Adom Google

@@ -90,7 +90,25 @@ SCOPES_FULL = [ ]  +# PERSONAL scope set — for connecting a personal @gmail via Adom's global "Adom Personal" OAuth+# client (see ADOM_PERSONAL_* below). Deliberately NON-RESTRICTED so the shared client works for+# every user without Google's restricted-scope CASA assessment: Calendar, Contacts, Tasks, the+# Drive files this app creates, and Gmail SEND/COMPOSE (sensitive, not restricted). NO inbox read+# (gmail.readonly/modify) and NO full Drive — those are restricted and switch on once Adom's+# verification + CASA clears; SCOPES_FULL then applies to the personal client too.+SCOPES_PERSONAL = [+    "https://www.googleapis.com/auth/calendar.events",+    "https://www.googleapis.com/auth/contacts",+    "https://www.googleapis.com/auth/tasks",+    "https://www.googleapis.com/auth/drive.file",+    "https://www.googleapis.com/auth/gmail.send",+    "https://www.googleapis.com/auth/gmail.compose",+]++ def _scopes_for(mode):+    if mode == "personal":+        return SCOPES_PERSONAL     return SCOPES_FULL if mode == "full" else SCOPES_SAFE  @@ -103,6 +121,16 @@ def _scopes_for(mode): # (Adom employees use BROKER mode instead, where the secret lives on the gateway; see provider.) ADOM_SHARED_GATEWAY = "https://oauth-9mycwxij7tif.adom.cloud" +# The global "Adom Google Connector" OAuth client — External (User Type = External), so ANY+# Google account OUTSIDE adom.inc can authorize through it: personal @gmail users AND other orgs'+# Workspace employees (the Adom work client is Internal to adom.inc and rejects them). One client+# for everyone external, brokered in BROKER mode, so the SECRET lives only on the gateway+# (creds/adom-connector.json) and the public client_id below is safe to ship. Users connect with+# zero setup via `adom-google connect-personal`. (Constants keep the *_PERSONAL_* names for+# back-compat; they mean the Connector.)+ADOM_PERSONAL_APP = "adom-connector"+ADOM_PERSONAL_CLIENT_ID = "89165832027-6ce69tm6vji6i0v8a5hl6g3cr56d0v0b.apps.googleusercontent.com"+ # The nine Google APIs adom-google drives — (console "enable" id, human label). ONBOARD_APIS = [     ("gmail.googleapis.com",         "Gmail API"),@@ -895,8 +923,16 @@ def cmd_auth(a):     cfg = _maybe_load_raw() or {}     # FULL is the default (no first-run mode quiz — issue #2). `--safe` is an advanced opt-in     # for users who explicitly want the narrower create-only scopes. `--full` is a no-op kept-    # for back-compat.+    # for back-compat. A PERSONAL @gmail (the global adom-personal client) uses the non-restricted+    # personal scope set automatically.     mode = "safe" if getattr(a, "safe", False) else "full"+    if _provider().get("app") == ADOM_PERSONAL_APP:+        # Adom Google Connector (External, Production/unverified): default to the non-restricted+        # (lite) set — Calendar/Contacts/Tasks/drive.file/gmail send+compose — which works for+        # external users TODAY while Google verification + CASA are pending. `--full` requests the+        # complete set: it succeeds for whitelisted testers now, and becomes usable for everyone+        # once CASA clears (at which point this default flips to full).+        mode = "full" if getattr(a, "full", False) else "personal"     scopes = _scopes_for(mode)     if a.manual:         return _auth_manual(cfg, scopes, mode)@@ -1137,6 +1173,35 @@ def cmd_accounts(a):     print("\nSelect one per-command with `--account <name>` or export ADOM_GOOGLE_ACCOUNT=<name>.")  +def cmd_connect_personal(a):+    """Connect a non-adom.inc Google account (personal @gmail, or another org's Workspace) via+    Adom's global 'Adom Google Connector' OAuth client — no manual Google-Cloud setup. Writes the+    built-in provider to the `personal` account, then the user runs+    `adom-google --account personal auth`."""+    if not ADOM_PERSONAL_CLIENT_ID:+        sys.exit("Connector sign-in is still being provisioned (Adom is standing up the shared\n"+                 "'Adom Google Connector' client). Not available yet — check back soon or email\n"+                 "[email protected]. Your work account (`adom-google auth`) is unaffected.")+    acct_dir = os.path.join(BASE_CFG_DIR, "accounts", "personal")+    os.makedirs(acct_dir, exist_ok=True)+    prov = {"gateway_url": ADOM_SHARED_GATEWAY, "client_id": ADOM_PERSONAL_CLIENT_ID,+            "app": ADOM_PERSONAL_APP, "broker": True}+    ppath = os.path.join(acct_dir, "provider.json")+    fd = os.open(ppath, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600)+    with os.fdopen(fd, "w") as f:+        json.dump(prov, f, indent=2)+    os.chmod(ppath, 0o600)+    print("✅ Personal profile ready (uses Adom's shared Google Connector client — no setup needed).")+    print("   Authorize your account now:\n")+    print("      adom-google --account personal auth\n")+    print("   Grants Calendar, Contacts, Tasks, Drive (files it creates), and Gmail send/compose today.")+    print("   (Full Gmail read + all Drive/Docs/Sheets/Slides unlock automatically once Adom's Google")+    print("   verification + CASA clear — no action needed. Testers can add `--full` now.)")+    print("   Google will show an 'unverified app' notice while verification is pending — choose")+    print("   Advanced → Continue to proceed.")+    print("   Use the personal profile any time:  adom-google --account personal <command>")++ def cmd_setup(a):     # Canonical first-run entry point. Always prints the ask-the-user hint (even mid-config),     # so the installing AI is reminded to ask the safe/full question before authorizing.@@ -1234,7 +1299,7 @@ def main():     p = argparse.ArgumentParser(add_help=False)     sub = p.add_subparsers(dest="cmd") -    s = sub.add_parser("auth"); s.add_argument("--manual", action="store_true"); s.add_argument("--safe", action="store_true", help="advanced: request the NARROW create-only scope set (no delete-all); default is FULL"); s.add_argument("--full", action="store_true", help="(no-op) full is the default now"); s.set_defaults(fn=cmd_auth)+    s = sub.add_parser("auth"); s.add_argument("--manual", action="store_true"); s.add_argument("--safe", action="store_true", help="advanced: request the NARROW create-only scope set (no delete-all); default is FULL"); s.add_argument("--full", action="store_true", help="Connector: request the FULL set incl. Gmail-read + all Drive (works for whitelisted testers now, everyone once CASA clears). No-op for the work client (already full)."); s.set_defaults(fn=cmd_auth)     s = sub.add_parser("auth-code"); s.add_argument("code"); s.set_defaults(fn=cmd_auth_code)     s = sub.add_parser("init"); s.add_argument("client_id"); s.add_argument("client_secret"); s.set_defaults(fn=cmd_init)     pv = sub.add_parser("provider"); pvs = pv.add_subparsers(dest="sub")@@ -1246,6 +1311,7 @@ def main():     s = sub.add_parser("status"); s.set_defaults(fn=cmd_status)     s = sub.add_parser("accounts"); s.add_argument("--json", action="store_true"); s.set_defaults(fn=cmd_accounts)     s = sub.add_parser("setup"); s.set_defaults(fn=cmd_setup)+    s = sub.add_parser("connect-personal"); s.set_defaults(fn=cmd_connect_personal)      ob = sub.add_parser("onboard"); ob.add_argument("--org"); ob.add_argument("--json", action="store_true")     ob.set_defaults(fn=cmd_onboard)