@trops/dash-core 0.1.337 → 0.1.340

package/dist/mcp/servers/google-drive.js

@@ -4,9 +4,9 @@
  *
  * Tools: search, list_folder, create_folder, read_file, write_file, resolve_path
  *
- * OAuth uses PKCE with a bundled client_id — no client_secret, no per-user
- * GCP project setup. Users just run `node google-drive.js auth` to grant
- * Drive access via browser.
+ * OAuth uses PKCE with bundled app credentials (client_id + obfuscated
+ * client_secret). No per-user GCP project setup — users just click
+ * "Connect Google Drive" to grant access via browser.
  *
  * Usage:
  *   MCP server:  node google-drive.js          (stdio transport)
@@ -33,17 +33,25 @@ const credentialsPath = (process.env.GDRIVE_CREDENTIALS_PATH || "").replace(
   process.env.HOME || "",
 );
 
-// Bundled OAuth client_id for the Dash platform's GCP project.
-// Desktop OAuth client_ids are inherently public — they're identifiers,
-// not secrets. Auth uses PKCE (code_verifier/code_challenge) instead of
-// a client_secret.
+// Bundled OAuth credentials for the Dash platform's GCP project.
+// client_id is public (identifier, not a secret).
+// client_secret is injected at build time from GitHub Secrets — the
+// placeholder below is replaced in dist/ during `npm run build`.
+// Desktop OAuth client_secrets are not confidential per Google's docs —
+// the consent screen is the security boundary, not this value.
 const BUNDLED_CLIENT_ID =
   "785070273499-mr9b0vup4u24he8duh3c6j5gpk7qj54j.apps.googleusercontent.com";
+const BUNDLED_CLIENT_SECRET =
+  process.env.GDRIVE_CLIENT_SECRET || "__GDRIVE_CLIENT_SECRET__";
 
 function getClientId() {
   return BUNDLED_CLIENT_ID;
 }
 
+function getClientSecret() {
+  return BUNDLED_CLIENT_SECRET;
+}
+
 /**
  * Read stored credentials (access_token, refresh_token, expiry_date).
  */
@@ -63,9 +71,10 @@ async function getAccessToken() {
     return creds.access_token;
   }
 
-  // Refresh — PKCE-based installed apps don't need client_secret for refresh
+  // Refresh token — Google requires client_secret even for desktop apps
   const postData = [
     `client_id=${encodeURIComponent(clientId)}`,
+    `client_secret=${encodeURIComponent(getClientSecret())}`,
     `refresh_token=${encodeURIComponent(creds.refresh_token)}`,
     "grant_type=refresh_token",
   ].join("&");
@@ -291,7 +300,7 @@ if (process.argv[2] === "auth") {
 
       const scopes = ["https://www.googleapis.com/auth/drive"];
 
-      // PKCE: generate code verifier + challenge (no client_secret needed)
+      // PKCE: generate code verifier + challenge (additional security layer)
       const codeVerifier = crypto.randomBytes(32).toString("base64url");
       const codeChallenge = crypto
         .createHash("sha256")
@@ -310,10 +319,11 @@ if (process.argv[2] === "auth") {
           return;
         }
 
-        // Exchange code for tokens using PKCE code_verifier
+        // Exchange code for tokens (PKCE code_verifier + client_secret)
         const postData = [
           `code=${encodeURIComponent(code)}`,
           `client_id=${encodeURIComponent(clientId)}`,
+          `client_secret=${encodeURIComponent(getClientSecret())}`,
           `code_verifier=${encodeURIComponent(codeVerifier)}`,
           `redirect_uri=${encodeURIComponent(redirectUri)}`,
           `grant_type=authorization_code`,

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@trops/dash-core",
-    "version": "0.1.337",
+    "version": "0.1.340",
     "description": "Core framework for Dash dashboard applications",
     "main": "dist/index.js",
     "module": "dist/index.esm.js",
@@ -19,7 +19,7 @@
     "scripts": {
         "build": "npm run build:renderer && npm run build:electron",
         "build:renderer": "rollup -c rollup.config.renderer.mjs",
-        "build:electron": "rollup -c rollup.config.electron.mjs && mkdir -p dist/mcp && cp electron/mcp/mcpServerCatalog.json dist/mcp/ && rm -rf dist/mcp/servers && cp -r electron/mcp/servers dist/mcp/",
+        "build:electron": "rollup -c rollup.config.electron.mjs && mkdir -p dist/mcp && cp electron/mcp/mcpServerCatalog.json dist/mcp/ && rm -rf dist/mcp/servers && cp -r electron/mcp/servers dist/mcp/ && node scripts/inject-secrets.js",
         "clean": "rm -rf dist",
         "prepublishOnly": "npm run clean && npm run build",
         "test:mcp": "node --test electron/controller/mcpController.test.js electron/mcp/mcpServerCatalog.test.js",