fix(auth): validate request dry-runs without credentials

.changeset/current-clippy-baseline.md

@@ -0,0 +1,5 @@
+---
+"@googleworkspace/cli": patch
+---
+
+Keep Apps Script file selection compatible with the current Clippy checks.

.changeset/offline-dry-run.md

@@ -0,0 +1,9 @@
+---
+"@googleworkspace/cli": patch
+---
+
+Skip authentication for Discovery-generated API and `docs +write` dry-runs.
+Validate and preview requests without accessing the keyring or reading, changing,
+or deleting stored credentials and token caches. Dry-runs work offline with a
+fresh cached Discovery schema; schema fetching on first use or cache expiry is
+unchanged. Real requests retain their existing authentication and error handling.

README.md

@@ -104,6 +104,21 @@ gws schema drive.files.list
 gws drive files list --params '{"pageSize": 100}' --page-all | jq -r '.files[].name'
 ```
 
+Discovery-generated API commands and `gws docs +write` support credential-free
+`--dry-run`: they validate inputs and display the request without obtaining a
+token, accessing the keyring, reading or changing stored credentials, or sending
+the API request.
+
+```bash
+# Preview a Docs append without signing in
+gws docs +write --document DOC_ID --text 'Hello, world!' --dry-run
+```
+
+These previews work offline with a fresh cached Discovery schema (24-hour TTL).
+First use or an expired cache can still fetch the schema over the network.
+Other helpers may need authenticated reads to prepare their plans; this guarantee
+applies to raw API commands and `docs +write`.
+
 ## Authentication
 
 The CLI supports multiple auth workflows so it works on your laptop, in CI, and on a server.

crates/google-workspace-cli/src/helpers/docs.rs

@@ -70,10 +70,15 @@ TIPS:
                 let (params_str, body_str, scopes) = build_write_request(matches, doc)?;
 
                 let scope_strs: Vec<&str> = scopes.iter().map(|s| s.as_str()).collect();
-                let (token, auth_method) = match auth::get_token(&scope_strs).await {
-                    Ok(t) => (Some(t), executor::AuthMethod::OAuth),
-                    Err(_) if matches.get_flag("dry-run") => (None, executor::AuthMethod::None),
-                    Err(e) => return Err(GwsError::Auth(format!("Docs auth failed: {e}"))),
+                let dry_run = matches.get_flag("dry-run");
+                // Skip auth entirely: even failed auth can mutate stored credentials.
+                let (token, auth_method) = if dry_run {
+                    (None, executor::AuthMethod::None)
+                } else {
+                    match auth::get_token(&scope_strs).await {
+                        Ok(t) => (Some(t), executor::AuthMethod::OAuth),
+                        Err(e) => return Err(GwsError::Auth(format!("Docs auth failed: {e}"))),
+                    }
                 };
 
                 // Method: documents.batchUpdate
@@ -100,7 +105,7 @@ TIPS:
                     auth_method,
                     None,
                     None,
-                    matches.get_flag("dry-run"),
+                    dry_run,
                     &pagination,
                     None,
                     &crate::helpers::modelarmor::SanitizeMode::Warn,

crates/google-workspace-cli/src/helpers/script.rs

@@ -169,13 +169,7 @@ fn process_file(path: &Path) -> Result<Option<serde_json::Value>, GwsError> {
             filename.trim_end_matches(".js").trim_end_matches(".gs"),
         ),
         "html" => ("HTML", filename.trim_end_matches(".html")),
-        "json" => {
-            if filename == "appsscript.json" {
-                ("JSON", "appsscript")
-            } else {
-                return Ok(None);
-            }
-        }
+        "json" if filename == "appsscript.json" => ("JSON", "appsscript"),
         _ => return Ok(None),
     };
 

crates/google-workspace-cli/src/main.rs

@@ -261,19 +261,24 @@ async fn run() -> Result<(), GwsError> {
     // to avoid restrictive scopes like gmail.metadata that block query parameters.
     let scopes: Vec<&str> = select_scope(&method.scopes).into_iter().collect();
 
-    // Authenticate: try OAuth, fail with error if credentials exist but are broken
-    let (token, auth_method) = match auth::get_token(&scopes).await {
-        Ok(t) => (Some(t), executor::AuthMethod::OAuth),
-        Err(e) => {
-            // If credentials were found but failed (e.g. decryption error, invalid token),
-            // propagate the error instead of silently falling back to unauthenticated.
-            // Only fall back to None if no credentials exist at all.
-            let err_msg = format!("{e:#}");
-            // NB: matches the bail!() message in auth::load_credentials_inner
-            if err_msg.starts_with("No credentials found") {
-                (None, executor::AuthMethod::None)
-            } else {
-                return Err(GwsError::Auth(format!("Authentication failed: {err_msg}")));
+    // Dry-runs only need the schema and inputs. Do not load credentials:
+    // authentication may access the keyring or remove corrupt credential files.
+    let (token, auth_method) = if dry_run {
+        (None, executor::AuthMethod::None)
+    } else {
+        match auth::get_token(&scopes).await {
+            Ok(t) => (Some(t), executor::AuthMethod::OAuth),
+            Err(e) => {
+                // If credentials were found but failed (e.g. decryption error, invalid token),
+                // propagate the error instead of silently falling back to unauthenticated.
+                // Only fall back to None if no credentials exist at all.
+                let err_msg = format!("{e:#}");
+                // NB: matches the bail!() message in auth::load_credentials_inner
+                if err_msg.starts_with("No credentials found") {
+                    (None, executor::AuthMethod::None)
+                } else {
+                    return Err(GwsError::Auth(format!("Authentication failed: {err_msg}")));
+                }
             }
         }
     };