Add support for Service Accounts

[pvieito]

Currently, gog seems to only support Client Accounts (the ones that require logging in via a web browser and configuring OAuth2 "Client Secrets" Credentials in Google Cloud). The big issue with this type of account is that they require Google to validate the OAuth consent screen, and with the testing mode, the credentials expire after just 7 days.

The other type of Google Accounts is Service Accounts (https://docs.cloud.google.com/iam/docs/service-account-overview), which do not expire and are linked to a given Google Cloud project. Also, if gog supported Service Accounts, you could be able to share specific Google Drive documents or folders so it could access them without granting full access to your account.

[salmonumbrella]

salmonumbrella

Thanks for the request! We want to keep this KISS and avoid changing the login flow/UI.

Proposed UX:

• No changes to the OAuth login page.
• If a service-account key is configured for --account, the CLI will just work in the backend by using the service account.
• If no service account is configured, we fall back to the existing OAuth refresh-token flow.

Why not default to service account?

• Service accounts only work for data they have access to. For user data (Gmail/Calendar/Contacts/People/Tasks) you need Workspace + admin-enabled domain-wide delegation.
• Making SA the default would break most consumer setups; auto-use when configured keeps it simple and reliable.

Questions to confirm before we implement:

• Are you on Google Workspace with admin access for domain-wide delegation?
• Which services do you need (Drive/Docs/Sheets vs Gmail/Calendar/etc)?
• Is sharing resources with the service account sufficient for your use case?

If the above matches your needs, we can add a gog auth service-account <account> --key <sa.json> command and wire it so the backend auto-selects SA when present.

[steipete]

Implemented Workspace service-account impersonation (domain-wide delegation) for all services.

• New commands: gog auth service-account set|status|unset <email> --key <service-account.json>.
• Service accounts take precedence when configured (over OAuth refresh tokens).
• gog auth list now includes an auth type column; gog --account <email> auth status shows auth_preferred.
• README includes end-to-end setup steps (GCP service account + Admin Console allowlist).

Landed on main:

• 3c131fb feat(auth): support Workspace service accounts (Add support for Service Accounts #54)
• 13deee9 docs(changelog): prep 0.6.0 unreleased

[pvieito]

@steipete Great, thanks!