Struct GoogleAuth 

pub struct GoogleAuth { /* private fields */ }

OAuth2 client with PKCE support

Implementations

impl GoogleAuth

pub async fn request_device_code( &self, scopes: &[String], ) -> Result<DeviceAuthChallenge>

Start a device flow asking for exactly scopes — the caller’s flag-derived set, already intersected with Google’s allowlist by [device_flow_scopes]. Returns the challenge to display to the user.

pub async fn poll_device_code( &self, challenge: &mut DeviceAuthChallenge, scopes: &[String], ) -> Result<Option<TokenStorage>>

Poll once. Returns Ok(None) while the user has not approved yet (caller sleeps retry_after() and retries), Ok(Some) with the stored token on approval, or Err on denial/expiry/failure.

scopes is the same set Self::request_device_code was called with: it is what the credential records when Google’s response omits scope, so the fallback is what was requested, never the index superset.

pub async fn login(&self, scopes: &[String]) -> Result<TokenStorage>

Fresh interactive login: drops any stored (possibly dead) token, runs the PKCE browser flow with exactly scopes, saves and returns the new token. The caller decides the set — see super::login_scopes, super::scopes_for_service and super::scopes.

impl GoogleAuth

pub async fn new(config: OAuthConfig) -> Result<Self>

Create new GoogleAuth from config

pub async fn new_for( config: OAuthConfig, account: impl Into<String>, ) -> Result<Self>

Create an auth handle bound to one named account’s own token (multi-account support). Same OAuth client and scopes; every store read and write targets that account’s keyring entry / fallback file exclusively. The name is validated and normalized here (rejects spaces, colons, and path separators; lowercased).

pub async fn with_account_store( &self, account: impl Into<String>, ) -> Result<Self>

A handle bound to account’s own token store, reusing this handle’s config (and thus the same OAuth client). The token cache is NOT shared: the new handle loads the named account’s stored token.

This is what commands/auth.rs uses to rebind a default handle when a per-command --account is present.

pub async fn with_default_account_store(&self) -> Result<Self>

A fresh handle on the DEFAULT account’s store — today’s exact entry naming, no account suffix.

grr auth login/status rebuild their handle through this so a named --account and the default take the same code path; without an account it is behavior-identical to the original construction.

pub fn token_backend(&self) -> &'static str

Token storage backend in use (for logs and auth login output).

pub async fn granted_scopes(&self) -> Vec<String>

The scope set the credential in hand holds — what Google actually granted, or the requested set when its response was silent — split out of TokenStorage::scope. Empty before any credential is loaded in this process (nothing is read from the keyring here), and for a token record written before the field existed.

grr auth status reports this. Only the credential knows what it holds: auth login’s count is what was requested, and the consent screen lets a user approve a subset of that.

pub async fn get_access_token(&self) -> Result<String>

Get valid access token, refreshing if necessary

pub async fn revoke(&self) -> Result<()>

Revoke current token

Trait Implementations

impl Clone for GoogleAuth

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.