skrzynka account/connection
Report which of the three Gmail connection paths an account can actually use, each verdict measured against Google when you ask rather than read off the vault.
Invocation#
skrzynka --organization <ID> account connection --provider gmail --bind <SOCKET> [--email <EMAIL>]Purpose#
Report which of the three Gmail connection paths an account can actually use, each verdict measured against Google when you ask rather than read off the vault.
Inputs and options#
| Input or option | Required | Meaning |
|---|---|---|
--bind <SOCKET> | Yes | Loopback address account authorize would listen on. The oauth verdict hands Google the callback URI http://<SOCKET>/v1/gmail/oauth/callback, so the verdict is about the address you would actually use. No address is assumed; missing it exits 2. |
--email <EMAIL> | No | The account to measure. Without it only the account-independent state of each path is reported: no credential is authenticated and no delegated token is minted. |
Global options accepted on this path are --organization <ID> (required on every command except serve, version and onboarding; none is assumed), --skarbiec-bin <PATH> (default skarbiec) and --text (print results as path: value lines for people instead of JSON).
Output and state effect#
Prints {account, mailbox_id, receiving_skarbiec_item_id, usable_paths, paths}. paths always carries exactly app_password, oauth and delegation, in that order, each with a verdict of usable, refused or unproven, the refusal code or null, a detail carrying the provider's own words where there are any, the exact next action, and an observed map of non-secret facts — client IDs, the redirect URI, the admin console URL, the Skarbiec item that was authenticated. usable_paths counts the verdicts of usable. Nothing is written: no mailbox, credential, flow or cursor changes, and no secret enters the output. app_password performs a real IMAP LOGIN against imap.gmail.com:993 with the credential the mailbox already names. oauth builds the authorization URL a real flow would hand Google, from the same builder, hands it over once without starting a flow, and reads the OAuth error code Google puts in the landing URL. delegation mints a real delegated token for a Workspace address, and refuses a consumer address before contacting Google at all.
Refusals#
NON_LOOPBACK_BIND_REFUSED:Skrzynka listens only on loopback addresses; <SOCKET> is not one, before anything is contacted.GMAIL_PROFILE_INVALID:email is not a valid address, before anything is contacted.MAILBOX_SELECTOR_AMBIGUOUS:<EMAIL> names <N> mailboxes (<IDS>); select one by id, because the report refuses to measure an arbitrary one of them.- A path that cannot be used is not a command failure: the exit status is 0 whenever the report was produced, including when
usable_pathsis 0. Only the refusals above exit 1. - Database initialization still precedes dispatch, so an unsupported schema is refused as
DATABASE_SCHEMA_UNSUPPORTED.