Gmail OAuth2 login for PQ email retrieval

Aperta
  • Qualcosa non va?
#697 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
22/100
Tipo di issue
Funzionalità
Chiarezza
Abbastanza chiara
Stato di attività
Tranquilla
Stack tecnologico
python
Ambito
authentication

Direzione di ricerca

This depends on #443's EmailProvider interface and fetch/parse/DB-match pipeline, which the payload does not show in code, so read #443 first and confirm it has merged. The new GmailOAuthProvider should implement that interface using a loopback OAuth flow with google-auth, the gmail.readonly scope, and tokens stored via keyring. Done means a Gmail user can connect without an app-password while the existing pipeline runs unchanged; Google app verification is an external dependency that runs in parallel.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

area: import feature on hold
Problem Statement

#443 implements PQ-from-email using generic IMAP + app-password, which
already works for Gmail (2FA + app-password). However, app-passwords are
an extra manual setup step for users, and some users may not want to
enable 2FA just to generate one.

Proposed Solution

Add Gmail as an OAuth2 login option alongside the generic IMAP path from
#443, so Gmail users can just click "Connect with Google" instead of
generating an app-password.

  • Use google-auth / google-api-python-client (official SDKs) rather
    than hand-rolled OAuth, to stay on the maintained side of any future
    protocol changes
  • Local loopback browser flow (opens system browser, listens on
    localhost callback) — standard pattern for desktop OAuth apps
  • Request the minimal scope needed: gmail.readonly
  • Token storage/refresh via keyring, same credential store as #443
  • Implements the shared EmailProvider interface from #443
    (GmailOAuthProvider), so it plugs into the same fetch/parse/DB-match
    pipeline without changes there
Notes / constraints
  • gmail.readonly is a restricted Google OAuth scope, requiring
    Google's app verification process before general release. Since
    OpenSAK is a pure desktop app with no backend server, we should be
    exempt from the costly annual security assessment — but standard
    verification (brand review + scope review) still applies and can take
    from a few days to a few weeks. Start this process early, in
    parallel with development     — it's an external dependency, not dev
    time, and shouldn't block the rest of the implementation.
  • Until verification completes, users will see Google's "unverified
    app" warning on first login — worth a short note in the UI/user guide
    so it doesn't look like a bug or a security problem with OpenSAK.
  • Expect roughly one maintenance session per year as Google updates
    OAuth/API requirements (this has happened before and will again) —
    a standing cost of third-party OAuth integration.
  • This is a convenience layer, not a functional requirement — #443's
    IMAP+app-password path already covers Gmail if this gets deprioritized.
Depends on
  • #443 (EmailProvider interface, fetch/parse/DB-match pipeline)
Expected Benefits

Smoother login UX for Gmail users — no manual app-password setup.

Lingua principale
Python
Stelle
37
Fork
17
Merge medio
16h 7m
PR unite (30g)
128

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di OpenSAK-Org/OpenSAK

Tutte le issue di OpenSAK-Org/OpenSAK

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.