mirror of
https://github.com/ChuckBuilds/LEDMatrix.git
synced 2026-08-13 22:58:06 +00:00
fix(calendar): implement the OAuth and calendar-listing endpoints
The plugin's config advertised a three-step setup and only step 1 existed. Step 3's picker fetched /api/v3/plugins/calendar/list-calendars, which was never registered, so Flask fell through to the global 404 handler and the user saw "Resource not found" -- a message that names nothing and points nowhere. Step 2 had no endpoint at all, so even a working picker would have found no token to list with. Two routes, following the pattern the spotify and ytm plugins already use for their own auth scripts: POST /plugins/calendar/authenticate two-step Google OAuth GET /plugins/calendar/list-calendars calendars for the picker The authenticate route drives calendar_registration.py, which the plugin already ships and which was written expressly for this -- it reads a redirect URL on stdin and prints one JSON object. It takes two calls because a human has to visit Google in between; the script persists the PKCE verifier from the first call for the second, without which the exchange fails with "Missing code verifier". The listing route reads the token directly rather than shelling out again: the picker is interactive and a subprocess per click is slower than the API call it would wrap. It refreshes an expired token in place, sorts the primary calendar first, and drops entries with no id, which could not be selected anyway. Both name the plugin when it is not installed, rather than reproducing the anonymous 404 that started this. Verified against the live Google API on the dev rig: HTTP 200 with the account's real calendars. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Udr6MfaFLUPhX5Fgo67Jf5
This commit is contained in:
ChuckBuilds
co-authored by
Claude Opus 5
Claude Opus 5
parent
bb1a1671ec
commit
7685e94ca5
@@ -7312,6 +7312,186 @@ def upload_calendar_credentials():
|
||||
logger.error('Error in upload_calendar_credentials', exc_info=True)
|
||||
return jsonify({'status': 'error', 'message': 'An error occurred; see logs for details', 'details': describe_exception(e)}), 500
|
||||
|
||||
def _calendar_plugin_dir() -> Optional[Path]:
|
||||
"""Where the calendar plugin is installed, or None if it is not."""
|
||||
if api_v3.plugin_manager:
|
||||
plugin_dir = api_v3.plugin_manager.get_plugin_directory('calendar')
|
||||
else:
|
||||
plugin_dir = PROJECT_ROOT / 'plugins' / 'calendar'
|
||||
if not plugin_dir:
|
||||
return None
|
||||
plugin_dir = Path(plugin_dir)
|
||||
return plugin_dir if plugin_dir.exists() else None
|
||||
|
||||
|
||||
def _run_calendar_registration(plugin_dir: Path, stdin_payload: str):
|
||||
"""Run the plugin's OAuth script and return the JSON object it prints.
|
||||
|
||||
The script decides between web and terminal mode by whether stdin is a
|
||||
tty, so it must be given a pipe. It emits one JSON object on stdout; the
|
||||
last parsable line is taken, because an import warning or a library's
|
||||
stderr redirection can land in front of it.
|
||||
|
||||
Returns (payload, error_message). Exactly one is None.
|
||||
"""
|
||||
script = plugin_dir / 'calendar_registration.py'
|
||||
if not script.exists():
|
||||
return None, 'Authentication script not found in the calendar plugin'
|
||||
|
||||
try:
|
||||
result = subprocess.run( # nosec B603 - fixed script path inside the plugin dir
|
||||
[sys.executable, str(script)],
|
||||
input=stdin_payload,
|
||||
capture_output=True,
|
||||
text=True,
|
||||
timeout=120,
|
||||
cwd=str(plugin_dir),
|
||||
)
|
||||
except subprocess.TimeoutExpired:
|
||||
return None, 'Authentication timed out after 120s'
|
||||
except OSError as e:
|
||||
return None, 'Could not run the authentication script: %s' % e
|
||||
|
||||
for line in reversed((result.stdout or '').splitlines()):
|
||||
line = line.strip()
|
||||
if not line:
|
||||
continue
|
||||
try:
|
||||
payload = json.loads(line)
|
||||
except json.JSONDecodeError:
|
||||
continue
|
||||
if isinstance(payload, dict):
|
||||
return payload, None
|
||||
|
||||
detail = (result.stderr or result.stdout or '').strip()[:300]
|
||||
return None, 'Authentication script produced no result%s' % (
|
||||
': %s' % detail if detail else '')
|
||||
|
||||
|
||||
@api_v3.route('/plugins/calendar/authenticate', methods=['POST'])
|
||||
def authenticate_calendar():
|
||||
"""Google OAuth for the calendar plugin, in the two steps it requires.
|
||||
|
||||
Step 1 (no body) returns the consent URL to open. Step 2 posts back the
|
||||
URL Google redirected to -- it fails to load, because the redirect points
|
||||
at a loopback address nothing is listening on, but the address bar carries
|
||||
the authorization code -- and the script exchanges it for a token.
|
||||
|
||||
Two calls rather than one because the user has to visit Google in between.
|
||||
The script persists the PKCE verifier from step 1 for step 2 to reuse; the
|
||||
exchange fails with "Missing code verifier" otherwise.
|
||||
"""
|
||||
try:
|
||||
plugin_dir = _calendar_plugin_dir()
|
||||
if plugin_dir is None:
|
||||
return jsonify({
|
||||
'status': 'error',
|
||||
'message': 'The calendar plugin is not installed'
|
||||
}), 404
|
||||
|
||||
if not (plugin_dir / 'credentials.json').exists():
|
||||
return jsonify({
|
||||
'status': 'error',
|
||||
'message': ('No credentials.json yet. Upload your Google OAuth '
|
||||
'client file first (Step 1).')
|
||||
}), 400
|
||||
|
||||
data = request.get_json(silent=True) or {}
|
||||
redirect_url = (data.get('redirect_url') or data.get('code') or '').strip()
|
||||
|
||||
payload, error = _run_calendar_registration(plugin_dir, redirect_url)
|
||||
if error:
|
||||
return jsonify({'status': 'error', 'message': error}), 500
|
||||
if payload.get('status') != 'success':
|
||||
# The script's own diagnosis is more useful than anything that
|
||||
# could be reconstructed here.
|
||||
return jsonify(payload), 400
|
||||
return jsonify(payload)
|
||||
|
||||
except Exception as e:
|
||||
logger.error('Error in authenticate_calendar', exc_info=True)
|
||||
return jsonify({'status': 'error',
|
||||
'message': 'An error occurred; see logs for details',
|
||||
'details': describe_exception(e)}), 500
|
||||
|
||||
|
||||
@api_v3.route('/plugins/calendar/list-calendars', methods=['GET'])
|
||||
def list_calendar_calendars():
|
||||
"""The calendars this account can see, for the config picker.
|
||||
|
||||
Reads the token the OAuth flow wrote rather than shelling out again: the
|
||||
picker is used interactively and a subprocess per click is slower than the
|
||||
API call it would be wrapping.
|
||||
"""
|
||||
try:
|
||||
plugin_dir = _calendar_plugin_dir()
|
||||
if plugin_dir is None:
|
||||
return jsonify({
|
||||
'status': 'error',
|
||||
'message': 'The calendar plugin is not installed'
|
||||
}), 404
|
||||
|
||||
token_file = plugin_dir / 'token.pickle'
|
||||
if not token_file.exists():
|
||||
return jsonify({
|
||||
'status': 'error',
|
||||
'message': ('Not authenticated with Google yet. Complete Step 2 '
|
||||
'first, then load your calendars.')
|
||||
}), 400
|
||||
|
||||
try:
|
||||
import pickle
|
||||
from google.auth.transport.requests import Request as GoogleRequest
|
||||
from googleapiclient.discovery import build as build_google_service
|
||||
except ImportError as e:
|
||||
return jsonify({
|
||||
'status': 'error',
|
||||
'message': ('The Google API libraries are not installed. Install '
|
||||
"the calendar plugin's requirements.txt. (%s)" % e)
|
||||
}), 500
|
||||
|
||||
with open(token_file, 'rb') as handle:
|
||||
# Written only by this plugin's own OAuth flow, into its own
|
||||
# directory, and read here exactly as the plugin itself reads it.
|
||||
creds = pickle.load(handle) # nosec B301 - locally generated token
|
||||
|
||||
if creds and creds.expired and creds.refresh_token:
|
||||
creds.refresh(GoogleRequest())
|
||||
with open(token_file, 'wb') as handle:
|
||||
pickle.dump(creds, handle)
|
||||
os.chmod(token_file, 0o600)
|
||||
|
||||
if not creds or not creds.valid:
|
||||
return jsonify({
|
||||
'status': 'error',
|
||||
'message': ('Stored Google credentials are no longer valid. '
|
||||
'Run Step 2 again to re-authenticate.')
|
||||
}), 400
|
||||
|
||||
service = build_google_service('calendar', 'v3', credentials=creds)
|
||||
entries = service.calendarList().list().execute().get('items', [])
|
||||
|
||||
calendars = [{
|
||||
'id': entry.get('id'),
|
||||
# The picker labels each row with summary and falls back to the id
|
||||
# only in its own display, so send something either way.
|
||||
'summary': entry.get('summary') or entry.get('id'),
|
||||
'primary': bool(entry.get('primary', False)),
|
||||
} for entry in entries if entry.get('id')]
|
||||
|
||||
# Primary first, then alphabetically: the list is usually short but the
|
||||
# one the user wants is almost always their own calendar.
|
||||
calendars.sort(key=lambda c: (not c['primary'], c['summary'].lower()))
|
||||
|
||||
return jsonify({'status': 'success', 'calendars': calendars})
|
||||
|
||||
except Exception as e:
|
||||
logger.error('Error in list_calendar_calendars', exc_info=True)
|
||||
return jsonify({'status': 'error',
|
||||
'message': 'An error occurred; see logs for details',
|
||||
'details': describe_exception(e)}), 500
|
||||
|
||||
|
||||
@api_v3.route('/plugins/assets/delete', methods=['POST'])
|
||||
def delete_plugin_asset():
|
||||
"""Delete an asset file for a plugin"""
|
||||
|
||||
@@ -0,0 +1,167 @@
|
||||
/**
|
||||
* Google OAuth Widget
|
||||
*
|
||||
* Step 2 of the calendar plugin's setup, between uploading the OAuth client
|
||||
* file and picking calendars. Google will not let a headless device complete
|
||||
* consent on its own, so the flow is necessarily two calls with a human in
|
||||
* between:
|
||||
*
|
||||
* 1. POST /api/v3/plugins/calendar/authenticate with no body
|
||||
* -> { auth_url } to open in a browser
|
||||
* 2. the browser lands on a loopback address that fails to load; its URL
|
||||
* carries the authorization code. POST it back as redirect_url
|
||||
* -> the server exchanges it and writes token.pickle
|
||||
*
|
||||
* The failed page in step 2 is expected and is worth saying out loud, because
|
||||
* it looks exactly like something went wrong.
|
||||
*
|
||||
* @module GoogleOAuthWidget
|
||||
*/
|
||||
|
||||
(function () {
|
||||
'use strict';
|
||||
|
||||
if (typeof window.LEDMatrixWidgets === 'undefined') {
|
||||
console.error('[GoogleOAuthWidget] LEDMatrixWidgets registry not found. Load registry.js first.');
|
||||
return;
|
||||
}
|
||||
|
||||
const ENDPOINT = '/api/v3/plugins/calendar/authenticate';
|
||||
|
||||
window.LEDMatrixWidgets.register('google-oauth', {
|
||||
name: 'Google OAuth Widget',
|
||||
version: '1.0.0',
|
||||
|
||||
/**
|
||||
* @param {HTMLElement} container
|
||||
* @param {Object} config - schema config (unused)
|
||||
* @param {*} value - unused; this widget stores nothing
|
||||
* @param {Object} options - { fieldId, pluginId, name }
|
||||
*/
|
||||
render: function (container, config, value, options) {
|
||||
const fieldId = options.fieldId;
|
||||
|
||||
// Nothing is stored in config by this step -- the result is
|
||||
// token.pickle on the device -- but the form still expects a field.
|
||||
const hidden = document.createElement('input');
|
||||
hidden.type = 'hidden';
|
||||
hidden.id = fieldId + '_hidden';
|
||||
hidden.name = options.name;
|
||||
hidden.value = value || '';
|
||||
|
||||
const startBtn = document.createElement('button');
|
||||
startBtn.type = 'button';
|
||||
startBtn.className = 'px-3 py-1.5 text-sm rounded-md bg-blue-600 hover:bg-blue-700 text-white';
|
||||
startBtn.innerHTML = '<i class="fas fa-key"></i> Connect Google Account';
|
||||
|
||||
const status = document.createElement('p');
|
||||
status.className = 'text-xs text-gray-400 mt-2';
|
||||
|
||||
const step2 = document.createElement('div');
|
||||
step2.className = 'mt-3 hidden';
|
||||
|
||||
const link = document.createElement('a');
|
||||
link.target = '_blank';
|
||||
link.rel = 'noopener noreferrer';
|
||||
link.className = 'text-blue-400 underline text-sm break-all';
|
||||
link.textContent = 'Open the Google consent screen';
|
||||
|
||||
const hint = document.createElement('p');
|
||||
hint.className = 'text-xs text-gray-400 mt-2';
|
||||
hint.textContent =
|
||||
'After approving, your browser will try to open a page that fails '
|
||||
+ 'to load. That is expected. Copy its full address from the bar '
|
||||
+ 'and paste it below.';
|
||||
|
||||
const codeInput = document.createElement('input');
|
||||
codeInput.type = 'text';
|
||||
codeInput.placeholder = 'http://127.0.0.1/?code=...';
|
||||
codeInput.className =
|
||||
'mt-2 block w-full px-3 py-2 text-sm border border-gray-600 '
|
||||
+ 'rounded-md bg-gray-800 text-gray-100';
|
||||
|
||||
const finishBtn = document.createElement('button');
|
||||
finishBtn.type = 'button';
|
||||
finishBtn.className = 'mt-2 px-3 py-1.5 text-sm rounded-md bg-green-600 hover:bg-green-700 text-white';
|
||||
finishBtn.innerHTML = '<i class="fas fa-check"></i> Finish Authentication';
|
||||
|
||||
function say(message, kind) {
|
||||
status.textContent = message;
|
||||
status.className = 'text-xs mt-2 ' + (
|
||||
kind === 'error' ? 'text-red-400'
|
||||
: kind === 'success' ? 'text-green-400'
|
||||
: 'text-gray-400');
|
||||
}
|
||||
|
||||
function post(body) {
|
||||
return fetch(ENDPOINT, {
|
||||
method: 'POST',
|
||||
headers: { 'Content-Type': 'application/json' },
|
||||
body: JSON.stringify(body || {})
|
||||
}).then(function (r) {
|
||||
return r.json().catch(function () {
|
||||
// A non-JSON body here means the request never reached
|
||||
// the handler -- worth saying so rather than "undefined".
|
||||
return { status: 'error', message: 'Server returned ' + r.status };
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
startBtn.addEventListener('click', function () {
|
||||
startBtn.disabled = true;
|
||||
say('Requesting a consent link...');
|
||||
post({}).then(function (data) {
|
||||
startBtn.disabled = false;
|
||||
if (data.status !== 'success' || !data.auth_url) {
|
||||
say(data.message || 'Could not start authentication.', 'error');
|
||||
return;
|
||||
}
|
||||
link.href = data.auth_url;
|
||||
step2.classList.remove('hidden');
|
||||
say(data.message || 'Open the link, approve, then paste the address back.');
|
||||
}).catch(function (err) {
|
||||
startBtn.disabled = false;
|
||||
say('Request failed: ' + err.message, 'error');
|
||||
});
|
||||
});
|
||||
|
||||
finishBtn.addEventListener('click', function () {
|
||||
const pasted = codeInput.value.trim();
|
||||
if (!pasted) {
|
||||
say('Paste the address your browser was redirected to.', 'error');
|
||||
return;
|
||||
}
|
||||
finishBtn.disabled = true;
|
||||
say('Exchanging the code with Google...');
|
||||
post({ redirect_url: pasted }).then(function (data) {
|
||||
finishBtn.disabled = false;
|
||||
if (data.status !== 'success') {
|
||||
say(data.message || 'Authentication failed.', 'error');
|
||||
return;
|
||||
}
|
||||
say(data.message || 'Authenticated.', 'success');
|
||||
step2.classList.add('hidden');
|
||||
codeInput.value = '';
|
||||
}).catch(function (err) {
|
||||
finishBtn.disabled = false;
|
||||
say('Request failed: ' + err.message, 'error');
|
||||
});
|
||||
});
|
||||
|
||||
step2.appendChild(link);
|
||||
step2.appendChild(hint);
|
||||
step2.appendChild(codeInput);
|
||||
step2.appendChild(finishBtn);
|
||||
|
||||
container.appendChild(hidden);
|
||||
container.appendChild(startBtn);
|
||||
container.appendChild(status);
|
||||
container.appendChild(step2);
|
||||
},
|
||||
|
||||
getValue: function (fieldId) {
|
||||
const hidden = document.getElementById(fieldId + '_hidden');
|
||||
return hidden ? hidden.value : '';
|
||||
}
|
||||
});
|
||||
})();
|
||||
@@ -987,6 +987,7 @@
|
||||
<script src="{{ url_for('static', filename='v3/js/widgets/custom-feeds.js') }}" defer></script>
|
||||
<script src="{{ url_for('static', filename='v3/js/widgets/array-table.js') }}" defer></script>
|
||||
<script src="{{ url_for('static', filename='v3/js/widgets/google-calendar-picker.js') }}" defer></script>
|
||||
<script src="{{ url_for('static', filename='v3/js/widgets/google-oauth.js') }}" defer></script>
|
||||
<script src="{{ url_for('static', filename='v3/js/widgets/day-selector.js') }}" defer></script>
|
||||
<script src="{{ url_for('static', filename='v3/js/widgets/time-range.js') }}" defer></script>
|
||||
<script src="{{ url_for('static', filename='v3/js/widgets/time-picker.js') }}" defer></script>
|
||||
|
||||
Reference in New Issue
Block a user