Auth Portal & Cloud File Search

The Auth Portal is a Flask web app running on Luci (Hetzner) at http://100.118.207.3:8788, accessible via Tailscale. It manages OAuth tokens for four cloud services so Elmar can re-authenticate from his phone or laptop without terminal access.

1. Portal calls /oauth2/v2.0/devicecode to get a user code + verification URL
2. User sees the code in the portal UI and clicks the link to microsoft.com/devicelogin
3. Background thread polls /oauth2/v2.0/token every 5s until user completes sign-in
4. On success, saves access_token + refresh_token + expires_on to the token JSON file
5. Auto-refresh: when the token expires, graph_api.py or the auth portal calls the refresh endpoint automatically

M365 Safair uses tenant-specific authority (/common as of today). Personal OneDrive uses /consumers authority with Files.ReadWrite.All scope only.

1. Portal generates a consent URL with all required scopes (Gmail, Calendar, Drive, etc.)
2. User clicks the link, signs into Google, grants consent
3. Google redirects to http://localhost:1 with an auth code in the URL
4. User copies the full redirect URL back to the portal
5. Portal extracts the code, exchanges it for tokens via oauth2.googleapis.com/token
6. Saves tokens to ~/.config/gws/credentials.json

1. Portal generates an auth URL pointing to dropbox.com/oauth2/authorize with token_access_type=offline
2. No redirect URI — Dropbox shows the auth code directly on screen
3. User copies the code and pastes it into the portal
4. Portal exchanges the code for tokens via api.dropboxapi.com/oauth2/token using Basic auth (app key:secret)
5. Saves access_token + refresh_token to ~/.dropbox-api-token.json
6. Auto-refresh via _dbx_refresh_token() when access token expires

Searches all four cloud drives in parallel via their respective APIs:

python ~/workspace/scripts/search_all.py "fleet plan"
python ~/workspace/scripts/search_all.py "FICA" --drive onedrive_work
python ~/workspace/scripts/search_all.py "budget" --top 10 --json

Three search modes available locally:

1. Added Dropbox OAuth to auth_portal.py — New card in the portal UI, OAuth2 code flow without redirect URI (Dropbox shows code directly on screen), token refresh support, health check integration
2. Added Personal OneDrive to auth_portal.py — Device code flow using /consumers authority, separate token file (~/.graph-api-token-personal.json), auto-refresh support
3. Created search_all.py — Unified cloud file search that queries all four drives in parallel via their APIs and merges/deduplicates results
4. Fixed Dropbox OAuth redirect issue — Removed redirect_uri=http://localhost:1 parameter (wasn't registered in the Dropbox app), switched to no-redirect flow
5. Authenticated Dropbox — Successfully authenticated with Elmar's Dropbox account

• Pending Personal OneDrive auth — Azure Portal change needed (supported account types → common). Code is ready.
• Pending Store Dropbox app key/secret in vault secrets (currently hardcoded in auth_portal.py)