Update Google Calendar integration

pyproject.toml

@@ -62,6 +62,9 @@ module = [
     "apiai.*",
     "feedparser.*",
     "gitlint.*",
+    "google.auth.*",
+    "google.oauth2.*",
+    "google_auth_oauthlib.*",
     "googleapiclient.*",
     "irc.*",
     "mercurial.*",

zulip/integrations/google/get-google-credentials

@@ -1,46 +1,65 @@
 #!/usr/bin/env python3
-import argparse
+import logging
 import os
+import sys
+from typing import List
 
-from oauth2client import client, tools
-from oauth2client.file import Storage
+from google.auth.transport.requests import Request
+from google.oauth2.credentials import Credentials
+from google_auth_oauthlib.flow import InstalledAppFlow
 
-flags = argparse.ArgumentParser(parents=[tools.argparser]).parse_args()
 
-# If modifying these scopes, delete your previously saved credentials
-# at zulip/bots/gcal/
-# NOTE: When adding more scopes, add them after the previous one in the same field, with a space
-# seperating them.
-SCOPES = "https://www.googleapis.com/auth/calendar.readonly"
-# This file contains the information that google uses to figure out which application is requesting
-# this client's data.
-CLIENT_SECRET_FILE = "client_secret.json"  # noqa: S105
-APPLICATION_NAME = "Zulip Calendar Bot"
-HOME_DIR = os.path.expanduser("~")
-
-
-def get_credentials() -> client.Credentials:
-    """Gets valid user credentials from storage.
-
-    If nothing has been stored, or if the stored credentials are invalid,
-    the OAuth2 flow is completed to obtain the new credentials.
-
-    Returns:
-        Credentials, the obtained credential.
+def get_credentials(
+    tokens_path: str,
+    client_secret_path: str,
+    scopes: List[str],
+    noauth_local_webserver: bool = False,
+) -> Credentials:
     """
+    Writes google tokens to a json file, using the client secret file (for the OAuth flow),
+    and the refresh token.
 
-    credential_path = os.path.join(HOME_DIR, "google-credentials.json")
+    If the tokens file exists and is valid, nothing needs to be done.
+    If the tokens file exists, but the auth token is expired (expiry duration of auth token
+    is 1 hour), the refresh token is used to get a new token.
+    If the tokens file does not exist, or is invalid, the OAuth2 flow is triggered.
 
-    store = Storage(credential_path)
-    credentials = store.get()
-    if not credentials or credentials.invalid:
-        flow = client.flow_from_clientsecrets(os.path.join(HOME_DIR, CLIENT_SECRET_FILE), SCOPES)
-        flow.user_agent = APPLICATION_NAME
-        # This attempts to open an authorization page in the default web browser, and asks the user
-        # to grant the bot access to their data. If the user grants permission, the run_flow()
-        # function returns new credentials.
-        credentials = tools.run_flow(flow, store, flags)
-        print("Storing credentials to " + credential_path)
+    The OAuth2 flow needs the client secret file, and requires the user to grant access to
+    the application via a browser authorization page, for the first run.
+    The authorization can be done either automatically using a local web server,
+    or manually by copy-pasting the auth code from the browser into the command line.
 
+    The fetched tokens are written to storage in a json file, for reference by other scripts.
+    """
+    creds = None
+    if os.path.exists(tokens_path):
+        creds = Credentials.from_authorized_user_file(tokens_path, scopes)
+    if not creds or not creds.valid:
+        if creds and creds.expired and creds.refresh_token:
+            creds.refresh(Request())
+        else:
+            if not os.path.exists(client_secret_path):
+                logging.error(
+                    "Unable to find the client secret file.\nPlease ensure that you have downloaded the client secret file from Google. Either place the client secret file at %s, or use the --client-secret-file option to specify the path to the client secret file.",
+                    client_secret_path,
+                )
+                sys.exit(1)
+            flow = InstalledAppFlow.from_client_secrets_file(
+                client_secret_path,
+                scopes,
+                redirect_uri="urn:ietf:wg:oauth:2.0:oob" if noauth_local_webserver else None,
+            )
 
-get_credentials()
+            if noauth_local_webserver:
+                auth_url, _ = flow.authorization_url(access_type="offline")
+                auth_code = input(
+                    f"Please visit this URL to authorize this application:\n{auth_url}\nEnter the authorization code: "
+                )
+                flow.fetch_token(code=auth_code)
+                creds = flow.credentials
+            else:
+                creds = flow.run_local_server(port=0)
+        with open(tokens_path, "w") as token_file:
+            token_file.write(creds.to_json())
+            logging.info("Saved tokens to %s", tokens_path)
+    return creds