aeat.core._google_credential_source module

Closed taxonomy for how google obtains credentials.

GoogleCredentialSourceKind is the accepted-value set governing which mechanism google uses to produce a google.oauth2.credentials.Credentials-shaped object for the Sheets/Drive export mirror. Declared in core per aeat-architecture-boundaries (closed value sets are StrEnum in the innermost ring) and aeat-schema-central-config (a code-level, non-registry taxonomy still belongs in the central authority, not scattered string literals).

See also

resolve_impersonated_credentials()

Resolves SERVICE_ACCOUNT_IMPERSONATION into a real, short-lived-token Credentials object.

build_google_credentials()

Resolves OAUTH_DESKTOP, the existing per-profile interactive-consent credential source.

class GoogleCredentialSourceKind(*values)

Bases: StrEnum

The closed set of mechanisms that can produce Google API credentials.

Members:

OAUTH_DESKTOP: The existing, default per-profile interactive OAuth

Desktop consent flow (aeat config google register / login). Persists a long-lived refresh token per profile via OAuthClient and OAuthToken.

SERVICE_ACCOUNT_IMPERSONATION: A shared Google service-account

identity is impersonated via Application Default Credentials (ADC) plus IAM roles/iam.serviceAccountTokenCreator. No long-lived credential is persisted by this application; a short-lived access token is re-derived from ADC and IAM on every use. See GoogleImpersonationConfig.

OAUTH_DESKTOP

SERVICE_ACCOUNT_IMPERSONATION