Add saved-players/game-history tabs and persistent Drive access via Supabase

- Points Tracker setup now has New Game / Saved Players / Game History
tabs. Game name is picked from history (with a + New game name
fallback) instead of always free-typed; Saved Players and Game
History are read-only browsers backed by sheets_backend.list_players
and the new list_game_names helper.

- st.login() alone can never give us a refresh_token -- Streamlit's
own _auth_callback discards anything but id_token/access_token
before user code runs. Added a separate, one-time Connect Google
Drive flow (src/google_oauth.py) using access_type=offline plus
prompt=consent to force Google to issue one, and store it Fernet-
encrypted in a Supabase Postgres table (src/token_store.py). On
every subsequent login, app.py silently redeems a fresh access
token from the stored refresh_token -- no repeat consent screen.
Falls back to showing the Connect Drive button only when no valid
session token and no usable stored refresh_token exist, and clears
a revoked/invalid stored token instead of looping.

- Simplified [auth] secrets back to identity-only defaults now that
Drive scope/consent lives entirely in the new flow; added a
[supabase] secrets section (db_url, encryption_key).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app.py

@@ -1,4 +1,6 @@
 import sys
+import uuid
+from datetime import datetime, timedelta, timezone
 from pathlib import Path
 
 sys.path.insert(0, str(Path(__file__).parent / "src"))
@@ -9,8 +11,96 @@ ensure_secrets_file()
 
 import streamlit as st
 
+import google_oauth
+import token_store
+
 st.set_page_config(page_title="Board Game Tracker", layout="wide")
 
+
+def _drive_redirect_uri() -> str:
+    return st.secrets["auth"]["redirect_uri"].removesuffix("/oauth2callback")
+
+
+def _store_access_token(tokens: dict) -> None:
+    st.session_state["google_access_token"] = tokens["access_token"]
+    expires_in = tokens.get("expires_in", 3600)
+    st.session_state["google_access_token_expires_at"] = datetime.now(
+        timezone.utc
+    ) + timedelta(seconds=expires_in - 60)
+
+
+def _access_token_valid() -> bool:
+    expires_at = st.session_state.get("google_access_token_expires_at")
+    return (
+        bool(st.session_state.get("google_access_token"))
+        and expires_at is not None
+        and datetime.now(timezone.utc) < expires_at
+    )
+
+
+def _handle_drive_oauth_callback() -> None:
+    """Completes the one-time "Connect Google Drive" exchange, if we're mid-flow."""
+    if not st.user.is_logged_in:
+        return
+    code = st.query_params.get("code")
+    state = st.query_params.get("state")
+    if not code or not state or state != st.session_state.get("drive_oauth_state"):
+        return
+
+    st.session_state.pop("drive_oauth_state", None)
+    try:
+        tokens = google_oauth.exchange_code(
+            st.secrets["auth"]["client_id"],
+            st.secrets["auth"]["client_secret"],
+            _drive_redirect_uri(),
+            code,
+        )
+    except Exception:
+        st.query_params.clear()
+        st.error("Failed to connect Google Drive. Please try again.")
+        return
+
+    refresh_token = tokens.get("refresh_token")
+    if refresh_token and "supabase" in st.secrets:
+        token_store.save_refresh_token(st.user.email, refresh_token)
+    _store_access_token(tokens)
+    st.query_params.clear()
+    st.rerun()
+
+
+def _ensure_drive_access() -> None:
+    """Populates session_state's Drive access token, silently refreshing from a
+    stored refresh_token when possible. Shows a one-time "Connect Google Drive"
+    link only when neither a live token nor a stored refresh_token exists.
+    """
+    if not st.user.is_logged_in or _access_token_valid():
+        return
+
+    if "supabase" in st.secrets:
+        refresh_token = token_store.get_refresh_token(st.user.email)
+        if refresh_token:
+            try:
+                tokens = google_oauth.refresh_access_token(
+                    st.secrets["auth"]["client_id"],
+                    st.secrets["auth"]["client_secret"],
+                    refresh_token,
+                )
+                _store_access_token(tokens)
+                return
+            except Exception:
+                token_store.delete_refresh_token(st.user.email)
+
+    state = uuid.uuid4().hex
+    st.session_state["drive_oauth_state"] = state
+    authorize_url = google_oauth.build_authorize_url(
+        st.secrets["auth"]["client_id"], _drive_redirect_uri(), state
+    )
+    st.link_button("Connect Google Drive", authorize_url)
+
+
+if "auth" in st.secrets:
+    _handle_drive_oauth_callback()
+
 with st.sidebar:
     if "auth" not in st.secrets:
         pass  # no auth configured in this environment; app stays anonymous-only
@@ -19,6 +109,7 @@ with st.sidebar:
     else:
         st.caption(f"Logged in as {st.user.email}")
         st.button("Log out", on_click=st.logout)
+        _ensure_drive_access()
 
 home_page = st.Page("pages/home.py", title="Home", url_path="home", default=True)
 skull_king_page = st.Page("pages/skull_king.py", title="Skull King", url_path="skull_king")

pages/points_tracker.py

@@ -26,7 +26,7 @@ def _get_workbook():
     """Returns the logged-in user's Sheets workbook, or None for anonymous sessions."""
     if "auth" not in st.secrets or not st.user.is_logged_in:
         return None
-    access_token = st.user.tokens.get("access")
+    access_token = st.session_state.get("google_access_token")
     if not access_token:
         return None
     if "pt_workbook" not in st.session_state:
@@ -36,14 +36,37 @@ def _get_workbook():
     return st.session_state.pt_workbook
 
 
-def _setup_phase():
+_NEW_GAME_NAME_SENTINEL = "+ New game name"
+
+
+def _game_name_picker(wb):
+    past_names = sheets.list_game_names(wb) if wb is not None else []
+    if not past_names:
+        st.session_state.pt_game_name = st.text_input(
+            "Game name (optional)",
+            value=st.session_state.pt_game_name,
+            placeholder="e.g. Catan, Ticket to Ride…",
+        )
+        return
+
+    options = past_names + [_NEW_GAME_NAME_SENTINEL]
+    current = st.session_state.pt_game_name
+    default_index = options.index(current) if current in options else len(options) - 1
+    choice = st.selectbox("Game name (optional)", options, index=default_index)
+    if choice == _NEW_GAME_NAME_SENTINEL:
+        st.session_state.pt_game_name = st.text_input(
+            "New game name",
+            value="" if current in past_names else current,
+            placeholder="e.g. Catan, Ticket to Ride…",
+        )
+    else:
+        st.session_state.pt_game_name = choice
+
+
+def _render_new_game_tab(wb):
     st.subheader("Game Setup")
 
-    st.session_state.pt_game_name = st.text_input(
-        "Game name (optional)",
-        value=st.session_state.pt_game_name,
-        placeholder="e.g. Catan, Ticket to Ride…",
-    )
+    _game_name_picker(wb)
 
     st.session_state.pt_winning_score = st.number_input(
         "Winning score (points to win)",
@@ -58,7 +81,6 @@ def _setup_phase():
         name = st.session_state.pt_new_player.strip()
         if name and name not in st.session_state.pt_players:
             st.session_state.pt_players.append(name)
-            wb = _get_workbook()
             if wb is not None:
                 sheets.add_player(wb, name)
         st.session_state.pt_new_player = ""
@@ -71,7 +93,6 @@ def _setup_phase():
         st.write("")
         st.button("Add Player", key="pt_add_btn", on_click=_add_player)
 
-    wb = _get_workbook()
     if wb is not None:
         saved_names = [p["name"] for p in sheets.list_players(wb) if p.get("name")]
         remaining = [n for n in saved_names if n not in st.session_state.pt_players]
@@ -102,6 +123,44 @@ def _setup_phase():
         st.info("Add at least 2 players to start.")
 
 
+def _render_saved_players_tab(wb):
+    st.subheader("Saved Players")
+    if wb is None:
+        st.info("Log in with Google to see your saved players.")
+        return
+    players = sheets.list_players(wb)
+    if not players:
+        st.caption("No saved players yet -- add one in the New Game tab.")
+        return
+    df = pd.DataFrame(players)[["name", "created_at"]]
+    st.dataframe(df, hide_index=True, width="stretch")
+
+
+def _render_game_history_tab(wb):
+    st.subheader("Game History")
+    if wb is None:
+        st.info("Log in with Google to see your game history.")
+        return
+    names = sheets.list_game_names(wb)
+    if not names:
+        st.caption("No games recorded yet.")
+        return
+    for name in names:
+        st.write(f"- {name}")
+
+
+def _setup_phase():
+    wb = _get_workbook()
+    tab_new, tab_players, tab_history = st.tabs(["New Game", "Saved Players", "Game History"])
+
+    with tab_new:
+        _render_new_game_tab(wb)
+    with tab_players:
+        _render_saved_players_tab(wb)
+    with tab_history:
+        _render_game_history_tab(wb)
+
+
 def _compute_cumulative(players, scores):
     cumsum = {p: 0 for p in players}
     history = []

requirements.txt

@@ -6,3 +6,6 @@ google-auth
 Authlib
 httpx
 tomli_w
+psycopg2-binary
+cryptography
+requests

src/bootstrap_secrets.py

@@ -5,8 +5,6 @@ import tomli_w
 
 _SECRETS_PATH = Path(".streamlit/secrets.toml")
 
-_DRIVE_FILE_SCOPE = "https://www.googleapis.com/auth/drive.file"
-
 
 def ensure_secrets_file() -> None:
     if _SECRETS_PATH.exists() or "AUTH_CLIENT_ID" not in os.environ:
@@ -20,11 +18,10 @@ def ensure_secrets_file() -> None:
             "client_id": os.environ["AUTH_CLIENT_ID"],
             "client_secret": os.environ["AUTH_CLIENT_SECRET"],
             "server_metadata_url": "https://accounts.google.com/.well-known/openid-configuration",
-            "expose_tokens": ["access"],
-            "client_kwargs": {
-                "scope": f"openid email profile {_DRIVE_FILE_SCOPE}",
-                "prompt": "consent select_account",
-            },
+        },
+        "supabase": {
+            "db_url": os.environ["SUPABASE_DB_URL"],
+            "encryption_key": os.environ["SUPABASE_ENCRYPTION_KEY"],
         },
     }
     _SECRETS_PATH.write_text(tomli_w.dumps(data))

src/google_oauth.py

@@ -0,0 +1,64 @@
+from urllib.parse import urlencode
+
+import requests
+
+_AUTHORIZE_URL = "https://accounts.google.com/o/oauth2/v2/auth"
+_TOKEN_URL = "https://oauth2.googleapis.com/token"
+_DRIVE_FILE_SCOPE = "https://www.googleapis.com/auth/drive.file"
+
+
+def build_authorize_url(client_id: str, redirect_uri: str, state: str) -> str:
+    """Builds the Google consent-screen URL for the one-time Drive connection.
+
+    access_type=offline + prompt=consent force Google to include a
+    refresh_token in the token response, even for a client that has been
+    authorized before.
+    """
+    params = {
+        "client_id": client_id,
+        "redirect_uri": redirect_uri,
+        "response_type": "code",
+        "scope": _DRIVE_FILE_SCOPE,
+        "access_type": "offline",
+        "prompt": "consent",
+        "state": state,
+    }
+    return f"{_AUTHORIZE_URL}?{urlencode(params)}"
+
+
+def exchange_code(client_id: str, client_secret: str, redirect_uri: str, code: str) -> dict:
+    """Exchanges an authorization code for tokens, including a refresh_token."""
+    response = requests.post(
+        _TOKEN_URL,
+        data={
+            "client_id": client_id,
+            "client_secret": client_secret,
+            "redirect_uri": redirect_uri,
+            "code": code,
+            "grant_type": "authorization_code",
+        },
+        timeout=10,
+    )
+    response.raise_for_status()
+    return response.json()
+
+
+def refresh_access_token(client_id: str, client_secret: str, refresh_token: str) -> dict:
+    """Mints a fresh access_token from a stored refresh_token, no browser needed.
+
+    Raises requests.HTTPError (e.g. invalid_grant) if the refresh_token has
+    been revoked -- callers should delete the stored token and prompt the
+    user to reconnect Drive.
+    """
+    response = requests.post(
+        _TOKEN_URL,
+        data={
+            "client_id": client_id,
+            "client_secret": client_secret,
+            "refresh_token": refresh_token,
+            "grant_type": "refresh_token",
+        },
+        timeout=10,
+    )
+    response.raise_for_status()
+    return response.json()

src/sheets_backend.py

@@ -41,6 +41,13 @@ def list_players(wb: gspread.Spreadsheet) -> list[dict]:
     return ws.get_all_records()
 
 
+def list_game_names(wb: gspread.Spreadsheet) -> list[str]:
+    """Distinct game names played, most-recently-used first."""
+    ws = wb.worksheet("games_played")
+    names = [row["game_name"] for row in ws.get_all_records() if row.get("game_name")]
+    return list(dict.fromkeys(reversed(names)))
+
+
 def add_player(wb: gspread.Spreadsheet, name: str) -> str:
     ws = wb.worksheet("players")
     existing = ws.get_all_records()

src/token_store.py

@@ -0,0 +1,59 @@
+import psycopg2
+import streamlit as st
+from cryptography.fernet import Fernet
+
+_TABLE_DDL = """
+CREATE TABLE IF NOT EXISTS user_refresh_tokens (
+    email TEXT PRIMARY KEY,
+    encrypted_refresh_token TEXT NOT NULL,
+    updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+)
+"""
+
+
+@st.cache_resource
+def _get_conn():
+    conn = psycopg2.connect(st.secrets["supabase"]["db_url"])
+    conn.autocommit = True
+    with conn.cursor() as cur:
+        cur.execute(_TABLE_DDL)
+    return conn
+
+
+def _fernet() -> Fernet:
+    return Fernet(st.secrets["supabase"]["encryption_key"])
+
+
+def save_refresh_token(email: str, refresh_token: str) -> None:
+    encrypted = _fernet().encrypt(refresh_token.encode()).decode()
+    conn = _get_conn()
+    with conn.cursor() as cur:
+        cur.execute(
+            """
+            INSERT INTO user_refresh_tokens (email, encrypted_refresh_token, updated_at)
+            VALUES (%s, %s, now())
+            ON CONFLICT (email) DO UPDATE
+                SET encrypted_refresh_token = EXCLUDED.encrypted_refresh_token,
+                    updated_at = now()
+            """,
+            (email, encrypted),
+        )
+
+
+def get_refresh_token(email: str) -> str | None:
+    conn = _get_conn()
+    with conn.cursor() as cur:
+        cur.execute(
+            "SELECT encrypted_refresh_token FROM user_refresh_tokens WHERE email = %s",
+            (email,),
+        )
+        row = cur.fetchone()
+    if row is None:
+        return None
+    return _fernet().decrypt(row[0].encode()).decode()
+
+
+def delete_refresh_token(email: str) -> None:
+    conn = _get_conn()
+    with conn.cursor() as cur:
+        cur.execute("DELETE FROM user_refresh_tokens WHERE email = %s", (email,))