id       = "oauth2l"
name     = "oauth2l"
homepage = "https://github.com/google/oauth2l"
description = "A command-line tool for Google OAuth 2.0 authentication."
executables   = ["oauth2l"]

[dotfiles]

# The official oauth2l README says retrieved OAuth tokens are cached in
# ~/.oauth2l by default; --cache can override it. The cache contains bearer
# tokens, so the fixed default is a whole-file secret.
# https://github.com/google/oauth2l#oauth2l
paths = []
exclude = []
secret = ["~/.oauth2l"]
side_effect = false

[commands]
format = 1
label = "OAuth 2.0 tokens for Google APIs"
description = "Fetch access tokens or an Authorization header. Other commands (curl, info, test, reset) and STS/impersonation options are left out."
quality = "ai-draft"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = false, short_bundles = false }

[[commands.subcommand]]
path = ["fetch"]
label = "Fetch an access token"

[[commands.subcommand.source]]
id = "readme"
kind = "help"
url = "https://github.com/google/oauth2l/blob/master/README.md"
revision = "master"
evidence = '''
$ oauth2l fetch --credentials ~/your_credentials.json --scope cloud-platform
$ oauth2l fetch --scope userinfo.email,cloud-platform
$ oauth2l header --scope cloud-platform
$ oauth2l fetch --type jwt --credentials ~/service_account.json --audience https://pubsub.googleapis.com/
$ oauth2l fetch --cache ~/different_path/.oauth2l --scope cloud-platform
$ oauth2l fetch --credentials ~/client_credentials.json --scope cloud-platform --refresh
$ oauth2l fetch --type sso --email me@google.com --scope cloud-platform
The authentication type. The currently supported types are "oauth", "jwt", or "sso". Defaults to "oauth".
### fetch --output_format
Token's output format for "fetch" command. One of bare, header, json, json_compact, pretty, or refresh_token. Default is bare.
$ oauth2l fetch --output_format pretty --scope cloud-platform
$ oauth2l info --token $(oauth2l fetch --scope pubsub)
'''

[[commands.subcommand.field]]
id = "credentials"
label = "Credentials JSON"
type = "path"
option = ["--credentials"]
path = { kind = "file", role = "input", must_exist = true }
sources = ["readme"]

[[commands.subcommand.field]]
id = "scope"
label = "Scopes"
type = "string"
option = ["--scope"]
description = "Comma-separated, no spaces, e.g. cloud-platform,pubsub."
sources = ["readme"]

[[commands.subcommand.field]]
id = "type"
label = "Authentication type"
type = "enum"
option = ["--type"]
choices = [{ value = "oauth", label = "OAuth" }, { value = "jwt", label = "JWT" }, { value = "sso", label = "SSO" }]
sources = ["readme"]

[[commands.subcommand.field]]
id = "audience"
label = "Audience (JWT)"
type = "url"
option = ["--audience"]
sources = ["readme"]

[[commands.subcommand.field]]
id = "email"
label = "Email (SSO or delegation)"
type = "string"
option = ["--email"]
sources = ["readme"]

[[commands.subcommand.field]]
id = "cache"
label = "Cache file"
type = "path"
option = ["--cache"]
path = { kind = "file", role = "output", must_exist = false }
sources = ["readme"]

[[commands.subcommand.field]]
id = "refresh"
label = "Refresh cached token"
type = "boolean"
option = ["--refresh"]
sources = ["readme"]

[[commands.subcommand.field]]
id = "output_format"
label = "Output format"
type = "enum"
option = ["--output_format"]
choices = [{ value = "bare", label = "Bare" }, { value = "header", label = "Header" }, { value = "json", label = "JSON" }, { value = "json_compact", label = "Compact JSON" }, { value = "pretty", label = "Pretty" }, { value = "refresh_token", label = "Refresh token" }]
sources = ["readme"]

[[commands.subcommand.task]]
id = "fetch_basic"
label = "Fetch an access token"
fields = ["credentials", "scope"]
required = ["scope"]

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["credentials", "scope", "type", "output_format"]

[[commands.subcommand.group]]
id = "advanced"
label = "Advanced"
fields = ["audience", "email", "cache", "refresh"]

[[commands.subcommand]]
path = ["header"]
label = "Print an Authorization header"

[[commands.subcommand.source]]
id = "readme"
kind = "help"
url = "https://github.com/google/oauth2l/blob/master/README.md"
revision = "master"
evidence = '''
$ oauth2l fetch --credentials ~/your_credentials.json --scope cloud-platform
$ oauth2l fetch --scope userinfo.email,cloud-platform
$ oauth2l header --scope cloud-platform
$ oauth2l fetch --type jwt --credentials ~/service_account.json --audience https://pubsub.googleapis.com/
$ oauth2l fetch --cache ~/different_path/.oauth2l --scope cloud-platform
$ oauth2l fetch --credentials ~/client_credentials.json --scope cloud-platform --refresh
$ oauth2l fetch --type sso --email me@google.com --scope cloud-platform
The authentication type. The currently supported types are "oauth", "jwt", or "sso". Defaults to "oauth".
### fetch --output_format
Token's output format for "fetch" command. One of bare, header, json, json_compact, pretty, or refresh_token. Default is bare.
$ oauth2l fetch --output_format pretty --scope cloud-platform
$ oauth2l info --token $(oauth2l fetch --scope pubsub)
'''

[[commands.subcommand.field]]
id = "credentials"
label = "Credentials JSON"
type = "path"
option = ["--credentials"]
path = { kind = "file", role = "input", must_exist = true }
sources = ["readme"]

[[commands.subcommand.field]]
id = "scope"
label = "Scopes"
type = "string"
option = ["--scope"]
description = "Comma-separated, no spaces, e.g. cloud-platform,pubsub."
sources = ["readme"]

[[commands.subcommand.field]]
id = "type"
label = "Authentication type"
type = "enum"
option = ["--type"]
choices = [{ value = "oauth", label = "OAuth" }, { value = "jwt", label = "JWT" }, { value = "sso", label = "SSO" }]
sources = ["readme"]

[[commands.subcommand.field]]
id = "audience"
label = "Audience (JWT)"
type = "url"
option = ["--audience"]
sources = ["readme"]

[[commands.subcommand.field]]
id = "email"
label = "Email (SSO or delegation)"
type = "string"
option = ["--email"]
sources = ["readme"]

[[commands.subcommand.field]]
id = "cache"
label = "Cache file"
type = "path"
option = ["--cache"]
path = { kind = "file", role = "output", must_exist = false }
sources = ["readme"]

[[commands.subcommand.field]]
id = "refresh"
label = "Refresh cached token"
type = "boolean"
option = ["--refresh"]
sources = ["readme"]

[[commands.subcommand.task]]
id = "header_basic"
label = "Print an Authorization header"
fields = ["credentials", "scope"]
required = ["scope"]

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["credentials", "scope", "type"]

[[commands.subcommand.group]]
id = "advanced"
label = "Advanced"
fields = ["audience", "email", "cache", "refresh"]