Module google_gemini 

Google Gemini (Code Assist) OAuth: authorization-code + PKCE.

Experimental. The user-facing endpoints (accounts.google.com/o/oauth2/v2/auth, oauth2.googleapis.com/token) are official Google OAuth 2.0 surfaces. The Code Assist runtime host (cloudcode-pa.googleapis.com/v1internal) that consumes the resulting access token is a product-client-observed integration surface and is treated as experimental — it is not described as a stable public third-party API.

Credential mapping:

• OAuthCredentials.refresh = long-lived Google refresh token (broker-owned only)
• OAuthCredentials.access = short-lived Google access token
• OAuthCredentials.expires = access-token expiry (ms, with skew)

The long-lived refresh token must never be vended, logged, or placed in broker wire types. This module operates only inside the auth boundary.

Structs

GeminiRegistration

Enums

GeminiAuthError

Secret-safe login/refresh errors — variants intentionally store neither tokens, codes, nor client-secret material so Display cannot leak them.

Constants

AUTHORIZE_URL

Google installed-app OAuth authorization endpoint (RFC 6749).

CALLBACK_HOST

Loopback callback host; RFC 8252 § 7.3 mandates a literal IP for installed apps. Google explicitly rejects localhost for some client types.

CALLBACK_PATH

Callback path — pinned distinct from the shared /callback to avoid state bleed with the other loopback providers.

CALLBACK_PORT

Default loopback port for the Gemini callback listener.

CLIENT_ID_ENV

Environment variable containing the Synaps-owned Google Desktop OAuth client registration used for Gemini Code Assist.

CLIENT_SECRET_ENV

Optional installed-app client value paired with CLIENT_ID_ENV. Desktop registrations are public clients; this value is configuration, not a confidential secret, but it still must not be logged or committed here.

CONNECT_TIMEOUT

Connect timeout for auth HTTP.

EXPIRY_SKEW_MS

Expiry safety-margin subtracted from now + expires_in.

MAX_RESPONSE_BODY_BYTES

Maximum response body bytes we will accept from Google OAuth endpoints.

PROVIDER

Canonical storage / broker id.

REQUEST_TIMEOUT

Full request timeout for auth HTTP.

SCOPES

Space-separated scopes. Same values as the official Gemini CLI reference: cloud-platform (Code Assist), userinfo.email, userinfo.profile.

TOKEN_URL

Google OAuth 2.0 token endpoint.

USERINFO_URL

Google userinfo endpoint (for optional post-auth account labeling).

Functions

build_authorize_url

Build a Google installed-app authorization URL with PKCE (S256), offline access, and forced consent so a refresh token is always issued.

credentials_from_token_response

login

Interactive login against the production Google OAuth endpoints.

login_with_registration

Interactive login with injectable seams — pinned to production URLs by default; a test harness may override the token endpoint (and set allow_http_token_endpoint = true) to talk to a loopback OAuth fake.

parse_pasted_callback

Parse a manually pasted Google OAuth loopback callback URL. Strict: requires http/127.0.0.1/exact-port/exact-path, both code and state, and exact state equality — never defaults a missing state.

redirect_uri

Build the loopback redirect URI for the Gemini OAuth flow. Always emits a literal loopback IP (RFC 8252 §7.3) — never localhost.

refresh_token

Refresh grant against the production Google token endpoint.

refresh_with_registration

Refresh grant with an overridable token endpoint. Public for zero-network harness use only — production callers must go through refresh_token.