime-shared.js";
-import { defineOAuthProviderExecutors, defineProviderProxy, ProviderRequestError } from "../provider-runtime.js";
+import { defineProviderProxy, ProviderRequestError } from "../provider-runtime.js";
+import { googleChatOAuthScopes } from "./scopes.js";
 export const googleChatApiBaseUrl = "https://chat.googleapis.com/v1";
 const service = "googlechat";
 const googleUserInfoUrl = "https://www.googleapis.com/oauth2/v3/userinfo";
@@ -13,11 +15,13 @@ export const googleChatActionHandlers = {
     list_messages: listMessages,
     get_message: getMessage,
 };
-export const executors = defineOAuthProviderExecutors(service, googleChatActionHandlers);
+export const executors = defineGoogleProviderExecutors(service, googleChatActionHandlers, {
+    scopes: googleChatOAuthScopes,
+});
 export const proxy = defineProviderProxy({
     service,
     baseUrl: googleChatApiBaseUrl,
-    auth: { type: "oauth_bearer" },
+    auth: googleBearerProxyAuth(googleChatOAuthScopes),
     skipDnsValidation: true,
 });
 export const credentialValidators = {
@@ -38,6 +42,7 @@ export const credentialValidators = {
             },
         };
     },
+    customCredential: googleServiceAccountValidator(service, googleChatOAuthScopes),
 };
 async function listSpaces(input, context) {
     const payload = await googleChatJsonRequest(`${googleChatApiBaseUrl}/spaces`, {

package/src/providers/googlechat/scopes.d.ts

@@ -0,0 +1,6 @@
+export declare const googleChatSpacesReadonlyScope = "https://www.googleapis.com/auth/chat.spaces.readonly";
+export declare const googleChatMessagesReadonlyScope = "https://www.googleapis.com/auth/chat.messages.readonly";
+export declare const googleOpenIdScope = "openid";
+export declare const googleEmailScope = "email";
+export declare const googleProfileScope = "profile";
+export declare const googleChatOAuthScopes: string[];

package/src/providers/googlechat/scopes.js

@@ -0,0 +1,12 @@
+export const googleChatSpacesReadonlyScope = "https://www.googleapis.com/auth/chat.spaces.readonly";
+export const googleChatMessagesReadonlyScope = "https://www.googleapis.com/auth/chat.messages.readonly";
+export const googleOpenIdScope = "openid";
+export const googleEmailScope = "email";
+export const googleProfileScope = "profile";
+export const googleChatOAuthScopes = [
+    googleChatSpacesReadonlyScope,
+    googleChatMessagesReadonlyScope,
+    googleOpenIdScope,
+    googleEmailScope,
+    googleProfileScope,
+];