Google Workspace и Codex: Gmail, Calendar и Drive через терминал

node - <<'NODE'
const fs = require('fs');
const crypto = require('crypto');
const path = '/root/codexclaw/.secrets/google/client_secret.json';
const secret = JSON.parse(fs.readFileSync(path, 'utf8'));
const cfg = secret.web || secret.installed;
const state = crypto.randomBytes(24).toString('hex');
fs.writeFileSync('/root/codexclaw/.secrets/google/oauth_state.txt', state, { mode: 0o600 });
const params = new URLSearchParams({
  client_id: cfg.client_id,
  redirect_uri: 'http://localhost:3000/oauth2callback',
  response_type: 'code',
  scope: [
    'https://www.googleapis.com/auth/gmail.readonly',
    'https://www.googleapis.com/auth/calendar.readonly',
    'https://www.googleapis.com/auth/drive.metadata.readonly',
    'https://www.googleapis.com/auth/drive.readonly'
  ].join(' '),
  access_type: 'offline',
  prompt: 'consent',
  include_granted_scopes: 'true',
  state,
});
console.log('https://accounts.google.com/o/oauth2/v2/auth?' + params.toString());
NODE

CALLBACK_URL='http://localhost:3000/oauth2callback?state=...&code=...&scope=...'

node - <<'NODE'
const fs = require('fs');
const callbackUrl = process.env.CALLBACK_URL;
if (!callbackUrl) throw new Error('CALLBACK_URL is required');
const secretPath = '/root/codexclaw/.secrets/google/client_secret.json';
const tokenPath = '/root/codexclaw/.secrets/google/token.json';
const statePath = '/root/codexclaw/.secrets/google/oauth_state.txt';
const secret = JSON.parse(fs.readFileSync(secretPath, 'utf8'));
const cfg = secret.web || secret.installed;
const url = new URL(callbackUrl);
const code = url.searchParams.get('code');
const state = url.searchParams.get('state');
const expectedState = fs.existsSync(statePath) ? fs.readFileSync(statePath, 'utf8').trim() : '';
if (!code) throw new Error('No code in callback URL');
if (expectedState && state !== expectedState) throw new Error('OAuth state mismatch');

const body = new URLSearchParams({
  client_id: cfg.client_id,
  client_secret: cfg.client_secret,
  code,
  grant_type: 'authorization_code',
  redirect_uri: 'http://localhost:3000/oauth2callback',
});

fetch('https://oauth2.googleapis.com/token', {
  method: 'POST',
  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
  body,
})
  .then(async (res) => {
    const data = await res.json();
    if (!res.ok) throw new Error(JSON.stringify(data));
    data.expires_at = Date.now() + (data.expires_in || 3600) * 1000;
    fs.writeFileSync(tokenPath, JSON.stringify(data, null, 2), { mode: 0o600 });
    fs.chmodSync(tokenPath, 0o600);
    console.log('token saved:', tokenPath);
    console.log('has access_token:', Boolean(data.access_token));
    console.log('has refresh_token:', Boolean(data.refresh_token));
  })
  .catch((err) => {
    console.error(err.message);
    process.exit(1);
  });
NODE