Switch Sheets persistence to per-user OAuth instead of a service account

Service accounts have zero Drive storage quota, so they can never
create a new file (even in a folder shared with them) -- confirmed by
testing the raw Drive API directly. Instead, request the drive.file
scope during Google login and expose the resulting access token via
Streamlit's expose_tokens=["access"], so each user's own account
creates and owns their spreadsheet directly. Drops the service
account, shared folder, and index-spreadsheet machinery entirely.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -23,21 +23,30 @@ forums](https://discuss.streamlit.io).
 
 The app works fully anonymously with no setup. Logging in with Google (button
 in the sidebar) additionally persists your players and round history to a
-Google Sheet owned by a service account.
+Google Sheet -- created directly in **your own Drive**, owned by you.
+
+There's no service account and no shared storage involved: Streamlit's login
+requests the `drive.file` scope alongside identity, so the app gets a
+short-lived OAuth token that lets it create/edit only the one spreadsheet it
+creates for you (`BoardGameTracker - {your email}`), nothing else in your
+Drive. Because it's created by your own account, it uses your own storage --
+there's no "service account has 0 storage quota" issue to work around.
+
+Trade-off: since the app stays in Google's "Testing" publishing status
+(no Google security review needed for a small friend group), each person who
+wants to log in must first be added as a **test user** in the OAuth consent
+screen, and will see an "unverified app" warning the first time they
+click through.
 
 ### One-time Google Cloud setup
-1. Enable the **Google Sheets API** and **Google Drive API** on a GCP project.
-2. Create an OAuth 2.0 **Web application** Client ID for login; add your
-   app's URL(s) as authorized redirect URIs (e.g. `http://localhost:8501` for
-   local dev).
-3. Create a **Service Account**, download its JSON key. Service accounts have
-   no Drive storage quota of their own, so:
-   - Create a folder in a real Google Drive account, share it with the
-     service account's `client_email` as **Editor**, and copy the folder ID
-     from its URL. This becomes `shared_folder_id` below.
-4. Run the one-time index-spreadsheet creation (see `src/sheets_backend.py`,
-   `get_or_create_user_workbook` needs an index spreadsheet — create one via
-   the service account inside the shared folder and note its ID).
+1. Create an OAuth 2.0 **Web application** Client ID; add your app's URL(s)
+   as authorized redirect URIs (e.g. `http://localhost:8501` for local dev).
+2. On the OAuth consent screen, add every player's Google account email
+   under **Test users** (keep publishing status as "Testing" -- this avoids
+   Google's verification review entirely for `drive.file`, a scope that
+   only grants access to files the app itself creates).
+3. No service account, no Sheets/Drive API project-level enablement, no
+   index spreadsheet -- the app's own OAuth client handles everything.
 
 ### Local dev — `.streamlit/secrets.toml` (gitignored, never commit this)
 ```toml
@@ -47,23 +56,16 @@ cookie_secret = "<random string>"
 client_id = "<oauth client id>"
 client_secret = "<oauth client secret>"
 server_metadata_url = "https://accounts.google.com/.well-known/openid-configuration"
+expose_tokens = ["access"]
 
-[gcp_service_account]
-# ...full service account JSON fields...
-
-[sheets]
-index_spreadsheet_id = "<id of the index spreadsheet>"
-shared_folder_id = "<id of the Drive folder shared with the service account>"
+[auth.client_kwargs]
+scope = "openid email profile https://www.googleapis.com/auth/drive.file"
+prompt = "consent select_account"
 ```
 
 ### Hugging Face Space deploy
 `st.login()` only reads `st.secrets`, so `src/bootstrap_secrets.py` assembles
 `.streamlit/secrets.toml` at startup from individual Space secrets (Settings →
 Variables and secrets), so nothing sensitive needs to live in the repo or the
-image:
-
-`AUTH_CLIENT_ID`, `AUTH_CLIENT_SECRET`, `AUTH_COOKIE_SECRET`,
-`AUTH_REDIRECT_URI` (your Space's public URL), `GCP_PROJECT_ID`,
-`GCP_PRIVATE_KEY_ID`, `GCP_PRIVATE_KEY` (paste with literal `\n` for
-newlines), `GCP_CLIENT_EMAIL`, `GCP_CLIENT_ID`, `GCP_CLIENT_X509_CERT_URL`,
-`SHEETS_INDEX_ID`, `SHEETS_SHARED_FOLDER_ID`.
+image: `AUTH_CLIENT_ID`, `AUTH_CLIENT_SECRET`, `AUTH_COOKIE_SECRET`,
+`AUTH_REDIRECT_URI` (your Space's public URL).

pages/points_tracker.py

@@ -26,8 +26,13 @@ def _get_workbook():
     """Returns the logged-in user's Sheets workbook, or None for anonymous sessions."""
     if "auth" not in st.secrets or not st.user.is_logged_in:
         return None
+    access_token = st.user.tokens.get("access")
+    if not access_token:
+        return None
     if "pt_workbook" not in st.session_state:
-        st.session_state.pt_workbook = sheets.get_or_create_user_workbook(st.user.email)
+        st.session_state.pt_workbook = sheets.get_or_create_user_workbook(
+            access_token, st.user.email
+        )
     return st.session_state.pt_workbook
 
 

src/bootstrap_secrets.py

@@ -5,6 +5,8 @@ import tomli_w
 
 _SECRETS_PATH = Path(".streamlit/secrets.toml")
 
+_DRIVE_FILE_SCOPE = "https://www.googleapis.com/auth/drive.file"
+
 
 def ensure_secrets_file() -> None:
     if _SECRETS_PATH.exists() or "AUTH_CLIENT_ID" not in os.environ:
@@ -18,23 +20,11 @@ def ensure_secrets_file() -> None:
             "client_id": os.environ["AUTH_CLIENT_ID"],
             "client_secret": os.environ["AUTH_CLIENT_SECRET"],
             "server_metadata_url": "https://accounts.google.com/.well-known/openid-configuration",
-        },
-        "gcp_service_account": {
-            "type": "service_account",
-            "project_id": os.environ["GCP_PROJECT_ID"],
-            "private_key_id": os.environ["GCP_PRIVATE_KEY_ID"],
-            "private_key": os.environ["GCP_PRIVATE_KEY"].replace("\\n", "\n"),
-            "client_email": os.environ["GCP_CLIENT_EMAIL"],
-            "client_id": os.environ["GCP_CLIENT_ID"],
-            "auth_uri": "https://accounts.google.com/o/oauth2/auth",
-            "token_uri": "https://oauth2.googleapis.com/token",
-            "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs",
-            "client_x509_cert_url": os.environ["GCP_CLIENT_X509_CERT_URL"],
-            "universe_domain": "googleapis.com",
-        },
-        "sheets": {
-            "index_spreadsheet_id": os.environ["SHEETS_INDEX_ID"],
-            "shared_folder_id": os.environ.get("SHEETS_SHARED_FOLDER_ID", ""),
+            "expose_tokens": ["access"],
+            "client_kwargs": {
+                "scope": f"openid email profile {_DRIVE_FILE_SCOPE}",
+                "prompt": "consent select_account",
+            },
         },
     }
     _SECRETS_PATH.write_text(tomli_w.dumps(data))

src/sheets_backend.py

@@ -2,57 +2,37 @@ import uuid
 from datetime import datetime, timezone
 
 import gspread
-import streamlit as st
-from google.oauth2.service_account import Credentials
-
-_SCOPES = [
-    "https://www.googleapis.com/auth/spreadsheets",
-    "https://www.googleapis.com/auth/drive",
-]
+from google.oauth2.credentials import Credentials
 
 _PLAYERS_HEADER = ["player_id", "name", "created_at"]
 _GAMES_HEADER = ["timestamp", "game_name", "session_id", "round_number", "player_name", "score"]
+_WORKBOOK_TITLE_PREFIX = "BoardGameTracker"
 
 
-@st.cache_resource
-def _get_client():
-    creds = Credentials.from_service_account_info(
-        st.secrets["gcp_service_account"], scopes=_SCOPES
-    )
+def _get_user_client(access_token: str) -> gspread.Client:
+    creds = Credentials(token=access_token)
     return gspread.authorize(creds)
 
 
-def _folder_id():
-    return st.secrets["sheets"].get("shared_folder_id") or None
-
+def get_or_create_user_workbook(access_token: str, email: str) -> gspread.Spreadsheet:
+    """Returns the user's own Sheets workbook, creating it in their Drive on first use.
 
-def _get_index_ws():
-    client = _get_client()
-    sh = client.open_by_key(st.secrets["sheets"]["index_spreadsheet_id"])
-    return sh.worksheet("users")
+    Uses the user's own OAuth access token (drive.file scope), so the file is
+    owned by them directly -- no service account or shared storage involved.
+    """
+    client = _get_user_client(access_token)
+    title = f"{_WORKBOOK_TITLE_PREFIX} - {email}"
 
+    existing = client.list_spreadsheet_files(title=title)
+    if existing:
+        return client.open_by_key(existing[0]["id"])
 
-def get_or_create_user_workbook(email: str) -> gspread.Spreadsheet:
-    client = _get_client()
-    index_ws = _get_index_ws()
-    rows = index_ws.get_all_records()
-    for row in rows:
-        if row.get("email") == email:
-            return client.open_by_key(row["spreadsheet_id"])
-
-    sh = client.create(f"BoardGameTracker - {email}", folder_id=_folder_id())
+    sh = client.create(title)
     players_ws = sh.sheet1
     players_ws.update_title("players")
     players_ws.append_row(_PLAYERS_HEADER)
     games_ws = sh.add_worksheet(title="games_played", rows=1, cols=len(_GAMES_HEADER))
     games_ws.append_row(_GAMES_HEADER)
-
-    try:
-        sh.share(email, perm_type="user", role="writer")
-    except gspread.exceptions.APIError:
-        pass  # sharing is a nice-to-have; don't block provisioning on it
-
-    index_ws.append_row([email, sh.id, sh.url, datetime.now(timezone.utc).isoformat()])
     return sh