feat(auth): steve-office → Internal OAuth client (staggered stage 1, guarded)

9283fd8e94984c5a132a5be54f46824014be5c28 · 2026-09-01 13:52:13 -0700 · Steve Abrams

Files touched

M server.js

Diff

commit 9283fd8e94984c5a132a5be54f46824014be5c28
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Tue Sep 1 13:52:13 2026 -0700

    feat(auth): steve-office → Internal OAuth client (staggered stage 1, guarded)
---
 server.js | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/server.js b/server.js
index 841da30..b1a5637 100644
--- a/server.js
+++ b/server.js
@@ -124,11 +124,17 @@ function saAuthFor(key) {
 }
 
 // Steve@ account (primary)
+// Staggered stage 1 (2026-09-01): steve-office ONLY moves to the new Internal
+// OAuth client (project 492000337767) so its next re-consent mints a durable
+// token. Falls back to the existing client when the Internal creds are absent.
+// info/personal/agentabrams/calendar stay on GMAIL_CLIENT_ID/SECRET untouched.
+const SO_ID = process.env.GMAIL_INTERNAL_CLIENT_ID || creds.GMAIL_INTERNAL_CLIENT_ID || GMAIL_CLIENT_ID;
+const SO_SECRET = process.env.GMAIL_INTERNAL_CLIENT_SECRET || creds.GMAIL_INTERNAL_CLIENT_SECRET || GMAIL_CLIENT_SECRET;
 let oauth2Client;
 let gmail;
 let tasksApi;
 try {
-  oauth2Client = new google.auth.OAuth2(GMAIL_CLIENT_ID, GMAIL_CLIENT_SECRET, GMAIL_REDIRECT_URI);
+  oauth2Client = new google.auth.OAuth2(SO_ID, SO_SECRET, GMAIL_REDIRECT_URI);
   oauth2Client.setCredentials({ refresh_token: GMAIL_REFRESH_TOKEN });
   gmail = google.gmail({ version: 'v1', auth: oauth2Client });
   tasksApi = google.tasks({ version: 'v1', auth: oauth2Client });

← 9ca35af fix(token-age): valid-past-7d-horizon = OK (long-lived), not · back to George Gmail · Revert "feat(auth): steve-office → Internal OAuth client (st 311f0a8 →