aeat.adapters.outbound.google._records module

Pydantic records for the Google OAuth and Drive configuration boundary.

The per-profile Google session persists adapters.outbound.google.OAuthClient, adapters.outbound.google.OAuthToken, and adapters.outbound.google.OAuthMetadata through adapters.outbound.google._session_store. adapters.outbound.google.DriveConfig stores the Drive root folder selected for the profile and is read by adapters.outbound.storage.get_storage_provider() when building the Drive backend. adapters.outbound.google.DriveAppProperties captures the typed appProperties commit-log schema at the storage boundary. See adapters.outbound.google._impersonation for adapters.outbound.google.GoogleCredentialSourceSelection, the per-profile persisted choice of core.GoogleCredentialSourceKind.

The OAuth scope constants come from core.config.Settings and are bundled as adapters.outbound.google.REQUIRED_SCOPES for login, refresh, and validation flows. Every record is frozen, strict, and forbids extra fields.

class OAuthClient(**data)[source]

Bases: BaseModel

Operator-imported Cloud Console Desktop OAuth client metadata.

Carries the JSON the operator downloaded from the Cloud Console after creating a Desktop application OAuth client. adapters.outbound.google.save_client() stores this record under the SECRET classification because client_secret is a long-lived credential. client_id and project_id can surface in status output for operator orientation.

Parameters:

  • client_id (str)

  • client_secret (str)

  • project_id (str)

  • auth_uri (str)

  • token_uri (str)

  • auth_provider_x509_cert_url (str)

  • redirect_uris (tuple[str, ...])

client_id: str
client_secret: str
project_id: str
auth_uri: str
token_uri: str
auth_provider_x509_cert_url: str
redirect_uris: tuple[str, ...]
class OAuthToken(**data)[source]

Bases: BaseModel

The refresh credential issued by Google for a per-profile login.

adapters.outbound.google.run_login_flow() returns this record with adapters.outbound.google.OAuthMetadata. adapters.outbound.google.save_token() persists it under the SECRET classification. The refresh token is re-persisted on every successful refresh because Google may rotate it. Access tokens are held in memory only and rebuilt from the refresh token on process start.

Parameters:

  • refresh_token (str)

  • token_uri (str)

refresh_token: str
token_uri: str
class OAuthMetadata(**data)[source]

Bases: BaseModel

Audit fields surfaced by aeat config google status and refresh policy.

This is the non-secret companion record to adapters.outbound.google.OAuthToken. adapters.outbound.google.save_metadata() persists which Google account the operator linked, which adapters.outbound.google.REQUIRED_SCOPES the consent screen granted, when the credential was issued, when it was last refreshed, and whether the most recent refresh hit a hard invalid_grant requiring re-consent.

Parameters:
account_email: str
granted_scopes: tuple[str, ...]
issued_at: datetime
last_refresh_at: datetime
reauth_required: bool
class DriveConfig(**data)[source]

Bases: BaseModel

Per-profile Drive backend configuration persisted alongside OAuth records.

adapters.outbound.google.save_drive_config() persists the operator’s chosen aeat-vault/ parent folder id. adapters.outbound.storage.get_storage_provider() reads it after core.config.Settings; the AEAT_GOOGLE_DRIVE_ROOT_FOLDER_ID setting remains an override for one-off and CI runs.

Parameters:

root_folder_id (str)

root_folder_id: str
class DriveAppProperties(**data)[source]

Bases: BaseModel

Typed Drive appProperties commit-log payload.

The record validates the richer (namespace, object_key_hmac, revision, source_hash, written_at, schema_version) tuple at the Google boundary. The current adapters.outbound.storage._google_drive.GoogleDriveProvider write path does not instantiate this model; it writes ownership, namespace, full HMAC, and content_hash keys directly and maps them into adapters.outbound.storage.ProviderObjectMetadata.

Parameters:

  • namespace (str)

  • object_key_hmac (str)

  • revision (int)

  • source_hash (str)

  • written_at (datetime)

  • schema_version (str)

namespace: str
object_key_hmac: str
revision: int
source_hash: str
written_at: datetime
schema_version: str