Module auth 

Gmail OAuth2 authentication: authorization-code + PKCE login, credential storage, and in-memory access-token refresh.

See ADR-0063 for the design rationale. The loopback-listener + browser-launch shape follows the Snowflake client’s external-browser SSO flow (crate::snowflake::client’s private auth module), extended with PKCE (RFC 7636), a state nonce, and an error= branch — none of which a static-token or SSO-only flow needs.

Structs

BrowserConfig

Loopback OAuth2 callback settings.

GmailAuthStatus

Secret-free presence/scope report, safe to serialise (e.g. over MCP).

GmailCredentials

Gmail OAuth2 credentials.

GmailSession

A live Gmail OAuth2 session: holds the refresh token and the current in-memory access token, refreshing on demand.

Enums

BrowserLaunch

How to open the authorization URL during login.

GmailScope

The Gmail OAuth2 scope granted at login.

Constants

GMAIL_API_URL

Environment variable overriding the real Gmail API host.

GMAIL_CLIENT_ID

Environment variable / settings key for the user’s Google Cloud OAuth2 client id.

GMAIL_CLIENT_SECRET

Environment variable / settings key for the user’s Google Cloud OAuth2 client secret.

GMAIL_REFRESH_TOKEN

Environment variable / settings key for the stored OAuth2 refresh token.

GMAIL_SCOPE

Environment variable / settings key recording the scope granted at login.

SCOPE_MODIFY

Read-write Gmail scope — required for label add/remove; opt-in.

SCOPE_READONLY

Read-only Gmail scope — the default.

Functions

load_credentials

Loads Gmail credentials from environment variables or settings.json.

login

Runs the OAuth2 authorization-code + PKCE login flow, persisting the resulting refresh token to ~/.omni-dev/settings.json.

remove_credentials

Removes Gmail credential keys from ~/.omni-dev/settings.json — this is gmail auth logout.

save_credentials

Saves Gmail credentials to ~/.omni-dev/settings.json.

status

Builds a GmailAuthStatus from the current settings / environment.