Crate secrets_engine_gworkspace 

Google Workspace and Drive — nothing here is mintable, so this engine’s value is custody: the long-lived refresh token stays on the server and consumers only ever receive an access token good for about an hour. The consumer never holds the durable secret, which is most of the benefit.

Domain-wide delegation is offered as a second mode, but it is a materially worse trade — see the caveats in doc() — and Google’s own guidance is now to avoid it for new integrations.

See docs/delegation/google-workspace.md for the mechanism and docs/delegation/setup/google-workspace.md for the operator walkthrough.

Structs

GworkspaceConfig

One authorised account. Every field here is durable secret material, which is why ConfigRoleStore makes config write-only: a read reports existence and nothing else.

GworkspaceEngine

RoleConfig

Enums

Mode