bernardo/nocal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(sync): add Microsoft account connect CLI

Browse Source 
nocal account connect microsoft runs the PKCE browser flow, reads /me,
upserts the deterministic account row, and persists tokens to Secret
Service as the final connected-state gate. Account IDs are hashed from
the remote subject so reconnect is idempotent, and a secret-store
failure leaves the same coherent state as a disconnect. Ships a
placeholder client ID with NOCAL_MICROSOFT_CLIENT_ID override until a
real Entra registration exists.
This commit is contained in:
Bernardo Magri
2026-07-21 18:44:47 +01:00
parent feec691535
commit 74c798e7aa
10 changed files with 1216 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
docs/ROADMAP.md
View File

@@ -105,10 +105,23 @@ Completed provider-boundary contracts and token broker:
`AccountDisconnected` for re-authentication
- Credential material never appears in exception messages
Completed account setup (CLI):
- `nocal account connect microsoft` runs the PKCE browser flow, reads `/me`,
upserts the deterministic account row, and persists tokens to Secret
Service as the final connected-state gate
- Deterministic local account IDs hashed from the remote subject make
reconnect idempotent; a secret-store failure leaves the same coherent state
as a disconnect
- Placeholder client ID with `NOCAL_MICROSOFT_CLIENT_ID` override until a
real Entra mobile/desktop registration exists
- Deterministic failure-path tests: rejection, token errors, identity
failure, storage failure, and credential redaction in error messages
Next provider-boundary slices:
- Account setup and CLI/TUI orchestration with live credential integration
- Generic `SyncProvider` integration and observable sync status
- TUI account orchestration and generic `SyncProvider` integration with
observable sync status
## 0.3 — CalDAV
@@ -125,9 +138,10 @@ Next provider-boundary slices:
The Graph read boundary uses stable v1 delta for the primary calendar and
complete stable-v1 calendar views for secondary calendars; it deliberately
avoids beta and undocumented per-calendar delta routes. No account UI/CLI
orchestration or live Microsoft credential integration exists yet, and remote
writes remain out of scope.
avoids beta and undocumented per-calendar delta routes. Account connect exists
as a CLI command with live credential integration through Secret Service, but
there is no account TUI or sync orchestration yet, and remote writes remain
out of scope.
## 1.0 — distribution quality