Saúde Becker OAuthReader
A software-development utility for persistent, non-interactive and read-only access to authorized Google Apps Script projects. OAuthReader is part of the Saúde Becker engineering toolchain and is designed to support source inspection, diagnostics and maintenance without granting mutation privileges to Google Apps Script resources.
The project is personal, non-commercial and not offered as a public authentication service. This page documents the implementation, security model and OAuth permissions used by the tool.
What the software does
OAuth enrollment
An authorized user completes an interactive Google OAuth enrollment once. The tool then binds the stored authorization to the expected Google identity.
Protected persistence
The refresh credential is stored locally on Windows using DPAPI with the CurrentUser protection boundary. Access tokens are not stored persistently.
Non-interactive refresh
Subsequent sessions obtain short-lived access tokens without browser interaction and fail closed if the protected credential or identity binding is invalid.
Read-only source access
The resulting access token is used only to read authorized Google Apps Script project content through the official API.
OAuth scopes
OAuthReader requests the following exact scope set:
openid
email
https://www.googleapis.com/auth/script.projects.readonly| Scope | Purpose | Resource mutation |
|---|---|---|
openid | Identity binding | No |
email | Verify the authorized Google account | No |
script.projects.readonly | Read Apps Script project source and metadata | No |
Security model
Least privilege
The sole Google resource scope is script.projects.readonly. The utility does not request Google Apps Script write scope.
Identity checks
The authenticated subject, verified email, OAuth audience and exact granted scope set are checked before the reader is accepted.
Fail-closed behavior
A missing protected store, invalid account binding or refresh failure does not fall back to an unverified or automatic interactive login.
Token handling
Refresh material is protected by Windows DPAPI. Short-lived access tokens remain ephemeral and are not persisted by the reader.
Implementation flow
Authorized Google account
|
v
One-time OAuth enrollment
|
v
Identity + audience + scope validation
|
v
Refresh credential protected with Windows DPAPI
|
v
Non-interactive OAuth refresh
|
v
Short-lived access token in memory
|
v
Google Apps Script API (GET / read-only)Current validation
Validated: the current Windows implementation has successfully refreshed authorization in a new process and after a Windows reboot, verified identity/audience/scopes, rejected wrong bindings and missing credential stores, and read the authorized Apps Script project without executing a write operation. The remaining publication work is related to the Google OAuth consent configuration, not to adding broader resource permissions.
Project resources
Development purpose
OAuthReader exists to support software engineering tasks in the Saúde Becker project: authenticated source inspection, repeatable diagnostics, automation continuity and safer operational tooling. It is explicitly designed to separate read-only inspection from mutation-capable components and to minimize long-lived credential exposure.
Contact
Maintainer: Danilo Becker — danilobecker@hotmail.com