LemonAi.Auth.GoogleGeminiCliOAuth (lemon_ai v0.1.0)

View Source

Google Gemini CLI OAuth helpers.

Supports PKCE authorization URL generation, localhost callback/manual paste parsing, token exchange + refresh, Code Assist project setup, encoded secret payloads, and API-key resolution for the google_gemini_cli provider.

Summary

Types

login_opt()
oauth_secret()

Functions

authorize_url(opts \\ [])

Build an OAuth authorization URL + PKCE verifier.

build_authorize_url(opts \\ [])

Build an OAuth authorization URL + PKCE verifier.

decode_secret(secret_value)

Decode OAuth secret payload.

encode_secret(secret)

Encode OAuth secret payload for storage by the caller.

exchange_code_for_secret(code, code_verifier, opts \\ [])

Exchange authorization code + PKCE verifier for an OAuth secret payload.

login_device_flow(opts \\ [])

Run the Gemini CLI OAuth flow.

parse_authorization_input(input)

Parse callback/manual pasted OAuth input. Accepts

resolve_api_key_from_secret(secret_name, secret_value, opts \\ [])

Resolve a usable Gemini CLI credential JSON string ({"token","projectId"}) from a secret value.

Types

login_opt()

@type login_opt() ::
  {:on_auth, (String.t(), String.t() | nil -> any())}
  | {:on_progress, (String.t() -> any())}
  | {:on_prompt, (map() -> String.t() | charlist())}
  | {:redirect_uri, String.t()}
  | {:state, String.t()}
  | {:project_id, String.t()}
  | {:callback_timeout_ms, pos_integer()}
  | {:listen_for_callback, boolean()}
  | {:local_callback_listener, module()}
  | {:persist_secret, (String.t(), String.t() -> any())}

oauth_secret()

@type oauth_secret() :: %{required(String.t()) => String.t() | integer() | nil}

Functions

authorize_url(opts \\ [])

@spec authorize_url(keyword()) :: {:ok, map()}

Build an OAuth authorization URL + PKCE verifier.

build_authorize_url(opts \\ [])

@spec build_authorize_url(keyword()) :: {:ok, map()}

Build an OAuth authorization URL + PKCE verifier.

decode_secret(secret_value)

@spec decode_secret(String.t()) :: {:ok, oauth_secret()} | :not_oauth

Decode OAuth secret payload.

encode_secret(secret)

@spec encode_secret(oauth_secret()) :: String.t()

Encode OAuth secret payload for storage by the caller.

exchange_code_for_secret(code, code_verifier, opts \\ [])

@spec exchange_code_for_secret(String.t(), String.t(), keyword()) ::
  {:ok, oauth_secret()} | {:error, term()}

Exchange authorization code + PKCE verifier for an OAuth secret payload.

login_device_flow(opts \\ [])

@spec login_device_flow([login_opt()]) :: {:ok, oauth_secret()} | {:error, term()}

Run the Gemini CLI OAuth flow.

When the redirect URI is local (http://localhost:8085/oauth2callback by default), A local listener can capture the browser callback automatically and fall back to manual paste only if the listener cannot complete the flow.

parse_authorization_input(input)

@spec parse_authorization_input(String.t()) ::
  {:ok, %{code: String.t(), state: String.t() | nil}} | {:error, term()}

Parse callback/manual pasted OAuth input. Accepts:

  • full callback URL
  • query string containing code=
  • plain code

resolve_api_key_from_secret(secret_name, secret_value, opts \\ [])

Resolve a usable Gemini CLI credential JSON string ({"token","projectId"}) from a secret value.

Returns :ignore for non-Gemini-CLI OAuth payloads.