mirror of
https://github.com/ChuckBuilds/LEDMatrix.git
synced 2026-08-13 22:58:06 +00:00
fix(calendar): implement the OAuth and calendar-listing endpoints (#458)
* fix(calendar): implement the OAuth and calendar-listing endpoints The plugin's config advertised a three-step setup and only step 1 existed. Step 3's picker fetched /api/v3/plugins/calendar/list-calendars, which was never registered, so Flask fell through to the global 404 handler and the user saw "Resource not found" -- a message that names nothing and points nowhere. Step 2 had no endpoint at all, so even a working picker would have found no token to list with. Two routes, following the pattern the spotify and ytm plugins already use for their own auth scripts: POST /plugins/calendar/authenticate two-step Google OAuth GET /plugins/calendar/list-calendars calendars for the picker The authenticate route drives calendar_registration.py, which the plugin already ships and which was written expressly for this -- it reads a redirect URL on stdin and prints one JSON object. It takes two calls because a human has to visit Google in between; the script persists the PKCE verifier from the first call for the second, without which the exchange fails with "Missing code verifier". The listing route reads the token directly rather than shelling out again: the picker is interactive and a subprocess per click is slower than the API call it would wrap. It refreshes an expired token in place, sorts the primary calendar first, and drops entries with no id, which could not be selected anyway. Both name the plugin when it is not installed, rather than reproducing the anonymous 404 that started this. Verified against the live Google API on the dev rig: HTTP 200 with the account's real calendars. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Udr6MfaFLUPhX5Fgo67Jf5 * fix(calendar): one input for the auth code, and a louder warning Two things reported after testing the flow. There were two boxes and no way to tell which to use. The config template's string branch dispatches widgets from an allow-list of names, and anything missing from it falls through to a plain input type=text -- so the field rendered both the widget's own box and a stray one for the same key. google-oauth is now on that list, which is all the widget ever needed to render in place of the fallback rather than beside it. And the warning that the redirect page fails to load was small grey text under a link, which is where it is least likely to be read. It is now an amber callout that leads with "The next page will fail to load. That is expected." The failure lands at exactly the moment the user has to act on it, and it looks precisely like the flow breaking rather than working. The paste box is labelled too, rather than relying on a placeholder that vanishes on focus. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Udr6MfaFLUPhX5Fgo67Jf5 * fix(calendar): redact script diagnostics, and page the calendar list Three findings from CodeRabbit, all valid. Raw subprocess output was being returned to the client -- the script's stderr on one path, and its own error payload on another. CodeQL flagged the same line. That script handles OAuth client secrets and interpolates exceptions into its messages, so either could carry a secret or a path. Both now go to the log unredacted, where they are worth having in full, and reach the client through a redactor. That redactor already existed inside describe_exception, which only takes exceptions. Split out as redact_text: an exception is not the only thing worth returning, and a subprocess's stderr is just as capable of quoting a token. calendarList.list returns 100 entries per page by default, caps at 250, and hands back a nextPageToken when there are more. Reading one page would have hidden calendars from the picker with nothing to say the list was cut short. It now pages, asking for 250 at a time, bounded at ten pages so a malformed token cannot spin. And a test helper was a lambda where ruff wants a def. The five new tests fail against the previous commit. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Udr6MfaFLUPhX5Fgo67Jf5 * fix(calendar): redact the last two raw exception interpolations CodeQL flagged four exposure paths. Two were mine and genuinely raw: the OSError from failing to spawn calendar_registration.py, which carries the interpreter path and whatever the OS chose to say, and the ImportError for the Google libraries, whose message named the missing module by interpolating the exception directly. Both now go through describe_exception, and the unredacted text goes to the log. The other two are the repo-wide pattern from PR #448 -- 67 handlers on main already return details=describe_exception(e), and these two new handlers follow it. That function is the sanitizer: it strips URL userinfo, auth headers and credential-shaped key=value pairs, collapses to one line and caps the length. CodeQL's taint tracking cannot see a sanitizer it has no model for, so it reports the flow regardless. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Udr6MfaFLUPhX5Fgo67Jf5 * fix(calendar): announce status changes, name the paste box, drop a no-op Three more from the review, all valid. The status line is written after every async call -- the consent link is ready, the exchange failed -- and was a plain paragraph, so a screen reader was told none of it. It is a live region now. The paste box had a visible label that was never associated with it, so its only accessible name was the placeholder, which disappears on focus: precisely when the value is being pasted. The label now points at the input by id. And a conditional in the test helper returned the same value from both branches, which Ruff flags as RUF034. It was left over from making the fake page; one page is all those cases need, and TestPagination builds its own sequences. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Udr6MfaFLUPhX5Fgo67Jf5 * test(calendar): assert the accessibility relationships, not their parts The previous assertions searched for role="status", aria-live, a label `for` and an input `id` independently, so they passed whether or not those belonged together. Two attributes on different elements announce nothing, and a `for` that names something other than the input leaves it just as anonymous. Both attributes are now asserted on the status element itself, and the label and input are checked to go through the same identifier rather than merely both existing. Verified by mutation: a mismatched pair and a displaced aria-live are both caught. Reported by CodeRabbit, against tests I had written two commits earlier. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Udr6MfaFLUPhX5Fgo67Jf5 --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Chuck
@@ -22,7 +22,7 @@ logger = logging.getLogger(__name__)
|
||||
from src.web_interface.api_helpers import success_response, error_response, validate_request_json
|
||||
from src.web_interface.errors import ErrorCode
|
||||
from src.web_interface.secret_helpers import find_secret_fields, separate_secrets
|
||||
from src.web_interface.error_handler import describe_exception
|
||||
from src.web_interface.error_handler import describe_exception, redact_text
|
||||
from src.plugin_system.operation_types import OperationType
|
||||
from src.web_interface.validators import (
|
||||
validate_file_upload
|
||||
@@ -7317,6 +7317,227 @@ def upload_calendar_credentials():
|
||||
logger.error('Error in upload_calendar_credentials', exc_info=True)
|
||||
return jsonify({'status': 'error', 'message': 'An error occurred; see logs for details', 'details': describe_exception(e)}), 500
|
||||
|
||||
# calendarList.list pages at 250 entries maximum. Ten pages is far past any
|
||||
# real account and exists only so a malformed nextPageToken cannot spin here.
|
||||
_CALENDAR_LIST_MAX_PAGES = 10
|
||||
|
||||
|
||||
def _calendar_plugin_dir() -> Optional[Path]:
|
||||
"""Where the calendar plugin is installed, or None if it is not."""
|
||||
if api_v3.plugin_manager:
|
||||
plugin_dir = api_v3.plugin_manager.get_plugin_directory('calendar')
|
||||
else:
|
||||
plugin_dir = PROJECT_ROOT / 'plugins' / 'calendar'
|
||||
if not plugin_dir:
|
||||
return None
|
||||
plugin_dir = Path(plugin_dir)
|
||||
return plugin_dir if plugin_dir.exists() else None
|
||||
|
||||
|
||||
def _run_calendar_registration(plugin_dir: Path, stdin_payload: str):
|
||||
"""Run the plugin's OAuth script and return the JSON object it prints.
|
||||
|
||||
The script decides between web and terminal mode by whether stdin is a
|
||||
tty, so it must be given a pipe. It emits one JSON object on stdout; the
|
||||
last parsable line is taken, because an import warning or a library's
|
||||
stderr redirection can land in front of it.
|
||||
|
||||
Returns (payload, error_message). Exactly one is None.
|
||||
"""
|
||||
script = plugin_dir / 'calendar_registration.py'
|
||||
if not script.exists():
|
||||
return None, 'Authentication script not found in the calendar plugin'
|
||||
|
||||
try:
|
||||
result = subprocess.run( # nosec B603 - fixed script path inside the plugin dir
|
||||
[sys.executable, str(script)],
|
||||
input=stdin_payload,
|
||||
capture_output=True,
|
||||
text=True,
|
||||
timeout=120,
|
||||
cwd=str(plugin_dir),
|
||||
)
|
||||
except subprocess.TimeoutExpired:
|
||||
return None, 'Authentication timed out after 120s'
|
||||
except OSError as e:
|
||||
logger.error('Could not run calendar_registration.py', exc_info=True)
|
||||
return None, 'Could not run the authentication script: %s' % describe_exception(e)
|
||||
|
||||
for line in reversed((result.stdout or '').splitlines()):
|
||||
line = line.strip()
|
||||
if not line:
|
||||
continue
|
||||
try:
|
||||
payload = json.loads(line)
|
||||
except json.JSONDecodeError:
|
||||
continue
|
||||
if isinstance(payload, dict):
|
||||
return payload, None
|
||||
|
||||
raw = (result.stderr or result.stdout or '').strip()
|
||||
# The unredacted text goes to the log, where it is worth having in full.
|
||||
# What comes back over HTTP is redacted: this is a script that handles
|
||||
# OAuth client secrets, and its stderr can quote them.
|
||||
if raw:
|
||||
logger.error('calendar_registration.py failed (exit %s): %s',
|
||||
result.returncode, raw)
|
||||
return None, 'Authentication script produced no result%s' % (
|
||||
': %s' % redact_text(raw) if raw else '')
|
||||
|
||||
|
||||
@api_v3.route('/plugins/calendar/authenticate', methods=['POST'])
|
||||
def authenticate_calendar():
|
||||
"""Google OAuth for the calendar plugin, in the two steps it requires.
|
||||
|
||||
Step 1 (no body) returns the consent URL to open. Step 2 posts back the
|
||||
URL Google redirected to -- it fails to load, because the redirect points
|
||||
at a loopback address nothing is listening on, but the address bar carries
|
||||
the authorization code -- and the script exchanges it for a token.
|
||||
|
||||
Two calls rather than one because the user has to visit Google in between.
|
||||
The script persists the PKCE verifier from step 1 for step 2 to reuse; the
|
||||
exchange fails with "Missing code verifier" otherwise.
|
||||
"""
|
||||
try:
|
||||
plugin_dir = _calendar_plugin_dir()
|
||||
if plugin_dir is None:
|
||||
return jsonify({
|
||||
'status': 'error',
|
||||
'message': 'The calendar plugin is not installed'
|
||||
}), 404
|
||||
|
||||
if not (plugin_dir / 'credentials.json').exists():
|
||||
return jsonify({
|
||||
'status': 'error',
|
||||
'message': ('No credentials.json yet. Upload your Google OAuth '
|
||||
'client file first (Step 1).')
|
||||
}), 400
|
||||
|
||||
data = request.get_json(silent=True) or {}
|
||||
redirect_url = (data.get('redirect_url') or data.get('code') or '').strip()
|
||||
|
||||
payload, error = _run_calendar_registration(plugin_dir, redirect_url)
|
||||
if error:
|
||||
return jsonify({'status': 'error', 'message': error}), 500
|
||||
if payload.get('status') != 'success':
|
||||
# The script's own diagnosis is more useful than anything that
|
||||
# could be reconstructed here -- but it interpolates exceptions
|
||||
# into its messages, so it reaches the client redacted and the
|
||||
# original goes to the log.
|
||||
logger.error('calendar authentication failed: %s', payload)
|
||||
safe = dict(payload)
|
||||
safe['message'] = redact_text(str(payload.get('message', '')
|
||||
or 'Authentication failed'))
|
||||
return jsonify(safe), 400
|
||||
return jsonify(payload)
|
||||
|
||||
except Exception as e:
|
||||
logger.error('Error in authenticate_calendar', exc_info=True)
|
||||
return jsonify({'status': 'error',
|
||||
'message': 'An error occurred; see logs for details',
|
||||
'details': describe_exception(e)}), 500
|
||||
|
||||
|
||||
@api_v3.route('/plugins/calendar/list-calendars', methods=['GET'])
|
||||
def list_calendar_calendars():
|
||||
"""The calendars this account can see, for the config picker.
|
||||
|
||||
Reads the token the OAuth flow wrote rather than shelling out again: the
|
||||
picker is used interactively and a subprocess per click is slower than the
|
||||
API call it would be wrapping.
|
||||
"""
|
||||
try:
|
||||
plugin_dir = _calendar_plugin_dir()
|
||||
if plugin_dir is None:
|
||||
return jsonify({
|
||||
'status': 'error',
|
||||
'message': 'The calendar plugin is not installed'
|
||||
}), 404
|
||||
|
||||
token_file = plugin_dir / 'token.pickle'
|
||||
if not token_file.exists():
|
||||
return jsonify({
|
||||
'status': 'error',
|
||||
'message': ('Not authenticated with Google yet. Complete Step 2 '
|
||||
'first, then load your calendars.')
|
||||
}), 400
|
||||
|
||||
try:
|
||||
import pickle
|
||||
from google.auth.transport.requests import Request as GoogleRequest
|
||||
from googleapiclient.discovery import build as build_google_service
|
||||
except ImportError as e:
|
||||
return jsonify({
|
||||
'status': 'error',
|
||||
# The name of the missing module is the whole diagnosis, but it
|
||||
# arrives as an exception, so it goes through the redactor like
|
||||
# any other -- an ImportError can quote a path.
|
||||
'message': ('The Google API libraries are not installed. Install '
|
||||
"the calendar plugin's requirements.txt. (%s)"
|
||||
% describe_exception(e))
|
||||
}), 500
|
||||
|
||||
with open(token_file, 'rb') as handle:
|
||||
# Written only by this plugin's own OAuth flow, into its own
|
||||
# directory, and read here exactly as the plugin itself reads it.
|
||||
creds = pickle.load(handle) # nosec B301 - locally generated token
|
||||
|
||||
if creds and creds.expired and creds.refresh_token:
|
||||
creds.refresh(GoogleRequest())
|
||||
with open(token_file, 'wb') as handle:
|
||||
pickle.dump(creds, handle)
|
||||
os.chmod(token_file, 0o600)
|
||||
|
||||
if not creds or not creds.valid:
|
||||
return jsonify({
|
||||
'status': 'error',
|
||||
'message': ('Stored Google credentials are no longer valid. '
|
||||
'Run Step 2 again to re-authenticate.')
|
||||
}), 400
|
||||
|
||||
service = build_google_service('calendar', 'v3', credentials=creds)
|
||||
|
||||
# calendarList.list returns 100 entries per page by default and caps at
|
||||
# 250, handing back a nextPageToken when there are more. Taking only
|
||||
# the first page would silently hide calendars from the picker, and the
|
||||
# user would have no way to tell the list was truncated.
|
||||
entries = []
|
||||
page_token = None
|
||||
for _ in range(_CALENDAR_LIST_MAX_PAGES):
|
||||
response = service.calendarList().list(
|
||||
maxResults=250, pageToken=page_token).execute()
|
||||
entries.extend(response.get('items', []))
|
||||
page_token = response.get('nextPageToken')
|
||||
if not page_token:
|
||||
break
|
||||
else:
|
||||
# 2500 calendars in, something is wrong with the account or the
|
||||
# token is looping; show what was collected rather than spin.
|
||||
logger.warning(
|
||||
'calendarList paging stopped at %d pages with more remaining',
|
||||
_CALENDAR_LIST_MAX_PAGES)
|
||||
|
||||
calendars = [{
|
||||
'id': entry.get('id'),
|
||||
# The picker labels each row with summary and falls back to the id
|
||||
# only in its own display, so send something either way.
|
||||
'summary': entry.get('summary') or entry.get('id'),
|
||||
'primary': bool(entry.get('primary', False)),
|
||||
} for entry in entries if entry.get('id')]
|
||||
|
||||
# Primary first, then alphabetically: the list is usually short but the
|
||||
# one the user wants is almost always their own calendar.
|
||||
calendars.sort(key=lambda c: (not c['primary'], c['summary'].lower()))
|
||||
|
||||
return jsonify({'status': 'success', 'calendars': calendars})
|
||||
|
||||
except Exception as e:
|
||||
logger.error('Error in list_calendar_calendars', exc_info=True)
|
||||
return jsonify({'status': 'error',
|
||||
'message': 'An error occurred; see logs for details',
|
||||
'details': describe_exception(e)}), 500
|
||||
|
||||
|
||||
@api_v3.route('/plugins/assets/delete', methods=['POST'])
|
||||
def delete_plugin_asset():
|
||||
"""Delete an asset file for a plugin"""
|
||||
|
||||
@@ -0,0 +1,196 @@
|
||||
/**
|
||||
* Google OAuth Widget
|
||||
*
|
||||
* Step 2 of the calendar plugin's setup, between uploading the OAuth client
|
||||
* file and picking calendars. Google will not let a headless device complete
|
||||
* consent on its own, so the flow is necessarily two calls with a human in
|
||||
* between:
|
||||
*
|
||||
* 1. POST /api/v3/plugins/calendar/authenticate with no body
|
||||
* -> { auth_url } to open in a browser
|
||||
* 2. the browser lands on a loopback address that fails to load; its URL
|
||||
* carries the authorization code. POST it back as redirect_url
|
||||
* -> the server exchanges it and writes token.pickle
|
||||
*
|
||||
* The failed page in step 2 is expected and is worth saying out loud, because
|
||||
* it looks exactly like something went wrong.
|
||||
*
|
||||
* @module GoogleOAuthWidget
|
||||
*/
|
||||
|
||||
(function () {
|
||||
'use strict';
|
||||
|
||||
if (typeof window.LEDMatrixWidgets === 'undefined') {
|
||||
console.error('[GoogleOAuthWidget] LEDMatrixWidgets registry not found. Load registry.js first.');
|
||||
return;
|
||||
}
|
||||
|
||||
const ENDPOINT = '/api/v3/plugins/calendar/authenticate';
|
||||
|
||||
window.LEDMatrixWidgets.register('google-oauth', {
|
||||
name: 'Google OAuth Widget',
|
||||
version: '1.0.0',
|
||||
|
||||
/**
|
||||
* @param {HTMLElement} container
|
||||
* @param {Object} config - schema config (unused)
|
||||
* @param {*} value - unused; this widget stores nothing
|
||||
* @param {Object} options - { fieldId, pluginId, name }
|
||||
*/
|
||||
render: function (container, config, value, options) {
|
||||
const fieldId = options.fieldId;
|
||||
|
||||
// Nothing is stored in config by this step -- the result is
|
||||
// token.pickle on the device -- but the form still expects a field.
|
||||
const hidden = document.createElement('input');
|
||||
hidden.type = 'hidden';
|
||||
hidden.id = fieldId + '_hidden';
|
||||
hidden.name = options.name;
|
||||
hidden.value = value || '';
|
||||
|
||||
const startBtn = document.createElement('button');
|
||||
startBtn.type = 'button';
|
||||
startBtn.className = 'px-3 py-1.5 text-sm rounded-md bg-blue-600 hover:bg-blue-700 text-white';
|
||||
startBtn.innerHTML = '<i class="fas fa-key"></i> Connect Google Account';
|
||||
|
||||
const status = document.createElement('p');
|
||||
status.className = 'text-xs text-gray-400 mt-2';
|
||||
// Every message this widget gives -- the consent link is ready,
|
||||
// the exchange failed -- arrives here after an async call, so a
|
||||
// screen reader is told nothing unless it is a live region.
|
||||
status.setAttribute('role', 'status');
|
||||
status.setAttribute('aria-live', 'polite');
|
||||
|
||||
const step2 = document.createElement('div');
|
||||
step2.className = 'mt-3 hidden';
|
||||
|
||||
const link = document.createElement('a');
|
||||
link.target = '_blank';
|
||||
link.rel = 'noopener noreferrer';
|
||||
link.className = 'text-blue-400 underline text-sm break-all';
|
||||
link.textContent = 'Open the Google consent screen';
|
||||
|
||||
// Deliberately loud. After consent the browser is redirected to a
|
||||
// loopback address nothing is listening on, so it lands on a
|
||||
// browser error page -- which reads as a failure at exactly the
|
||||
// moment the user has to act on it. Said quietly in grey it gets
|
||||
// missed, and the flow looks broken when it is working.
|
||||
const hint = document.createElement('div');
|
||||
hint.className =
|
||||
'mt-3 p-3 rounded-md border border-amber-500/60 bg-amber-500/10';
|
||||
hint.innerHTML =
|
||||
'<p class="text-sm text-amber-300 font-semibold">'
|
||||
+ '<i class="fas fa-triangle-exclamation"></i> '
|
||||
+ 'The next page will fail to load. That is expected.</p>'
|
||||
+ '<p class="text-xs text-amber-200/90 mt-1">'
|
||||
+ 'After you approve access, Google sends your browser to '
|
||||
+ '<code>127.0.0.1</code>, where nothing is running \u2014 so you will see '
|
||||
+ '"This site can\u2019t be reached" or similar. Nothing has gone wrong. '
|
||||
+ 'Copy the <strong>entire address</strong> out of the address bar '
|
||||
+ '(it contains <code>?code=...</code>) and paste it in the box below.</p>';
|
||||
|
||||
const codeInputId = fieldId + '_redirect_url';
|
||||
|
||||
const codeLabel = document.createElement('label');
|
||||
codeLabel.className = 'block text-xs text-gray-300 mt-3';
|
||||
codeLabel.textContent = 'Paste the address from that failed page here:';
|
||||
// The label was visible but not associated, so the input still had
|
||||
// no accessible name -- a placeholder is not one, and it vanishes
|
||||
// on focus, which is exactly when the value is being pasted.
|
||||
codeLabel.setAttribute('for', codeInputId);
|
||||
|
||||
const codeInput = document.createElement('input');
|
||||
codeInput.type = 'text';
|
||||
codeInput.id = codeInputId;
|
||||
codeInput.placeholder = 'http://127.0.0.1/?code=...';
|
||||
codeInput.className =
|
||||
'mt-2 block w-full px-3 py-2 text-sm border border-gray-600 '
|
||||
+ 'rounded-md bg-gray-800 text-gray-100';
|
||||
|
||||
const finishBtn = document.createElement('button');
|
||||
finishBtn.type = 'button';
|
||||
finishBtn.className = 'mt-2 px-3 py-1.5 text-sm rounded-md bg-green-600 hover:bg-green-700 text-white';
|
||||
finishBtn.innerHTML = '<i class="fas fa-check"></i> Finish Authentication';
|
||||
|
||||
function say(message, kind) {
|
||||
status.textContent = message;
|
||||
status.className = 'text-xs mt-2 ' + (
|
||||
kind === 'error' ? 'text-red-400'
|
||||
: kind === 'success' ? 'text-green-400'
|
||||
: 'text-gray-400');
|
||||
}
|
||||
|
||||
function post(body) {
|
||||
return fetch(ENDPOINT, {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
body: JSON.stringify(body || {})
|
||||
}).then(function (r) {
|
||||
return r.json().catch(function () {
|
||||
// A non-JSON body here means the request never reached
|
||||
// the handler -- worth saying so rather than "undefined".
|
||||
return { status: 'error', message: 'Server returned ' + r.status };
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
startBtn.addEventListener('click', function () {
|
||||
startBtn.disabled = true;
|
||||
say('Requesting a consent link...');
|
||||
post({}).then(function (data) {
|
||||
startBtn.disabled = false;
|
||||
if (data.status !== 'success' || !data.auth_url) {
|
||||
say(data.message || 'Could not start authentication.', 'error');
|
||||
return;
|
||||
}
|
||||
link.href = data.auth_url;
|
||||
step2.classList.remove('hidden');
|
||||
say(data.message || 'Open the link, approve, then paste the address back.');
|
||||
}).catch(function (err) {
|
||||
startBtn.disabled = false;
|
||||
say('Request failed: ' + err.message, 'error');
|
||||
});
|
||||
});
|
||||
|
||||
finishBtn.addEventListener('click', function () {
|
||||
const pasted = codeInput.value.trim();
|
||||
if (!pasted) {
|
||||
say('Paste the address your browser was redirected to.', 'error');
|
||||
return;
|
||||
}
|
||||
finishBtn.disabled = true;
|
||||
say('Exchanging the code with Google...');
|
||||
post({ redirect_url: pasted }).then(function (data) {
|
||||
finishBtn.disabled = false;
|
||||
if (data.status !== 'success') {
|
||||
say(data.message || 'Authentication failed.', 'error');
|
||||
return;
|
||||
}
|
||||
say(data.message || 'Authenticated.', 'success');
|
||||
step2.classList.add('hidden');
|
||||
codeInput.value = '';
|
||||
}).catch(function (err) {
|
||||
finishBtn.disabled = false;
|
||||
say('Request failed: ' + err.message, 'error');
|
||||
});
|
||||
});
|
||||
|
||||
step2.appendChild(link);
|
||||
step2.appendChild(hint);
|
||||
step2.appendChild(codeLabel);
|
||||
step2.appendChild(codeInput);
|
||||
step2.appendChild(finishBtn);
|
||||
|
||||
container.appendChild(hidden);
|
||||
container.appendChild(startBtn);
|
||||
container.appendChild(status);
|
||||
container.appendChild(step2);
|
||||
},
|
||||
|
||||
getValue: function (fieldId) {
|
||||
const hidden = document.getElementById(fieldId + '_hidden');
|
||||
return hidden ? hidden.value : '';
|
||||
}
|
||||
});
|
||||
})();
|
||||
@@ -987,6 +987,7 @@
|
||||
<script src="{{ url_for('static', filename='v3/js/widgets/custom-feeds.js') }}" defer></script>
|
||||
<script src="{{ url_for('static', filename='v3/js/widgets/array-table.js') }}" defer></script>
|
||||
<script src="{{ url_for('static', filename='v3/js/widgets/google-calendar-picker.js') }}" defer></script>
|
||||
<script src="{{ url_for('static', filename='v3/js/widgets/google-oauth.js') }}" defer></script>
|
||||
<script src="{{ url_for('static', filename='v3/js/widgets/day-selector.js') }}" defer></script>
|
||||
<script src="{{ url_for('static', filename='v3/js/widgets/time-range.js') }}" defer></script>
|
||||
<script src="{{ url_for('static', filename='v3/js/widgets/time-picker.js') }}" defer></script>
|
||||
|
||||
@@ -815,7 +815,7 @@
|
||||
<i class="fas fa-info-circle mr-1"></i>
|
||||
Changes in the file manager save immediately — no need to click Save Configuration.
|
||||
</p>
|
||||
{% elif str_widget in ['text-input', 'textarea', 'select-dropdown', 'toggle-switch', 'radio-group', 'date-picker', 'time-picker', 'slider', 'color-picker', 'email-input', 'url-input', 'password-input', 'font-selector', 'file-upload-single', 'plugin-file-manager'] %}
|
||||
{% elif str_widget in ['text-input', 'textarea', 'select-dropdown', 'toggle-switch', 'radio-group', 'date-picker', 'time-picker', 'slider', 'color-picker', 'email-input', 'url-input', 'password-input', 'font-selector', 'file-upload-single', 'plugin-file-manager', 'google-oauth'] %}
|
||||
{# Render widget container #}
|
||||
<div id="{{ field_id }}_container" class="{{ str_widget }}-container"></div>
|
||||
<script>
|
||||
|
||||
Reference in New Issue
Block a user