Package app.spellscroll.auth

Class SpellscrollOAuthClient

java.lang.Object

app.spellscroll.auth.SpellscrollOAuthClient

public class SpellscrollOAuthClient
extends Object

Performs OAuth2 Authorization Code + PKCE authentication against Google or Microsoft, using a temporary localhost redirect server to capture the authorization code.

Only the refresh token is persisted (via SpellscrollTokenStore, which delegates to the OS native credential store). Access tokens are obtained fresh each Gradle run by exchanging the refresh token, so they never touch disk.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static enum	SpellscrollOAuthClient.Provider

Constructor Summary

Constructors

Constructor	Description
SpellscrollOAuthClient(SpellscrollTokenStore tokenStore)

Method Summary

Modifier and Type	Method	Description
String	getValidToken()	Returns a fresh access token by silently exchanging the stored refresh token.
String	login()	Runs the interactive browser-based OAuth2 flow, presenting a provider selection page.
String	login(SpellscrollOAuthClient.Provider provider)	Runs the interactive browser-based OAuth2 flow for provider.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

SpellscrollOAuthClient

public SpellscrollOAuthClient(SpellscrollTokenStore tokenStore)

Method Details

getValidToken

public String getValidToken()
                     throws IOException,
InterruptedException

Returns a fresh access token by silently exchanging the stored refresh token.

Because we don't record which provider issued the stored token, we try Google first then Microsoft — only the correct provider will accept the token. Returns null if no refresh token is stored or both providers reject it, in which case the caller should invoke login().

Throws:

IOException

InterruptedException

login

public String login()
             throws IOException,
InterruptedException

Runs the interactive browser-based OAuth2 flow, presenting a provider selection page.

Opens a local HTTP server and directs the browser to a sign-in page where the user can choose between Google and Microsoft. Once a provider is chosen the standard Authorization Code + PKCE flow completes in the same browser tab. Blocks until the provider redirects back (up to 5 minutes). The resulting refresh token is persisted to the OS credential store.

Returns:

the access token for the current session

Throws:

IOException - if network I/O fails

InterruptedException - if the waiting thread is interrupted

login

public String login(SpellscrollOAuthClient.Provider provider)
             throws IOException,
InterruptedException

Runs the interactive browser-based OAuth2 flow for provider.

The localhost redirect server is started before the browser is opened to ensure the authorization code is never missed. Blocks until the provider redirects back (up to 5 minutes). The resulting refresh token is persisted to the OS credential store.

Returns:

the access token for the current session

Throws:

IOException - if network I/O fails

InterruptedException - if the waiting thread is interrupted