CRT/storebound
1
0
Fork 0
Code Issues Pull requests Releases 1 Packages 1 Activity Actions

credential broker: Play tokens from POST /api/google/token (cached, single flight, local key fallback), grants and APIs per package in validate, Play write preflight, apps check and the desktop Accounts view; Google 403 names the API or grant, no retry

Browse source
This commit is contained in:
CRTkafa 2026-10-25 22:50:52 +07:00
parent 304407e523
commit 2c5e30090f
27 changed files with 1145 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

16
cli/lib/desktop-protocol.ts
View file

@ -315,6 +315,22 @@ export interface AccountCheck {
/** What to do, in words. */
fix: string | null;
docs: string | null;
/** Play: where the tokens come from, the credential broker or the local key file (no values). */
source?: 'broker' | 'file' | null;
/** Play with a credential broker: the grants and APIs it lists per Play app of this machine. */
grants?: BrokerGrant[];
}
/** One Play app's access as the credential broker lists it (GET /api/google/play/<package>/storebound). */
export interface BrokerGrant {
packageName: string;
/** false: the package is not registered on the broker (no data; not a missing access). */
registered: boolean;
/** Play permissions of the service account (developer-level ones included); null when the broker has none. */
grants: string[] | null;
enabledApis: string[] | null;
/** Permissions / APIs storebound's commands need that are not there. */
missing: string[];
}
/**