Add File Picker Support To OAuth Credentials

Overview

Enhance our Generic OAuth credential component to support file picker for OAuth clients that use restrictive scopes (like drive.file). This requires users to explicitly select which files their credentials can access, as these scopes don't grant broad file access.

Motivation

Some OAuth providers offer restrictive scopes that only allow access to user-selected files (e.g., Google's drive.file scope). Our Generic OAuth implementation needs to support file pickers for these clients, as the credentials won't function without explicit file authorization.

Technical Requirements

OAuth Client Configuration

• Add requires_file_picker boolean to oauth_clients table
• Add file_picker_config JSON field to store picker configuration (mime types, view options, etc.)
• Update OauthClient schema and changeset

Backend Changes

• Add authorized_resources field to oauth_tokens table
• Update OauthToken schema to handle authorized resources
• Create helpers for managing authorized resources in Lightning.Credentials
• Add validation to ensure at least one file is authorized for restrictive scopes

GenericOauthComponent Updates

• Check if selected OAuth client has requires_file_picker enabled
• When enabled, show authorized files section after successful OAuth
• Make file selection mandatory before credential can be saved
• Add "Select Files" button that launches appropriate picker based on provider
• Implement remove functionality for individual files
• Handle picker events and update authorized resources
• Show warning if no files are selected

Frontend Implementation

• Create provider-agnostic file picker JS hook that can work with different providers
• Start with Google Picker implementation as first provider
• Structure to easily add other providers (Dropbox Chooser, OneDrive Picker, etc.)

UI Flow

1. User selects OAuth client in credential form
2. Completes OAuth flow as normal
3. If client requires file picker:

   Authorized Files (Required)
   This credential uses restricted access and requires you to select specific files.
   
   ⚠️ No files selected - credential cannot be used until files are authorized
   
   [Select Files]
   

4. After selecting files:

   Authorized Files: 3 selected
   
   ✓ Monthly Report.xlsx                [Remove]
   ✓ Patient Records.xlsx               [Remove]
   ✓ Budget Tracker.xlsx                [Remove]
   
   [+ Add More Files]
   

5. Credential can only be saved once at least one file is selected

Implementation Notes

• File picker is REQUIRED for OAuth clients with restrictive scopes
• Credentials without authorized files won't work with restrictive scopes
• Each provider may have different picker implementations
• Authorized resources are stored in the oauth_token, not the credential
• Clear error states when no files are selected

Questions to Resolve

• How to handle when authorized files are deleted/renamed on provider side?
• Should we support folder-level authorization for providers that allow it?
• What happens to existing workflows when files are removed from authorization?
• Should we show which workflows use which authorized files?