[kvlonge]

Lets a google_sheets connection read spreadsheets as a Google user, through an installed-app (Desktop) OAuth client, as well as with a service account.

Status: user OAuth tested against a simulated Google endpoint, not yet against live Google. The service-account path is unchanged and keeps its live coverage.

Config: client_id and client_secret, plus an optional refresh_token for unattended runs. A connection sets at most one of the three service-account key settings or client_id; plan refuses other combinations.

Flow:

• Consent: a PKCE browser sign-in asking only for spreadsheets.readonly, with access_type=offline and prompt=consent select_account. It reuses Snowflake's loopback/paste sign-in, now shared as browser_code (first commit, a refactor with no behaviour change).
• Cache: the refresh token is cached in sqlload/google-tokens.json below the user's cache folder (0600), keyed "<client_id> <connection>".
• Renewal: access tokens are renewed with the connection's or the cached refresh token. A token the Sheets API refuses is replaced.
• Errors:
  • A revoked or expired refresh token is a non-retryable error (exit 1) naming the cause and the fix.
  • With no terminal, or under --json, the run fails at once and says how to sign in.
  • A token endpoint that answers 429/5xx is retried, and exits 75 if it stays down.

Tests:

• 12 unit cases against a fake Google consent page and token endpoint: renewal, consent with a PKCE check, cache reuse, refused tokens, revoked tokens with and without a terminal, a wrong client secret, and 503/500 outages, checking exit-75 classification.
• CLI tests through the testkit's fake Sheets API, whose /token route now refuses revoked refresh tokens: a configured refresh token loads; a revoked one exits 1 with retryable: false; a --json run with nothing cached fails without prompting; mixed or half-set credentials are refused.

Docs: a new "Sign in as a Google user" section in sources/google-sheets.mdx, marked 0.35.0 (not released yet). The exact consent steps are on CHI-1240.

Closes CHI-1240.

[cloudflare-workers-and-pages]

Deploying sqlload with    Cloudflare Pages

Latest commit:	9ca4be3
Status:	✅  Deploy successful!
Preview URL:	https://fec0219c.sqlload.pages.dev
Branch Preview URL:	https://feat-sheets-user-oauth.sqlload.pages.dev

View logs