# Google Docs Access Checker

A small static web app. Each user presses **Continue with Google**, chooses a Google account, approves read-only permissions, and the app automatically checks:

1. Google authentication.
2. Whether Google Drive can list Google Docs visible to that account.
3. Whether the Google Docs API can read a document's content.

It displays up to 10 matching Docs and a text preview after a successful read.

## One-time setup for the website owner

You configure the OAuth Client ID once. After that, visitors do not enter any keys; they just sign in with Google.

### 1. Create a Google Cloud project

Open [Google Cloud Console](https://console.cloud.google.com/) and create or select a project.

### 2. Enable the APIs

In **APIs & Services → Library**, enable:

- **Google Drive API**
- **Google Docs API**

### 3. Configure Google Auth Platform

Set up the OAuth consent screen / Google Auth Platform branding and audience. While the app is in Testing mode, add the Google accounts that will test it as test users.

### 4. Create the OAuth Client ID

In **APIs & Services → Credentials** (or **Google Auth Platform → Clients**):

1. Create an **OAuth client ID**.
2. Choose **Web application**.
3. Under **Authorized JavaScript origins**, add the exact origin where the app will be hosted. Examples:
   - `https://yourdomain.com`
   - `https://www.yourdomain.com`
   - `http://localhost:8000` for local testing.
4. Save and copy the Client ID. Do not create or add a client secret; this is a browser-only OAuth flow.

An origin contains only scheme, hostname, and optional port. Do not include a path or trailing slash.

### 5. Set the Client ID once

Open `config.js` and replace the placeholder value:

```js
window.GOOGLE_DRIVE_CHECKER_CONFIG = {
  clientId: 'PASTE_YOUR_GOOGLE_OAUTH_CLIENT_ID_HERE'
};
```

Paste your Web application Client ID between the quotes. Save the file and upload the whole folder to your HTTPS website. Every visitor to that deployment will use this same configured Client ID.

The Client ID is public browser configuration. Never put a client secret in this app.

## Run locally

From this folder, start a static server:

```bash
python -m http.server 8000
```

Open `http://localhost:8000` and ensure that exact origin is listed in the OAuth client's Authorized JavaScript origins.

Do not open `index.html` directly as a `file://` URL. Google OAuth requires a valid web origin.

## Permissions requested

The app requests these Google scopes:

- `openid`, `email`, `profile` — identify the signed-in Google account.
- `https://www.googleapis.com/auth/drive.metadata.readonly` — list Google Drive file metadata (names and IDs), without editing files.
- `https://www.googleapis.com/auth/documents.readonly` — read the contents of Google Docs, without editing them.

The app deliberately does **not** request the broader `drive.readonly` scope. The Docs read-only scope is classified by Google as sensitive, so public distribution may require OAuth app verification. Keep the OAuth project in Testing mode and add only intended testers while developing.

The app is entirely browser-side. The access token is held only in page memory and is cleared when the page is refreshed or the user disconnects. The app does not upload document content to a custom server, store tokens in localStorage, or change documents.

## iPhone notes

- Host the app on HTTPS.
- Open it in Safari or the installed web app.
- The Google OAuth library is loaded before the sign-in button is enabled; the token request starts directly from the button tap to avoid mobile popup restrictions.
- If the Google account chooser does not open, allow pop-ups for the site and try again.

## Troubleshooting

- **`origin_mismatch`**: Add the exact current origin (including `https` and any port) to Authorized JavaScript origins.
- **App not configured for this user**: Add the Google account as a test user in Google Auth Platform while the app is in Testing mode.
- **API disabled / `accessNotConfigured`**: Enable both the Google Drive API and Google Docs API in the same project as the OAuth Client ID.
- **Drive passes but Docs permission is not granted**: Disconnect, sign in again, and approve the Google Docs read-only permission.
- **Drive finds no Docs**: The signed-in account has no Google Docs visible to the app. Share a Google Doc with that account and run the test again.

## Files

- `index.html` — interface and script loading order.
- `config.js` — one-time OAuth Client ID configuration.
- `styles.css` — layout and responsive styling.
- `app.js` — Google OAuth, Drive listing, and Docs content-read test.