Replace Supabase Postgres refresh-token storage with an encrypted cookie

Supabase connectivity didn't work out (this sandbox also can't reach
port 5432 directly, and the pooler swap didn't resolve it either).
Per user's direction, drop the Postgres dependency entirely and store
the Google refresh_token in a long-lived, Fernet-encrypted browser
cookie instead (extra-streamlit-components' CookieManager, since
Streamlit page code has no direct access to set real HttpOnly
cookies). Trade-off vs. the DB approach: this is per-browser/device,
not centrally keyed by account -- a new device still needs to click
Connect Drive once. The cookie only ever holds ciphertext; the
decryption key stays server-side in secrets and never reaches the
browser.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/cookie_token_store.py

@@ -0,0 +1,46 @@
+import hashlib
+from datetime import datetime, timedelta, timezone
+
+import extra_streamlit_components as stx
+import streamlit as st
+from cryptography.fernet import Fernet
+
+_COOKIE_MAX_AGE_DAYS = 400  # ~ the longest lifetime browsers allow anyway (Chrome caps at 400 days)
+
+
+@st.cache_resource
+def _cookie_manager() -> stx.CookieManager:
+    return stx.CookieManager(key="bgt_cookie_manager")
+
+
+def _fernet() -> Fernet:
+    return Fernet(st.secrets["cookies"]["encryption_key"])
+
+
+def _cookie_name(email: str) -> str:
+    # cookie-name must be a valid HTTP token, so hash the email rather than use it raw.
+    return "bgt_rt_" + hashlib.sha256(email.encode()).hexdigest()[:16]
+
+
+def save_refresh_token(email: str, refresh_token: str) -> None:
+    encrypted = _fernet().encrypt(refresh_token.encode()).decode()
+    expires_at = datetime.now(timezone.utc) + timedelta(days=_COOKIE_MAX_AGE_DAYS)
+    _cookie_manager().set(
+        _cookie_name(email), encrypted, expires_at=expires_at, key=f"set_{_cookie_name(email)}"
+    )
+
+
+def get_refresh_token(email: str) -> str | None:
+    encrypted = _cookie_manager().get(_cookie_name(email))
+    if not encrypted:
+        return None
+    try:
+        return _fernet().decrypt(encrypted.encode()).decode()
+    except Exception:
+        return None
+
+
+def delete_refresh_token(email: str) -> None:
+    name = _cookie_name(email)
+    if _cookie_manager().get(name) is not None:
+        _cookie_manager().delete(name, key=f"delete_{name}")

src/token_store.py

@@ -1,59 +0,0 @@
-import psycopg2
-import streamlit as st
-from cryptography.fernet import Fernet
-
-_TABLE_DDL = """
-CREATE TABLE IF NOT EXISTS user_refresh_tokens (
-    email TEXT PRIMARY KEY,
-    encrypted_refresh_token TEXT NOT NULL,
-    updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
-)
-"""
-
-
-@st.cache_resource
-def _get_conn():
-    conn = psycopg2.connect(st.secrets["supabase"]["db_url"])
-    conn.autocommit = True
-    with conn.cursor() as cur:
-        cur.execute(_TABLE_DDL)
-    return conn
-
-
-def _fernet() -> Fernet:
-    return Fernet(st.secrets["supabase"]["encryption_key"])
-
-
-def save_refresh_token(email: str, refresh_token: str) -> None:
-    encrypted = _fernet().encrypt(refresh_token.encode()).decode()
-    conn = _get_conn()
-    with conn.cursor() as cur:
-        cur.execute(
-            """
-            INSERT INTO user_refresh_tokens (email, encrypted_refresh_token, updated_at)
-            VALUES (%s, %s, now())
-            ON CONFLICT (email) DO UPDATE
-                SET encrypted_refresh_token = EXCLUDED.encrypted_refresh_token,
-                    updated_at = now()
-            """,
-            (email, encrypted),
-        )
-
-
-def get_refresh_token(email: str) -> str | None:
-    conn = _get_conn()
-    with conn.cursor() as cur:
-        cur.execute(
-            "SELECT encrypted_refresh_token FROM user_refresh_tokens WHERE email = %s",
-            (email,),
-        )
-        row = cur.fetchone()
-    if row is None:
-        return None
-    return _fernet().decrypt(row[0].encode()).decode()
-
-
-def delete_refresh_token(email: str) -> None:
-    conn = _get_conn()
-    with conn.cursor() as cur:
-        cur.execute("DELETE FROM user_refresh_tokens WHERE email = %s", (email,))