fix: Improve auth flow (#12)

- Remove deprecated OOB oauth flow for loopback withh fallback for headless env's
- Updated token storeage to use single source of truth
- Ensure auto-refesh works for stored tokens
- Added better error handling
- Improve tests

Author: DRBragg

lib/rcal/adapters/auth/base.rb

@@ -10,6 +10,10 @@ def load_credentials
           raise NotImplementedError, "#{self.class} must implement #load_credentials"
         end
 
+        def load_client_credentials
+          raise NotImplementedError, "#{self.class} must implement #load_client_credentials"
+        end
+
         def authenticated?
           raise NotImplementedError, "#{self.class} must implement #authenticated?"
         end
@@ -21,6 +25,14 @@ def token_expired?
         def clear_credentials
           raise NotImplementedError, "#{self.class} must implement #clear_credentials"
         end
+
+        def token_path
+          raise NotImplementedError, "#{self.class} must implement #token_path"
+        end
+
+        def client_credentials_path
+          raise NotImplementedError, "#{self.class} must implement #client_credentials_path"
+        end
       end
     end
   end

lib/rcal/adapters/auth/google.rb

@@ -1,45 +1,59 @@
 require "json"
+require "yaml"
 require "fileutils"
 require_relative "base"
 
 module Rcal
   module Adapters
     module Auth
       class Google < Base
-        def self.default_token_path
-          base = ENV.fetch("XDG_DATA_HOME") { File.join(ENV.fetch("HOME"), ".local", "share") }
-          File.join(base, "rcal", "tokens.json")
-        end
+        SCOPES = [
+          "https://www.googleapis.com/auth/calendar.readonly",
+          "https://www.googleapis.com/auth/calendar.events"
+        ].freeze
+
+        TOKEN_FILENAME = "google_tokens.yaml"
+        CLIENT_CREDENTIALS_FILENAME = "client_credentials.json"
+        LEGACY_TOKEN_FILENAME = "tokens.json"
 
-        def initialize(token_path: self.class.default_token_path)
-          @token_path = token_path
+        def initialize(data_dir:)
+          @data_dir = data_dir
         end
 
         def store_credentials(credentials)
           ensure_directory_exists
 
           token_data = {
+            "client_id" => credentials.client_id,
             "access_token" => credentials.access_token,
             "refresh_token" => credentials.refresh_token,
-            "expires_at" => credentials.expires_at.to_i
+            "scope" => Array(credentials.scope),
+            "expiration_time_millis" => (credentials.expires_at.to_i * 1000)
           }
 
-          File.write(@token_path, JSON.generate(token_data))
-          File.chmod(0o600, @token_path)
+          yaml_data = {"default" => JSON.generate(token_data)}
+          File.write(token_path, YAML.dump(yaml_data))
+          File.chmod(0o600, token_path)
         end
 
         def load_credentials
-          return nil unless File.exist?(@token_path)
+          return nil unless File.exist?(token_path)
 
-          JSON.parse(File.read(@token_path))
-        rescue JSON::ParserError
+          yaml_data = YAML.safe_load_file(token_path)
+          return nil unless yaml_data&.key?("default")
+
+          JSON.parse(yaml_data["default"])
+        rescue JSON::ParserError, Psych::SyntaxError
           nil
         end
 
         def authenticated?
           creds = load_credentials
           return false if creds.nil?
 
+          client_creds = load_client_credentials
+          return false if client_creds.nil?
+
           # Need at least a refresh token to be considered authenticated
           # (we can refresh expired access tokens)
           !creds["refresh_token"].nil? && !creds["refresh_token"].empty?
@@ -49,21 +63,43 @@ def token_expired?
           creds = load_credentials
           return true if creds.nil?
 
-          expires_at = creds["expires_at"]
-          return true if expires_at.nil?
+          expiration = creds["expiration_time_millis"]
+          return true if expiration.nil?
 
-          Time.at(expires_at) <= Time.now
+          Time.at(expiration / 1000) <= Time.now
         end
 
         def clear_credentials
-          FileUtils.rm_f(@token_path)
+          FileUtils.rm_f(token_path)
+          # Clean up legacy token file if it exists from a previous version
+          FileUtils.rm_f(legacy_token_path)
+        end
+
+        def load_client_credentials
+          creds_file = client_credentials_path
+          return nil unless File.exist?(creds_file)
+
+          JSON.parse(File.read(creds_file))
+        rescue JSON::ParserError
+          nil
+        end
+
+        def token_path
+          File.join(@data_dir, TOKEN_FILENAME)
+        end
+
+        def client_credentials_path
+          File.join(@data_dir, CLIENT_CREDENTIALS_FILENAME)
         end
 
         private
 
+        def legacy_token_path
+          File.join(@data_dir, LEGACY_TOKEN_FILENAME)
+        end
+
         def ensure_directory_exists
-          dir = File.dirname(@token_path)
-          FileUtils.mkdir_p(dir) unless File.directory?(dir)
+          FileUtils.mkdir_p(@data_dir) unless File.directory?(@data_dir)
         end
       end
     end

lib/rcal/adapters/calendar/google.rb

@@ -1,5 +1,6 @@
 require "time"
 require "google/apis/calendar_v3"
+require "signet"
 require_relative "base"
 require_relative "../../models/calendar"
 require_relative "../../models/event"
@@ -8,65 +9,89 @@ module Rcal
   module Adapters
     module Calendar
       class Google < Base
+        AUTH_ERROR_MESSAGE = "Authentication expired or revoked. Run 'rcal init' to re-authenticate."
+
         def initialize(service:)
           @service = service
         end
 
         def list_calendars
-          response = @service.list_calendar_lists
-          items = response.items || []
+          with_auth_handling do
+            response = @service.list_calendar_lists
+            items = response.items || []
 
-          items.map { |cal| build_calendar(cal) }
+            items.map { |cal| build_calendar(cal) }
+          end
         end
 
         def get_calendar(calendar_id:)
-          google_calendar = @service.get_calendar(calendar_id)
-          build_calendar(google_calendar)
+          with_auth_handling do
+            google_calendar = @service.get_calendar(calendar_id)
+            build_calendar(google_calendar)
+          end
         end
 
         def list_events(calendar_id:, time_min:, time_max:)
-          response = @service.list_events(
-            calendar_id,
-            time_min: time_min.iso8601,
-            time_max: time_max.iso8601,
-            single_events: true,
-            order_by: "startTime"
-          )
+          with_auth_handling do
+            response = @service.list_events(
+              calendar_id,
+              time_min: time_min.iso8601,
+              time_max: time_max.iso8601,
+              single_events: true,
+              order_by: "startTime"
+            )
 
-          items = response.items || []
+            items = response.items || []
 
-          items.map { |evt| build_event(evt, calendar_id: calendar_id) }
+            items.map { |evt| build_event(evt, calendar_id: calendar_id) }
+          end
         end
 
         def get_event(calendar_id:, event_id:)
-          google_event = @service.get_event(calendar_id, event_id)
-          build_event(google_event, calendar_id: calendar_id)
+          with_auth_handling do
+            google_event = @service.get_event(calendar_id, event_id)
+            build_event(google_event, calendar_id: calendar_id)
+          end
         end
 
         def create_event(calendar_id:, event:)
-          google_event = build_google_event(event)
-          response = @service.insert_event(calendar_id, google_event)
-          build_event(response, calendar_id: calendar_id)
+          with_auth_handling do
+            google_event = build_google_event(event)
+            response = @service.insert_event(calendar_id, google_event)
+            build_event(response, calendar_id: calendar_id)
+          end
         end
 
         def update_event(calendar_id:, event_id:, event:)
-          google_event = build_google_event(event)
-          response = @service.update_event(calendar_id, event_id, google_event)
-          build_event(response, calendar_id: calendar_id)
+          with_auth_handling do
+            google_event = build_google_event(event)
+            response = @service.update_event(calendar_id, event_id, google_event)
+            build_event(response, calendar_id: calendar_id)
+          end
         end
 
         def delete_event(calendar_id:, event_id:)
-          @service.delete_event(calendar_id, event_id)
-          true
+          with_auth_handling do
+            @service.delete_event(calendar_id, event_id)
+            true
+          end
         end
 
         def quick_add(calendar_id:, text:)
-          response = @service.quick_add_event(calendar_id, text)
-          build_event(response, calendar_id: calendar_id)
+          with_auth_handling do
+            response = @service.quick_add_event(calendar_id, text)
+            build_event(response, calendar_id: calendar_id)
+          end
         end
 
         private
 
+        def with_auth_handling
+          yield
+        rescue ::Google::Apis::AuthorizationError, Signet::AuthorizationError
+          raise CLI::Kit::Abort, AUTH_ERROR_MESSAGE
+        end
+
         def build_calendar(google_calendar)
           Rcal::Calendar.new(
             id: google_calendar.id,

lib/rcal/auth.rb

@@ -24,6 +24,18 @@ def clear_credentials
         adapter.clear_credentials
       end
 
+      def load_client_credentials
+        adapter.load_client_credentials
+      end
+
+      def token_path
+        adapter.token_path
+      end
+
+      def client_credentials_path
+        adapter.client_credentials_path
+      end
+
       def adapter
         @adapter ||= default_adapter
       end
@@ -38,7 +50,7 @@ def reset_adapter!
 
       def default_adapter
         Adapters::Auth::Google.new(
-          token_path: File.join(Configuration.data_dir, "tokens.json")
+          data_dir: Configuration.data_dir
         )
       end
     end

lib/rcal/calendar_service.rb

@@ -2,6 +2,7 @@
 require "yaml"
 require "google/apis/calendar_v3"
 require "googleauth"
+require "googleauth/stores/file_token_store"
 require_relative "adapters/calendar/google"
 require_relative "auth"
 require_relative "config"
@@ -67,40 +68,29 @@ def build_calendar_service
         service
       end
 
+      # Load credentials via UserAuthorizer so refreshed tokens are
+      # automatically persisted back to google_tokens.yaml via the
+      # on_refresh callback (see UserAuthorizer#monitor_credentials).
       def load_credentials
-        client_creds = load_client_credentials
-        token_data = load_google_token_data
+        client_creds = Auth.load_client_credentials
+        return nil if client_creds.nil?
 
-        return nil if client_creds.nil? || token_data.nil?
-
-        Google::Auth::UserRefreshCredentials.new(
-          client_id: client_creds["client_id"],
-          client_secret: client_creds["client_secret"],
-          access_token: token_data["access_token"],
-          refresh_token: token_data["refresh_token"],
-          expires_at: token_data["expiration_time_millis"] ? Time.at(token_data["expiration_time_millis"] / 1000) : nil
+        token_store = Google::Auth::Stores::FileTokenStore.new(
+          file: Auth.token_path
         )
-      end
 
-      def load_client_credentials
-        creds_file = File.join(Configuration.data_dir, "client_credentials.json")
-        return nil unless File.exist?(creds_file)
-
-        JSON.parse(File.read(creds_file))
-      rescue JSON::ParserError
-        nil
-      end
-
-      def load_google_token_data
-        token_file = File.join(Configuration.data_dir, "google_tokens.yaml")
-        return nil unless File.exist?(token_file)
+        client_id = Google::Auth::ClientId.new(
+          client_creds["client_id"],
+          client_creds["client_secret"]
+        )
 
-        yaml_data = YAML.safe_load_file(token_file)
-        return nil unless yaml_data&.key?("default")
+        authorizer = Google::Auth::UserAuthorizer.new(
+          client_id,
+          Adapters::Auth::Google::SCOPES,
+          token_store
+        )
 
-        JSON.parse(yaml_data["default"])
-      rescue JSON::ParserError, Psych::SyntaxError
-        nil
+        authorizer.get_credentials("default")
       end
     end
   end