cadrumo.adapters.outbound.google.session_store module¶

Encrypted Google record persistence.

This module writes Google records through adapters.persistence.storage.sql.secure_objects.SecureObjectRepository.

Five per-profile record families back Google configuration and session state, each under the namespace and SensitivityClass declared by the storage registry:

adapters.persistence.storage.secure_object_namespaces.GOOGLE_OAUTH_CLIENT_NAMESPACE stores the operator-imported adapters.outbound.google.records.OAuthClient at SECRET sensitivity because client_secret is a long-lived credential.
adapters.persistence.storage.secure_object_namespaces.GOOGLE_OAUTH_TOKEN_NAMESPACE stores the refresh adapters.outbound.google.records.OAuthToken returned by adapters.outbound.google.oauth_flow.run_login_flow() at SECRET sensitivity.
adapters.persistence.storage.secure_object_namespaces.GOOGLE_OAUTH_METADATA_NAMESPACE stores the non-secret adapters.outbound.google.records.OAuthMetadata account, scope, issuance, refresh, and reauth audit fields at FINANCIAL sensitivity.
adapters.persistence.storage.secure_object_namespaces.GOOGLE_DRIVE_CONFIG_NAMESPACE stores the adapters.outbound.google.records.DriveConfig root folder selection used by adapters.outbound.storage.factory.get_storage_provider() at FINANCIAL sensitivity.
adapters.persistence.storage.secure_object_namespaces.GOOGLE_CREDENTIAL_SOURCE_NAMESPACE stores the adapters.outbound.google.impersonation.GoogleCredentialSourceSelection choice of core.google_credential_source.GoogleCredentialSourceKind (and, for service-account impersonation, the target SA email/scopes) at FINANCIAL sensitivity — configuration only, never a credential.

The public helpers use the profile identifier resolved by adapters.outbound.google.active_profile.resolve_active_profile() as the storage object key, matching the {profile} grammar on all five namespace definitions.

save_client(profile, client)[source]¶

Persist an adapters.outbound.google.records.OAuthClient for profile.

The record is written under adapters.persistence.storage.secure_object_namespaces.GOOGLE_OAUTH_CLIENT_NAMESPACE with SensitivityClass SECRET so aeat config google login and Drive credential hydration can reload the operator-imported Desktop OAuth client.

Return type:

None

Parameters:

profile (str)
client (OAuthClient)

load_client(profile)[source]¶

Load the adapters.outbound.google.records.OAuthClient for profile.

Return type:: OAuthClient | None
Returns:: The stored adapters.outbound.google.records.OAuthClient, or None when the profile has not registered a Desktop OAuth client.
Parameters:: profile (str)

save_token(profile, token)[source]¶

Persist an adapters.outbound.google.records.OAuthToken for profile.

The token is written under adapters.persistence.storage.secure_object_namespaces.GOOGLE_OAUTH_TOKEN_NAMESPACE with SensitivityClass SECRET. The CLI saves this after adapters.outbound.google.oauth_flow.run_login_flow(), and refresh code may overwrite it when Google rotates the refresh token.

Return type:

None

Parameters:

profile (str)
token (OAuthToken)

load_token(profile)[source]¶

Load the adapters.outbound.google.records.OAuthToken for profile.

Return type:: OAuthToken | None
Returns:: The stored adapters.outbound.google.records.OAuthToken, or None when the profile has no active Google login session.
Parameters:: profile (str)

save_metadata(profile, metadata)[source]¶

Persist adapters.outbound.google.records.OAuthMetadata for profile.

Metadata is non-secret companion state for adapters.outbound.google.records.OAuthToken: account email, granted scopes, issue/refresh timestamps, and reauth status. It is written under adapters.persistence.storage.secure_object_namespaces.GOOGLE_OAUTH_METADATA_NAMESPACE with SensitivityClass FINANCIAL.

Return type:

None

Parameters:

profile (str)
metadata (OAuthMetadata)

load_metadata(profile)[source]¶

Load the adapters.outbound.google.records.OAuthMetadata for profile.

Return type:: OAuthMetadata | None
Returns:: The stored adapters.outbound.google.records.OAuthMetadata, or None when no metadata record exists for the profile.
Parameters:: profile (str)

save_drive_config(profile, config)[source]¶

Persist the per-profile adapters.outbound.google.records.DriveConfig.

The config is written under adapters.persistence.storage.secure_object_namespaces.GOOGLE_DRIVE_CONFIG_NAMESPACE with SensitivityClass FINANCIAL so adapters.outbound.storage.factory.get_storage_provider() can resolve the Drive root folder without re-reading environment-only configuration.

Return type:

None

Parameters:

profile (str)
config (DriveConfig)

load_drive_config(profile)[source]¶

Load the per-profile adapters.outbound.google.records.DriveConfig.

Return type:: DriveConfig | None
Returns:: The stored adapters.outbound.google.records.DriveConfig, or None when the profile has no persisted Drive root folder selection.
Parameters:: profile (str)

save_credential_source_selection(profile, selection)[source]¶

Persist the per-profile adapters.outbound.google.impersonation.GoogleCredentialSourceSelection.

The record is written under adapters.persistence.storage.secure_object_namespaces.GOOGLE_CREDENTIAL_SOURCE_NAMESPACE with SensitivityClass FINANCIAL so adapters.outbound.storage.factory.build_google_credentials() can dispatch to the chosen core.google_credential_source.GoogleCredentialSourceKind without re-reading environment-only configuration. No long-lived secret rides on this record: the impersonated access token is re-derived from Application Default Credentials on every use and is never persisted.

Return type:

None

Parameters:

profile (str)
selection (GoogleCredentialSourceSelection)

load_credential_source_selection(profile)[source]¶

Load the per-profile adapters.outbound.google.impersonation.GoogleCredentialSourceSelection.

Return type:: GoogleCredentialSourceSelection | None
Returns:: The stored adapters.outbound.google.impersonation.GoogleCredentialSourceSelection, or None when the profile has no persisted selection. A None result means the default core.google_credential_source.GoogleCredentialSourceKind.OAUTH_DESKTOP path applies — callers must not treat a missing record as an error.
Parameters:: profile (str)

delete_session(profile)[source]¶

Delete the login session while preserving registration and Drive config.

Removes only the adapters.persistence.storage.secure_object_namespaces.GOOGLE_OAUTH_TOKEN_NAMESPACE and adapters.persistence.storage.secure_object_namespaces.GOOGLE_OAUTH_METADATA_NAMESPACE records, matching aeat config google logout. The registered adapters.outbound.google.records.OAuthClient and adapters.outbound.google.records.DriveConfig remain available so a later login can reuse the Cloud Console JSON and the same Drive root folder.

The token and its companion metadata are one logout, so they are removed in ONE unit of work. They used to be two independent commits: a failure on the second left the token gone and the metadata behind, which is the worst of the three possible outcomes. It is not a half-logout an operator can see and retry — load_token reports no session while the metadata row still describes one, so status surfaces read as logged-in against a credential that no longer exists, and the stale row survives the retry because the retry finds nothing to delete.

apply_batch() already provides the all-or-nothing removal, and it addresses rows by the stored key digest, so the natural profile key is digested here through the same helper the write path uses.

Parameters:: profile (str) – The profile identifier whose token and metadata records to delete.
Return type:: tuple[bool, bool]
Returns:: A pair (token_removed, metadata_removed), reporting what was present before the removal. Both are read before the batch rather than returned by it: the batch is one statement per namespace and reports no per-row outcome, and inferring presence from a delete’s return value is what forced the two-commit shape to begin with.