gamesheet_sdk.teams.login module

HTTP-only login flow for the GameSheet teams dashboard.

Authenticates against the same Firebase project as the admin dashboard (gamesheet-production) but uses pure HTTP calls instead of headless browser automation:

  1. POST Firebase REST signInWithPassword with the project’s API key.

  2. GET /api/auth/tokens on the teams API gateway, exchanging the Firebase ID token for application-level

    access and refresh tokens.

The resulting tokens are persisted via save_tokens() so that subsequent CLI commands can authenticate without repeating the login flow.

gamesheet_sdk.teams.login.refresh_access_token(refresh_token, *, timeout=15.0)[source]

Exchange a refresh token for a fresh {access, refresh} pair via the teams API gateway.

POSTs to TEAMS_REFRESH_PATH with Authorization: Bearer <refresh_token> and an empty JSON body. The gateway returns a new access token and a replacement refresh token.

This is a standalone HTTP call that does not use a Session, so it can be called from inside an auto-refresh retry path without recursing.

Parameters:

  • refresh_token (str) – The refresh token to exchange for new tokens.

  • timeout (float) – Request timeout in seconds. Defaults to DEFAULT_TIMEOUT_S.

Returns:

Dictionary with keys access and refresh, each containing the corresponding token string.

Return type:

dict[str, str]

Raises:

  • AuthenticationError – If the refresh token is rejected (HTTP 401). This typically means the token has expired and the user needs to re-authenticate via gamesheet-teams login.

  • GameSheetError – For any other non-2xx HTTP response from the token refresh endpoint.

class gamesheet_sdk.teams.login.TeamsLoginFlow[source]

Bases: object

HTTP-based LoginFlow for the teams dashboard.

Authenticates via two sequential HTTP calls — Firebase REST signInWithPassword followed by a token exchange against the teams API gateway — without requiring a headless browser.

Example:

from gamesheet_sdk.common.config import Config
from gamesheet_sdk.teams.login import TeamsLoginFlow

config = Config(base_url="https://teams.gamesheet.app")
flow = TeamsLoginFlow(config)
tokens = flow.authenticate(email="user@example.com", password="secret")
print(tokens["access"])

Store the configuration for credential resolution and token persistence.

Parameters:

config (Config) – SDK configuration (credentials, URLs, storage paths).

__init__(config)[source]

Store the configuration for credential resolution and token persistence.

Parameters:

config (Config) – SDK configuration (credentials, URLs, storage paths).

authenticate(email=None, password=None, *, timeout=None)[source]

Run the HTTP-only teams login and return tokens.

Resolves credentials from the arguments or Config, authenticates with Firebase, exchanges the ID token for application tokens, and persists them to disk.

Parameters:

  • email (str | None) – Login email, or None to resolve from config/env.

  • password (str | None) – Login password, or None to resolve from config/env.

  • timeout (float | None) – HTTP request timeout in seconds, or None for the default.

Returns:

Token bundle with "access" and "refresh" keys.

Return type:

dict[str, str]

Raises:

AuthenticationError – If credentials are missing, Firebase rejects them, or the token exchange fails.