Crate bothy_oauth 

Google OAuth for Bothy apps that run their own sign-in: the CLI, the Python binding, embedded agents.

The core crate never does OAuth; it asks an AccessTokenProvider for tokens. This crate provides one (RefreshingTokens) plus the flows to get the long-lived grant behind it: a browser sign-in with a loopback redirect and PKCE (loopback_login), and the device flow for machines without a browser (device_login). TokenStore keeps the grant in the OS keyring or a file readable only by the user.

Tokens and client secrets never appear in Debug output or error messages.

Structs

Client

An OAuth client of the app’s Google Cloud project.

DeviceCode

What the user must do to approve a device sign-in.

Grant

A long-lived grant: the refresh token and the scopes it covers.

RefreshingTokens

Fresh access tokens from a grant, cached until a minute before they expire.

TokenStore

Keeps a grant in the OS keyring, or in a 0600 file where there is none (headless Linux without a Secret Service). BOTHY_TOKEN_STORE=file, or TokenStore::file_only, uses only the file.

Enums

Location

Where TokenStore::save put the grant.

Constants

SCOPE_APPDATA

The hidden per-app folder (appDataFolder). Not available through the device flow.

SCOPE_FILE

Files the app created, such as the visible Bothy/<name> folders.

Traits

AccessTokenProvider

Supplies OAuth access tokens to a backend.

Functions

device_login

Signs in on a machine without a browser: the user enters a code on another device. Google allows only drive.file here (it rejects drive.appdata in this flow).

http

The HTTP client for Google’s OAuth endpoints (rustls with ring).

loopback_login

Signs in through the browser: a loopback redirect to 127.0.0.1 with PKCE.

refresh

Exchanges a refresh token for an access token: (token, lifetime).

revoke

Revokes a refresh token at Google. Google revokes per Cloud project: every device of the user signed in with this project is signed out, so apps should usually only forget the token locally (TokenStore::clear).

write_private

Writes bytes to path atomically, readable only by the user (mode 0600 on Unix).