bernardo/nocal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: store OAuth tokens securely

Browse Source 
Add bounded token response parsing with refresh-token retention and a cancellable worker-thread libsecret adapter using versioned credential payloads.

Verify CRUD, isolation, cancellation, corruption, unavailable service, redaction, and cleanup against an isolated D-Bus and gnome-keyring Secret Service in normal, warning-as-error, and sanitizer profiles.
This commit is contained in:
Bernardo Magri
2026-07-18 11:56:04 +01:00
parent 295acbc125
commit 3560a7d23d
13 changed files with 1405 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
docs/ROADMAP.md
View File

@@ -57,11 +57,23 @@ Completed concrete Linux adapters:
while literal HTTP `127.0.0.1` needs a manifest edit and IPv6 loopback is not
supported
Completed token/secret boundary:
- Strict, bounded token JSON parsing with a required initial refresh token
- Refresh-token rotation with retention of the previous token when a refresh
response omits a replacement
- Versioned libsecret payloads keyed by opaque local account IDs
- Synchronous, cancellable Secret Service calls restricted to worker threads
- Real isolated D-Bus/gnome-keyring integration tests
- Explicit missing, locked, cancelled, and failure results; no connected account
until the complete secret store succeeds
- OAuth secrets only in Secret Service, never SQLite, logs, CLI arguments, or
environment variables
Next provider-boundary slices:
- Token JSON parsing and a Secret Service adapter isolated off the render thread
because synchronous libsecret calls may block
- OAuth secrets in Secret Service, never SQLite
- Microsoft `/me` identity and read-only calendar discovery
- Read-only Graph delta synchronization using delegated `Calendars.Read`
- Generic `SyncProvider` contract and observable sync status
## 0.3 — CalDAV
@@ -78,10 +90,10 @@ Next provider-boundary slices:
- Account/calendar management UI and per-calendar ANSI identity
The cache, generic HTTP/OAuth boundary, and concrete Linux adapters are
prerequisites, not usable Microsoft 365 integration. There is still no token
parser, Secret Service backend, Graph call, or account UI. The immediate sequence is token parsing plus an
off-render-thread Secret Service adapter, then read-only Microsoft Graph
discovery and delta synchronization.
prerequisites, not usable Microsoft 365 integration. The token/Secret
Service phase still provides no Graph call, account UI, or usable account setup.
After it passes verification, the immediate sequence is Microsoft `/me`,
read-only calendar discovery, and Graph delta synchronization.
## 1.0 — distribution quality