Module auth 

OAuth2 authentication: PKCE loopback flow (RFC 8252) with an RFC 8628 device-flow fallback, tokens in the OS keyring.

Multi-account: one OAuth client, one token per Google account. An auth handle is bound to one account’s store entry (the default account keeps the legacy naming byte-for-byte); named accounts log in independently.

Structs

AuthConfigBuilder

DeviceAuthChallenge

Pending device authorization: show verification_url + user_code to the user, then poll with super::GoogleAuth::poll_device_code until done.

GoogleAuth

OAuth2 client with PKCE support

TokenStorage

Token storage with automatic refresh.

Functions

scopes

The consent set: every scope the embedded index names, minus the ones Google will not show a user (see [APP_AUTH_SCOPES]), plus a curated floor for scopes no method declares. Requested in full at login — per-call escalation is deliberately not implemented, so “which scopes do I hold” is never a question: one credential, everything the index can express, nothing to configure. A token keeps whatever it was granted, so a build that widens this list needs one grr auth login to take effect.