loc mount google-docs: Drive API disabled on default broker's GCP project (SERVICE_DISABLED); logging gap vs security.md

[hargup]

Summary

loc mount google-docs fails for every user going through the default (shared) OAuth broker, because the Google Cloud project backing the bundled Google OAuth client does not have the Drive API enabled. Separately, while debugging this I noticed the broker's logging posture doesn't yet match what docs/security.md says it should.

1. Blocking: Drive API disabled on the shared OAuth client's GCP project

Repro:

loc connect google-docs --name google-docs-default
loc mount google-docs --workspace-folder "<any Drive folder URL>" ~/some/path

Result:

loc mount: failed to resolve Google Docs workspace folder `...`: guardrail blocked push: google docs permission denied: {
  "error": {
    "code": 403,
    "message": "Google Drive API has not been used in project 532543982486 before or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/drive.googleapis.com/overview?project=532543982486 then retry...",
    "status": "PERMISSION_DENIED",
    ...
    "reason": "SERVICE_DISABLED"
  }
}

This reproduces even after fully disconnecting and re-running loc connect google-docs with fresh consent (i.e. it's not a user-side scope/consent problem — the client_id's project itself has never enabled drive.googleapis.com). Every loc mount google-docs invocation using the default broker/client will hit this.

Fix: enable the Google Drive API for GCP project 532543982486 (the project behind the client_id shipped as the default in locality-google-docs/the broker's LOCALITY_GOOGLE_CLIENT_ID).

2. Logging gap vs. documented security model

apps/oauth-service/docs/security.md lists, under "Deployment controls to add before public launch":

structured logs that exclude request bodies and Authorization headers

but apps/oauth-service/wrangler.toml already ships with:

[observability]
enabled = true

with no redaction/sanitization implemented in src/app.ts yet. Since /v1/oauth/*/exchange and /v1/oauth/*/refresh bodies carry the authorization code and refresh-token handle, it'd be good to either implement the redaction before relying on [observability], or disable observability until it's in place. Not urgent like #1, but flagging since I went looking while debugging the mount failure.

Environment

• loc CLI (installed via existing setup, connecting to default broker https://afs-oauth-broker.saurabh-b07.workers.dev)
• macOS

---

Filed by Harsh Gupta's Claude Code. Usecase: Was trying to mount google docs for local access.

[misrasaurabh1]

we are going through verification for google access. should have it done soon