lestash 1.63.0__tar.gz → 1.63.2__tar.gz

{lestash-1.63.0 → lestash-1.63.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: lestash
-Version: 1.63.0
+Version: 1.63.2
 Summary: Personal knowledge base CLI - aggregate content from multiple sources
 License: AGPL-3.0-only
 Requires-Python: >=3.12

{lestash-1.63.0 → lestash-1.63.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "lestash"
-version = "1.63.0"
+version = "1.63.2"
 description = "Personal knowledge base CLI - aggregate content from multiple sources"
 readme = "README.md"
 license = {text = "AGPL-3.0-only"}

{lestash-1.63.0 → lestash-1.63.2}/src/lestash/core/google_auth.py

@@ -80,6 +80,7 @@ def save_credentials(credentials: Credentials, scopes: list[str] | None = None)
         "client_id": credentials.client_id,
         "client_secret": credentials.client_secret,
         "scopes": list(credentials.scopes) if credentials.scopes else (scopes or DEFAULT_SCOPES),
+        "expiry": credentials.expiry.isoformat() if credentials.expiry else None,
     }
     path = get_credentials_path()
     path.write_text(json.dumps(creds_data, indent=2))
@@ -88,12 +89,19 @@ def save_credentials(credentials: Credentials, scopes: list[str] | None = None)
 
 def load_credentials() -> Credentials | None:
     """Load OAuth credentials from config file."""
+    from datetime import datetime
+
     path = get_credentials_path()
     if not path.exists():
         return None
 
     try:
         creds_data = json.loads(path.read_text())
+        expiry_str = creds_data.get("expiry")
+        expiry = datetime.fromisoformat(expiry_str) if expiry_str else None
+        # google-auth uses naive UTC datetimes internally; strip tzinfo if present
+        if expiry and expiry.tzinfo is not None:
+            expiry = expiry.replace(tzinfo=None)
         return Credentials(
             token=creds_data.get("token"),
             refresh_token=creds_data.get("refresh_token"),
@@ -101,6 +109,7 @@ def load_credentials() -> Credentials | None:
             client_id=creds_data.get("client_id"),
             client_secret=creds_data.get("client_secret"),
             scopes=creds_data.get("scopes", DEFAULT_SCOPES),
+            expiry=expiry,
         )
     except (json.JSONDecodeError, OSError, KeyError):
         return None
@@ -132,7 +141,12 @@ def run_auth_flow(
         raise FileNotFoundError(msg)
 
     effective_scopes = scopes or DEFAULT_SCOPES
-    flow = InstalledAppFlow.from_client_secrets_file(str(secrets_path), effective_scopes)
+    # Explicitly load the `installed` client config — from_client_secrets_file checks
+    # for `web` before `installed`, so a file with both sections always picks web.
+    # OOB redirect (used by the headless flow) is not allowed for web client types.
+    raw = json.loads(secrets_path.read_text())
+    installed_config = raw.get("installed") or raw
+    flow = InstalledAppFlow.from_client_config({"installed": installed_config}, effective_scopes)
 
     use_headless = headless if headless is not None else is_headless()
     credentials = _run_manual_flow(flow) if use_headless else flow.run_local_server(port=0)
@@ -167,16 +181,20 @@ def get_credentials(scopes: list[str] | None = None) -> Credentials:
     """
     credentials = load_credentials()
 
-    if credentials and credentials.valid:
+    if credentials and credentials.valid and credentials.expiry is not None:
         return credentials
 
-    if credentials and credentials.expired and credentials.refresh_token:
+    if credentials and credentials.refresh_token:
         try:
             credentials.refresh(Request())
             save_credentials(credentials, scopes)
             return credentials
-        except Exception:
-            pass
+        except Exception as e:
+            if "invalid_grant" in str(e).lower():
+                get_credentials_path().unlink(missing_ok=True)
+            raise ValueError(
+                f"Google credentials are no longer valid ({e}). Re-authenticate via the UI."
+            ) from e
 
     raise ValueError("No valid Google credentials. Run 'lestash google auth' to authenticate.")
 
@@ -193,15 +211,19 @@ def check_auth_status() -> dict:
     credentials = load_credentials()
     if credentials:
         result["scopes"] = list(credentials.scopes) if credentials.scopes else []
-        if credentials.valid:
+        # Treat missing expiry as expired — legacy credentials saved without expiry
+        # would otherwise appear valid indefinitely even after revocation.
+        if credentials.valid and credentials.expiry is not None:
             result["authenticated"] = True
-        elif credentials.expired and credentials.refresh_token:
+        elif credentials.refresh_token:
             try:
                 credentials.refresh(Request())
                 save_credentials(credentials)
                 result["authenticated"] = True
             except Exception as e:
                 result["refresh_error"] = str(e)
+                if "invalid_grant" in str(e).lower():
+                    get_credentials_path().unlink(missing_ok=True)
 
     return result