aeat.adapters.outbound.google._session_store module

Encrypted Google record persistence.

This module writes Google records through adapters.persistence.storage.SecureObjectRepository.

Five per-profile record families back Google configuration and session state, each under the namespace and adapters.persistence.storage.SensitivityClass declared by the storage registry:

• adapters.persistence.storage.GOOGLE_OAUTH_CLIENT_NAMESPACE stores the operator-imported adapters.outbound.google.OAuthClient at SECRET sensitivity because client_secret is a long-lived credential.

• adapters.persistence.storage.GOOGLE_OAUTH_TOKEN_NAMESPACE stores the refresh adapters.outbound.google.OAuthToken returned by adapters.outbound.google.run_login_flow() at SECRET sensitivity.

• adapters.persistence.storage.GOOGLE_OAUTH_METADATA_NAMESPACE stores the non-secret adapters.outbound.google.OAuthMetadata account, scope, issuance, refresh, and reauth audit fields at FINANCIAL sensitivity.

• adapters.persistence.storage.GOOGLE_DRIVE_CONFIG_NAMESPACE stores the adapters.outbound.google.DriveConfig root folder selection used by adapters.outbound.storage.get_storage_provider() at FINANCIAL sensitivity.

• adapters.persistence.storage.GOOGLE_CREDENTIAL_SOURCE_NAMESPACE stores the adapters.outbound.google.GoogleCredentialSourceSelection choice of core.GoogleCredentialSourceKind (and, for service-account impersonation, the target SA email/scopes) at FINANCIAL sensitivity — configuration only, never a credential.

The public helpers use the profile identifier resolved by adapters.outbound.google.resolve_active_profile() as the storage object key, matching the {profile} grammar on all five namespace definitions.

save_client(profile, client)

Persist an adapters.outbound.google.OAuthClient for profile.

The record is written under adapters.persistence.storage.GOOGLE_OAUTH_CLIENT_NAMESPACE with adapters.persistence.storage.SensitivityClass SECRET so aeat config google login and Drive credential hydration can reload the operator-imported Desktop OAuth client.

Return type:

None

Parameters:

• profile (str)

• client (OAuthClient)

load_client(profile)

Load the adapters.outbound.google.OAuthClient for profile.

Return type:

OAuthClient | None

Returns:

The stored adapters.outbound.google.OAuthClient, or None when the profile has not registered a Desktop OAuth client.

Parameters:

profile (str)

save_token(profile, token)

Persist an adapters.outbound.google.OAuthToken for profile.

The token is written under adapters.persistence.storage.GOOGLE_OAUTH_TOKEN_NAMESPACE with adapters.persistence.storage.SensitivityClass SECRET. The CLI saves this after adapters.outbound.google.run_login_flow(), and refresh code may overwrite it when Google rotates the refresh token.

Return type:

None

Parameters:

• profile (str)

• token (OAuthToken)

load_token(profile)

Load the adapters.outbound.google.OAuthToken for profile.

Return type:

OAuthToken | None

Returns:

The stored adapters.outbound.google.OAuthToken, or None when the profile has no active Google login session.

Parameters:

profile (str)

save_metadata(profile, metadata)

Persist adapters.outbound.google.OAuthMetadata for profile.

Metadata is non-secret companion state for adapters.outbound.google.OAuthToken: account email, granted scopes, issue/refresh timestamps, and reauth status. It is written under adapters.persistence.storage.GOOGLE_OAUTH_METADATA_NAMESPACE with adapters.persistence.storage.SensitivityClass FINANCIAL.

Return type:

None

Parameters:

• profile (str)

• metadata (OAuthMetadata)

load_metadata(profile)

Load the adapters.outbound.google.OAuthMetadata for profile.

Return type:

OAuthMetadata | None

Returns:

The stored adapters.outbound.google.OAuthMetadata, or None when no metadata record exists for the profile.

Parameters:

profile (str)

save_drive_config(profile, config)

Persist the per-profile adapters.outbound.google.DriveConfig.

The config is written under adapters.persistence.storage.GOOGLE_DRIVE_CONFIG_NAMESPACE with adapters.persistence.storage.SensitivityClass FINANCIAL so adapters.outbound.storage.get_storage_provider() can resolve the Drive root folder without re-reading environment-only configuration.

Return type:

None

Parameters:

• profile (str)

• config (DriveConfig)

load_drive_config(profile)

Load the per-profile adapters.outbound.google.DriveConfig.

Return type:

DriveConfig | None

Returns:

The stored adapters.outbound.google.DriveConfig, or None when the profile has no persisted Drive root folder selection.

Parameters:

profile (str)

save_credential_source_selection(profile, selection)

Persist the per-profile adapters.outbound.google.GoogleCredentialSourceSelection.

The record is written under adapters.persistence.storage.GOOGLE_CREDENTIAL_SOURCE_NAMESPACE with adapters.persistence.storage.SensitivityClass FINANCIAL so adapters.outbound.storage.build_google_credentials() can dispatch to the chosen core.GoogleCredentialSourceKind without re-reading environment-only configuration. No long-lived secret rides on this record: the impersonated access token is re-derived from Application Default Credentials on every use and is never persisted.

Return type:

None

Parameters:

• profile (str)

• selection (GoogleCredentialSourceSelection)

load_credential_source_selection(profile)

Load the per-profile adapters.outbound.google.GoogleCredentialSourceSelection.

Return type:

GoogleCredentialSourceSelection | None

Returns:

The stored adapters.outbound.google.GoogleCredentialSourceSelection, or None when the profile has no persisted selection. A None result means the default core.GoogleCredentialSourceKind.OAUTH_DESKTOP path applies — callers must not treat a missing record as an error.

Parameters:

profile (str)

delete_session(profile)

Delete the login session while preserving registration and Drive config.

Removes only the adapters.persistence.storage.GOOGLE_OAUTH_TOKEN_NAMESPACE and adapters.persistence.storage.GOOGLE_OAUTH_METADATA_NAMESPACE records, matching aeat config google logout. The registered adapters.outbound.google.OAuthClient and adapters.outbound.google.DriveConfig remain available so a later login can reuse the Cloud Console JSON and the same Drive root folder.

Parameters:

profile (str) – The profile identifier whose token and metadata records to delete.

Return type:

tuple[bool, bool]

Returns:

A pair (token_removed, metadata_removed).