bernardo/nocal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(sync): add provider contracts and OAuth token broker

Browse Source 
Draft the generic SyncProvider/SyncObserver contracts and implement
OAuthTokenBroker: valid access tokens with a five-minute refresh skew,
rotation persisted before use so a new refresh token is never lost,
400/401 refresh rejections erase the secret and surface
AccountDisconnected, and no credential material in error messages.
This commit is contained in:
Bernardo Magri
2026-07-20 22:50:54 +01:00
parent 98e07e287e
commit 23bcb20ab5
6 changed files with 919 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
docs/ROADMAP.md
View File

@@ -93,6 +93,18 @@ Completed secondary-calendar stable-v1 reconciliation:
- Overlapping windows retain events until their last membership is removed
- No beta or undocumented per-calendar delta dependency
Completed provider-boundary contracts and token broker:
- Generic `SyncProvider`/`SyncObserver` contracts for account connect, sync,
and disconnect with staged progress events
- `OAuthTokenBroker` returning valid per-operation access tokens with a
five-minute refresh skew
- Refresh rotation persisted before use so a new refresh token is never lost;
transient refresh failures leave stored credentials untouched
- 400/401 refresh rejections erase the stored secret and surface
`AccountDisconnected` for re-authentication
- Credential material never appears in exception messages
Next provider-boundary slices:
- Account setup and CLI/TUI orchestration with live credential integration