machinaos 0.0.76 → 0.0.78

package/server/nodes/google/__init__.py

@@ -1 +1,55 @@
-"""Plugins for the 'google' palette group. See ../__init__.py for the package layout."""
+"""Plugins for the 'google' palette group.
+
+Self-contained plugin folder (Wave 11.H pattern). One folder owns
+the entire Google Workspace surface:
+
+- 6 service plugins — ``gmail.py``, ``calendar.py``, ``drive.py``,
+  ``sheets.py``, ``tasks.py``, ``contacts.py``, plus
+  ``gmail_receive.py`` for the polling trigger.
+- ``_credentials.py`` — :class:`GoogleCredential` (OAuth2). The
+  6 service plugins all reference this single credential class.
+- ``_oauth.py`` — OAuth 2.0 client (formerly
+  ``services/google_oauth.py``).
+- ``_auth_helper.py`` — shared credential builder + proactive
+  refresh (formerly ``services/handlers/google_auth.py``). Used by
+  every Workspace plugin to obtain a refresh-aware ``Credentials``
+  object.
+- ``_handlers.py`` — 3 WebSocket handlers
+  (``google_oauth_login`` / ``google_oauth_status`` /
+  ``google_logout``).
+- ``_router.py`` — HTTP OAuth callback (``/api/google/callback``).
+
+Two self-registration calls below — the central WS dispatcher and
+the FastAPI app pick up the plugin's surface without ever importing
+this module by name.
+"""
+
+from services.event_waiter import register_filter_builder
+from services.status_broadcaster import register_service_refresh
+from services.ws_handler_registry import (
+    register_option_loader,
+    register_router,
+    register_ws_handlers,
+)
+
+from . import _router
+from ._filters import build_gmail_filter
+from ._handlers import WS_HANDLERS
+from ._option_loaders import (
+    load_calendar_list,
+    load_drive_folders,
+    load_gmail_labels,
+    load_tasklists,
+)
+from ._refresh import refresh_google_status
+
+register_ws_handlers(WS_HANDLERS)
+register_router(_router.router, name="google")
+register_service_refresh(refresh_google_status)
+register_filter_builder("googleGmailReceive", build_gmail_filter)
+
+# loadOptionsMethod loaders (Wave 11.I, milestone M.2).
+register_option_loader("gmailLabels", load_gmail_labels)
+register_option_loader("googleCalendarList", load_calendar_list)
+register_option_loader("googleDriveFolders", load_drive_folders)
+register_option_loader("googleTasklists", load_tasklists)

package/server/{services/handlers/google_auth.py → nodes/google/_auth_helper.py}

@@ -37,7 +37,7 @@ async def get_google_credentials(
     Returns:
         google.oauth2.credentials.Credentials ready for API use
     """
-    from core.container import container
+    from services.plugin.deps import get_auth_service, get_database
 
     account_mode = parameters.get('account_mode', 'owner')
     customer_id = "owner"
@@ -47,7 +47,7 @@ async def get_google_credentials(
         if not customer_id:
             raise ValueError("customer_id required for customer mode")
 
-        db = container.database()
+        db = get_database()
         connection = await db.get_google_connection(customer_id)
         if not connection:
             raise ValueError(f"No Google connection for customer: {customer_id}")
@@ -61,7 +61,7 @@ async def get_google_credentials(
         await db.update_google_last_used(customer_id)
 
     else:
-        auth_service = container.auth_service()
+        auth_service = get_auth_service()
         tokens = await auth_service.get_oauth_tokens("google", customer_id="owner")
 
         if not tokens or not tokens.get("access_token"):
@@ -70,9 +70,12 @@ async def get_google_credentials(
             )
 
         access_token = tokens["access_token"]
-        refresh_token = tokens.get("refresh_token")
+        # refresh_token is read from DB directly (RFC 9700; not cached).
+        refresh_token = await auth_service.get_oauth_refresh_token(
+            "google", customer_id="owner"
+        )
 
-    auth_service = container.auth_service()
+    auth_service = get_auth_service()
     client_id = await auth_service.get_api_key("google_client_id") or ""
     client_secret = await auth_service.get_api_key("google_client_secret") or ""
 

package/server/nodes/google/_base.py

@@ -59,12 +59,12 @@ async def track_google_usage(
     ``google_tasks`` / ``google_contacts``. Google APIs are free at our
     tier — this is analytics bookkeeping, cost is $0.
     """
-    from core.container import container
+    from services.plugin.deps import get_database
 
     pricing = get_pricing_service()
     cost_data = pricing.calculate_api_cost(service, action, resource_count)
 
-    db = container.database()
+    db = get_database()
     await db.save_api_usage_metric({
         'session_id': context.get('session_id', 'default'),
         'node_id': node_id,

package/server/nodes/google/_credentials.py

@@ -7,7 +7,7 @@ to hand to ``googleapiclient.discovery.build``), so :meth:`build_credentials`
 returns that object instead of an httpx request.
 
 OAuth flow (authorization_url / token_url / scopes) is owned by
-:mod:`services.google_oauth`; this class is the plugin-facing interface
+:mod:`nodes.google._oauth`; this class is the plugin-facing interface
 + Credentials-modal metadata.
 """
 
@@ -30,7 +30,7 @@ class GoogleCredential(OAuth2Credential):
     docs_url = "https://developers.google.com/workspace"
 
     # Scope union across all 6 Google plugins. Single source of truth:
-    # :data:`services.google_oauth.GOOGLE_WORKSPACE_SCOPES`, exposed lazily
+    # :data:`nodes.google._oauth.GOOGLE_WORKSPACE_SCOPES`, exposed lazily
     # to avoid import-cycle risk during credential auto-discovery.
     scopes: ClassVar[tuple] = ()
 
@@ -38,7 +38,7 @@ class GoogleCredential(OAuth2Credential):
     def get_scopes(cls) -> tuple:
         """Return the live scope list (lazy import)."""
         if not cls.scopes:
-            from services.google_oauth import GOOGLE_WORKSPACE_SCOPES
+            from nodes.google._oauth import GOOGLE_WORKSPACE_SCOPES
             cls.scopes = tuple(GOOGLE_WORKSPACE_SCOPES)
         return cls.scopes
 
@@ -50,12 +50,12 @@ class GoogleCredential(OAuth2Credential):
     ):
         """Return a ``google.oauth2.credentials.Credentials`` object.
 
-        Thin wrapper over :func:`services.handlers.google_auth.get_google_credentials`
+        Thin wrapper over :func:`nodes.google._auth_helper.get_google_credentials`
         — the existing helper already handles owner-vs-customer token
         sources + proactive refresh. Keeping the implementation there
         (plus this indirection) means the plugin file's import surface
         stays flat and there's a single place to evolve the refresh
         policy.
         """
-        from services.handlers.google_auth import get_google_credentials
+        from nodes.google._auth_helper import get_google_credentials
         return await get_google_credentials(parameters, context)

package/server/nodes/google/_filters.py

@@ -0,0 +1,25 @@
+"""Gmail event-trigger filter builder (Wave 11.I, milestone K).
+
+Moved verbatim from ``services/event_waiter.build_gmail_filter``.
+``filter_query`` is applied at the Gmail API level during polling
+(see :mod:`._polling`); this filter only checks labels for events
+already on the bus.
+"""
+
+from __future__ import annotations
+
+from typing import Callable, Dict
+
+
+def build_gmail_filter(params: Dict) -> Callable[[Dict], bool]:
+    """Build filter function for Gmail email events."""
+    label_filter = params.get('label_filter', 'INBOX')
+
+    def matches(data: Dict) -> bool:
+        if label_filter and label_filter != 'all':
+            labels = data.get('labels', [])
+            if label_filter not in labels:
+                return False
+        return True
+
+    return matches

package/server/nodes/google/_handlers.py

@@ -0,0 +1,57 @@
+"""Google Workspace WebSocket handlers — factory-built (Wave 11.I, S.2).
+
+The 3 handlers (``google_oauth_login`` / ``google_oauth_status`` /
+``google_logout``) come from
+:func:`services.events.oauth_lifecycle.make_oauth_lifecycle_handlers`.
+``legacy_status_broadcast="google_status"`` keeps the pre-S frontend
+listeners happy by emitting the legacy wire-frame alongside the
+unified credential-event broadcast.
+
+The factory pulls ``google_client_id`` + ``google_client_secret`` from
+``auth_service`` inside the async :func:`_google_oauth_factory` helper
+and constructs a :class:`GoogleOAuth` per call.
+"""
+
+from __future__ import annotations
+
+from typing import Any, Dict, Optional
+
+from services.events.oauth_lifecycle import make_oauth_lifecycle_handlers
+
+from ._oauth import GoogleOAuth
+
+
+async def _google_oauth_factory(
+    *, redirect_uri: Optional[str] = None, **_kwargs,
+) -> GoogleOAuth:
+    """Build a :class:`GoogleOAuth` from stored client credentials."""
+    from services.plugin.deps import get_auth_service
+
+    auth_service = get_auth_service()
+    client_id = await auth_service.get_api_key("google_client_id") or ""
+    client_secret = await auth_service.get_api_key("google_client_secret") or ""
+    return GoogleOAuth(
+        client_id=client_id,
+        client_secret=client_secret,
+        redirect_uri=redirect_uri or "",
+    )
+
+
+def _user_info_to_email(info: Dict[str, Any]) -> str:
+    return info.get("email", "Unknown") or "Unknown"
+
+
+WS_HANDLERS = make_oauth_lifecycle_handlers(
+    provider="google",
+    oauth_factory=_google_oauth_factory,
+    user_info_to_subject=_user_info_to_email,
+    legacy_status_broadcast="google_status",
+)
+
+
+# Module-level aliases so the contract tests in
+# ``tests/credentials/test_websocket_handlers.py`` can import the
+# handlers by name.
+handle_google_oauth_login = WS_HANDLERS["google_oauth_login"]
+handle_google_oauth_status = WS_HANDLERS["google_oauth_status"]
+handle_google_logout = WS_HANDLERS["google_logout"]