Documentation
¶
Overview ¶
Package credentials stores and resolves the OAuth refresh token.
Resolution order, the same one gh uses:
- GDOCS_REFRESH_TOKEN in the environment (CI, automation).
- The OS keyring (Secret Service on Linux, Keychain on macOS, Credential Manager on Windows), account = profile name.
- A 0600 file under the profile directory, written only when the keyring was unavailable at login time; the caller is warned.
A missing keyring entry falls through; a broken keyring (no session bus, no secret service) also falls through to the file so a headless machine still works, and the underlying error is reported if nothing else is found.
Index ¶
Constants ¶
const EnvVar = "GDOCS_REFRESH_TOKEN"
EnvVar is the environment override.
const ServiceName = "google-docs-mcp"
ServiceName is the keyring service identifier.
Variables ¶
var ErrNotFound = errors.New("credentials: no refresh token found; run `google-docs-mcp login`")
ErrNotFound means no token is stored anywhere.
Functions ¶
func IsKeyringNotFound ¶
IsKeyringNotFound reports whether err is the keyring's "no entry" error.
Types ¶
type Backend ¶
type Backend interface {
Get(service, account string) (string, error)
Set(service, account, secret string) error
Delete(service, account string) error
}
Backend is the keyring contract. Tests substitute an in-memory one.
type Store ¶
type Store struct {
Profile string
Keyring Backend
FilePath string
Env func(string) string
// Warn receives human-readable warnings (plaintext fallback in use).
Warn func(string)
}
Store resolves and saves the refresh token for one profile.
func (*Store) ResolveStored ¶ added in v0.2.0
ResolveStored returns the token from the keyring or the file, ignoring the environment override: the token logout can revoke and delete.
Source Files