{exc}
" + "Add your client_secret.json file, then try the connect button again.
" + "" + ), + status_code=400, + ) + return RedirectResponse(url=authorization_url) + + +@router.get("/integrations/google/callback", response_class=HTMLResponse, name="google_oauth_callback") +def google_oauth_callback( + request: Request, + state: str | None = None, + error: str | None = None, + manager: GoogleAuthManager = Depends(get_google_auth_manager), +): + if error: + return HTMLResponse( + ( + "" + f"{error}
" + "You can close this tab and try again from the WiseClaw admin panel.
" + "" + ), + status_code=400, + ) + + if not state: + return HTMLResponse( + ( + "" + "Missing OAuth state.
" + "You can close this tab and try again from the WiseClaw admin panel.
" + "" + ), + status_code=400, + ) + + try: + manager.complete_web_oauth(str(request.url_for("google_oauth_callback")), state, str(request.url)) + except Exception as exc: + return HTMLResponse( + ( + "" + f"{exc}
" + "You can close this tab and try again from the WiseClaw admin panel.
" + "" + ), + status_code=400, + ) + + return HTMLResponse( + ( + "" + "WiseClaw can now use your Gmail and Google Drive tools.
" + "You can close this tab and refresh the admin panel.
" + "" + ) + ) diff --git a/backend/app/admin/services.py b/backend/app/admin/services.py index 09fcd1a..f583297 100644 --- a/backend/app/admin/services.py +++ b/backend/app/admin/services.py @@ -169,7 +169,11 @@ class AdminService: def get_secret_mask(self, key: str) -> str: record = self.session.get(SecretORM, key) - value = record.value if record else "" + if record is not None: + value = record.value + else: + settings = get_settings() + value = str(getattr(settings, key, "") or "") if len(value) < 4: return "" return f"{value[:2]}***{value[-2:]}" diff --git a/backend/app/config.py b/backend/app/config.py index 57af586..48f8430 100644 --- a/backend/app/config.py +++ b/backend/app/config.py @@ -21,7 +21,11 @@ class Settings(BaseSettings): zai_base_url: str = "https://api.z.ai/api/anthropic" zai_model: str = "glm-5" anythingllm_base_url: str = "http://127.0.0.1:3001" - anythingllm_workspace_slug: str = "wiseclaw" + anythingllm_workspace_slug: str = "benim-calisma-alanim" + google_client_secrets_file: str = ".google/client_secret.json" + google_token_file: str = ".google/token.json" + google_client_id: str = Field(default="", repr=False) + google_client_secret: str = Field(default="", repr=False) search_provider: str = "brave" telegram_bot_token: str = Field(default="", repr=False) brave_api_key: str = Field(default="", repr=False) diff --git a/backend/app/db.py b/backend/app/db.py index f0ff4d0..5976766 100644 --- a/backend/app/db.py +++ b/backend/app/db.py @@ -12,6 +12,8 @@ DEFAULT_TOOLS = { "brave_search": True, "second_brain": True, "browser_use": True, + "gmail": True, + "google_drive": True, "searxng_search": False, "web_fetch": True, "apple_notes": True, diff --git a/backend/app/google/auth.py b/backend/app/google/auth.py new file mode 100644 index 0000000..205b070 --- /dev/null +++ b/backend/app/google/auth.py @@ -0,0 +1,164 @@ +import asyncio +import json +import os +import time +from pathlib import Path + +from google.auth.transport.requests import Request +from google.oauth2.credentials import Credentials +from google_auth_oauthlib.flow import Flow + +from app.config import Settings + + +GOOGLE_SCOPES = [ + "https://www.googleapis.com/auth/gmail.readonly", + "https://www.googleapis.com/auth/drive.metadata.readonly", + "https://www.googleapis.com/auth/drive.file", +] + + +class GoogleAuthError(RuntimeError): + pass + + +_OAUTH_STATES: dict[str, float] = {} +_OAUTH_STATE_TTL_SECONDS = 900 + + +class GoogleAuthManager: + def __init__(self, settings: Settings, workspace_root: Path) -> None: + self.settings = settings + self.workspace_root = workspace_root.resolve() + + async def get_credentials(self) -> Credentials: + return await asyncio.to_thread(self._load_credentials) + + def _load_credentials(self) -> Credentials: + token_path = self.token_path + client_path = self.client_path + + if not client_path.exists(): + raise GoogleAuthError( + f"Google client secrets file is missing: {client_path}. " + "Create a Google OAuth Web Application and place its JSON here." + ) + if not token_path.exists(): + raise GoogleAuthError( + f"Google token file is missing: {token_path}. " + "Run the Google OAuth bootstrap step first." + ) + + credentials = Credentials.from_authorized_user_file(str(token_path), GOOGLE_SCOPES) + if credentials.expired and credentials.refresh_token: + credentials.refresh(Request()) + token_path.write_text(credentials.to_json(), encoding="utf-8") + + if not credentials.valid: + raise GoogleAuthError( + "Google credentials are invalid. Re-run the Google OAuth bootstrap step." + ) + return credentials + + @property + def client_path(self) -> Path: + return self._resolve_path(self.settings.google_client_secrets_file) + + @property + def token_path(self) -> Path: + return self._resolve_path(self.settings.google_token_file) + + def write_client_secrets_file(self, client_id: str, client_secret: str) -> Path: + client_id = client_id.strip() + client_secret = client_secret.strip() + if not client_id or not client_secret: + raise GoogleAuthError("Google client ID and client secret are required.") + + redirect_uris = [ + f"http://127.0.0.1:{self.settings.admin_port}/admin/integrations/google/callback", + f"http://localhost:{self.settings.admin_port}/admin/integrations/google/callback", + ] + payload = { + "web": { + "client_id": client_id, + "project_id": "wiseclaw-local", + "auth_uri": "https://accounts.google.com/o/oauth2/auth", + "token_uri": "https://oauth2.googleapis.com/token", + "auth_provider_x509_cert_url": "https://www.googleapis.com/oauth2/v1/certs", + "client_secret": client_secret, + "redirect_uris": redirect_uris, + } + } + self.client_path.parent.mkdir(parents=True, exist_ok=True) + self.client_path.write_text(json.dumps(payload, indent=2), encoding="utf-8") + return self.client_path + + def begin_web_oauth(self, redirect_uri: str) -> str: + if not self.client_path.exists(): + raise GoogleAuthError( + f"Google client secrets file is missing: {self.client_path}. " + "Place your Google OAuth client JSON there first." + ) + + self._configure_local_oauth_transport(redirect_uri) + flow = Flow.from_client_secrets_file(str(self.client_path), GOOGLE_SCOPES) + flow.redirect_uri = redirect_uri + authorization_url, state = flow.authorization_url( + access_type="offline", + include_granted_scopes="true", + prompt="consent", + ) + self._store_state(state) + return authorization_url + + def complete_web_oauth(self, redirect_uri: str, state: str, authorization_response: str) -> Credentials: + if not self._consume_state(state): + raise GoogleAuthError("Google OAuth state is missing or expired. Start the connect flow again.") + + self._configure_local_oauth_transport(redirect_uri) + flow = Flow.from_client_secrets_file(str(self.client_path), GOOGLE_SCOPES, state=state) + flow.redirect_uri = redirect_uri + flow.fetch_token(authorization_response=authorization_response) + credentials = flow.credentials + self.token_path.parent.mkdir(parents=True, exist_ok=True) + self.token_path.write_text(credentials.to_json(), encoding="utf-8") + return credentials + + def oauth_status(self) -> tuple[bool, bool, str]: + if not self.client_path.exists(): + return False, False, ( + f"Missing Google OAuth client file at {self.client_path}. " + "Add client_secret.json first." + ) + if not self.token_path.exists(): + return False, False, "Google account is not connected yet." + try: + self._load_credentials() + except GoogleAuthError as exc: + return True, False, str(exc) + return True, True, "Google account is connected." + + def _resolve_path(self, raw_path: str) -> Path: + path = Path(raw_path).expanduser() + if not path.is_absolute(): + path = (self.workspace_root / path).resolve() + else: + path = path.resolve() + return path + + def _store_state(self, state: str) -> None: + now = time.time() + expired = [item for item, created_at in _OAUTH_STATES.items() if now - created_at > _OAUTH_STATE_TTL_SECONDS] + for item in expired: + _OAUTH_STATES.pop(item, None) + _OAUTH_STATES[state] = now + + def _consume_state(self, state: str) -> bool: + created_at = _OAUTH_STATES.pop(state, None) + if created_at is None: + return False + return time.time() - created_at <= _OAUTH_STATE_TTL_SECONDS + + def _configure_local_oauth_transport(self, redirect_uri: str) -> None: + if redirect_uri.startswith("http://127.0.0.1") or redirect_uri.startswith("http://localhost"): + os.environ["OAUTHLIB_INSECURE_TRANSPORT"] = "1" diff --git a/backend/app/llm/planner.py b/backend/app/llm/planner.py index 1f5c1b0..b45a0db 100644 --- a/backend/app/llm/planner.py +++ b/backend/app/llm/planner.py @@ -30,6 +30,8 @@ def build_prompt_context( "If the user asks you to create or update files, use the files tool with action `write`.\n" "If the user asks you to create a note in Apple Notes, use apple_notes with action `create_note`.\n" "If the user asks about their saved notes, documents, archive, workspace knowledge, or second brain, use second_brain or the injected second-brain context before answering.\n" + "If the user asks about Gmail or email inbox contents, use the gmail tool before answering.\n" + "If the user asks about Google Drive files or documents, use the google_drive tool before answering.\n" "For a static HTML/CSS/JS app, write the files first, then use the terminal tool to run a local server in the background with a command like `python3 -m http.server 9990 -d{telegramStatus?.message || "Checking..."}
{googleStatus?.message || "Checking Google OAuth status..."}
+ {googleStatus?.connect_url ? ( + + {googleStatus.connected ? "Reconnect Google" : "Connect Google"} + + ) : null} +