Re: GDrive: Automatic refresh of oauth2 access token

hey Norman,

On 21.05.2024 19:56, Norman J. Goldstein via Duplicity-talk wrote:
> I followed those instructions -- very clear, thanks.  One addition I suggest is to mention:  When setting up, the file at the end of the path, GOOGLE_CREDENTIALS_FILE, must not already exist.

you mean like it throws an error if the file exists beforehand?

> **** I did the setup for *My Drive based shared folder* and a regular account.
>
> My proejct is in testing mode (rather than published) at the recommendation of the Google verification guys -- my project is being used privately.  Unfortunately, in testing mode, the access token expires every 7 days.

still not understanding why if you plan to use it permanently. if you are the only one who knows this API key where is the harm? published afaik does not mean that others might use it

usually the software, duplicity in this case, would apply for a key and maintain it. but as we are open source, these keys would be available to anyone, so we could not prevent misuse. that is the reason why every user has to do it themselves. i seem to remember that that would be a service account and also that this one would not time out. how about you try that route?

> I have started writing a separate python CLI to send the refresh token to Google to get back a valid access token, but am actually stuck at reading the credentials json file from disk :-).  The API  probably just needs some kind of initialization.
>
>   I am pretty sure that duplicity could automate this by doing the refresh when it is needs to.  In fact, the API is supposed to do this automatically when in offline mode:
>
> In paragraph: Refreshing an access token (offline access)
> https://developers.google.com/identity/protocols/oauth2/web-server#offline
>
> Any suggestions much appreciated.

looks like we could add in the backend
```
flow.authorization_url(
     # Enable offline access so that you can refresh an access token without
     # re-prompting the user for permission. Recommended for web server apps.
     access_type='offline',
     # Enable incremental authorization. Recommended as a best practice.
     include_granted_scopes='true')"
```
and if a "user grants offline access to the requested scopes" that should work.

not sure if we will need to make that switchable in case the offline persission wasn't granted. that needs to be tested.

do you want me to send you a patched gdrive backend file to test with? can you patch it yourself?

sunny regards ..ede

_______________________________________________
Duplicity-talk mailing list
[email protected]
https://lists.nongnu.org/mailman/listinfo/duplicity-talk