Adom Google

@@ -24,7 +24,34 @@ See `adom-google help`. import sys, os, json, base64, argparse, urllib.parse, ssl, socket, hashlib, secrets, struct, time import requests -CFG_DIR = os.path.expanduser("~/.config/adom-google")+# --- ACCOUNTS ----------------------------------------------------------------------------------+# adom-google supports multiple Google accounts on one container, fully isolated from each+# other. The unnamed "default" account keeps the original ~/.config/adom-google/ paths; a+# named account (e.g. `--account personal`) lives under ~/.config/adom-google/accounts/<name>/+# with its OWN config.json (refresh token, mode) and its OWN provider.json (which may point at+# a different OAuth client/app — a Workspace-Internal client can't sign in a gmail.com user).+# Select with `--account <name>` (any position) or ADOM_GOOGLE_ACCOUNT=<name>.+def _resolve_account():+    acct = os.environ.get("ADOM_GOOGLE_ACCOUNT", "").strip()+    argv, kept, i = sys.argv, [sys.argv[0]], 1+    while i < len(argv):+        a = argv[i]+        if a == "--account":+            if i + 1 >= len(argv):+                sys.exit("ERROR: --account requires a name, e.g. --account personal")+            acct = argv[i + 1]; i += 2; continue+        if a.startswith("--account="):+            acct = a.split("=", 1)[1]; i += 1; continue+        kept.append(a); i += 1+    sys.argv = kept+    acct = (acct or "default").strip().lower()+    if not acct or not all(c.isalnum() or c in "-_" for c in acct):+        sys.exit(f"ERROR: bad account name {acct!r} — letters/digits/dashes/underscores only")+    return acct++ACCOUNT = _resolve_account()+BASE_CFG_DIR = os.path.expanduser("~/.config/adom-google")+CFG_DIR = BASE_CFG_DIR if ACCOUNT == "default" else os.path.join(BASE_CFG_DIR, "accounts", ACCOUNT) CFG = os.path.join(CFG_DIR, "config.json") LEGACY_CFG = os.path.expanduser("~/.config/adom-gmail/config.json") HERE = os.path.dirname(os.path.realpath(__file__))  # realpath: resolve the ~/.local/bin symlink@@ -158,7 +185,8 @@ PEOPLE_API = "https://people.googleapis.com/v1" # Adom employees get the Adom provider via the private `adom-google-adom` package; everyone else # self-hosts a gateway or buys a managed one ([email protected]). See README. DEFAULT_APP = "adom-google"-PROVIDER_PATH = os.path.join(CFG_DIR, "provider.json")+PROVIDER_PATH = os.path.join(CFG_DIR, "provider.json")          # per-account when --account is set+BASE_PROVIDER_PATH = os.path.join(BASE_CFG_DIR, "provider.json")  # named accounts inherit from this BUNDLED_PROVIDER = os.path.join(HERE, "provider.json") LEGACY_CREDS = os.path.join(HERE, "credentials.json") MANUAL_REDIRECT = "http://localhost"  # manual desktop-client flow: loopback, user copies the code@@ -186,7 +214,9 @@ def _provider():             "client_secret": "client_secret", "app": "app"}     merge(BUNDLED_PROVIDER, full)     merge(LEGACY_CREDS, {"clientId": "client_id", "clientSecret": "client_secret", "app": "app"})-    merge(PROVIDER_PATH, full)+    merge(BASE_PROVIDER_PATH, full)+    if PROVIDER_PATH != BASE_PROVIDER_PATH:+        merge(PROVIDER_PATH, full)   # named account's own provider wins over the inherited base     e = os.environ     p["gateway_url"]    = e.get("OAUTH_GATEWAY_URL",      p["gateway_url"])     p["gateway_ws"]     = e.get("OAUTH_GATEWAY_WS",       p["gateway_ws"])@@ -194,7 +224,7 @@ def _provider():     p["client_secret"]  = e.get("ADOM_GOOGLE_CLIENT_SECRET", p["client_secret"])     p["app"]            = e.get("ADOM_GOOGLE_APP",        p["app"])     # broker is a bool — merge() skips falsy values, so read it explicitly (later wins).-    for path in (BUNDLED_PROVIDER, PROVIDER_PATH):+    for path in (BUNDLED_PROVIDER, BASE_PROVIDER_PATH, PROVIDER_PATH):         if os.path.exists(path):             try:                 d = json.load(open(path))@@ -253,8 +283,8 @@ def _maybe_load_raw():     if os.path.exists(CFG):         with open(CFG) as f:             return json.load(f)-    # One-time migration from adom-gmail.-    if os.path.exists(LEGACY_CFG):+    # One-time migration from adom-gmail (default account only — named accounts start clean).+    if ACCOUNT == "default" and os.path.exists(LEGACY_CFG):         with open(LEGACY_CFG) as f:             legacy = json.load(f)         legacy.setdefault("scopes", ["https://www.googleapis.com/auth/gmail.readonly"])@@ -956,6 +986,7 @@ def cmd_provider_set(a): def cmd_provider_show(a):     pr = _provider()     if os.path.exists(PROVIDER_PATH):       src = PROVIDER_PATH+    elif os.path.exists(BASE_PROVIDER_PATH): src = BASE_PROVIDER_PATH + " (inherited from default account)"     elif os.path.exists(BUNDLED_PROVIDER):  src = BUNDLED_PROVIDER + " (bundled)"     elif os.path.exists(LEGACY_CREDS):      src = LEGACY_CREDS + " (legacy)"     elif os.environ.get("OAUTH_GATEWAY_URL"): src = "environment"@@ -1035,6 +1066,43 @@ def cmd_onboard_finish(a):     print("\nNext: ask the user safe vs full, then `adom-google auth`.")  +def cmd_accounts(a):+    """List every configured account: the default plus each dir under accounts/."""+    rows = []+    def probe(name, cfg_dir):+        cfg_path = os.path.join(cfg_dir, "config.json")+        cfg = {}+        if os.path.exists(cfg_path):+            try:+                cfg = json.load(open(cfg_path))+            except Exception:+                pass+        prov_path = os.path.join(cfg_dir, "provider.json")+        app = None+        if os.path.exists(prov_path):+            try:+                app = json.load(open(prov_path)).get("app")+            except Exception:+                pass+        rows.append({"account": name, "authorized": bool(cfg.get("refresh_token")),+                     "mode": cfg.get("mode"), "app": app, "config": cfg_path})+    probe("default", BASE_CFG_DIR)+    acct_root = os.path.join(BASE_CFG_DIR, "accounts")+    if os.path.isdir(acct_root):+        for name in sorted(os.listdir(acct_root)):+            if os.path.isdir(os.path.join(acct_root, name)):+                probe(name, os.path.join(acct_root, name))+    if getattr(a, "json", False):+        print(json.dumps(rows, indent=2))+        return+    for r in rows:+        star = "*" if r["account"] == ACCOUNT else " "+        auth = f"authorized ({r['mode'] or 'mode unset'})" if r["authorized"] else "NOT authorized"+        app = f"  app={r['app']}" if r["app"] else ""+        print(f"{star} {r['account']:<12} {auth}{app}")+    print("\nSelect one per-command with `--account <name>` or export ADOM_GOOGLE_ACCOUNT=<name>.")++ def cmd_setup(a):     # Canonical first-run entry point. Always prints the ask-the-user hint (even mid-config),     # so the installing AI is reminded to ask the safe/full question before authorizing.@@ -1049,6 +1117,7 @@ def cmd_status(a):     pr = _provider()     cid = cfg.get("client_id") or pr["client_id"] or "(none)"     src = "config" if cfg.get("client_id") else ("provider" if pr["client_id"] else "UNSET")+    print(f"Account:     {ACCOUNT}" + ("" if ACCOUNT == "default" else "  (select with --account or ADOM_GOOGLE_ACCOUNT)"))     print(f"Config:      {CFG}")     print(f"Provider:    gateway={pr['gateway_url'] or '(UNSET — run `provider set`)'}  app={pr['app']}")     print(f"OAuth client: {(cid[:18] + '…') if cid != '(none)' else cid} (from {src})")@@ -1113,6 +1182,16 @@ API (generic passthrough — hit ANY Google API with your token; the "whole boar DRIVE / CALENDAR / SHEETS / DOCS / SLIDES: either use `api` above, or add a typed subcommand. Add the scope in SCOPES (top of this file) and re-run `auth`. +ACCOUNTS (multiple Google accounts, fully isolated — e.g. work + personal):+  adom-google accounts [--json]        list configured accounts (token presence, mode, app)+  adom-google --account <name> <cmd>   run ANY command against a named account+  ADOM_GOOGLE_ACCOUNT=<name>           same, via env (flag wins)+  The default (unnamed) account keeps the original paths; a named account lives at+  ~/.config/adom-google/accounts/<name>/ with its OWN config.json + provider.json.+  Its provider inherits from the default account's provider.json unless overridden —+  set a different OAuth client/app with:  adom-google --account <name> provider set …+  First-time auth for a new account:      adom-google --account <name> auth [--full]+ SECURITY: config is 0600; secrets are never echoed to stdout/stderr or logs. """ @@ -1131,6 +1210,7 @@ def main():     x.add_argument("--app"); x.set_defaults(fn=cmd_provider_set)     x = pvs.add_parser("show"); x.set_defaults(fn=cmd_provider_show)     s = sub.add_parser("status"); s.set_defaults(fn=cmd_status)+    s = sub.add_parser("accounts"); s.add_argument("--json", action="store_true"); s.set_defaults(fn=cmd_accounts)     s = sub.add_parser("setup"); s.set_defaults(fn=cmd_setup)      ob = sub.add_parser("onboard"); ob.add_argument("--org"); ob.add_argument("--json", action="store_true")