Add Refresh Tokens to handle Google OAuth2 process

[ZhenjaMax]

Please describe your feature request

I'm frustrated with Google OAuth2 authorization. I have to do this every hour, and it's annoying!

Describe the solution you'd like

Use Refresh Tokens. They allow the client to use the same OAuth2 token much longer.

I'll try to point out some of the details.

1. Use access_type=offline on the PHP server side to get Refresh Token with OAuth2 Token.
2. Create OS installation to handle URI so Card Maker can be opened from the browser link.
3. Look at the GoogleInitializerFactory class at line 72: delete IssuedUtc = DateTime.UtcNow and add Refresh Token there later.

Potentially useful links

• About Refresh Token from Google Documentation;
• Implementation notes from Google Developers;
• Stack Overflow question: 400 behaviour.

[nhmkdev]

Yes, very annoying!

I can't promise I can improve things but will check into it again. 😅

Google really doesn't care much about desktop applications. I wrote up some history here: Google Integration History.

Key notes for myself:

• Must maintain backwards compatibility (don't want to force everyone to upgrade unless absolutely necessary)
• Do not change scopes or anything related to the Google auth side of things because they may reject the entire application and then CardMaker might not work with Google at all (or under very strict limits and with big warning banners)
• The client secret must never be shipped with the CardMaker binary. This value isn't even available to lookup from the Google auth page anymore.

[nhmkdev]

I spent way too much time trying figure out how Desktop Apps are supposed to work with Google's latest OAuth2.

Conclusion: Never submit the client_secret file but be sure to compile the client_secret file into the resulting binary. This is extremely confusing but it's what they expect developers to do. The claim is that the use of PKCE (a whole other thing) will make sure the client_secret isn't misused if someone decompiles the binary. 🙄

I'll look into how this all might work with CardMaker but it's not a small number of changes.

If implemented the biggest wins are:

• Token refresh (assuming it works as the docs describe)
• Use the google flow and built-in .NET functionality for requesting and maintaining the token used by the app

[nhmkdev]

https://github.com/nhmkdev/cardmaker/releases/tag/v.1.6.0.0-unstable.v.a3 is the initial version containing the functionality. CardMaker now uses the Google provided flow to prompt acceptance via the browser. Additionally lightly verified the command line functionality still works.

I suspect there is more to do in terms of making the Google auth page look/act correctly.

⚠️ proceed with caution if you want to give it a try ⚠️

[ZhenjaMax]

Tested v1.6.0.0a3 today. Works as expected, I don't see any incorrects for now.