evo-cli 0.12.1__tar.gz → 0.12.2__tar.gz

{evo_cli-0.12.1 → evo_cli-0.12.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: evo_cli
-Version: 0.12.1
+Version: 0.12.2
 Summary: Evolution CLI - a developer toolbox for setting up dev machines
 Author: maycuatroi
 Project-URL: Homepage, https://github.com/maycuatroi/evo-cli
@@ -124,6 +124,7 @@ directly.
 evo cred doctor                       # health + expiry of every credential, exit 1 if any expired
 evo cred get openai_api_key           # print one value by dotted path, nothing else on stdout
 evo cred add openai_api_key           # prompt with no echo, write the folder file, recompile
+evo cred auth --service google-drive  # first-time OAuth consent, stores the refresh token
 evo cred refresh --all                # refresh Google OAuth access tokens
 evo cred compile                      # rebuild ~/.omelet.json from the folder
 evo cred sync push                    # push the folder to a private GitHub repo via gh
@@ -146,6 +147,16 @@ Configuration is env-driven, with no personal defaults baked in:
 `evo cred sync push` refuses to push to a repo whose visibility is not `PRIVATE`. Never echo a value
 into a shared terminal or a log; `doctor` and `list` only ever print a masked preview.
 
+`evo cred auth` performs the initial OAuth consent that `refresh` cannot: it starts a loopback server,
+opens the consent screen, and writes the resulting refresh token into the store. Create the OAuth
+client in the Cloud Console first (APIs & Services -> Credentials -> Create OAuth client ID ->
+**Desktop app**) and pass the downloaded JSON with `--client-secrets`; there is no gcloud equivalent
+for creating an OAuth client.
+
+`evo gdrive` reads its token from the `google_drive` entry through this store rather than parsing
+`~/.omelet.json` itself, so a refresh writes to the folder and recompiles instead of racing whatever
+else has the flat file open.
+
 #### Harness Repositories
 
 Fast-forward every available repository declared in a harness manifest:

{evo_cli-0.12.1 → evo_cli-0.12.2}/README.md

@@ -96,6 +96,7 @@ directly.
 evo cred doctor                       # health + expiry of every credential, exit 1 if any expired
 evo cred get openai_api_key           # print one value by dotted path, nothing else on stdout
 evo cred add openai_api_key           # prompt with no echo, write the folder file, recompile
+evo cred auth --service google-drive  # first-time OAuth consent, stores the refresh token
 evo cred refresh --all                # refresh Google OAuth access tokens
 evo cred compile                      # rebuild ~/.omelet.json from the folder
 evo cred sync push                    # push the folder to a private GitHub repo via gh
@@ -118,6 +119,16 @@ Configuration is env-driven, with no personal defaults baked in:
 `evo cred sync push` refuses to push to a repo whose visibility is not `PRIVATE`. Never echo a value
 into a shared terminal or a log; `doctor` and `list` only ever print a masked preview.
 
+`evo cred auth` performs the initial OAuth consent that `refresh` cannot: it starts a loopback server,
+opens the consent screen, and writes the resulting refresh token into the store. Create the OAuth
+client in the Cloud Console first (APIs & Services -> Credentials -> Create OAuth client ID ->
+**Desktop app**) and pass the downloaded JSON with `--client-secrets`; there is no gcloud equivalent
+for creating an OAuth client.
+
+`evo gdrive` reads its token from the `google_drive` entry through this store rather than parsing
+`~/.omelet.json` itself, so a refresh writes to the folder and recompiles instead of racing whatever
+else has the flat file open.
+
 #### Harness Repositories
 
 Fast-forward every available repository declared in a harness manifest:

evo_cli-0.12.2/evo_cli/VERSION

@@ -0,0 +1 @@
+0.12.2

{evo_cli-0.12.1 → evo_cli-0.12.2}/evo_cli/commands/cred.py

@@ -2,13 +2,15 @@ import getpass
 import json
 import os
 import sys
+import webbrowser
+from pathlib import Path
 
 import rich_click as click
 from rich.table import Table
 
 from evo_cli.console import console, info, success, warning
 from evo_cli.credentials import doctor as doctor_module
-from evo_cli.credentials import google_oauth, migrate, sync
+from evo_cli.credentials import google_oauth, migrate, oauth_flow, sync
 from evo_cli.credentials.registry import config_path, credentials_dir
 from evo_cli.credentials.store import (
     CredentialError,
@@ -199,6 +201,89 @@ def refresh(refresh_all, service, dry_run):
         raise click.exceptions.Exit(1)
 
 
+@cred_group.command("auth", help="Run the first-time Google OAuth consent flow and store the refresh token.")
+@click.option(
+    "--service",
+    required=True,
+    type=click.Choice(sorted(google_oauth.SERVICE_ALIASES)),
+    help="Which service to authorise.",
+)
+@click.option(
+    "--client-secrets",
+    type=click.Path(exists=True, dir_okay=False, path_type=Path),
+    help="OAuth client JSON downloaded from the Cloud Console. Omit to reuse the stored client.",
+)
+@click.option("--scope", "scopes", multiple=True, help="Override the scopes. Repeat for several.")
+@click.option("--no-browser", is_flag=True, help="Print the URL instead of opening a browser.")
+def auth(service, client_secrets, scopes, no_browser):
+    target = google_oauth.SERVICE_ALIASES[service]
+    _guard(require_folder)
+
+    entries = _guard(google_oauth.select_entries, target)
+    if not entries:
+        raise click.ClickException(f"no oauth entry for '{service}' in the store")
+    path, entry = entries[0]
+
+    resolved_scopes = list(scopes) or (entry.get("oauth") or {}).get("scopes")
+    if not resolved_scopes:
+        raise click.ClickException(
+            f"no scopes known for '{service}'. Pass --scope, or add them to the oauth descriptor "
+            f"in evo_cli/credentials/registry.py."
+        )
+
+    if client_secrets:
+        client_id, client_secret = _guard(oauth_flow.client_from_secrets_file, client_secrets)
+    else:
+        client_id, client_secret = oauth_flow.client_from_entry(entry)
+    if not client_id or not client_secret:
+        raise click.ClickException(
+            "no OAuth client available. Create one in the Cloud Console "
+            "(APIs & Services -> Credentials -> OAuth client ID -> Desktop app), download the JSON, "
+            "and pass it with --client-secrets."
+        )
+
+    server, redirect_uri, thread = oauth_flow.capture_code()
+    state = oauth_flow.new_state()
+    url = oauth_flow.build_auth_url(client_id, redirect_uri, resolved_scopes, state)
+
+    info(f"scopes: {', '.join(resolved_scopes)}")
+    info(f"listening on {redirect_uri}")
+    if no_browser:
+        console.print(f"\nOpen this URL to authorise:\n\n{url}\n")
+    else:
+        console.print("\nOpening your browser to authorise. Approve the consent screen.\n")
+        webbrowser.open(url)
+
+    thread.start()
+    thread.join(timeout=300)
+    result = oauth_flow._Handler.result
+    server.server_close()
+
+    if result is None:
+        raise click.ClickException("timed out waiting for the consent redirect")
+    if result.get("error"):
+        raise click.ClickException(f"Google returned an error: {result['error']}")
+    if result.get("state") != state:
+        raise click.ClickException("state mismatch on the redirect; aborting rather than trusting it")
+
+    body = _guard(oauth_flow.exchange_code, client_id, client_secret, result["code"], redirect_uri)
+
+    oauth = entry.get("oauth") or {}
+    container_path = oauth.get("client_from") or oauth.get("container") or []
+    if container_path:
+        cursor = entry.setdefault("flat", {})
+        for part in container_path[:-1]:
+            cursor = cursor.setdefault(part, {})
+        leaf = cursor.setdefault(container_path[-1], {})
+        leaf["client_id"] = client_id
+        leaf["client_secret"] = client_secret
+
+    expiry = _guard(oauth_flow.store_tokens, path, entry, body, resolved_scopes)
+    count, _, target_path = _guard(compile_flat)
+    success(f"{target}: authorised, valid until {expiry}")
+    success(f"compiled {count} entries -> {target_path}")
+
+
 @cred_group.command("migrate", help="Split a flat omelet.json into the per-service credentials folder.")
 @click.option("--source", "source", type=click.Path(), help="Flat file to migrate. Defaults to the compiled config.")
 @click.option("--dry-run", is_flag=True, help="Show the plan, write nothing.")

{evo_cli-0.12.1 → evo_cli-0.12.2}/evo_cli/commands/gdrive.py

@@ -1,22 +1,23 @@
 import base64
 import json
 import mimetypes
-import os
 import re
 import sys
-import tempfile
 import urllib.error
 import urllib.parse
 import urllib.request
-from datetime import datetime, timedelta, timezone
+from datetime import datetime, timezone
 from pathlib import Path
 
 import rich_click as click
 from rich.text import Text
 
 from evo_cli.console import error, info, step, success, warning
+from evo_cli.credentials import google_oauth
+from evo_cli.credentials.registry import dig, load_entries
+from evo_cli.credentials.store import compile_flat
 
-CONFIG_PATH = Path(os.environ.get("OMELET_CONFIG", str(Path.home() / ".omelet.json")))
+DRIVE_SERVICE_ID = "google_drive"
 TOKEN_URL = "https://oauth2.googleapis.com/token"
 DOCS_API = "https://docs.googleapis.com/v1/documents/{doc_id}"
 DRIVE_FILE_API = "https://www.googleapis.com/drive/v3/files/{file_id}"
@@ -48,24 +49,14 @@ def extract_doc_id(value):
     return None
 
 
-def read_config():
-    if not CONFIG_PATH.exists():
-        raise click.ClickException(f"config not found: {CONFIG_PATH}")
-    return json.loads(CONFIG_PATH.read_text(encoding="utf-8"))
-
-
-def write_config(data):
-    tmp = tempfile.NamedTemporaryFile("w", delete=False, dir=str(CONFIG_PATH.parent), encoding="utf-8")
-    try:
-        json.dump(data, tmp, indent=2, ensure_ascii=False)
-        tmp.write("\n")
-        tmp.close()
-        os.chmod(tmp.name, 0o600)
-        os.replace(tmp.name, CONFIG_PATH)
-    except Exception:
-        if os.path.exists(tmp.name):
-            os.unlink(tmp.name)
-        raise
+def drive_entry():
+    for path, entry in load_entries():
+        if entry.get("id") == DRIVE_SERVICE_ID and entry.get("oauth"):
+            return path, entry
+    raise click.ClickException(
+        f"no '{DRIVE_SERVICE_ID}' oauth entry in the credential store. "
+        "Authorise it once with: evo cred auth --service google-drive --client-secrets <client.json>"
+    )
 
 
 def token_expired(token_section):
@@ -73,7 +64,7 @@ def token_expired(token_section):
     if not expiry:
         return True
     try:
-        when = datetime.fromisoformat(expiry)
+        when = datetime.fromisoformat(str(expiry).replace("Z", "+00:00"))
     except ValueError:
         return True
     if when.tzinfo is None:
@@ -82,62 +73,31 @@ def token_expired(token_section):
     return (when - now).total_seconds() < 60
 
 
-def refresh_token(data):
-    rclone_section = data.get("rclone", {})
-    token_section = rclone_section.get("token", {})
-    refresh = token_section.get("refresh_token")
-    if not refresh:
-        raise click.ClickException("rclone.token.refresh_token missing in config")
-
-    client_id = os.environ.get("RCLONE_DRIVE_CLIENT_ID") or rclone_section.get("client_id")
-    client_secret = os.environ.get("RCLONE_DRIVE_CLIENT_SECRET") or rclone_section.get("client_secret")
-    if not client_id or not client_secret:
+def refresh_token(path, entry):
+    creds, err = google_oauth.resolve_creds(entry)
+    if err:
         raise click.ClickException(
-            "OAuth client credentials required. Set RCLONE_DRIVE_CLIENT_ID + RCLONE_DRIVE_CLIENT_SECRET "
-            "or add rclone.client_id + rclone.client_secret to the config."
+            f"cannot refresh {DRIVE_SERVICE_ID}: {err}. "
+            "Authorise once with: evo cred auth --service google-drive --client-secrets <client.json>"
         )
-
-    payload = urllib.parse.urlencode(
-        {
-            "client_id": client_id,
-            "client_secret": client_secret,
-            "refresh_token": refresh,
-            "grant_type": "refresh_token",
-        }
-    ).encode("utf-8")
-    req = urllib.request.Request(TOKEN_URL, data=payload, method="POST")
-    req.add_header("Content-Type", "application/x-www-form-urlencoded")
-
     try:
-        with urllib.request.urlopen(req, timeout=30) as resp:
-            body = json.loads(resp.read().decode("utf-8"))
-    except urllib.error.HTTPError as exc:
-        err_body = exc.read().decode("utf-8", "replace")
-        raise click.ClickException(f"token refresh failed: HTTP {exc.code} {err_body}") from exc
-
-    access = body.get("access_token")
-    if not access:
-        raise click.ClickException(f"no access_token in refresh response: {body}")
-
-    expires_in = int(body.get("expires_in", 3600))
-    tz = timezone(timedelta(hours=7))
-    expiry = (datetime.now(tz) + timedelta(seconds=expires_in)).isoformat()
+        expiry = google_oauth.refresh_entry(path, entry, creds)
+    except Exception as exc:
+        raise click.ClickException(f"token refresh failed: {google_oauth.describe_error(exc)}") from exc
 
-    data["rclone"]["token"]["access_token"] = access
-    data["rclone"]["token"]["expiry"] = expiry
-    data["rclone"]["token"]["expires_in"] = expires_in
-    write_config(data)
+    compile_flat()
     info(f"Refreshed Drive access token (valid until [accent]{expiry}[/accent])")
-    return access
+    return creds["container"][entry["oauth"]["access_field"]]
 
 
 def access_token():
-    data = read_config()
-    token_section = data.get("rclone", {}).get("token", {})
-    token = token_section.get("access_token")
-    if not token or token_expired(token_section):
+    path, entry = drive_entry()
+    oauth = entry["oauth"]
+    container = dig(entry.get("flat", {}), oauth["container"]) or {}
+    token = container.get(oauth["access_field"])
+    if not token or token_expired(container):
         info("Access token missing or expired - refreshing.")
-        token = refresh_token(data)
+        token = refresh_token(path, entry)
     return token
 
 

{evo_cli-0.12.1 → evo_cli-0.12.2}/evo_cli/commands/localproxy.py

@@ -32,7 +32,6 @@ from rich.text import Text
 
 from evo_cli.console import console, error, info, step, success, warning
 
-
 # ── Certificate authority / leaf generation ──────────────────────────────────
 
 def _cert_dir(custom=None):

evo_cli-0.12.2/evo_cli/credentials/oauth_flow.py

@@ -0,0 +1,146 @@
+import json
+import secrets
+import threading
+import urllib.parse
+import urllib.request
+from datetime import datetime, timedelta
+from http.server import BaseHTTPRequestHandler, HTTPServer
+
+from evo_cli.credentials.google_oauth import TOKEN_URL
+from evo_cli.credentials.registry import dig
+from evo_cli.credentials.store import TZ, CredentialError, write_entry
+
+AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth"
+
+SUCCESS_PAGE = b"""<!doctype html><meta charset="utf-8">
+<title>evo cred auth</title>
+<body style="font-family:system-ui;padding:3rem;max-width:32rem">
+<h2>Authorised</h2><p>The token was written to your credential store. You can close this tab.</p>
+</body>"""
+
+FAILURE_PAGE = b"""<!doctype html><meta charset="utf-8">
+<title>evo cred auth</title>
+<body style="font-family:system-ui;padding:3rem;max-width:32rem">
+<h2>Authorisation failed</h2><p>Check the terminal for details.</p>
+</body>"""
+
+
+def client_from_secrets_file(path):
+    try:
+        data = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError) as exc:
+        raise CredentialError(f"cannot read OAuth client file {path}: {exc}") from exc
+
+    block = data.get("installed") or data.get("web") or data
+    client_id = block.get("client_id")
+    client_secret = block.get("client_secret")
+    if not client_id or not client_secret:
+        raise CredentialError(
+            f"{path} has no client_id/client_secret. Download the JSON from "
+            "Console -> APIs & Services -> Credentials -> your OAuth client."
+        )
+    return client_id, client_secret
+
+
+def client_from_entry(entry):
+    oauth = entry.get("oauth") or {}
+    source = dig(entry.get("flat", {}), oauth.get("client_from") or []) or {}
+    return source.get("client_id"), source.get("client_secret")
+
+
+def build_auth_url(client_id, redirect_uri, scopes, state):
+    params = {
+        "client_id": client_id,
+        "redirect_uri": redirect_uri,
+        "response_type": "code",
+        "scope": " ".join(scopes),
+        "access_type": "offline",
+        "prompt": "consent",
+        "state": state,
+    }
+    return f"{AUTH_URL}?{urllib.parse.urlencode(params)}"
+
+
+def exchange_code(client_id, client_secret, code, redirect_uri):
+    payload = urllib.parse.urlencode(
+        {
+            "client_id": client_id,
+            "client_secret": client_secret,
+            "code": code,
+            "grant_type": "authorization_code",
+            "redirect_uri": redirect_uri,
+        }
+    ).encode("utf-8")
+    request = urllib.request.Request(TOKEN_URL, data=payload, method="POST")
+    request.add_header("Content-Type", "application/x-www-form-urlencoded")
+    with urllib.request.urlopen(request, timeout=60) as response:
+        return json.loads(response.read().decode("utf-8"))
+
+
+class _Handler(BaseHTTPRequestHandler):
+    result = None
+
+    def do_GET(self):
+        query = urllib.parse.parse_qs(urllib.parse.urlparse(self.path).query)
+        code = query.get("code", [None])[0]
+        state = query.get("state", [None])[0]
+        error = query.get("error", [None])[0]
+
+        ok = bool(code) and not error
+        self.send_response(200)
+        self.send_header("Content-Type", "text/html; charset=utf-8")
+        self.end_headers()
+        self.wfile.write(SUCCESS_PAGE if ok else FAILURE_PAGE)
+        type(self).result = {"code": code, "state": state, "error": error}
+
+    def log_message(self, *_args):
+        return
+
+
+def capture_code(timeout=300):
+    server = HTTPServer(("127.0.0.1", 0), _Handler)
+    server.timeout = timeout
+    _Handler.result = None
+    redirect_uri = f"http://127.0.0.1:{server.server_port}"
+
+    def serve():
+        while _Handler.result is None:
+            server.handle_request()
+
+    thread = threading.Thread(target=serve, daemon=True)
+    return server, redirect_uri, thread
+
+
+def store_tokens(path, entry, body, scopes):
+    access = body.get("access_token")
+    refresh = body.get("refresh_token")
+    if not access:
+        raise CredentialError("no access_token in Google's response")
+    if not refresh:
+        raise CredentialError(
+            "Google returned no refresh_token. Revoke the app at "
+            "https://myaccount.google.com/permissions and authorise again."
+        )
+
+    oauth = entry["oauth"]
+    flat = entry.setdefault("flat", {})
+    cursor = flat
+    for part in oauth["container"][:-1]:
+        cursor = cursor.setdefault(part, {})
+    container = cursor.setdefault(oauth["container"][-1], {})
+
+    expiry = (datetime.now(TZ) + timedelta(seconds=int(body.get("expires_in", 3600)))).isoformat()
+    container[oauth["access_field"]] = access
+    container["refresh_token"] = refresh
+    container[oauth["expiry_field"]] = expiry
+    container["scopes"] = list(scopes)
+
+    entry["expiry"] = expiry
+    entry["status"] = "active"
+    entry["last_rotated"] = datetime.now(TZ).isoformat()
+    write_entry(path, entry)
+    return expiry
+
+
+def new_state():
+    return secrets.token_urlsafe(24)

{evo_cli-0.12.1 → evo_cli-0.12.2}/evo_cli/credentials/registry.py

@@ -155,7 +155,11 @@ SPECS = [
         "category": "google-oauth",
         "type": "oauth_token",
         "lifetime": "access ~1h, refresh until revoked",
-        "description": "rclone Google Drive remote: OAuth token + root folder",
+        "description": (
+            "rclone Google Drive remote: OAuth token + root folder. Being replaced by google_drive; "
+            "still active because red-life/packages/core/src/teaching/drive.ts reads it. Do not mark "
+            "deprecated until that consumer migrates - compile would drop the key and break it."
+        ),
         "rotate": "evo cred refresh --service rclone (or rclone config reconnect)",
         "oauth": {
             "container": ["rclone", "token"],
@@ -189,13 +193,14 @@ SPECS = [
         "category": "google-oauth",
         "type": "oauth_token",
         "lifetime": "access ~1h, refresh until revoked",
-        "description": "Google Drive OAuth token (evo gdrive)",
-        "rotate": "evo cred refresh --service google-drive",
+        "description": "Google Drive OAuth token, project omelet-f0b89 (evo gdrive, life teach)",
+        "rotate": "evo cred refresh --service google-drive; first consent: evo cred auth --service google-drive",
         "oauth": {
             "container": ["google_drive", "token"],
             "access_field": "token",
             "expiry_field": "expiry",
             "client_from": ["google_drive", "token"],
+            "scopes": ["https://www.googleapis.com/auth/drive.readonly"],
         },
         "keys": ["google_drive"],
     },
@@ -322,7 +327,7 @@ SPECS = [
         "category": "firebase",
         "type": "service_account",
         "lifetime": "stable",
-        "description": "Firebase Admin SDK service account (project omelet-f0b89)",
+        "description": "Firebase Admin SDK service account (project fu-instructor)",
         "rotate": "Firebase console -> Service accounts -> generate new key",
         "keys": ["firebase_admin_sdk"],
     },

{evo_cli-0.12.1 → evo_cli-0.12.2}/evo_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: evo_cli
-Version: 0.12.1
+Version: 0.12.2
 Summary: Evolution CLI - a developer toolbox for setting up dev machines
 Author: maycuatroi
 Project-URL: Homepage, https://github.com/maycuatroi/evo-cli
@@ -124,6 +124,7 @@ directly.
 evo cred doctor                       # health + expiry of every credential, exit 1 if any expired
 evo cred get openai_api_key           # print one value by dotted path, nothing else on stdout
 evo cred add openai_api_key           # prompt with no echo, write the folder file, recompile
+evo cred auth --service google-drive  # first-time OAuth consent, stores the refresh token
 evo cred refresh --all                # refresh Google OAuth access tokens
 evo cred compile                      # rebuild ~/.omelet.json from the folder
 evo cred sync push                    # push the folder to a private GitHub repo via gh
@@ -146,6 +147,16 @@ Configuration is env-driven, with no personal defaults baked in:
 `evo cred sync push` refuses to push to a repo whose visibility is not `PRIVATE`. Never echo a value
 into a shared terminal or a log; `doctor` and `list` only ever print a masked preview.
 
+`evo cred auth` performs the initial OAuth consent that `refresh` cannot: it starts a loopback server,
+opens the consent screen, and writes the resulting refresh token into the store. Create the OAuth
+client in the Cloud Console first (APIs & Services -> Credentials -> Create OAuth client ID ->
+**Desktop app**) and pass the downloaded JSON with `--client-secrets`; there is no gcloud equivalent
+for creating an OAuth client.
+
+`evo gdrive` reads its token from the `google_drive` entry through this store rather than parsing
+`~/.omelet.json` itself, so a refresh writes to the folder and recompiles instead of racing whatever
+else has the flat file open.
+
 #### Harness Repositories
 
 Fast-forward every available repository declared in a harness manifest:

{evo_cli-0.12.1 → evo_cli-0.12.2}/evo_cli.egg-info/SOURCES.txt

@@ -43,6 +43,7 @@ evo_cli/credentials/__init__.py
 evo_cli/credentials/doctor.py
 evo_cli/credentials/google_oauth.py
 evo_cli/credentials/migrate.py
+evo_cli/credentials/oauth_flow.py
 evo_cli/credentials/registry.py
 evo_cli/credentials/store.py
 evo_cli/credentials/sync.py

{evo_cli-0.12.1 → evo_cli-0.12.2}/tests/test_cred.py

@@ -1,11 +1,13 @@
 import json
+from urllib.parse import parse_qs, urlparse
 
 import pytest
 from click.testing import CliRunner
 
 from evo_cli.cli import cli
+from evo_cli.commands import gdrive
 from evo_cli.credentials import doctor as doctor_module
-from evo_cli.credentials import migrate, registry
+from evo_cli.credentials import migrate, oauth_flow, registry
 from evo_cli.credentials.store import compile_flat, get_value, set_value
 
 
@@ -28,7 +30,7 @@ def _write(store, rel, entry):
 
 def test_cred_command_is_registered():
     assert "cred" in cli.commands
-    for name in ("get", "list", "doctor", "compile", "add", "refresh", "migrate", "sync", "path"):
+    for name in ("get", "list", "doctor", "compile", "add", "auth", "refresh", "migrate", "sync", "path"):
         assert name in cli.commands["cred"].commands
     assert set(cli.commands["cred"].commands["sync"].commands) == {"push", "pull"}
 
@@ -170,7 +172,11 @@ def test_doctor_flags_expired_oauth_and_exits_nonzero(store):
 
 
 def test_secret_preview_masks_and_never_shows_full_value(store):
-    _write(store, "ai/openai.json", {"id": "openai", "service": "OpenAI", "flat": {"openai_api_key": "sk-abcdefghijklmnop"}})
+    _write(
+        store,
+        "ai/openai.json",
+        {"id": "openai", "service": "OpenAI", "flat": {"openai_api_key": "sk-abcdefghijklmnop"}},
+    )
     _write(store, "tools/short.json", {"id": "short", "service": "Short", "flat": {"short_token": "tiny"}})
 
     previews = {row["service"]: row["secret"] for row in doctor_module.scan()}
@@ -261,8 +267,12 @@ def test_refresh_writes_new_token_and_recompiles(store, monkeypatch):
         {
             "id": "gmail",
             "service": "Gmail",
-            "oauth": {"container": ["gmail", "token"], "access_field": "token", "expiry_field": "expiry",
-                      "client_from": ["gmail", "token"]},
+            "oauth": {
+                "container": ["gmail", "token"],
+                "access_field": "token",
+                "expiry_field": "expiry",
+                "client_from": ["gmail", "token"],
+            },
             "flat": {
                 "gmail": {
                     "token": {
@@ -293,9 +303,15 @@ def test_refresh_dry_run_does_not_write(store, monkeypatch):
         "google-oauth/gmail.json",
         {
             "id": "gmail",
-            "oauth": {"container": ["gmail", "token"], "access_field": "token", "expiry_field": "expiry",
-                      "client_from": ["gmail", "token"]},
-            "flat": {"gmail": {"token": {"token": "old", "refresh_token": "rt", "client_id": "c", "client_secret": "s"}}},
+            "oauth": {
+                "container": ["gmail", "token"],
+                "access_field": "token",
+                "expiry_field": "expiry",
+                "client_from": ["gmail", "token"],
+            },
+            "flat": {
+                "gmail": {"token": {"token": "old", "refresh_token": "rt", "client_id": "c", "client_secret": "s"}}
+            },
         },
     )
 
@@ -316,8 +332,12 @@ def test_refresh_skips_entry_without_refresh_token(store):
         "google-oauth/gmail.json",
         {
             "id": "gmail",
-            "oauth": {"container": ["gmail", "token"], "access_field": "token", "expiry_field": "expiry",
-                      "client_from": ["gmail", "token"]},
+            "oauth": {
+                "container": ["gmail", "token"],
+                "access_field": "token",
+                "expiry_field": "expiry",
+                "client_from": ["gmail", "token"],
+            },
             "flat": {"gmail": {"token": {"token": "old"}}},
         },
     )
@@ -340,3 +360,129 @@ def test_sync_requires_repo_env(store, monkeypatch):
 def test_registry_maps_contract_keys_to_specs():
     for key in ("rclone", "gmail", "google_drive", "google_calendar", "facebook", "openai_api_key"):
         assert registry.spec_for_flat_key(key) is not None
+
+
+def test_auth_command_is_registered():
+    assert "auth" in cli.commands["cred"].commands
+
+
+def test_build_auth_url_requests_offline_consent():
+    url = oauth_flow.build_auth_url("cid", "http://127.0.0.1:9999", ["scope/a", "scope/b"], "st8")
+
+    assert url.startswith(oauth_flow.AUTH_URL + "?")
+    query = parse_qs(urlparse(url).query)
+    assert query["client_id"] == ["cid"]
+    assert query["redirect_uri"] == ["http://127.0.0.1:9999"]
+    assert query["scope"] == ["scope/a scope/b"]
+    assert query["access_type"] == ["offline"]
+    assert query["prompt"] == ["consent"]
+    assert query["state"] == ["st8"]
+
+
+def test_client_from_secrets_file_reads_installed_block(tmp_path):
+    path = tmp_path / "client.json"
+    path.write_text(json.dumps({"installed": {"client_id": "cid", "client_secret": "cs"}}), encoding="utf-8")
+
+    assert oauth_flow.client_from_secrets_file(path) == ("cid", "cs")
+
+
+def test_client_from_secrets_file_rejects_a_file_without_a_client(tmp_path):
+    path = tmp_path / "client.json"
+    path.write_text(json.dumps({"nothing": True}), encoding="utf-8")
+
+    with pytest.raises(Exception) as excinfo:
+        oauth_flow.client_from_secrets_file(path)
+
+    assert "no client_id/client_secret" in str(excinfo.value)
+
+
+def test_store_tokens_refuses_a_response_without_refresh_token(store):
+    entry = {
+        "id": "google_drive",
+        "oauth": {"container": ["google_drive", "token"], "access_field": "token", "expiry_field": "expiry"},
+        "flat": {},
+    }
+
+    with pytest.raises(Exception) as excinfo:
+        oauth_flow.store_tokens(
+            store["dir"] / "google-oauth" / "google-drive.json",
+            entry,
+            {"access_token": "at", "expires_in": 3600},
+            ["s"],
+        )
+
+    assert "no refresh_token" in str(excinfo.value)
+
+
+def test_store_tokens_writes_token_refresh_and_scopes(store):
+    path = store["dir"] / "google-oauth" / "google-drive.json"
+    entry = {
+        "id": "google_drive",
+        "oauth": {"container": ["google_drive", "token"], "access_field": "token", "expiry_field": "expiry"},
+        "flat": {},
+    }
+
+    oauth_flow.store_tokens(
+        path,
+        entry,
+        {"access_token": "at", "refresh_token": "rt", "expires_in": 3600},
+        ["https://www.googleapis.com/auth/drive.readonly"],
+    )
+
+    written = json.loads(path.read_text(encoding="utf-8"))["flat"]["google_drive"]["token"]
+    assert written["token"] == "at"
+    assert written["refresh_token"] == "rt"
+    assert written["scopes"] == ["https://www.googleapis.com/auth/drive.readonly"]
+    assert written["expiry"]
+
+
+def test_gdrive_reads_the_google_drive_entry_not_rclone(store):
+    _write(
+        store,
+        "google-oauth/rclone.json",
+        {
+            "id": "rclone",
+            "oauth": {
+                "container": ["rclone", "token"],
+                "access_field": "access_token",
+                "expiry_field": "expiry",
+                "client_from": ["rclone"],
+            },
+            "flat": {"rclone": {"token": {"access_token": "rclone-token", "expiry": "2099-01-01T00:00:00+00:00"}}},
+        },
+    )
+    _write(
+        store,
+        "google-oauth/google-drive.json",
+        {
+            "id": "google_drive",
+            "oauth": {
+                "container": ["google_drive", "token"],
+                "access_field": "token",
+                "expiry_field": "expiry",
+                "client_from": ["google_drive", "token"],
+            },
+            "flat": {"google_drive": {"token": {"token": "drive-token", "expiry": "2099-01-01T00:00:00+00:00"}}},
+        },
+    )
+
+    assert gdrive.access_token() == "drive-token"
+
+
+def test_gdrive_without_a_drive_entry_points_at_the_auth_command(store):
+    with pytest.raises(Exception) as excinfo:
+        gdrive.access_token()
+
+    assert "evo cred auth --service google-drive" in str(excinfo.value)
+
+
+def test_registry_drive_scope_is_readonly_not_full_drive():
+    spec = registry.spec_for_flat_key("google_drive")
+
+    assert spec["oauth"]["scopes"] == ["https://www.googleapis.com/auth/drive.readonly"]
+
+
+def test_rclone_is_not_deprecated_while_red_life_still_reads_it():
+    spec = registry.spec_for_flat_key("rclone")
+
+    assert spec.get("status") != "deprecated"

evo_cli-0.12.1/evo_cli/VERSION

@@ -1 +0,0 @@
-0.12.1