google-oauth2-env-vars 1.4.0 → 2.0.0

package/LICENCE.md

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2020 Cédric Delpoux
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,5 +1,5 @@
 <div align="center">
-  <h1>google-oauth2-env-vars<h1>
+  <h1>google-oauth2-env-vars</h1>
 
 [![Npm version][badge-npm]][npm]
 [![Npm downloads][badge-npm-dl]][npm]
@@ -15,15 +15,15 @@ Helper class to generate and cache `Google OAuth 2.0` tokens in `.env` files:
 ```dotenv
 GOOGLE_OAUTH_CLIENT_ID=23...8o1jm.apps.googleusercontent.com
 GOOGLE_OAUTH_CLIENT_SECRET=QL...naxL
-GOOGLE_PHOTOS_TOKEN={"access_token":"ya..54c","refresh_token":"1..qq0","scope":"https://www.googleapis.com/auth/photoslibrary.readonly","token_type":"Bearer","expiry_date":1598277881619}
+GOOGLE_DOCS_TOKEN={"access_token":"ya..54c","refresh_token":"1..qq0","scope":"https://www.googleapis.com/auth/documents.readonly","token_type":"Bearer","expiry_date":1598277881619}
 ```
 
 ## Usage
 
-Download package from the NPM registry:
+It requires Node.js 22 or later. Download the package from the npm registry:
 
 ```shell
-yarn add google-oauth2-env-vars
+npm install google-oauth2-env-vars
 ```
 
 ### Generate .env vars
@@ -33,40 +33,64 @@ const GoogleOAuth2 = require("google-oauth2-env-vars")
 
 const googleOAuth2 = new GoogleOAuth2({
   // .env token var name
-  token: "GOOGLE_PHOTOS_TOKEN",
+  token: "GOOGLE_DOCS_TOKEN",
   // Authorization scope
-  scope: ["https://www.googleapis.com/auth/photoslibrary.readonly"],
+  scope: ["https://www.googleapis.com/auth/documents.readonly"],
   // APIs to enable in Google console
-  apis: ["photoslibrary.googleapis.com"],
+  apis: ["docs.googleapis.com"],
   //
   // Optional
   //
-  // Port for node server
-  port: 5000, // DEFAULT
+  // Fixed port of the local server receiving the authorization code,
+  // for a "Web application" client. Any free port by default.
+  port: 5000,
 })
 
 const envVars = await googleOAuth2.generateEnvVars()
 ```
 
+When the variables are missing from the environment, `generateEnvVars()` walks you through the setup in the terminal:
+
+1. It asks you to enable each API in `apis` in the Google Cloud console.
+2. It asks for the `Client ID` and `Client secret` of an OAuth 2.0 client of type "Desktop app". With a fixed `port`, it can also be a "Web application" client whose authorized redirect URI is `http://localhost:<port>/callback`.
+3. It asks you to authorize the application, and receives the authorization code on a local server, which listens on any free port unless `port` is set. The authorization uses PKCE.
+4. It writes `GOOGLE_OAUTH_CLIENT_ID`, `GOOGLE_OAUTH_CLIENT_SECRET` and the token to the `.env` and `.env.*` files of the current directory, or to a new `.env` file when there is none. It leaves out `.envrc` and the templates `.env.example`, `.env.sample` and `.env.template`, which are often committed. A variable that is already there is replaced.
+
+Each URL is printed in the terminal and opened in your browser when possible.
+
 ### Get Auth
 
+`getAuth()` returns an `OAuth2Client` from [google-auth-library](https://www.npmjs.com/package/google-auth-library), which refreshes the access token when it expires:
+
 ```js
 const GoogleOAuth2 = require("google-oauth2-env-vars")
+const {docs} = require("@googleapis/docs")
 
 const googleOAuth2 = new GoogleOAuth2({
   // .env token var name
-  token: "GOOGLE_PHOTOS_TOKEN",
+  token: "GOOGLE_DOCS_TOKEN",
 })
 const auth = await googleOAuth2.getAuth()
-const {token} = await auth.getAccessToken()
-const googlePhotos = new GooglePhotos(token)
+const googleDocs = docs({version: "v1", auth})
 ```
 
+`getEnvVars()` returns the same variables without creating a client, and throws when one of them is missing or invalid.
+
 ## Contributing
 
 - ⇄ Pull/Merge requests and ★ Stars are always welcome.
 - For bugs and feature requests, please [create an issue][github-issue].
 
+```shell
+npm install
+npm run lint
+npm test
+```
+
+The code is plain JavaScript. The types of the public API are written as [JSDoc](https://www.typescriptlang.org/docs/handbook/jsdoc-supported-types.html) comments: `npm run lint` checks them with TypeScript, and `npm pack` turns them into the `.d.ts` files of the package.
+
+To release a version, bump it in `package.json` and `CHANGELOG.md`, then publish a GitHub release: the `Publish` workflow publishes it to npm, with its provenance.
+
 [badge-npm]: https://img.shields.io/npm/v/google-oauth2-env-vars.svg?style=flat-square
 [badge-npm-dl]: https://img.shields.io/npm/dt/google-oauth2-env-vars.svg?style=flat-square
 [badge-licence]: https://img.shields.io/badge/license-MIT-blue.svg?style=flat-square

package/index.js

@@ -1,34 +1,74 @@
-require("dotenv").config()
-
 const {askClientIds} = require("./utils/ask-client-ids")
 const {getNewToken} = require("./utils/get-new-token")
 const {initAuth} = require("./utils/init-auth")
 
-const {
-  CLIENT_ID,
-  CLIENT_SECRET,
-  DEFAULT_PORT,
-  TOKEN_FIELDS,
-} = require("./utils/constants")
+const {CLIENT_ID, CLIENT_SECRET, TOKEN_FIELDS} = require("./utils/constants")
+
+try {
+  process.loadEnvFile()
+} catch (e) {
+  if (e.code !== "ENOENT") {
+    throw e
+  }
+}
+
+/**
+ * @typedef {object} Options
+ * @property {string} [token] Name of the .env variable holding the token
+ * @property {string[]} [scope] Scopes the token is authorized for
+ * @property {string[]} [apis] APIs to enable in the Google Cloud console
+ * @property {number} [port] Fixed port for a "Web application" client registered
+ *   with http://localhost:<port>/callback. A free port is picked by default,
+ *   which needs a "Desktop app" client.
+ */
+
+/** @typedef {import("google-auth-library").Credentials} Token */
+
+/** @param {Error} e */
+const printError = (e) => {
+  console.error("")
+  console.error(`❌  ${e.message}`)
+  process.exitCode = 1
+}
 
 class GoogleOAuth2 {
+  /** @param {Options} [options] */
   constructor(options = {}) {
     this.tokenName = options.token || null
     this.scope = options.scope || null
     this.apisToEnable = options.apis || []
-    this.port = options.port || DEFAULT_PORT
+    this.port = options.port || 0
   }
 
+  /** @param {Token} token */
   isTokenValid(token) {
     return token && TOKEN_FIELDS.every((field) => !!token[field])
   }
 
+  /**
+   * @param {string} rawToken
+   * @returns {Token}
+   */
+  parseToken(rawToken) {
+    try {
+      return JSON.parse(rawToken)
+    } catch (e) {
+      throw new Error(
+        `${this.tokenName} is not valid JSON (${e.message}). ` +
+          "It must be on a single line, with double quotes around every key and string value: " +
+          `${this.tokenName}={"access_token":"...","refresh_token":"...","scope":"...","token_type":"Bearer","expiry_date":0}. ` +
+          "Run the token generation again to get a new one.",
+        {cause: e}
+      )
+    }
+  }
+
   async getNewEnvVars() {
     if (!this.scope) {
       throw new Error("You need to define `scope` in GoogleOAuth2 constructor")
     }
 
-    const {clientId, clientSecret} = await askClientIds()
+    const {clientId, clientSecret} = await askClientIds({port: this.port})
 
     const token = await getNewToken({
       clientId,
@@ -39,58 +79,73 @@ class GoogleOAuth2 {
       port: this.port,
     })
 
-    return token
+    return {
+      [CLIENT_ID]: clientId,
+      [CLIENT_SECRET]: clientSecret,
+      [this.tokenName]: token,
+    }
   }
 
+  /**
+   * Read the variables from the environment, and throw when one of them is
+   * missing or invalid.
+   *
+   * @returns {Record<string, string | Token>}
+   */
   getEnvVars() {
-    let envClientId
-    let envClientSecret
-    let envToken
+    const clientId = process.env[CLIENT_ID]
+    const clientSecret = process.env[CLIENT_SECRET]
+    const rawToken = this.tokenName && process.env[this.tokenName]
 
-    if (process.env[CLIENT_ID]) {
-      envClientId = process.env[CLIENT_ID]
-    } else {
+    if (!clientId) {
       throw new Error(`${CLIENT_ID} not found in .env`)
     }
 
-    if (process.env[CLIENT_SECRET]) {
-      envClientSecret = process.env[CLIENT_SECRET]
-    } else {
+    if (!clientSecret) {
       throw new Error(`${CLIENT_SECRET} not found in .env`)
     }
 
-    if (this.tokenName && process.env[this.tokenName]) {
-      envToken = JSON.parse(process.env[this.tokenName])
-    }
-
-    if (!envToken) {
+    if (!rawToken) {
       throw new Error(`${this.tokenName} not found in .env`)
     }
 
-    if (!this.isTokenValid(envToken)) {
+    const token = this.parseToken(rawToken)
+
+    if (!this.isTokenValid(token)) {
       throw new Error(
         `${this.tokenName} not valid. Please generate a new token`
       )
     }
 
     return {
-      [CLIENT_ID]: envClientId,
-      [CLIENT_SECRET]: envClientSecret,
-      [this.tokenName]: envToken,
+      [CLIENT_ID]: clientId,
+      [CLIENT_SECRET]: clientSecret,
+      [this.tokenName]: token,
     }
   }
 
+  /**
+   * Read the variables, or walk through their generation when they are missing.
+   * A failure is printed in the console and sets the exit code, instead of
+   * throwing, and the result is then undefined.
+   *
+   * @returns {Promise<Record<string, string | Token> | undefined>}
+   */
   async generateEnvVars() {
     let envVars
 
     try {
       envVars = this.getEnvVars()
-      console.log(`✅${CLIENT_ID} found in .env`)
-      console.log(`✅${CLIENT_SECRET} found in .env`)
-      console.log(`✅${this.tokenName} found in .env`)
+      console.log(`✅  ${CLIENT_ID} found in .env`)
+      console.log(`✅  ${CLIENT_SECRET} found in .env`)
+      console.log(`✅  ${this.tokenName} found in .env`)
     } catch (e) {
-      console.log(`❌${e.message}`)
-      envVars = await this.getNewEnvVars()
+      console.log(`❌  ${e.message}`)
+      envVars = await this.getNewEnvVars().catch(printError)
+    }
+
+    if (!envVars) {
+      return undefined
     }
 
     console.log("")
@@ -104,17 +159,12 @@ class GoogleOAuth2 {
 
   async getAuth() {
     const envVars = this.getEnvVars()
-    const clientId = envVars[CLIENT_ID]
-    const clientSecret = envVars[CLIENT_SECRET]
-    const token = envVars[this.tokenName]
 
-    const auth = await initAuth({
-      clientId,
-      clientSecret,
-      token,
+    return initAuth({
+      clientId: envVars[CLIENT_ID],
+      clientSecret: envVars[CLIENT_SECRET],
+      token: envVars[this.tokenName],
     })
-
-    return auth
   }
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "google-oauth2-env-vars",
-  "version": "1.4.0",
+  "version": "2.0.0",
   "description": "Generate and cache Google OAuth 2.0 tokens in .env files",
   "repository": "https://github.com/cedricdelpoux/google-oauth2-env-vars",
   "author": {
@@ -17,29 +17,32 @@
     "api"
   ],
   "main": "index.js",
+  "types": "types/index.d.ts",
   "files": [
     "index.js",
-    "utils"
+    "utils",
+    "types"
   ],
+  "engines": {
+    "node": ">=22"
+  },
   "dependencies": {
-    "clipboardy": "^2.3.0",
-    "dotenv": "^16.0.3",
-    "express": "^4.18.2",
-    "glob": "^9.3.2",
-    "googleapis": "^114.0.0",
-    "inquirer": "^8.0.0",
-    "open": "^8.0.0"
+    "google-auth-library": "^11.3.4"
   },
   "devDependencies": {
-    "eslint": "^8.36.0",
-    "eslint-config-prettier": "^8.8.0",
-    "husky": "^8.0.3",
-    "lint-staged": "^13.2.0",
-    "prettier": "2.8.7"
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^22.20.5",
+    "eslint": "^10.14.0",
+    "globals": "^17.14.0",
+    "prettier": "^3.10.1",
+    "typescript": "^7.0.2"
   },
   "scripts": {
-    "lint": "eslint index.js utils/*.js",
-    "prepare": "husky install",
-    "prepublishOnly": "yarn lint"
+    "build": "tsc",
+    "lint": "eslint . && prettier --check . && tsc --noEmit",
+    "format": "prettier --write .",
+    "test": "node --test",
+    "prepack": "npm run build",
+    "prepublishOnly": "npm run lint && npm test"
   }
 }

package/types/index.d.ts

@@ -0,0 +1,56 @@
+export = GoogleOAuth2;
+export type Options = {
+    /**
+     * Name of the .env variable holding the token
+     */
+    token?: string;
+    /**
+     * Scopes the token is authorized for
+     */
+    scope?: string[];
+    /**
+     * APIs to enable in the Google Cloud console
+     */
+    apis?: string[];
+    /**
+     * Fixed port for a "Web application" client registered
+     * with http://localhost:<port>/callback. A free port is picked by default,
+     * which needs a "Desktop app" client.
+     */
+    port?: number;
+};
+export type Token = import("google-auth-library").Credentials;
+declare class GoogleOAuth2 {
+    tokenName: string;
+    scope: string[];
+    apisToEnable: string[];
+    port: number;
+    /** @param {Options} [options] */
+    constructor(options?: Options);
+    /** @param {Token} token */
+    isTokenValid(token: Token): boolean;
+    /**
+     * @param {string} rawToken
+     * @returns {Token}
+     */
+    parseToken(rawToken: string): Token;
+    getNewEnvVars(): Promise<{
+        [x: string]: string | import("google-auth-library").Credentials;
+    }>;
+    /**
+     * Read the variables from the environment, and throw when one of them is
+     * missing or invalid.
+     *
+     * @returns {Record<string, string | Token>}
+     */
+    getEnvVars(): Record<string, string | Token>;
+    /**
+     * Read the variables, or walk through their generation when they are missing.
+     * A failure is printed in the console and sets the exit code, instead of
+     * throwing, and the result is then undefined.
+     *
+     * @returns {Promise<Record<string, string | Token> | undefined>}
+     */
+    generateEnvVars(): Promise<Record<string, string | Token> | undefined>;
+    getAuth(): Promise<import("google-auth-library").OAuth2Client>;
+}

package/types/utils/ask-client-ids.d.ts

@@ -0,0 +1,10 @@
+declare const _exports: {
+    askClientIds: typeof askClientIds;
+};
+export = _exports;
+declare const askClientIds: ({ port }: {
+    port: any;
+}) => Promise<{
+    clientId: string;
+    clientSecret: string;
+}>;

package/types/utils/ask.d.ts

@@ -0,0 +1,7 @@
+declare const _exports: {
+    ask: typeof ask;
+    askRequired: typeof askRequired;
+};
+export = _exports;
+declare const ask: (question: any) => Promise<string>;
+declare const askRequired: (question: any) => Promise<string>;

package/types/utils/constants.d.ts

@@ -0,0 +1,8 @@
+declare const _exports: {
+    CLIENT_ID: string;
+    CLIENT_SECRET: string;
+    OAUTH_URL: string;
+    ENABLE_API_URL: string;
+    TOKEN_FIELDS: string[];
+};
+export = _exports;

package/types/utils/get-authorization-code.d.ts

@@ -0,0 +1,8 @@
+declare const _exports: {
+    getAuthorizationCode: typeof getAuthorizationCode;
+};
+export = _exports;
+declare const getAuthorizationCode: ({ port, onListening }: {
+    onListening: any;
+    port: any;
+}) => Promise<any>;

package/types/utils/get-new-token.d.ts

@@ -0,0 +1,12 @@
+declare const _exports: {
+    getNewToken: typeof getNewToken;
+};
+export = _exports;
+declare const getNewToken: ({ clientId, clientSecret, scope, tokenName, apisToEnable, port, }: {
+    apisToEnable: any;
+    clientId: any;
+    clientSecret: any;
+    port: any;
+    scope: any;
+    tokenName: any;
+}) => Promise<import("google-auth-library").Credentials>;

package/types/utils/init-auth.d.ts

@@ -0,0 +1,10 @@
+declare const _exports: {
+    initAuth: typeof initAuth;
+};
+export = _exports;
+import { OAuth2Client } from "google-auth-library";
+declare const initAuth: ({ clientId, clientSecret, token }: {
+    clientId: any;
+    clientSecret: any;
+    token: any;
+}) => OAuth2Client;

package/types/utils/open-url.d.ts

@@ -0,0 +1,8 @@
+declare const _exports: {
+    openUrl: typeof openUrl;
+};
+export = _exports;
+declare const openUrl: ({ message, url }: {
+    message: any;
+    url: any;
+}) => void;

package/types/utils/write-to-env-files.d.ts

@@ -0,0 +1,5 @@
+declare const _exports: {
+    writeToEnvFiles: typeof writeToEnvFiles;
+};
+export = _exports;
+declare const writeToEnvFiles: (name: any, value: any) => void;

package/utils/ask-client-ids.js

@@ -1,11 +1,10 @@
-const inquirer = require("inquirer")
-
+const {askRequired} = require("./ask")
 const {openUrl} = require("./open-url")
 const {writeToEnvFiles} = require("./write-to-env-files")
 
 const {CLIENT_ID, CLIENT_SECRET, OAUTH_URL} = require("./constants")
 
-const askClientIds = async () => {
+const askClientIds = async ({port}) => {
   if (process.env[CLIENT_ID] && process.env[CLIENT_SECRET]) {
     console.log(`✅  ${CLIENT_ID} found in .env`)
     console.log(`✅  ${CLIENT_SECRET} found in .env`)
@@ -17,28 +16,19 @@ const askClientIds = async () => {
   }
 
   console.log("")
-  console.info('Create an "Google OAuth 2.0 Client ID" with the config:')
-  console.info('Type: "Web application"')
-  console.info('Redirect uri: "http://localhost:5000/callback"')
+  console.info('Create a "Google OAuth 2.0 Client ID" of type "Desktop app"')
+  if (port) {
+    console.info(
+      `or of type "Web application" with the redirect URI "http://localhost:${port}/callback"`
+    )
+  }
 
-  await openUrl({message: "Google OAuth 2.0 URL:", url: OAUTH_URL})
+  openUrl({message: "Google OAuth 2.0 URL:", url: OAUTH_URL})
 
   console.log("Copy your `Client ID` and `Client secret`")
 
-  const {clientId, clientSecret} = await inquirer.prompt([
-    {
-      type: "input",
-      name: "clientId",
-      message: "Client ID:",
-      validate: (input) => !!input,
-    },
-    {
-      type: "input",
-      name: "clientSecret",
-      message: "Client Secret:",
-      validate: (input) => !!input,
-    },
-  ])
+  const clientId = await askRequired("Client ID: ")
+  const clientSecret = await askRequired("Client Secret: ")
 
   writeToEnvFiles(CLIENT_ID, clientId)
   writeToEnvFiles(CLIENT_SECRET, clientSecret)

package/utils/ask.js

@@ -0,0 +1,29 @@
+const readline = require("node:readline/promises")
+
+const ask = async (question) => {
+  const rl = readline.createInterface({
+    input: process.stdin,
+    output: process.stdout,
+  })
+
+  try {
+    return (await rl.question(question)).trim()
+  } finally {
+    rl.close()
+  }
+}
+
+const askRequired = async (question) => {
+  let answer = ""
+
+  while (!answer) {
+    answer = await ask(question)
+  }
+
+  return answer
+}
+
+module.exports = {
+  ask,
+  askRequired,
+}

package/utils/constants.js

@@ -1,7 +1,6 @@
 module.exports = {
   CLIENT_ID: "GOOGLE_OAUTH_CLIENT_ID",
   CLIENT_SECRET: "GOOGLE_OAUTH_CLIENT_SECRET",
-  DEFAULT_PORT: 5000,
   OAUTH_URL:
     "https://console.developers.google.com/apis/credentials/oauthclient",
   ENABLE_API_URL:

package/utils/get-authorization-code.js

@@ -1,34 +1,56 @@
-/* global Promise */
-const express = require("express")
+const http = require("node:http")
 
-const {openUrl} = require("./open-url")
-
-const getAuthorizationCode = async ({url, port}) => {
-  return new Promise((resolve, reject) => {
-    const app = express()
+const TEXT_HEADERS = {
+  "Content-Type": "text/plain; charset=utf-8",
+  Connection: "close",
+}
 
-    app.listen(port, async () => {
-      console.log("🤚  You need to authorize your application")
+const getAuthorizationCode = ({port, onListening}) =>
+  new Promise((resolve, reject) => {
+    const server = http.createServer((req, res) => {
+      const {pathname, searchParams} = new URL(req.url, "http://localhost")
 
-      await openUrl({message: "Authorization URL:", url})
+      if (pathname !== "/callback") {
+        res.writeHead(404, TEXT_HEADERS).end()
+        return
+      }
 
-      console.log("🛑  Follow the URL to authorize your application")
-    })
+      const code = searchParams.get("code")
+      server.close()
 
-    app.get("/callback", (req, res) => {
-      if (req.query.code) {
+      if (code) {
         console.log("✅  Application authorized")
-        res.send(
-          "Succeed! You can close this tab and go back to your terminal."
-        )
-
-        resolve(req.query.code)
+        res
+          .writeHead(200, TEXT_HEADERS)
+          .end("Success! You can close this tab and go back to your terminal.")
+        resolve(code)
       } else {
-        reject("no code")
+        const message = `Authorization failed: ${searchParams.get("error") || "no code received"}`
+        res.writeHead(400, TEXT_HEADERS).end(message)
+        reject(new Error(message))
       }
     })
+
+    server.on("error", (/** @type {NodeJS.ErrnoException} */ e) => {
+      if (e.code !== "EADDRINUSE") {
+        reject(e)
+        return
+      }
+      reject(
+        new Error(
+          `Port ${port} is already in use. Free it, or leave out \`port\` ` +
+            'to listen on any free port, which needs a "Desktop app" OAuth client.',
+          {cause: e}
+        )
+      )
+    })
+    server.listen(port, () => {
+      const address = /** @type {import("node:net").AddressInfo} */ (
+        server.address()
+      )
+      onListening(address.port)
+    })
   })
-}
 
 module.exports = {
   getAuthorizationCode,

package/utils/get-new-token.js

@@ -1,10 +1,20 @@
-const {google} = require("googleapis")
+const {CodeChallengeMethod, OAuth2Client} = require("google-auth-library")
 
+const {ask} = require("./ask")
 const {getAuthorizationCode} = require("./get-authorization-code")
+const {openUrl} = require("./open-url")
 const {writeToEnvFiles} = require("./write-to-env-files")
 const {ENABLE_API_URL} = require("./constants")
-const {openUrl} = require("./open-url")
-const {waitInput} = require("./wait-input")
+
+const enableApi = async (api) => {
+  console.log(`🤚  You need to enable "${api}" API`)
+  openUrl({message: "API URL:", url: `${ENABLE_API_URL}${api}`})
+  console.log(`🛑  Follow the URL and enable "${api}" API`)
+  console.log("")
+  await ask("🚦  API enabled? Press Enter to continue setup")
+  console.log("")
+  console.log("------------------------")
+}
 
 const getNewToken = async ({
   clientId,
@@ -14,46 +24,48 @@ const getNewToken = async ({
   apisToEnable,
   port,
 }) => {
-  try {
-    console.log("------------------------")
-    console.log("| Generating new token |")
-    console.log("------------------------")
-    console.log("")
-    if (apisToEnable) {
-      for (const api of apisToEnable) {
-        console.log(`🤚  You need to enable "${api}" API`)
-
-        await openUrl({message: "API URL:", url: `${ENABLE_API_URL}${api}`})
-
-        console.log(`🛑  Follow the URL and enable "${api}" API`)
-
-        await waitInput("API enabled?")
-      }
-    }
-
-    const client = new google.auth.OAuth2(
-      clientId,
-      clientSecret,
-      `http://localhost:${port}/callback`
-    )
-
-    const authUrl = client.generateAuthUrl({
-      access_type: "offline",
-      scope,
-      prompt: "consent",
-    })
-    const code = await getAuthorizationCode({url: authUrl, port})
-
-    const {tokens} = await client.getToken(code)
-
-    if (tokenName) {
-      writeToEnvFiles(tokenName, JSON.stringify(tokens))
-    }
-
-    return tokens
-  } catch (e) {
-    throw new Error(e)
+  console.log("------------------------")
+  console.log("| Generating new token |")
+  console.log("------------------------")
+  console.log("")
+
+  for (const api of apisToEnable) {
+    await enableApi(api)
   }
+
+  const client = new OAuth2Client({clientId, clientSecret})
+  const {codeVerifier, codeChallenge} = await client.generateCodeVerifierAsync()
+  let redirectUri
+
+  const code = await getAuthorizationCode({
+    port,
+    onListening: (listeningPort) => {
+      redirectUri = `http://localhost:${listeningPort}/callback`
+      const url = client.generateAuthUrl({
+        access_type: "offline",
+        scope,
+        prompt: "consent",
+        redirect_uri: redirectUri,
+        code_challenge: codeChallenge,
+        code_challenge_method: CodeChallengeMethod.S256,
+      })
+      console.log("🤚  You need to authorize your application")
+      openUrl({message: "Authorization URL:", url})
+      console.log("🛑  Follow the URL to authorize your application")
+    },
+  })
+
+  const {tokens} = await client.getToken({
+    code,
+    codeVerifier,
+    redirect_uri: redirectUri,
+  })
+
+  if (tokenName) {
+    writeToEnvFiles(tokenName, JSON.stringify(tokens))
+  }
+
+  return tokens
 }
 
 module.exports = {

package/utils/init-auth.js

@@ -1,23 +1,14 @@
-const {google} = require("googleapis")
+const {OAuth2Client} = require("google-auth-library")
 
-const initAuth = async ({clientId, clientSecret, token}) => {
-  const auth = new google.auth.OAuth2(clientId, clientSecret)
+const initAuth = ({clientId, clientSecret, token}) => {
+  const auth = new OAuth2Client({clientId, clientSecret})
 
   auth.setCredentials(token)
 
-  let expired = true
-
-  if (token.expiry_date) {
-    const nowDate = new Date()
-    const expirationDate = new Date(token.expiry_date)
-    expired = expirationDate.getTime() < nowDate.getTime()
-  }
-
-  if (expired) {
-    auth.on("tokens", (refreshedToken) => {
-      auth.setCredentials(refreshedToken)
-    })
-  }
+  // A refreshed token comes without its refresh_token, which must be kept
+  auth.on("tokens", (refreshedToken) => {
+    auth.setCredentials({...token, ...refreshedToken})
+  })
 
   return auth
 }

package/utils/open-url.js

@@ -1,39 +1,41 @@
-const inquirer = require("inquirer")
-const clipboardy = require("clipboardy")
-const open = require("open")
+const {spawn} = require("node:child_process")
 
-exports.openUrl = async ({message, url}) => {
+/**
+ * @param {string} url
+ * @returns {[string, string[]]}
+ */
+const getOpenCommand = (url) => {
+  switch (process.platform) {
+    case "darwin":
+      return ["open", [url]]
+    case "win32":
+      // Quoted so that cmd does not split the URL on its "&"
+      return ["cmd", ["/c", "start", '""', `"${url}"`]]
+    default:
+      return ["xdg-open", [url]]
+  }
+}
+
+const openUrl = ({message, url}) => {
+  console.log("")
+  console.log(`🔗  ${message} ${url}`)
   console.log("")
-  const {choice} = await inquirer.prompt([
-    {
-      type: "list",
-      name: "choice",
-      message,
-      choices: [
-        {
-          name: "Open in my browser",
-          value: "browser",
-          short: "🌐  Opened in your browser",
-        },
-        {
-          name: "Copy to clipboard",
-          value: "clipboard",
-          short: "📋  Added to your clipboard",
-        },
-        {
-          name: "Write to terminal",
-          value: "terminal",
-          short: `🔗  ${url}`,
-        },
-      ],
-    },
-  ])
 
-  if (choice === "browser") {
-    open(url)
-  } else if (choice === "clipboard") {
-    clipboardy.writeSync(url)
+  const [command, args] = getOpenCommand(url)
+
+  try {
+    const child = spawn(command, args, {
+      detached: true,
+      stdio: "ignore",
+      windowsVerbatimArguments: true,
+    })
+    child.on("error", () => {})
+    child.unref()
+  } catch {
+    // The URL is printed above, so it can still be opened by hand
   }
+}
 
-  console.log("")
+module.exports = {
+  openUrl,
 }

package/utils/write-to-env-files.js

@@ -1,22 +1,42 @@
-const glob = require("glob")
-const fs = require("fs")
+const fs = require("node:fs")
 
-const envFiles = glob.sync(".env*")
+const TEMPLATE_FILES = new Set([".env.example", ".env.sample", ".env.template"])
 
-if (envFiles.length === 0) {
-  envFiles.push(".env")
+const isEnvFile = (name) =>
+  name === ".env" || (name.startsWith(".env.") && !TEMPLATE_FILES.has(name))
+
+const getEnvFiles = () => {
+  const files = fs
+    .readdirSync(".", {withFileTypes: true})
+    .filter((entry) => entry.isFile() && isEnvFile(entry.name))
+    .map((entry) => entry.name)
+
+  return files.length > 0 ? files : [".env"]
+}
+
+const setEnvLine = (content, name, line) => {
+  const lines = content.split("\n")
+  const isVarLine = (text) => text.startsWith(`${name}=`)
+  const index = lines.findIndex(isVarLine)
+
+  if (index === -1) {
+    const separator = content && !content.endsWith("\n") ? "\n" : ""
+    return `${content}${separator}${line}\n`
+  }
+
+  return lines
+    .map((text, i) => (i === index ? line : text))
+    .filter((text, i) => i === index || !isVarLine(text))
+    .join("\n")
 }
 
 const writeToEnvFiles = (name, value) => {
-  try {
-    envFiles.forEach((file) => {
-      fs.appendFileSync(file, `${name}=${value}\n`)
-      console.log(`✅  ${name} added to ${file}`)
-    })
-    console.log("")
-  } catch (e) {
-    throw new Error(e)
+  for (const file of getEnvFiles()) {
+    const content = fs.existsSync(file) ? fs.readFileSync(file, "utf8") : ""
+    fs.writeFileSync(file, setEnvLine(content, name, `${name}=${value}`))
+    console.log(`✅  ${name} written to ${file}`)
   }
+  console.log("")
 }
 
 module.exports = {

package/utils/wait-input.js

@@ -1,19 +0,0 @@
-/* global Promise */
-const readline = require("readline")
-
-exports.waitInput = async (message) => {
-  return new Promise((resolve) => {
-    const rl = readline.createInterface({
-      input: process.stdin,
-      output: process.stdout,
-    })
-
-    console.log("")
-
-    rl.question(`🚦  ${message} Press any key to continue setup`, () => {
-      console.log("")
-      console.log("------------------------")
-      resolve()
-    })
-  })
-}