cadrumo.adapters.outbound.google.errors module

Typed exception hierarchy for the Google OAuth Desktop integration.

Every subclass is an core.errors.hierarchy.CadrumoError with a stable core.errors.error_codes.ErrorCode declared in the adapter error registry. That keeps the public CLI taxonomy explicit while entrypoints.cli.config.google_errors can map concrete GoogleAuthError subclasses to localised refusal text. Constructors carry structured diagnostic context (context={...}) without leaking the secret material handled by adapters.outbound.google.oauth_flow.

class GoogleAuthPreconditionCondition(*values)[source]

Bases: StrEnum

Stable failed conditions observed by the Google authentication boundary.

ACTIVE_PROFILE_RESOLVED
INTERACTIVE_TERMINAL_AVAILABLE
PROFILE_IDENTITY_RESOLVED
PROFILE_RECORD_SESSION_AVAILABLE
REQUIRED_SCOPES_GRANTED
OAUTHLIB_AVAILABLE
OAUTH_CLIENT_CONFIG_VALID
LOOPBACK_RECEIVER_BOUND
BROWSER_LAUNCHER_AVAILABLE
OAUTH_ENDPOINT_REACHABLE
OAUTH_FLOW_COMPLETED
IDENTITY_ASSERTION_PRESENT
IDENTITY_ASSERTION_VERIFIER_AVAILABLE
IDENTITY_ASSERTION_VERIFIED
IDENTITY_EMAIL_PRESENT
ADC_CLIENT_AVAILABLE
ADC_AVAILABLE
IAM_CREDENTIAL_MINTED
ADC_SOURCE_FRESH
google_auth_no_action_verdict(*, condition, facts, provenance, outcome)[source]

Delegate a fact-only Google-auth refusal to the public verdict authority.

Parameters:
exception GoogleAuthError(message=None, *, context=None, translated_message=None, precondition_verdict=None)[source]

Bases: TerminalPreconditionErrorMixin[PreconditionVerdict], CadrumoError

Base class for every Google OAuth Desktop authentication failure.

Catch this at CLI boundaries that need one Google-auth refusal arm while preserving the concrete core.errors.error_codes.ErrorCode on each leaf.

Parameters:

  • message (str | None)

  • context (Mapping[str, object] | None)

  • translated_message (str | None)

  • precondition_verdict (VerdictT | None)

Return type:

None

code
exception GoogleAuthValidationError(message=None, *, context=None, translated_message=None, precondition_verdict=None)[source]

Bases: GoogleAuthError

Raised when input parameters fail validation.

Parameters:

  • message (str | None)

  • context (Mapping[str, object] | None)

  • translated_message (str | None)

  • precondition_verdict (VerdictT | None)

Return type:

None

code
exception GoogleAuthClientNotRegisteredError(message=None, *, context=None, translated_message=None, precondition_verdict=None)[source]

Bases: GoogleAuthError

Raised when no Cloud Console Desktop OAuth client is registered for the active profile.

Parameters:

  • message (str | None)

  • context (Mapping[str, object] | None)

  • translated_message (str | None)

  • precondition_verdict (VerdictT | None)

Return type:

None

code
exception GoogleAuthClientRevokedError(message=None, *, context=None, translated_message=None, precondition_verdict=None)[source]

Bases: GoogleAuthError

Raised when the operator (or Google) revoked the registered Desktop OAuth client.

Parameters:

  • message (str | None)

  • context (Mapping[str, object] | None)

  • translated_message (str | None)

  • precondition_verdict (VerdictT | None)

Return type:

None

code
exception GoogleAuthRevokedError(message=None, *, context=None, translated_message=None, precondition_verdict=None)[source]

Bases: GoogleAuthError

Raised when the refresh token was revoked (e.g. via myaccount.google.com).

Maps to Google’s invalid_grant response with error_description="Token has been expired or revoked.".

Parameters:

  • message (str | None)

  • context (Mapping[str, object] | None)

  • translated_message (str | None)

  • precondition_verdict (VerdictT | None)

Return type:

None

code
exception GoogleAuthExpiredError(message=None, *, context=None, translated_message=None, precondition_verdict=None)[source]

Bases: GoogleAuthError

Raised when a Testing-project refresh token has aged past Google’s 7-day cap.

Parameters:

  • message (str | None)

  • context (Mapping[str, object] | None)

  • translated_message (str | None)

  • precondition_verdict (VerdictT | None)

Return type:

None

code
exception GoogleAuthScopeInsufficientError(message=None, *, context=None, translated_message=None, precondition_verdict=None)[source]

Bases: GoogleAuthError

Raised when the granted scope set does not include every scope required by the call site.

Parameters:

  • message (str | None)

  • context (Mapping[str, object] | None)

  • translated_message (str | None)

  • precondition_verdict (VerdictT | None)

Return type:

None

code
exception GoogleAuthNetworkError(message=None, *, context=None, translated_message=None, precondition_verdict=None)[source]

Bases: GoogleAuthError

Raised when the OAuth or token endpoint is unreachable (DNS, TLS, timeout, refused).

Parameters:

  • message (str | None)

  • context (Mapping[str, object] | None)

  • translated_message (str | None)

  • precondition_verdict (VerdictT | None)

Return type:

None

code
exception GoogleAuthLoopbackBindError(message=None, *, context=None, translated_message=None, precondition_verdict=None)[source]

Bases: GoogleAuthError

Raised when the loopback HTTP receiver cannot bind a local port.

Parameters:

  • message (str | None)

  • context (Mapping[str, object] | None)

  • translated_message (str | None)

  • precondition_verdict (VerdictT | None)

Return type:

None

code
exception GoogleAuthBrowserOpenError(message=None, *, context=None, translated_message=None, precondition_verdict=None)[source]

Bases: GoogleAuthError

Raised when the OS-default browser launcher fails to open the consent URL.

Parameters:

  • message (str | None)

  • context (Mapping[str, object] | None)

  • translated_message (str | None)

  • precondition_verdict (VerdictT | None)

Return type:

None

code
exception GoogleAuthNonInteractiveError(message=None, *, context=None, translated_message=None, precondition_verdict=None)[source]

Bases: GoogleAuthError

Raised when the interactive browser consent flow is attempted without a controlling terminal.

The Desktop OAuth flow opens the consent screen in a browser and then blocks a loopback HTTP receiver until the operator completes consent. With no controlling TTY (a piped, redirected, or detached invocation) no operator can complete the flow, so the receiver would block forever. This refusal fails fast instead, naming the interactive-terminal prerequisite.

Parameters:

  • message (str | None)

  • context (Mapping[str, object] | None)

  • translated_message (str | None)

  • precondition_verdict (VerdictT | None)

Return type:

None

code
exception GoogleAuthKeychainLockedError(message=None, *, context=None, translated_message=None, precondition_verdict=None)[source]

Bases: GoogleAuthError

Raised when the OS keychain backing the secret store is locked or unreachable.

Parameters:

  • message (str | None)

  • context (Mapping[str, object] | None)

  • translated_message (str | None)

  • precondition_verdict (VerdictT | None)

Return type:

None

code
exception GoogleAuthProfileUnboundError(message=None, *, context=None, translated_message=None, precondition_verdict=None)[source]

Bases: GoogleAuthError

Raised when Google auth cannot resolve the active AEAT profile.

Emitted by adapters.outbound.google.active_profile.resolve_active_profile() and profile-loading guards in adapters.outbound.google.oauth_flow.

Parameters:

  • message (str | None)

  • context (Mapping[str, object] | None)

  • translated_message (str | None)

  • precondition_verdict (VerdictT | None)

Return type:

None

code