feat: add token file and env Login

auth/tokens.go

@@ -0,0 +1,55 @@
+package auth
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"time"
+)
+
+// TokenSet is persisted at tokens.json mode 0600.
+type TokenSet struct {
+	AccessToken  string    `json:"access_token"`
+	RefreshToken string    `json:"refresh_token,omitempty"`
+	TokenType    string    `json:"token_type,omitempty"`
+	Expiry       time.Time `json:"expiry,omitempty"`
+	ClientID     string    `json:"client_id,omitempty"`
+	ClientSecret string    `json:"client_secret,omitempty"`
+	AuthURL      string    `json:"auth_url,omitempty"`
+	TokenURL     string    `json:"token_url,omitempty"`
+	RedirectURL  string    `json:"redirect_url,omitempty"`
+	AccountID    string    `json:"account_id,omitempty"`
+}
+
+// WriteTokens stores OAuth tokens with mode 0600.
+func WriteTokens(path, access, refresh string) error {
+	return WriteTokenSet(path, TokenSet{AccessToken: access, RefreshToken: refresh, TokenType: "Bearer"})
+}
+
+// WriteTokenSet writes the full token record.
+func WriteTokenSet(path string, t TokenSet) error {
+	b, err := json.MarshalIndent(t, "", "  ")
+	if err != nil {
+		return fmt.Errorf("marshal tokens: %w", err)
+	}
+	if err := os.WriteFile(path, append(b, '\n'), 0o600); err != nil {
+		return fmt.Errorf("write tokens: %w", err)
+	}
+	return nil
+}
+
+// ReadTokens loads tokens.json.
+func ReadTokens(path string) (TokenSet, error) {
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return TokenSet{}, err
+	}
+	var t TokenSet
+	if err := json.Unmarshal(b, &t); err != nil {
+		return TokenSet{}, fmt.Errorf("parse tokens: %w", err)
+	}
+	if t.AccessToken == "" && t.RefreshToken == "" {
+		return TokenSet{}, fmt.Errorf("tokens: missing access_token")
+	}
+	return t, nil
+}