feat(google): add token_command support for external token fetching

- allows the use of https://github.com/pdobsan/oama to manage oauth tokens

Author: fishman

vdirsyncer/storage/google.py

@@ -40,15 +40,25 @@
 class GoogleSession(dav.DAVSession):
     def __init__(
         self,
-        token_file,
-        client_id,
-        client_secret,
+        token_file=None,
+        client_id=None,
+        client_secret=None,
+        token_command=None,
         url=None,
         *,
         connector: aiohttp.BaseConnector,
     ):
-        if not have_oauth2:
-            raise exceptions.UserError("aiohttp-oauthlib not installed")
+        if token_command is not None:
+            if isinstance(token_command, str):
+                self._token_command = token_command
+                self._token_command_shell = True
+            else:
+                self._token_command = list(token_command)
+                self._token_command_shell = False
+        else:
+            self._token_command = None
+            if not have_oauth2:
+                raise exceptions.UserError("aiohttp-oauthlib not installed")
 
         # Required for discovering collections
         if url is not None:
@@ -58,7 +68,7 @@ def __init__(
         self._settings = {}
         self.connector = connector
 
-        self._token_file = Path(expand_path(token_file))
+        self._token_file = Path(expand_path(token_file)) if token_file else None
         self._client_id = client_id
         self._client_secret = client_secret
         self._token = None
@@ -68,24 +78,52 @@ async def request(self, method, path, **kwargs):
         if not self._token:
             await self._init_token()
 
+        if self._token_command:
+            kwargs["headers"] = dict(kwargs.get("headers", {}))
+            kwargs["headers"]["Authorization"] = f"Bearer {self._token}"
+            try:
+                return await super().request(method, path, **kwargs)
+            except aiohttp.ClientResponseError as e:
+                if e.status == 401:
+                    logger.debug("Token expired, re-fetching via token_command")
+                    await self._fetch_token_via_command()
+                    kwargs["headers"]["Authorization"] = f"Bearer {self._token}"
+                    return await super().request(method, path, **kwargs)
+                raise
+
         return await super().request(method, path, **kwargs)
 
     async def _save_token(self, token):
         """Helper function called by OAuth2Session when a token is updated."""
+        if self._token_command:
+            return
+        assert self._token_file is not None
         checkdir(expand_path(os.path.dirname(self._token_file)), create=True)
         with atomic_write(self._token_file, mode="w", overwrite=True) as f:
             json.dump(token, f)
 
     @property
     def _session(self):
-        """Return a new OAuth session for requests.
+        """Return a new session for requests.
+
+        When token_command is set, returns a plain aiohttp session (the
+        external command handles all OAuth concerns). Otherwise returns an
+        OAuth2Session that manages the OAuth2 flow with Google.
 
-        Accesses the self.redirect_uri field (str): the URI to redirect
+        The OAuth2 path uses self.redirect_uri (str): the URI to redirect
         authentication to. Should be a loopback address for a local server that
         follows the process detailed in
         https://developers.google.com/identity/protocols/oauth2/native-app.
         """
 
+        if self._token_command:
+            return aiohttp.ClientSession(
+                connector=self.connector,
+                connector_owner=False,
+                trust_env=True,
+            )
+
+        assert have_oauth2
         return OAuth2Session(
             client_id=self._client_id,
             token=self._token,
@@ -103,6 +141,10 @@ def _session(self):
         )
 
     async def _init_token(self):
+        if self._token_command:
+            await self._fetch_token_via_command()
+            return
+
         try:
             with self._token_file.open() as f:
                 self._token = json.load(f)
@@ -165,6 +207,30 @@ async def _init_token(self):
             # FIXME: Ugly
             await self._save_token(self._token)
 
+    async def _fetch_token_via_command(self):
+        import subprocess
+
+        assert self._token_command is not None
+
+        try:
+            if self._token_command_shell:
+                stdout = subprocess.check_output(
+                    self._token_command, text=True, shell=True
+                )
+            else:
+                stdout = subprocess.check_output(self._token_command, text=True)
+        except OSError as e:
+            raise exceptions.UserError(
+                f"Failed to execute token_command: {self._token_command}\n{e!s}"
+            )
+
+        self._token = stdout.strip()
+        if not self._token:
+            raise exceptions.UserError(
+                f"token_command returned empty output: {self._token_command}"
+            )
+        logger.debug("Successfully fetched token via token_command")
+
 
 class GoogleCalendarStorage(dav.CalDAVStorage):
     class session_class(GoogleSession):
@@ -185,9 +251,10 @@ def _get_collection_from_url(url):
 
     def __init__(
         self,
-        token_file,
-        client_id,
-        client_secret,
+        token_file=None,
+        client_id=None,
+        client_secret=None,
+        token_command=None,
         start_date=None,
         end_date=None,
         item_types=(),
@@ -200,6 +267,7 @@ def __init__(
             token_file=token_file,
             client_id=client_id,
             client_secret=client_secret,
+            token_command=token_command,
             start_date=start_date,
             end_date=end_date,
             item_types=item_types,
@@ -230,14 +298,16 @@ class discovery_class(dav.CardDiscover):
 
     storage_name = "google_contacts"
 
-    def __init__(self, token_file, client_id, client_secret, **kwargs):
+    def __init__(self, token_file=None, client_id=None, client_secret=None,
+                 token_command=None, **kwargs):
         if not kwargs.get("collection"):
             raise exceptions.CollectionRequired
 
         super().__init__(
             token_file=token_file,
             client_id=client_id,
             client_secret=client_secret,
+            token_command=token_command,
             **kwargs,
         )