Gmail OAuth2 login for PQ email retrieval

未关闭
  • 哪里不对？
#697 1 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看

维护者通常 1 天内回复

还没有人认领这个 Issue。

评估

难度
4/5
预计耗时
3-5 天
新手友好度
22/100
Issue 类型
功能
描述清晰度
基本清楚
活跃度
冷清
技术栈
python
领域
authentication

调研方向

This depends on #443's EmailProvider interface and fetch/parse/DB-match pipeline, which the payload does not show in code, so read #443 first and confirm it has merged. The new GmailOAuthProvider should implement that interface using a loopback OAuth flow with google-auth, the gmail.readonly scope, and tokens stored via keyring. Done means a Gmail user can connect without an app-password while the existing pipeline runs unchanged; Google app verification is an external dependency that runs in parallel.

由索引模型根据 Issue 内容生成。

描述

area: import feature on hold
Problem Statement

#443 implements PQ-from-email using generic IMAP + app-password, which
already works for Gmail (2FA + app-password). However, app-passwords are
an extra manual setup step for users, and some users may not want to
enable 2FA just to generate one.

Proposed Solution

Add Gmail as an OAuth2 login option alongside the generic IMAP path from
#443, so Gmail users can just click "Connect with Google" instead of
generating an app-password.

  • Use google-auth / google-api-python-client (official SDKs) rather
    than hand-rolled OAuth, to stay on the maintained side of any future
    protocol changes
  • Local loopback browser flow (opens system browser, listens on
    localhost callback) — standard pattern for desktop OAuth apps
  • Request the minimal scope needed: gmail.readonly
  • Token storage/refresh via keyring, same credential store as #443
  • Implements the shared EmailProvider interface from #443
    (GmailOAuthProvider), so it plugs into the same fetch/parse/DB-match
    pipeline without changes there
Notes / constraints
  • gmail.readonly is a restricted Google OAuth scope, requiring
    Google's app verification process before general release. Since
    OpenSAK is a pure desktop app with no backend server, we should be
    exempt from the costly annual security assessment — but standard
    verification (brand review + scope review) still applies and can take
    from a few days to a few weeks. Start this process early, in
    parallel with development     — it's an external dependency, not dev
    time, and shouldn't block the rest of the implementation.
  • Until verification completes, users will see Google's "unverified
    app" warning on first login — worth a short note in the UI/user guide
    so it doesn't look like a bug or a security problem with OpenSAK.
  • Expect roughly one maintenance session per year as Google updates
    OAuth/API requirements (this has happened before and will again) —
    a standing cost of third-party OAuth integration.
  • This is a convenience layer, not a functional requirement — #443's
    IMAP+app-password path already covers Gmail if this gets deprioritized.
Depends on
  • #443 (EmailProvider interface, fetch/parse/DB-match pipeline)
Expected Benefits

Smoother login UX for Gmail users — no manual app-password setup.

主要语言
Python
星标
37
派生
17
平均合并
16 小时 7 分钟
30 天内合并 PR
128

环境准备

  • 没有 Dockerfile 或 Docker Compose 文件
  • 没有 Pull Request 模板
  • 阅读贡献指南

从这里开始

  1. 先读完整个 Issue，再读项目的贡献指南。
  2. 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
  3. Fork 仓库，在一个分支上完成修改。
  4. 提交 Pull Request，并在描述里引用这个 Issue 编号。

OpenSAK-Org/OpenSAK 的其他 Issue

查看 OpenSAK-Org/OpenSAK 的全部 Issue

相似的 Issue

更多 Python Issue

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。