Support Service Account Authentication

gcalcli/argparsers.py

@@ -24,6 +24,11 @@
         'type': str,
         'help': 'API client_secret',
     },
+    '--service-account': {
+        'default': None,
+        'type': str,
+        'help': 'Path to Service Account key file (JSON)',
+    },
     '--noauth_local_server': {
         'action': 'store_false',
         'dest': 'auth_local_server',

gcalcli/auth.py

@@ -2,6 +2,7 @@
 import socket
 from google.auth.transport.requests import Request
 from google_auth_oauthlib.flow import InstalledAppFlow
+from google.oauth2 import service_account
 from google.oauth2.credentials import Credentials
 from gcalcli.printer import Printer
 
@@ -94,3 +95,9 @@ def creds_from_legacy_json(data):
         )
     }
     return Credentials(data['access_token'], **kwargs)
+
+
+def load_service_account(key_file_path):
+    return service_account.Credentials.from_service_account_file(
+        key_file_path, scopes=["https://www.googleapis.com/auth/calendar"]
+    )

gcalcli/gcal.py

@@ -192,6 +192,18 @@ def _load_credentials(self):
         if self.userless_mode:
             return
 
+        # Check for Service Account first (bypasses cache)
+        key_path = self.options.get('service_account')
+        if key_path:
+            self.printer.debug_msg(f'Loading Service Account from {key_path}\n')
+            try:
+                self.credentials = auth.load_service_account(key_path)
+                return
+            except Exception as e:
+                raise GcalcliError(
+                    f'Failed to load service account: {e}'
+                )
+
         # Try loading cached credentials
         oauth_filepath = self.data_file_path('oauth')
         if not oauth_filepath.exists():

tests/test_service_account.py

@@ -0,0 +1,41 @@
+
+import pytest
+from gcalcli.gcal import GoogleCalendarInterface
+from gcalcli import auth
+
+def test_service_account_loading(PatchedGCalI, monkeypatch):
+    # Mock auth.load_service_account to return a dummy
+    mock_creds = "DUMMY_CREDS"
+
+    mock_called = False
+    def mock_load(path):
+        nonlocal mock_called
+        mock_called = True
+        assert path == "/tmp/fake-key.json"
+        return mock_creds
+
+    monkeypatch.setattr(auth, 'load_service_account', mock_load)
+
+    # Initialize GCal with service_account option
+    # Note: PatchedGCalI uses default_options fixture usually, we override
+    gcal = PatchedGCalI(service_account="/tmp/fake-key.json")
+
+    # Trigger auth load (lazy init might not have done it yet if cache existed? 
+    # But PatchedGCalI stubs things out. Let's explicitly call _load_credentials or access)
+    gcal._load_credentials()
+
+    assert mock_called
+    assert gcal.credentials == mock_creds
+
+def test_service_account_skips_oauth_cache(PatchedGCalI, monkeypatch, tmp_path):
+    # Setup a fake oauth cache file
+    # PatchedGCalI mocks data_file_path_stub. We need to create the file where it expects.
+    # But checking if the file is IGNORED is the goal.
+
+    # Mock load_service_account
+    monkeypatch.setattr(auth, 'load_service_account', lambda p: "SA_CREDS")
+
+    gcal = PatchedGCalI(service_account="/tmp/key.json")
+    gcal._load_credentials()
+
+    assert gcal.credentials == "SA_CREDS"