get_refresh_token.py

"""One-time local script to obtain a Google Drive refresh token.

Run this ONCE on your laptop after downloading `client_secret.json` from GCP:

    pip install google-auth-oauthlib
    python get_refresh_token.py

A browser window will open. Log in with the Google account whose Drive you
want the thyroid initial-visit notes saved to. After consent, the script prints
three values you copy into Hugging Face Space → Settings → Variables and
secrets:

    GDRIVE_CLIENT_ID
    GDRIVE_CLIENT_SECRET
    GDRIVE_REFRESH_TOKEN

You can then delete `client_secret.json` (or keep it offline — never commit
it; .gitignore already excludes it).
"""

from __future__ import annotations

import json
import sys
from pathlib import Path

try:
    from google_auth_oauthlib.flow import InstalledAppFlow
except ImportError:
    sys.stderr.write(
        "Missing dependency. Run:\n    pip install google-auth-oauthlib\n"
    )
    sys.exit(1)

SCOPES = ["https://www.googleapis.com/auth/drive.file"]
CLIENT_SECRET_PATH = Path(__file__).parent / "client_secret.json"


def main() -> None:
    if not CLIENT_SECRET_PATH.exists():
        sys.stderr.write(
            f"client_secret.json not found at {CLIENT_SECRET_PATH}\n"
            "Download it from GCP Console → APIs & Services → Credentials → "
            "your OAuth client → DOWNLOAD JSON, then place it in this folder.\n"
        )
        sys.exit(1)

    flow = InstalledAppFlow.from_client_secrets_file(str(CLIENT_SECRET_PATH), SCOPES)
    creds = flow.run_local_server(
        port=0,
        prompt="consent",
        authorization_prompt_message="A browser window is opening for Google login...",
        success_message="Authorization complete. You can close this tab and return to the terminal.",
    )

    if not creds.refresh_token:
        sys.stderr.write(
            "No refresh_token returned. This usually means you have already authorised\n"
            "this OAuth client and Google did not re-issue one. To force a new refresh\n"
            "token, go to https://myaccount.google.com/permissions, revoke the app,\n"
            "and run this script again.\n"
        )
        sys.exit(1)

    with CLIENT_SECRET_PATH.open() as f:
        client_data = json.load(f)
    installed = client_data.get("installed") or client_data.get("web") or {}
    client_id = installed.get("client_id", "")
    client_secret = installed.get("client_secret", "")

    print()
    print("=" * 70)
    print("SUCCESS — copy these THREE values into Hugging Face Space secrets:")
    print("=" * 70)
    print()
    print(f"GDRIVE_CLIENT_ID      = {client_id}")
    print(f"GDRIVE_CLIENT_SECRET  = {client_secret}")
    print(f"GDRIVE_REFRESH_TOKEN  = {creds.refresh_token}")
    print()
    print("Optional, only if you want a fixed Drive folder name:")
    print('GDRIVE_FOLDER_NAME    = Thyroid Initial Visits   (default if unset)')
    print()
    print("Keep these secret. Anyone with the refresh_token can write to your Drive")
    print("(scoped to files this app creates only — drive.file scope).")
    print("=" * 70)


if __name__ == "__main__":
    main()